Internet Routing Games

Transcription

1 Internet Routing Game João P. Hepanha Center for Control Dynamical Sytem an Computation Univerity of California Santa Barbara In collaboration with: S. Bohacek (Univ. Delaware), K. Obraczka (UC Santa Cruz) J. Lee (Potoc, UC Santa Barbara), C. Lim (PhD caniate, USC) Network Security v. Fault-Tolerance The baic principle behin the eign of the Internet wa to utilize maive reunancy to achieve fault-tolerance but thi oe not necearily reult in ecurity againt maliciou attack Fault tolerance Network ecurity robutne with repect to ranom failure (game againt chance) robutne with repect to attack (game againt an averary) An averary can explore weaknee that chance will not eaily fin

2 Security v. Fault-Tolerance in Routing ingle-path routing tochatic multi-path routing ource 0% a etination a b b Suppoe all link are equally likely to fail, an one of them oe fail Which routing trategy reult in higher probability that a packet will reach etination? link label refer to probability of forwaring a packet Both routing cheme reult in exactly the ame probability () Security v. Fault-Tolerance in Routing ingle-path routing tochatic multi-path routing ource 0% a etination a b b Suppoe all link are equally likely to fail, an one of them oe fail Aume that fail wa caue by an attacker that elect the link Which routing trategy reult in higher probability that a packet will reach etination? Attacker can learn routing policy an prevent all communication by compromiing a ingle link Compromiing a ingle link, probability of intercepting packet i only (auming tochatic multi-path) later we will fin other reaon why multi-path may be avantageou 2

3 Outline. How to compute tochatic multi-path routing table for general network? Noncooperative game explore reunancy in an averarial context 2. Multi-path routing for multi-agent & networke control ytem ource Stochatic routing policie 0% 2 4 0% etination probability that a packet arriving at the noe where l tart will be route though link l et of (uniirectional) link tochatic routing policy R ú { r l 0 : l L } for every noe n e.g., R ú {.,.,,.,.,, } ummation over link that exit noe n a to a to R toch et of all routing policie

4 ource Stochatic routing policie 0% 0% 0% 90% etination probability that a packet arriving at the noe where l tart will be route though link l et of (uniirectional) link tochatic routing policy R ú { r l 0 : l L } 0% 90% R toch R no-cycle for every noe n ummation over link that exit noe n et of all routing policie et of all cycle-free policie, i.e., for which there i no cloe equence of link all with poitive routing probability Attack pace ource a probability that packet in link l are compromie et of link pure attack P ú { p l : l L } b 2 4 c e f etination attacker ha available a pool of pure attack an will elect the one that i more likely to prevent communication e.g., pure attack at link with 0% probability of ucce: P ú { 0, 0,., 0, 0, 0, 0 } pure attack at noe f with 20% probability of ucce: P f ú { 0, 0,.2, 0, 0,.2,.2 } P et of all (pure) attack available to attacker 4

5 Mixe attack b ource a 2 4 c e probability that the attacker will intercept a packet traveling in link l et of link (pure) attack P ú { p l : l L } f etination attacker i allowe to ranomize between pure attack with appropriate probabilitie P et of all pure attack available to attacker mixe attack policy M ú { m P : P P } [0,] P probability that the attacker elect the pure attack P Example 0% 2 4 0% tochatic routing policy R ú {.,.,,.,.,, } pure attack available to attacker P ú { {.,0,0,0,0,0,0},{0,.,0,0,0,0,0},,{0,0,0,0,0,.,0}, {0,0,0,0,0,0,.} } 0% effective link attack ( attack) (attacker can target any link, it will uccee in compromiing packet elivery with 0% probability)

6 Example 0% 2 4 0% % % % tochatic routing policy R ú {.,.,,.,.,, } pure attack available to attacker P ú { {.,0,0,0,0,0,0},{0,.,0,0,0,0,0},,{0,0,0,0,0,.,0}, {0,0,0,0,0,0,.} } mixe attack policy M ú { 0, 0,.,.,., 0, 0 } probability that packet i capture for routing policy R an mixe attack policy M but not really rational Example 0% 0% % % % 0% 0% mixe attack policy M ú { 0, 0,.,.,., 0, 0 } tochatic routing policy R ú {.,.,,.,.,, } for thi attack policy M router cannot o better but attacker coul o better againt R with M ú { 0,, 0, 0, 0, 0, 0 } but then neither of the above policie i an equilibrium ince at leat one player can improve it outcome by changing it policy

7 Routing game ource 2 4 etination Compute ale-point equilibrium policie: R * R no-cycle (cycle-free tochatic routing policy) M * [0,] P (mixe attack policy) for which Exitence? Computation? policie choen by intelligent opponent to minimize their wort-cae loe (no player will improve it outcome by eviating from equilibrium) Probability of capture Given ource 2 4 R R no-cycle M ú { m P : P P } [0,] P (cycle-free tochatic routing policy) (mixe attack policy) etination iagonal matrix with all the element of R row vector with all the pure policie p l unique olution to (matrix A an vector c only epen on the graph) Linear (thu concave) in M (maximizer) but not convex with repect to the routing policy R (minimizer) o mini-max exitence theorem o not apply

8 Probability of capture ource 2 4 etination Uner mil aumption (*) on pure attack Given R R no-cycle, M ú { m P : P P } [0,] P row vector with all the pure policie p l flow vector unique olution to (matrix A an vector c only epen on the graph) (*) the ame pure attack oe not imultaneouly target two link in the ame path (true for every ingle-link or ingle-noe attack) Probability of capture ource 2 4 etination Uner mil aumption (*) on pure attack Given R R no-cycle, M ú { m P : P P } [0,] P row vector with all the pure policie p l flow vector unique olution to (matrix A an vector c only epen on the graph) Not convex with repect to the routing policy R but linear (convex!) with repect to the vector x Key iea: olve game for x & then compute R 8

9 Routing policie & Flow vector Theorem: i) There i a one-to-one correponence between routing policie R in R toch & flow vector x in a convex et X R L ii) For cycle-free R R no-cycle, the correponing flow vector x atifie Therefore Routing policie & Flow vector Theorem: i) There i a one-to-one correponence between routing policie R in R toch & flow vector x in a convex et X R L ii) For cycle-free R R no-cycle, the correponing flow vector x atifie tochatic routing policy flow vector 0% 0% tochatic routing policy R ú {.,.,,.,.,, } flow vector x ú {.,.,.,.,.,.,.} the vector x X obey a flow conervation law at every noe, with total unit flow exiting the ource noe 9

10 flow vector..0. Compute ale-point: x * X M * [0,] P for which Flow game (flow vector) (mixe attack policy) Theorem: Every flow game ha a ale-point (x *,M * ) with x * cycle-free by bilinearity of the criterion an convexity an (almot) compactne of X & [0,] P Back to routing game flow vector tochatic routing policy...0 Theorem: The routing game ha ale-point policie. Moreover, for every ale-point (x *, M * ) of the flow game with x * cycle-free, the pair (R *, M * ) i a ale-point of the routing game, with R * contructe from x * : ummation over all link that exit from the ame noe a l Solving the flow game actually olve the routing game 0

11 Solution to the flow & routing game flow vector tochatic routing policy...0 Theorem: The value V * of the flow game i given by max-flow problem olvable by linear programming an the ale-point x * i any x at which the minimum i attaine. Optimal routing policy R * can be compute uing: Max-flow interpretation for pure attack at iniviual link for pure attack at iniviual noe Optimal routing minimize the maximum link flow (ubject to contraint that epen on the link reliability) In practice, maximize throughput ubject to link banwith contraint Optimal routing minimize the maximum noe loa (ubject to contraint that epen on noe reliability) In practice, balance the loa between noe (ueful for energy-tarve noe)

12 Several reaon to ue multi-path routing increae ecurity improve robutne increae throughput maximize network utilization Hepanha, Bohacek. Preliminary Reult in Routing Game, 200. Bohacek, Hepanha, Lee, Obraczka, Lim, Enhancing ecurity via tochatic routing, 2002 Papaimitrato, Haa, Secure meage tranmiion in mobile a hoc network, 200 Lee, Mira, Rubentein, Ditribute Algorithm for Secure Multipath Routing, 200 Ganean, Govinan, Shenker, Etrin, Highly Reilient, Energy Efficient Multipath Routing in Wirele Senor Network, 2002 Wei, Zakhor, Robut Multipath Source Routing Protocol (RMPSR) for Vieo Communication over Wirele A Hoc Network, 2004 Tang, McKinley, A itribute multipath computation framework for overlay network application, 2004 Chen, Chan, Li, Multipath routing for vieo elivery over banwithlimite network, 2004 Elwali, Jin, Low, Wijaja, MATE: MPLS aaptive traffic engineering, 200 Lee, Gerla, Split multipath routing with maximally ijoint path in a hoc network, 200 Mirrokni, Thottan, Uzunalioglu, Paul, Simple polynomial time framework for reuce-path ecompoition in multi-path routing, 2004 proce Etimation through network zero-mean tochatic iturbance remote tate-etimator x k+ x k Optimal remote tate etimator: for implicity: full-tate available no meaurement noie no quantization Remote tate etimation error: 2

13 proce Etimation through network zero-mean tochatic iturbance remote tate-etimator x k+ x k Failure caue by an attacker that uccee with probability p att ingle-path routing probability of faile tranmiion = p att multi-path routing probability of faile tranmiion = p att /2 Etimation through network proce tochatic iturbance remote tate-etimator x k+ x k Conier ranom failure: p fail probability that a link will fail T ttr mean time-to-recover (exponentially itribute) ingle-path routing At teay tate: multi-path routing but rop are not i.i..

14 proce Etimation through network tochatic iturbance remote tate-etimator x k+ x k Conier ranom failure: p fail probability that a link will fail T ttr mean time-to-recover (exponentially itribute) For: -imenional quai-table proce A = + e, e low fail probability p fail ingle-path routing multi-path routing in thi networke etimation problem, the maximum prea of packet i optimal even againt ranom failure twice a large amiible mean time-to-recover Concluion Communication network are extremely vulnerable component to critical ytem multitue of iniviual component, patially itribute, ifficult to protect epecially true for wirele network (jamming, eaveropping, battery rainage ue to overue, etc.) Game theory i a natural framework to tuy robutne reunancy, by itelf, oe not guarantee robutne attack are not ranom event: very unlikely event can be prompte by an attacker Determine routing police that exploit multi-path routing formulation a a zero-um game between router an attacker ale-point olution foun by reucing problem to a flow-game policie foun alo have application to - throughput maximization - loa balancing - improve robutne of NCS (even againt ranom failure) [ Obervation: traitional meaure of QoS uch a probability of rop, expecte elay are not ufficient to preict performance in NCS ] 4