The BGP (Border Gateway Protocol) is the single inter-domain routing protocol that enables network operators within each autonomous system (AS) to influence routing decisions by independently setting local policies on route filtering and selection. This independence leads to fragile networking and makes analysis of policy configurations very complex. To aid the systematic and efficient study of the policy configuration space, this paper presents a reduction calculus on policy-based routing systems. In the calculus, we provide two types of reduction rules that transform policy configurations by merging duplicate and complementary router configurations to simplify analysis. We show that the reductions are sound, dual of each other and are locally complete. The reductions are also computationally attractive, requiring only local configuration information and modification. These properties establish our reduction calculus as a sound, efficient, and complete theory for scaling up existing analysis techniques

Gurney, Alexander J. T.

Loo, Boon Thau

Scedrov, Andre

Talcott, Carolyn

Wang, Anduo

English

Kosmopolis

Breif Announcement: A Calculus of Policy-Based Routing Systems

ScholarlyCommons@Penn

University of PennsylvaniaScholarlyCommonsDepartmental Papers (CIS) Department of Computer & Information Science7-2012Breif Announcement: A Calculus of Policy-BasedRouting SystemsAnduo WangUniversity of PennsylvaniaCarolyn TalcottSRIAlexander J. T. GurneyUniversity of PennsylvaniaBoon Thau LooUniversity of Pennsylvania, boonloo@cis.upenn.eduAndre ScedrovUniversity of PennsylvaniaFollow this and additional works at: http://repository.upenn.edu/cis_papersPart of the Computer Sciences CommonsWang, A., Talcott, C., Gurney, A., Loo, B., & Scedrov, A., Brief Announcement: A Calculus of Policy-Based Routing Systems, ACM Symposium onPrinciples of Distributed Computing, July 2012, doi: 10.1145/2332432.2332501© 1994, 1995, 1998, 2002, 2009 by ACM, Inc. Permission to copy and distribute this document is hereby granted provided that this notice is retainedon all copies, that copies are not altered, and that ACM is credited when the material is used to form other copyright policies.This paper is posted at ScholarlyCommons. http://repository.upenn.edu/cis_papers/684For more information, please contact libraryrepository@pobox.upenn.edu.Recommended CitationAnduo Wang, Carolyn Talcott, Alexander J. T. Gurney, Boon Thau Loo, and Andre Scedrov, "Breif Announcement: A Calculus ofPolicy-Based Routing Systems", . July 2012.Breif Announcement: A Calculus of Policy-Based Routing SystemsAbstractThe BGP (Border Gateway Protocol) is the single inter-domain routing protocol that enables networkoperators within each autonomous system (AS) to influence routing decisions by independently setting localpolicies on route filtering and selection. This independence leads to fragile networking and makes analysis ofpolicy configurations very complex. To aid the systematic and efficient study of the policy configuration space,this paper presents a reduction calculus on policy-based routing systems. In the calculus, we provide two typesof reduction rules that transform policy configurations by merging duplicate and complementary routerconfigurations to simplify analysis. We show that the reductions are sound, dual of each other and are locallycomplete. The reductions are also computationally attractive, requiring only local configuration informationand modification. These properties establish our reduction calculus as a sound, efficient, and complete theoryfor scaling up existing analysis techniques.DisciplinesComputer SciencesCommentsWang, A., Talcott, C., Gurney, A., Loo, B., & Scedrov, A., Brief Announcement: A Calculus of Policy-BasedRouting Systems, ACM Symposium on Principles of Distributed Computing, July 2012, doi: 10.1145/2332432.2332501© 1994, 1995, 1998, 2002, 2009 by ACM, Inc. Permission to copy and distribute this document is herebygranted provided that this notice is retained on all copies, that copies are not altered, and that ACM is creditedwhen the material is used to form other copyright policies.This conference paper is available at ScholarlyCommons: http://repository.upenn.edu/cis_papers/684Brief Announcement: A Calculus ofPolicy-Based Routing SystemsAnduo Wang∗ Carolyn Talcott† Alexander J. T. Gurney∗Boon Thau Loo∗ Andre Scedrov∗∗University of Pennsylvania, Philadelphia, Pennsylvania, USA †SRI, Menlo Park, California, USA{anduo,agurney,boonloo}@cis.upenn.edu clt@csl.sri.comscedrov@math.upenn.eduABSTRACTThe BGP (Border Gateway Protocol) is the single inter-domainrouting protocol that enables network operators within each au-tonomous system (AS) to influence routing decisions by indepen-dently setting local policies on route filtering and selection. Thisindependence leads to fragile networking and makes analysis ofpolicy configurations very complex. To aid the systematic and ef-ficient study of the policy configuration space, this paper presentsa reduction calculus on policy-based routing systems. In the cal-culus, we provide two types of reduction rules that transform pol-icy configurations by merging duplicate and complementary routerconfigurations to simplify analysis. We show that the reductions aresound, dual of each other and are locally complete. The reductionsare also computationally attractive, requiring only local configura-tion information and modification. These properties establish ourreduction calculus as a sound, efficient, and complete theory forscaling up existing analysis techniques.Categories and Subject DescriptorsC.2.2 [Computer-Communication Networks]: Network Proto-colsGeneral TermsVerification, Management1. INTRODUCTIONThe Internet today runs on a complex routing protocol called theBorder Gateway Protocol or BGP [2] for short. BGP enables In-ternet Service Providers (ISPs) worldwide to exchange reachabilityinformation to destinations over the Internet. With policy-basedrouting, BGP enables network operators to influence routing deci-sions by independently setting local policies. Each ISP acts as anautonomous system and influences the Internet routing process forits own economic reasons through policy-based routing. This inde-pendence leads to fragile networking and makes analysis of policyconfigurations very complex. Given the set of local policy config-urations at each router, a BGP system converges and is said to besafe, if it produces stable routing tables, given any sequence of rout-ing message exchanges. To aid the systematic and efficient studyof the policy configuration space, this paper makes the followingcontributions.• We propose an abstract model for modeling Internet topology andCopyright is held by the author/owner(s).PODC’12, July 16–18, 2012, Madeira, Portugal.ACM 978-1-4503-1450-3/12/07.policies. This abstract model, which we call the Extended PathDiagram (EDP), extends prior models [1, 3], and provides a basisfor our reduction calculus.• We present a reduction calculus on policy-based routing systems.In the calculus we provide two types of reduction that transformpolicy configurations to simplify analysis. Using our EDP model,we show that the reductions are sound, dual of each other and arelocally complete. The reductions are also computationally attrac-tive, requiring only local configuration information and modifica-tion. As a result, they have the potential to significantly reduceanalysis time, and also provide a basis for identifying network in-stances that have similar configuration patterns.• Finally, to demonstrate the practical value of our reduction calcu-lus, we have identified several use cases.2. FORMAL MODELThe development of our calculus requires support for both spec-ification and analysis, rather than using existing model [1] or anal-ysis structure [3] and switch between them, we develop our ownabstract model – EPD (Extended Path Digraph), which combinesthe strength of both. First, EPD specifies policy configuration byspecifying the network topology (which node shares routing infor-mation with which) and the routing policy at each node (what arethe available paths and routing preference among them). Second,EPD embeds the route preference dependency relation in the net-work topology, which enables reasoning directly on EPD. The factthat EPD includes the network topology and routing policy makesEPD convenient for reasoning in and about our calculus, especiallythe reasoning makes use of the network topology change.We first provide the notations we will use throughout the paper.For a policy configuration, we write V for its network nodes, dfor the fixed destination node in V 1, P for the union of all simplepaths from nodes in V to d(i.e. P are the available routing pathsproduced by the routing system under the policy configuration),Pu for the subset of P consisting of paths from u to d, and (u, v)for the one-hop path from node u to v. We use the symbol ‘◦’for concatenation of paths. Given a path p from v to d, we write(u, v) ◦ p or simply u ◦ p for the path from u to d. Similarly, givena p from u to v, and a path q from v to node w, we write p ◦ q todenote the concatenated path from u to w. Finally for two pathsp, q in Pu from the same node u to d, we write p ≺ q to denote u’s1Routing policies are configured separately for each destination,and assuming the Internet is symmetric, we can focus our discusseson a fixed destination.preference of p over q2. Using these notations, we define the EPDinstance associated with a policy configuration as follows:An EPD instance is a graph G = {(V, P, d), E} where (V, P )are the vertexes in the graph, d ∈ V the particular destination, andE is the set of arcs. V are node vertexes and P are path vertexes,available paths to d. The are two types of arc: (1) transmissionarcs, (p, q) where p is proper suffix of q; and (2) preference arcs,(p, q) where p, q are path vertexes in Pu, the paths from u to d, andp is preferred over q according to the route preference relation ofu (p ≺ q).Closely related with safety is the acyclicity of the configuration.We say a policy configuration is cyclic (acyclic) if its EPD is cyclic(acyclic). An EPD instance G = {(V, d, P ), E} is cyclic (acyclic)if the arcs E contains at least one (no) cycle. The following char-acterization was first proved by Sobrinho [3]:If a policy configuration is acyclic, then it is safe. If a policy config-uration is cyclic, then we can construct a trace of routing updatesunder which the routing system exhibits route oscillation.3. THE CALCULUSThis section presents a calculus of policy based routing systems,in which one rewrites a configuration by reduction. There are twotypes of reduction - duplicate and complementary reductions thatonly require checking local policy configurations at the relevantnodes and their direct neighbors. The basic idea is to incrementallymerge two node vertexes into one while preserving safety property.At the top level, the reduction proceeds by repeatedly: (1) locat-ing two reducible nodes; (2) if reducible, merge the two node’slocal configuration according to the reduction; and (3) rewritingthe remainder of the EPD instance to reflect that local change. Inthe following, assume we are working with a given EPD instanceG = {(V, d, P ), E}. We first introduce two auxiliary notions:“consistent node” and “node rewrite” that will simplify our pre-sentation of the calculus.Two EPD node vertexes u, v in V are consistent, if E does notcontain a cycle consisting of only path vertexes in u, v.Inconsistent vertexes implies the policy configuration is unsafe,and therefore is considered a mis-configuration. Our reductionswill only be performed on configurations with no inconsistent pairs.Next, we define “node rewrite”.For two consistent node vertexes u, v in V , u rewrites to v byfollows: Rewrite the path vertex p ∈ Pu in u to p′ ∈ Pv in v by: Ifp = u ◦w ◦ r, and w 6= v, then rewrite p to w ◦ r; If p = u ◦ v ◦ r,then rewrite p to r; For all other cases, abort rewrite. Rewrite thepreference among Pu to that among Pv by: Rewrite preference arc(p, q) to (p′, q′), where p(q) rewrites to p′(q′).Duplicate and Complementary Nodes We define two notions ofreducible nodes, which we call duplicate and complementary.For two consistent node vertexes u, v in V , v is a duplicate of u,if after rewriting v to u, the following conditions hold: (1) v’s pathvertexes P ′v is equivalent to (or a subset of) the path vertexes Pu;(2) For every preference arc (p, q) in v, there exists (p′, q′) in u.For two consistent node vertexes u, v in V , v is complementaryto u, if for any two path vertexes p in Pu, q in Pv , the followingcondition holds: For any two node vertexes x, y from u, v’s down-stream neighbors, which route to the destination through u, v. Apreference arc from x ◦ p to x ◦ q exists in x, iff a preference arcexists from y ◦ p to y ◦ q in y.To merge u, v, if u, v are duplicate, we can simply remove u;if u is complementary to u, then we merge them by: (1) Let path2≺ specifies the route preference among paths. It is local to eachnode, i.e., it only relates paths from same node.vertexes Pw to be the union of Pu and Pv; (2) Let transmissionarcs in w be according to the consensus agreed by u, v’s neighbors:transmission arc (p, q) is in w, if (x ◦ p, x ◦ q) is in x for somedownstream neighbor x.4. PROPERTIESThe key properties of reduction are that the duplicate and com-plementary reductions preserve safety, that they are dual of eachother by nature, and locally complete. Finally, we discuss conflu-ence property of the reductions.Soundness Our main soundness result is that the reductions rewritecyclic (acyclic) EPDs into cyclic (acyclic) EPDs. This means thatthe reductions preserve safety, i.e. we never have false positives orfalse negatives, with respect to safety property, after applying thereduction.Duality Duplicate and complementary reductions are dual. As-suming EPD G, two node vertexes u, v, the set of their upstreamneighbors Nfrom (through which u, v route to the destination) anddownstream neighbors Nto (which route to the destination throughu, v). If all the nodes in Nfrom (Nto) can be merged into one nodeby (multiple steps of) complementary (duplicate) reduction, thenu, v are duplicate (complementary) nodes. This duality implies avery interesting practical result: If two nodes’ upstream (down-stream) are complementary (duplicate), then these two nodes them-selves are duplicate (complementary). Moreover, the reduction canbe performed in either order: Merge either Nfrom(Nto) or u, vfirst.Local Completeness Consider an EPDG, our reductions are “localreduction” for two nodes u, v in G, in the sense that we only need(and are allowed) to check the configuration at u, v and their directneighbors (i.e. Nfrom or Nto). We assume no knowledge of therest of configuration. We write Nrest to denote these nodes. Thatis, the local reduction we propose must preserve the safety propertyfor any configuration Nrest. Duplicate and complementary reduc-tion are locally complete. We do not exclude the existence of othersafety preserving reduction that requires checking policy configu-ration beyond u, v and their neighbors.Confluence Duplicate reduction is confluent while complementaryis not. There is a counter-example. For a set of nodes V , if they arepair-wise duplicate, that is any pair of u, v in V can be merged byone-step duplicate reduction, then V can be merged into one singlenode by multiple steps of duplicate reduction, regardless the orderin which the nodes merged. A counter-example for complemen-tary nodes, consider an EPD with three node vertexes u,v,w whohave the same set of downstream neighbors, we construct their pathvertexes and preference such that, while u,v and v,w can be pair-wise reduced into u’ and w’ respectively. While complementaryreduction can be applied to either u,v or v,w, a further reductionstep is not possible.AcknowledgmentThis research is funded in part by NSF grants (CCF-0820208,CNS-0830949, CNS-0845552, CNS-1040672, TC-0905607 and CPS-0932397), AFOSR grant FA9550-08-1-0352, and ONR grant N00014-11-1-0555.5. REFERENCES[1] T. G. Griffin and G. Wilfong. An analysis of BGPconvergence properties. In SIGCOMM, 1999.[2] Y. Rekhter., T. Li., and S. Hares. A border gateway protocol 4(bgp-4). RFC 4271, 2006.[3] J. Sobrinho. Network routing with path vector protocols:theory and applications. In SIGCOMM, 2003.

https://repository.upenn.edu/cgi/viewcontent.cgi?article=1721&amp;context=cis_papers

Breif Announcement: A Calculus of Policy-Based Routing Systems

Abstract

Similar works

Full text

Available Versions

Kosmopolis

ScholarlyCommons@Penn