Safe Inter-domain Routing under Diverse Commercial Agreements

Transcription

1 University of Pennsylvni ScholrlyCommons Deprtmentl Ppers (ESE) Deprtment of Electricl & Systems Engineering Sfe Inter-omin Routing uner Diverse Commercil Agreements Yong Lio University of Msschusetts - Amherst Lixin Go University of Msschusetts - Amherst Roch A. Guérin University of Pennsylvni, guerin@cm.org Zhi-Li Zhng University of Minnesot - Twin Cities Follow this n itionl works t: Prt of the Digitl Communictions n Networking Commons, n the OS n Networks Commons Recommene Cittion Yong Lio, Lixin Go, Roch A. Guérin, n Zhi-Li Zhng, "Sfe Inter-omin Routing uner Diverse Commercil Agreements",. My Accepte for publiction in IEEE/ACM Trnsctions on Networking. Copyright 2010 IEEE. This mteril is poste here with permission of the IEEE. Such permission of the IEEE oes not in ny wy imply IEEE enorsement of ny of the University of Pennsylvni's proucts or services. Internl or personl use of this mteril is permitte. However, permission to reprint/republish this mteril for vertising or promotionl purposes or for creting new collective works for resle or reistribution must be obtine from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this ocument, you gree to ll provisions of the copyright lws protecting it. This pper is poste t ScholrlyCommons. For more informtion, plese contct repository@pobox.upenn.eu.

2 Sfe Inter-omin Routing uner Diverse Commercil Agreements Abstrct Commercil greements rive the routing policies use in toy's Internet. The two most extensively stuie commercil greements re trnsit n peering; however, they re only two of mny iverse n continuously evolving commercil greements tht ISPs enter into. So fr, the only known prcticl sfe n robust routing policy is Go n Rexfor's policy guieline, which is pplicble to trnsit n peering greements only. It is, therefore, of importnce to ientify routing policies tht re sfe n robust n t the sme time cpble of ccommoting the iverse commercil greements existing in the Internet. In prticulr, this pper investigtes the extent to which routing policies cn be evise to ccommote complex mutul trnsit greements. We propose series of policy guielines tht llow mutul trnsit greements with progressively broer semntics to be estblishe. Those policy guielines gurntee routing sfety n robustness s long s the AS grph stisfies corresponing set of precise topologicl constrints. An experimentl evlution of the propose policy guielines emonstrtes the benefits they woul likely ffor in terms of routing relibility, if opte in the current Internet. Keywors Inter-omin routing, policy, sfeness, BGP Disciplines Digitl Communictions n Networking OS n Networks Comments Accepte for publiction in IEEE/ACM Trnsctions on Networking. Copyright 2010 IEEE. This mteril is poste here with permission of the IEEE. Such permission of the IEEE oes not in ny wy imply IEEE enorsement of ny of the University of Pennsylvni's proucts or services. Internl or personl use of this mteril is permitte. However, permission to reprint/republish this mteril for vertising or promotionl purposes or for creting new collective works for resle or reistribution must be obtine from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this ocument, you gree to ll provisions of the copyright lws protecting it. This journl rticle is vilble t ScholrlyCommons:

3 1 Sfe Inter-omin Routing uner Diverse Commercil Agreements Yong Lio, Lixin Go, Fellow, IEEE, Roch Guerin, Fellow, IEEE, n Zhi-Li Zhng Abstrct Commercil greements rive the routing policies use in toy s Internet. The two most extensively stuie commercil greements re trnsit n peering; however, they re only two of mny iverse n continuously evolving commercil greements tht ISPs enter into. So fr, the only known prcticl sfe n robust routing policy is Go n Rexfor s policy guieline, which is pplicble to trnsit n peering greements only. It is, therefore, of importnce to ientify routing policies tht re sfe n robust n t the sme time cpble of ccommoting the iverse commercil greements existing in the Internet. In prticulr, this pper investigtes the extent to which routing policies cn be evise to ccommote complex mutul trnsit greements. We propose series of policy guielines tht llow mutul trnsit greements with progressively broer semntics to be estblishe. Those policy guielines gurntee routing sfety n robustness s long s the AS grph stisfies corresponing set of precise topologicl constrints. An experimentl evlution of the propose policy guielines emonstrtes the benefits they woul likely ffor in terms of routing relibility, if opte in the current Internet. I. INTRODUCTION The Internet consists of lrge number of inter-connecte utonomous systems (ASes). Ech AS enters into certin commercil greements with few other ASes so s to ttin globl rechbility cross the Internet. These commercil greements etermine how n wht trffic the ASes exchnge n thereby ictte their inter-omin routing policies. Two typicl commercil greements re trnsit n peering greements. Commercil greements between ASes re, however, continuously evolving n commonly tke mny forms beyon the bove two greements. Their existence n evolution re riven by the business interests of ISPs n other plyers, the competitive mrketplce, n the constntly chnging Internet structure. For exmple, one ISP my cquire or merge with nother ISP. Since it is often not economiclly fesible to physiclly merge two existing networks, the reltionship between the two ASes nees to be reefine: they my wnt to use ech others proviers to rech certin estintions (i.e., the two ASes now provie trnsit to ech other). As nother exmple, n AS might estblish privte trnsit greement for prticulr customer with one of its neighbors (n instnce of selective trnsit), while estblishing peering greement Yong Lio n Lixin Go re with the Deprtment of Electricl n Computer Engineering, University of Msschusetts, Amherst, MA (emil: {ylio, lgo}@ecs.umss.eu). Roch Guerin is with the Deprtment of Electricl n Systems Engineering, University of Pennsylvni, Philelphi, PA (emil: guerin@ee.upenn.eu). Zhi-Li Zhng is with the Deprtment of Computer Science n Engineering, University of Minnesot, Minnepolis, MN (emil: zhzhng@cs.umn.eu). with tht neighbor for the rest of its customers. Similrly, two physiclly co-locte enterprise networks might estblish mutul bckup greement, where one provies trnsit service to the other only when the other s link to its own provier fils or is in mintennce. By entering into vrious forms of iverse commercil greements, ASes cn not only chieve cost svings, they cn lso enhnce service relibility n vilbility to their customers. Furthermore, the economic structure of the Internet is likely to evolve in mny irections [1] [3], n this in itself will trnslte into broer set of commercil greements. Yet, broening the set of commercil greements tht cn be ccommote in inter-omin routing is esier si thn one. Commercil greements ictte the routing policies opte in ech AS, n it is well known tht the use of rbitrry routing policies cn le to routing oscilltions [4]. So fr, the only known prcticl sfe n robust routing policy is Go n Rexfor s policy guieline [5], which is pplicble only to trnsit n peering greements, with extension to the bckup greement [6]. Arbitrry greements, such s n AS trnsiting trffic between ny two other ASes, hve been shown to possibly cuse persistent routing oscilltions [7]. Clerly, some cution is in orer when contemplting more generl greements. The possible greements between ASes cn tke mny ifferent forms. This pper stuies routing policies tht gurntee routing sfety n robustness while ccommoting set of commercil greements tht offer itionl iversity. We focus on the cses where two ASes re willing to provie connectivity to ech other to rech the rest of the Internet, i.e., they trnsit trffic for ech other, n therefore estblish one of the so-clle mutul trnsit greements [8]. As we will see lter in the pper, such mutul trnsit greements cover mny possible forms of complex greements mong ISPs. Some of these greements lrey exist in the Internet, but how to sfely ccommote them is not yet fully unerstoo. More importntly, s the Internet s iversity continues to grow, more ASes re expecte to enter into vrious complex greements such s mutul trnsit greements. To provie guielines on how to hnle the mutul trnsit greements, we introuce routing polices tht expose incresingly lrger sets of pths. We show tht those pths re inee neee to ccommote the iverse mutul trnsit greements. The policies re provbly sfe n robust, s long s the Internet AS-level topology stisfies certin constrints. We lso perform representtive set of experiments to show tht llowing ASes to enter into mutul trnsit greements cn substntilly improve Internet routing resiliency to certin filures.

4 2 The rest of the pper is orgnize s follows. Section II gives some bckgroun on inter-omin routing policies, motivtions for ccommoting more iverse commercil greements, n brief overview of the pper. Section III etils the missible pth sets prouce by mutul trnsit greements. Section IV specifies how to rnk those pths to voi policy isputes. Section V presents the routing policies consiere in the pper n formlly estblishes their sfety n robustness properties. The prcticl implictions of the propose routing policies re iscusse in section VI. Section VII presents experiments ime t evluting the potentil fult-tolernce benefits when some ASes exten the greements they engge into to inclue mutul trnsit greements. Section VIII conclues the pper. II. BACKGROUND, MOTIVATION AND OVERVIEW In this section, we first provie some bckgroun on interomin routing policies n how they relte to routing sfety n robustness. We then iscuss AS business reltions (or commercil greements) tht ictte routing policies, n outline the Go-Rexfor policy guieline. We rgue tht in prctice there exist more iverse n complex commercil greements, but how to sfely ccommote those greements is not yet cler. Therefore, stuying this problem is both vluble in theory n neee in prctice. A. Routing Policies, Routing Sfety n Robustness In essence, routing policies specify two things: (i) the pths tht re expose or nnounce to neighbors, vi export policies, n (ii) preferences or rnking of the pths lerne from neighbors, vi import policies. It is well known tht without ny restriction on policies, so-clle policy isputes my rise n le to routing oscilltion [9,10]. To voi such sitution, certin limittions must be pplie to routing policies. Griffin et l. introuce the notions of routing sfety n robustness [4,10]. Informlly, set of routing policies re si to be sfe if the resulting routing system lwys converges to unique stble stte. Such routing policies re robust if they re sfe uner ny topology chnges (e.g., link filures). Furthermore, sufficient conition for routing sfety n robustness is ientifie in [10]: if set of routing policies o not le to ispute wheel, they re sfe n robust (see APPENDIX A for the efinition of ispute wheel). The problem of sfety n robustness in policy routing is further investigte in [7]. The uthors show tht if ASes re llowe to rbitrrily filter their routes, sfe n robust routing hs to constrin the pth rnking to be selecting the pth with the shortest weighte pth length. The sfe pth vector protocol is propose in [11], which inclues mechnism to ynmiclly etect oscilltions inuce by policy isputes. This is further extene in [12], which resolves routing oscilltions by letting n AS select less preferre but more stble route when tht AS etects tht it is itself involve in policy ispute. Jggr et l. stuy the routing sfeness problem in clss bse pth vector systems in [13]. Sobrinho stuies the convergence of pth vector routing protocol using the routing lgebr frmework in [14,15]. Bse on the routing lgebr frmework, met routing lnguge is propose in [16], which cn be use to escribe n construct sfe routing protocols. B. Prcticl Routing Policy Guielines Accommoting Trnsit n Peering Agreements In prctice, the routing policies opte by ASes re often ictte by the commercil greements they hve with other ASes n their own business interests. The most common greements re trnsit where the provier AS provies service to the customer AS in connecting to the Internet, n peering where two ASes gree to swp trffic between their respective customers without monetry settlement [17]. Tking these two common business reltions into ccount, Go n Rexfor present the prefer customer n no vlley pth policy guieline, which gurntees routing sfety n robustness if the AS topology oes not contin ny provier-customer cycle [5]. The prefer customer guieline constrins the configurtion of import policies to ssign higher preference to pths lerne from customers thn to pths lerne from peers n proviers 1. The no vlley pth guieline specifies tht the export policies of ASes shoul not llow vlleys to pper in ny AS pths. A vlley pth rises when n AS nnounces pth lerne from peer or provier to nother peer or provier. The AS grph topologicl constrint neee to ensure the sfety n robustness of the Go-Rexfor policy guieline is firly mil, becuse n AS usully chooses other ASes of bigger size or coverge thn itself s its proviers [5] 2. C. Diverse Commercil Agreements As just llue to, while trnsit n peering greements re the most common ones, fr more iverse n complex commercil greements exist in prctice. A well-known n esy to unerstn exmple is the sibling reltion [8,17], where two ASes provie trnsit service to ech other. This reltion coul be estblishe becuse: n ISP owns two ASes in two geogrphicl regions, or n AS merges with or cquires nother AS. At first glnce, it woul seem tht sibling reltion coul be trete s two seprte provier-customer reltions, to which the Go-Rexfor policy guieline coul be pplie. Such tretment, however, woul le to mjor technicl problem: it violtes the mil topologicl constrint uner which the Go-Rexfor policy guieline is prove to be sfe n robust. We use relistic exmple in Fig. 1 to illustrte the potentil issues. In the mile of 2007, Tiscli (AS3257) cquire Pipex Brobn (AS5413) [18]. Both Tiscli n Pipex bought their trnsit service from TeliSoner (AS1299), which is tier-1 ISP [19]. Before their merging, Tiscli n Pipex use TeliSoner to rech some estintion prefix p. However, if they tret ech other s customers, Tiscli woul prefer Pipex s route to p n Pipex woul prefer 1 The ctul policies pplie in relity coul be quite complicte. There re cses where some lrge ISP prefers peer pths over customer pths for certin estintions. 2 The size of n AS coul be quntifie by its trffic volume or egree in the AS grph. The coverge of n AS is usully the geogrphicl re tht AS covers.

5 3 Tiscli s route too. This is bsiclly DISAGREE scenrio escribe in [10]. Routing oscilltion my occur becuse no unique stble stte exists in DISAGREE scenrio. As there is no systemtic guieline for hnling sibling reltion yet, when two ASes merge, they usully hve to tret ech other s peers. This is conservtive tretment tht uner-utilizes the connections between them, s they only use those connections to rech ech other s customers. Fig. 1. provier-customer sibling-sibling TeliSoner AS1299 Tiscli AS3257 Ti Te p Pipex AS5413 Exmple of sibling reltion estblishe between merging ASes. Besies the sibling reltion, nother exmple of iverse greements is two peering ASes with specil greements for certin estintions, where they provie trnsit to ech other but only for those estintions. For other estintions, they exchnge customer trffic s per the stnr peering greement. Except for the bckup greement stuie in [6], it hs until now not been cler wht prcticl policy guielines re neee to ccommote more iverse commercil greements, e.g., the sibling reltion, the cse of peering reltion with specil mutul trnsit rrngement, n so forth, while ensuring the sfety n robustness of the globl inter-omin routing system. In prctice, ASes or ISPs commonly use few locl tweks to better meet their own business interests, with little concern or respect for the sfety n robustness of the globl routing system. Hence, it is importnt to unerstn how one cn ccommote more iverse greements in sfe n robust mnner. Our pper is evote to this problem. D. Accommoting Mutul Trnsit Agreements: An Overview We focus primrily on how to sfely ccommote fmily of wht we term mutul trnsit greements. In generl, mutul trnsit greement between two ASes mens tht they re willing to provie ech other with connectivity to rech the rest of the Internet [8]. For exmple, the sibling reltion iscusse bove is one type of mutul trnsit greement. In prctice, mutul trnsit greements cn hve wie-rnge of semntics regring wht pths the ASes entering into those greements expose to ech other. We first stuy the mutul trnsit greement where two ASes expose to ech other their provier, customer, n peer pths, which is most likely wht hppens in the current Internet when two ASes re merging. Next, we expn the semntic of mutul trnsit, so tht n AS cn lso nnounce certin pths lerne from its own mutul trnsit neighbors to other neighbors with which it hs mutul trnsit greements. Finlly, we consier the most generl form of mutul trnsit, i.e., two ASes entering into n greement where they nnounce ll their pths to ech other. In section III, we stuy wht type of pths shoul be expose to support the vrious mutul trnsit greements we Pi hve just ientifie. How to setup the preference of those missible pths to voi potentil policy isputes is iscusse in section IV. In section V, we present series of policy guielines tht llow progressively lrger sets of missible pths, n cn therefore, ccommote mutul trnsit greements with progressively broer menings. We show tht those guielines cn be provbly sfe n robust. In the rest of the pper, we sy tht two ASes hve n MTrn greement or they re MTrn neighbors, if they hve entere into mutul trnsit greement. The link between two MTrn neighbors is clle n MTrn link. The routes lerne from n MTrn neighbor re referre to s MTrn routes or MTrn pths. III. ADMISSIBLE PATHS FOR ACCOMMODATING MUTUAL TRANSIT AGREEMENT In this section, we first introuce n bstrct AS grph moel tht cptures the complex nture of mutul trnsit greements. Next, we introuce the concept of missible pth set. The missible pths essentilly specify the export policy of the policy guielines require to mke mutul trnsit greements sfe. A. AS Grph Moel We moel the Internet AS-level topology s grph G = (V, E), where the noes re ASes n eges represent greements between ASes. An ege in G cn be unirecte, irecte, or bi-irecte. An unirecte ege (u v) inictes peering greement between u n v; irecte ege (u v) represents trnsit greement where u is the provier of v; n bi-irecte ege (u v) represents mutul trnsit greement between u n v. Let E enote the set of unirecte eges, E the set of irecte eges, n E the set of biirecte eges. Obviously, E = E E E. B. AS Pths, Steps, n AS Pths with Steps A pth P in grph G = (V, E) is n orere sequence of istinct noes, i.e., P = u 0 u 1... u m, where u i u j, i j. If m=0, we sy P is trivil pth; otherwise P is non-trivil pth. P is ownhill pth if P is trivil pth; or ll eges in P re irecte eges n ny noe (except the first one) is customer of its previous noe in P. Tht is, P is ownhill pth if m=0; or (u i u i+1 ) E, i [0, m 1]. P is n uphill pth if ll eges in P re irecte eges n ny noe (except the first one) is provier of its previous noe. Tht is, P is n uphill pth if (u i+1 u i ) E, i [0, m 1]. We sy tht P is step if ll eges in P re bi-irecte eges, i.e., (u i u i+1 ) E, i [0, m 1]. In prticulr, step P is referre to s k-step if it contins k bi-irecte eges. We lso refer to k s the step with of k-step. Pth P is referre to s ownhill pth with steps if no segment of P is n uphill pth n it contins t lest one biirecte ege, i.e., i [0, m 1], (u i+1 u i ) E n j [0, m 1], (u j u j+1 ) E. 3 P is referre to s n uphill 3 Note tht pth with only bi-irecte eges is ownhill pth with steps.

6 4 pth with steps if no segment of P is non-trivil ownhill pth, n P hs t lest one irecte ege n one bi-irecte ege. Tht is, P is n uphill pth with steps if f [0, m 1], (u f u f+1 ) E, n i, j [0, m 1], (u i+1 u i ) E, (u j u j+1 ) E. When P is ownhill pth with steps n the wiest step in P is k-step, P is referre to s ownhill pth with k-steps. Uphill pth with k-steps cn be similrly efine. See Fig. 2 for n illustrtion of uphill/ownhill pths (with steps). u m u m u 0 u 0 2) Allowing vlley-free pths with steps: It is necessry to permit vlley-free pths with steps in orer to ccommote mutul trnsit greements. When two MTrn neighbors, ASes u n v, nnounce to ech other their provier routes, customer routes, n peer routes, the result is tht ll vlley-free AS pths incluing u n v hve t lest 1-step, i.e., ege (u v). Further, if u n v hve mutul trnsit greements with other ASes n they lso nnounce the routes lerne from those ASes to ech other, we will see vlley-free pths incluing steps wier thn one. In generl, we efine the set of missible pths P k in Definition III.1, which inclues ll vlley-free pths with steps not wier thn some number k. Fig. 4 provies some exmples of vlley-free pths in P 1. u 0 u 0 u m u m () (b) (c) () Fig. 2. Exmples of uphill/ownhill pths (with n without steps). The soli rrows represent AS reltionships. The she rrows represent AS pths. () is n uphill pth; (b) is n uphill pth with step; (c) is ownhill pth; () is ownhill pths with step. () (b) (c) C. Amissible Pth Set Next we illustrte the kin of pths tht shoul be permitte to ccommote the mutul trnsit greements. 1) Not llowing vlley pths: In generl, no vlley pths shoul be llowe. Allowing vlley pths essentilly sks ASes to trnsit trffic for their proviers. Given tht customers must py their proviers for ll trffic going to or coming from themselves, such prctice oes not mke economic sense. The vlley pths consiere in this pper hve broer mening thn those in the Go-Rexfor policy guieline ue to the introuction of mutul trnsit greements. We sy pth P hs vlley if P contins ownhill segment (with or without steps) followe by n uphill segment (with or without steps); or it contins ownhill segment (with or without steps), followe by n unirecte ege, mybe then n uphill segment (with or without steps). A pth tht contins vlley is vlley pth. Fig. 3 shows severl exmples of vlley pths. () (b) (c) () (e) (f) Fig. 3. Exmples of vlley pths. In () n (b), n AS trnsits trffic for its two proviers; in (c) n (), ASes with mutul trnsit greements trnsit trffic for their proviers; in (e) n (f), two peering ASes trnsit trffic for their proviers. Fig. 4. () (e) (f) Exmple pths in set P 1. The she rrows represent AS pths. Definition III.1 (P k ) The set of missible pths, P k, inclues: (i) uphill pths with steps of with t most k, (ii) ownhill pths with steps of with t most k, (iii) pths consisting of n uphill segment followe by ownhill segment n with no steps wier thn k, (iv) pths consisting of n uphill segment followe first by n unirecte ege, n next by ownhill segment, n with no steps wier thn k. Clerly, P k+1 P k, n in prticulr, P k P 0, where P 0 is the collection of missible pths uner the Go-Rexfor policy guieline, which covers only the trnsit n peering greements. As mentione, n AS pth with only bi-irecte eges is ownhill pth with steps, therefore, n m-step pth where m k, is n missible pth in P k. Here we provie some motivtions for our efinition of missible pth sets P k. First, by llowing vlley-free pths with 1-step, i.e., those pths in P 1 P 0 (P 0 is the complement of P 0 ), two ASes cn estblish mutul trnsit greement where they nnounce to ech other ll pths except the pths lerne from other MTrn neighbors. If two ASes hve mutul trnsit greement where they lso nnounce to ech other certin pths lerne from other MTrn neighbors, it is necessry to expn the missible pth set to P k where k > 1. Further, if two MTrn neighbors nnounce to ech other ll their pths, the missible pth set shoul be P. IV. CLASSES OF PATHS AND RANKING OF THE PATHS We hve seen tht the mutul trnsit greements give rise to missible pth sets incluing vlley-free pths with steps. The

7 5 next nturl question woul be how to rnk these pths so s to setup their preferences. Approprite pth rnking is importnt, otherwise policy isputes my rise. In this section, we first clssify pths in the missible pth sets, n then we stuy how to rnk the pths bse on their clsses. A. Clsses of Pths in the Amissible Pth Set In set P k, we still hve provier pths, customer pths, n peer pths, which come from the trnsit n peering greements. If AS 0 lerns pth P from provier (resp., customer, peer) n P P k, we sy P is provier (resp., customer, peer) pth of 0. Besies those three types of pths, in set P k where k>0, there re lso pths lerne from mutul trnsit neighbors. For two MTrn neighbors 0 n 1, we further istinguish the pths tht 1 exports to 0 into those going ownhill n those going uphill in the AS hierrchy. Given n AS grph G = (V, E), pth P = m Q (m 1) lerne by 0 from its MTrn neighbor 1 is clle m MTrn pth if ( i i+1 ) E, i [0, m-1] n Q is customer pth of m. In other wors, m MTrn pth hs n m-step t the beginning, which is followe by segment going ownhill in the AS hierrchy. Likewise, we sy P is u m MTrn pth of 0 if Q is provier pth or peer pth of m, i.e., Q is segment going uphill in the AS hierrchy (my be followe by ownhill segment). When the context is cler, we sometimes rop the inex m, n use the terms MTrn n umtrn pths to refer to ny m MTrn n u m MTrn pths in P k (m k), respectively. Note tht route to prefix owne by the AS itself is consiere to be customer route of tht AS, so pth consisting of only bi-irecte eges is MTrn pth, i.e., P is MTrn pth if Q = null. Fig. 5 shows some exmples of MTrn n umtrn pths. () 2 MTrn () u 2 MTrn (b) 1 MTrn (e) u 1 MTrn A (c) 2 MTrn (f) u 1 MTrn Fig. 5. Exmples of MT rn pths n umt rn pths. The she rrows represent AS pths. AS in () hs 2 MTrn pth to AS. The pth in (b) is 1 MTrn pth becuse it hs one MTrn link in the beginning. Fig. (c) shows pth with only MTrn links n it is 2 MTrn pth. Fig. () n (e) epict exmples of u 2 MTrn pth n u 1 MTrn pth, respectively. An umtrn pth cn hve ownhill segment, s Fig. (f) shows. Hving clssifie pths in P k into provier, customer, peer, MTrn, n umtrn pths, next we procee to rnk them. As in the Go-Rexfor policy guieline, we prefer customer pths over peer pths n provier pths; no preference is neee between peer n provier pths. The remining unspecifie cses re how to rnk between MTrn pths n other types of pths, n how to rnk MTrn pths mong themselves. Section IV-B consiers rnking M T rn pths, while section IV-C stuies the rnking of umtrn pths. Section IV-D summrizes the rnking rules. B. Rnking MTrn Pths In iscussing ech rnking rule, we use n exmple to show tht ispute wheel will rise if the rnking oes not follow the rule. Dispute wheel relte terms, such s pivot noe, spoke pth, n rim pth, will be use in the iscussion. Their efinitions cn be foun in APPENDIX A. 1) Customer pth n MTrn pth: We use the exmple of Fig. 6() to show tht customer pth shoul be preferre over MTrn pth to voi policy isputes. ASes, b, n c in Fig. 6() re MTrn neighbors n is their customer. ASes, b, n c hve irect customer pths to n they nnounce their customer pths to ech other, so tht they lso hve MTrn pths to. If MTrn pths re preferre over customer pths, Fig. 6() hs ispute wheel. Tht is,, b, n c re the pivot noes; their customer pths re the spoke pths; n their MTrn pths re the rim pths. Preferring customer pth over MTrn pth breks the ispute wheel, becuse the pivot noes will prefer their spoke pths over rim pths. Preferring customer pths over MTrn pths not only solves the potentil routing oscilltion, it lso mkes economic sense. Becuse customers lwys py for the trffic trnsite by their proviers, customer pths shoul lwys be preferre. 2) Provier pth n MTrn pth: Next we stuy how to rnk between provier pths n MTrn pths. In Fig. 6(b), ASes n c re MTrn neighbors; b is the provier of n ; c is provier of. AS b hs two customer pths to, one is the irect pth n the other is vi. AS lerns provier pth from b n MTrn pth from c. If b prefers the customer pth vi n prefers its provier pth over its MTrn pth, there is ispute wheel. Tht is, the pivot noes re n b; the spoke pths re :c: n b:; n the rim pths re :b: n b::c:. The policy ispute in Fig. 6(b) cn be resolve if prefers its spoke pth :c: over its rim pth :b:. Hence, we shoul prefer MTrn pths over provier pths. There is lso n economic justifiction for this rnking rule. Sening trffic to proviers lwys increses one s cost. However, using MTrn pth will not cost more, becuse two MTrn neighbors usully o not chrge ech other (e.g., two merging ASes). Besies, preferring M T rn pth over provier pth cn benefit the MTrn neighbor, becuse it will sen the trffic to customer n chrge tht customer. 3) Peer pth n MTrn pth: MTrn pths shoul be preferre over peer pths; otherwise ispute wheel s shown in Fig. 6(c) cn occur. Here, b, n c re peers n they re MTrn neighbors of. ASes, b, n c lern their MTrn pths from ; they lso hve peer pths to once they nnounce their M T rn pths to ech other. If peer pths re preferre over MTrn pths, Fig. 6(c) hs ispute

8 6 b C b C c b e C b () customer&mt rn (b) provier&mt rn (c) peer&mt rn () MT rn&mt rn Fig. 6. Exmples showing the potentil policy isputes when MT rn pths re not properly rnke. () shows policy ispute if MT rn pths re preferre over customer pths; (b) shows policy ispute if provier pths re preferre over MTrn pths; (c) shows policy ispute if peer pths re preferre over MTrn pths; () shows policy ispute if 1 MTrn pths re preferre over 2 MTrn pths. The she rrows re the preferre pths to estintion in those policy isputes. The policy isputes in () n (c) re exmples of the BADGADGET scenrio iscusse in [10]; (b) n () re DISAGREE scenrios [10]. wheel. Tht is,, b, n c re the pivot noes; their MTrn pths re the spoke pths; n their peer pths re the rim pths. This ispute cn be resolve by preferring MTrn pths over peer pths. Agin, such rnking mkes economic sense: Two ASes hving mutul trnsit greement usully belong to the sme ISP (such s merging ASes). Since M T rn pth goes through customer of the MTrn neighbor, sening the trffic through n MTrn neighbor will benefit tht neighbor, s its customers lwys py. 4) Between MTrn pths: Given i MTrn pth n j MTrn pth, if i<j, we shoul prefer the i MTrn pth over the j MTrn pth. In other wors, the MTrn pth with less MTrn links t its beginning shoul be preferre. Violting this rnking rule woul result in policy isputes like the one in Fig. 6(). Here is customer of c n e. AS n AS b hve 1 MTrn pths :c: n b:e: to, respectively. ASes n b nnounce their 1 MTrn pths to ech other so tht they lso hve 2 MTrn pths to. If 2 MTrn pths re preferre over 1 MTrn pths, there is policy ispute between n b. It lso mkes sense economiclly to prefer the MTrn pth with less steps t its beginning. As the trffic will eventully be sent to some AS tht is not n MTrn neighbor, it is better to shift the trffic off-the-net s soon s possible. C. Rnking um T rn Pths Similr to the iscussions in section IV-B, in this section we lso use exmples to illustrte the rnking rules neee to voi policy isputes. 1) Customer pth n umtrn pth: We use Fig. 7() to show tht customer pths shoul be preferre over umtrn pths to voi policy isputes. In Fig. 7(), n b re MTrn neighbors; c is provier of b n ; is lso provier of. AS b hs provier pth n MTrn pth to. AS hs irect customer pth n umtrn pth to. We lrey know tht b prefers its MTrn pth b:: to. If prefers its umtrn pth over its customer pth, there is ispute wheel in Fig. 7(). Tht is, the pivot noes re n b; the spoke pths re : n b:c:; n the rim pths re :b:c: n b::. Hence, we shoul prefer customer pths over um T rn pths. 2) Provier pth n um T rn pth: Between provier pths n um T rn pths, provier pths shoul be preferre; otherwise the network of Fig. 7(b) will hve ispute wheel. In Fig. 7(b),, b, n c re MTrn neighbors n they re customers of. ASes, b, n c hve both irect provier pths n umtrn pths to estintion. If umtrn pths re preferre, there is ispute wheel in Fig. 7(b), where, b, n c re the pivot noes; their irect provier pths re the spoke pths; n their umtrn pths re the rim pths. Preferring provier pths over um T rn pths lso hs economic justifictions. Consier the cse where n AS hs both provier pth n umtrn pth, the ltter one goes through provier of n MTrn neighbor. If the two ASes belong to single (merge) ISP, it is better to shift the trffic off-the-net s soon s possible, rther thn crrying it onthe-net between the two ASes, s eventully the ISP nees to py provier to trnsit the trffic. Even if the two ASes re seprtely owne MTrn neighbors, using um T rn pths inste of provier pths woul not benefit either of them, becuse one of them must py provier to trnsit the trffic. 3) Peer pth n umtrn pth: We use Fig. 7(c) to show tht peer pths shoul be preferre over umtrn pths to voi potentil policy isputes. In Fig. 7(c),, b, n c re MTrn neighbors n they hve s peer. Hence,, b, n c hve both peer pths n umtrn pths to. If umtrn pths re preferre over peer pths, Fig. 7(c) hs ispute wheel, i.e.,, b, n c re the pivot noes, their peer pths re the spoke pths, n their umtrn pths re the rim pths. Preferring peer pths over um T rn pths breks this ispute wheel becuse the pivot noes will use their spoke pths. 4) Between umtrn pths: For two umtrn pths, the one prefixe by fewer MTrn links shoul be preferre to voi the policy ispute of Fig. 7(). Fig. 7() is similr to Fig. 6() except tht estintion is provier of c n e. If n b prefer their u 2 MTrn pths over their u 1 MTrn pths, there is policy ispute between n b. To voi such policy ispute, we shoul prefer u i MTrn pths over u j MTrn pths if i<j. D. Summry of Pth Rnking Rules Bse on the bove iscussions, our pth rnking rules cn be uniquely etermine. Let P 1 P 2 enote preferring pth P 1 over P 2. We hve customer MTrn provier umtrn, n customer MTrn peer umtrn; between multiple M T rn pths, the one prefixe by the lest number of MTrn links shoul be preferre; between

9 7 c C b b C b c b e () customer&umt rn (b) provier&umt rn (c) peer&umt rn () umt rn&umt rn Fig. 7. Exmples showing the potentil policy isputes when umt rn pths re not properly rnke. () shows policy ispute if umt rn pths re preferre over customer pths; (b) shows policy ispute if umt rn pths re preferre over provier pths; (c) shows policy ispute if umt rn pths re preferre over peer pths; () shows policy ispute if u 2 MTrn pths re preferre over u 1 MTrn pths. The she rrows re the preferre pths to estintion in those policy isputes. The policy isputes in () n () re DISAGREE scenrios [10]; (b) n (c) re BADGADGET scenrios [10]. multiple um T rn pths, the one prefixe by the lest number of MTrn links shoul be preferre. V. POLICY GUIDELINES FOR ACCOMMODATING MUTUAL TRANSIT AGREEMENTS We re now in position to formlly n completely specify the generlize policy guielines neee to ccommote rnge of mutul trnsit greements. The sfety n robustness properties of those guielines will lso be formlly estblishe. A. Policy Guielines We present three instnces of policy guielines, which ccommote mutul trnsit greements with progressively broer menings. Policy V.1 ccommotes the greement where two MTrn neighbors nnounce to ech other their provier, customer, n peer pths. Policy V.2 further llows certin MTrn pths to be nnounce to MTrn neighbors. Finlly, Policy V.3 ccommotes the mutul trnsit greement where two MTrn neighbors cn nnounce ny pths to ech other. Policy V.1 (1-step policy) EXPORT POLICY To Customer: nnounce ll routes To Peer: nnounce customer n 1MTrn routes To MTrn: nnounce customer, peer, n provier routes To Provier: nnounce customer n 1MTrn routes IMPORT POLICY customer 1MTrn provier u 1MTrn customer 1MTrn peer u 1MTrn 1) 1-step policy: Policy V.1, enote s the 1-step policy, ccommotes bsic mutul trnsit greement where two MTrn neighbors nnounce to ech other ll their pths except MTrn pths. Becuse MTrn pths re not nnounce to MTrn neighbors, consecutive MTrn links will not pper in ny AS pths. If this policy is opte, the vli AS pths inclue ll vlley-free pths n vlley-free pths with 1-steps. In other wors, the missible pth set of Policy V.1 is P 1. We believe tht the vlley-free pths with steps llowe by the 1-step policy re most likely wht re use in prctice by some ISPs toy. Since n AS usully hs only one MTrn neighbor, no consecutive bi-irecte eges will pper in ny AS pths. 2) k-step policy: For fixe k>1, Policy V.2 further extens the missible pth set to P k, i.e., ny vlley-free pths with steps not wier thn k. We cll Policy V.2 the k-step policy. The k-step policy llows n AS to nnounce certin MTrn pths to its MTrn neighbors, i.e., nnouncing those pths prefixe by less thn k MTrn links to MTrn neighbors. Policy V.2 (k-step policy) EXPORT POLICY To Customer: nnounce ll routes To Peer: nnounce customer n imtrn routes i k To MTrn: nnounce customer n provier routes; nnounce imtrn n u imtrn routes i < k To Provier: nnounce customer n imtrn routes i k IMPORT POLICY customer imtrn jmtrn ( j > i) provier u imtrn u jmtrn ( j > i) customer imtrn jmtrn ( j > i) peer u imtrn u jmtrn ( j > i) 3) ny-step policy: Lstly, Policy V.3, nme the nystep policy, llows vlley-free pths with steps of ny with. In other wors, the missible pth set is P. In sense, Policy V.3 llows nnouncing the mximl set of pths in ccommoting mutul trnsit greements, i.e., it llows ny pths to be nnounce to ny MTrn neighbors. Policy V.3 (ny-step policy) EXPORT POLICY To Customer: nnounce ll routes To Peer: nnounce customer n MT rn routes To MTrn: nnounce ll routes To Provier: nnounce customer n MT rn routes IMPORT POLICY customer imtrn jmtrn ( j > i) provier u imtrn u jmtrn ( j > i) customer imtrn jmtrn ( j > i) peer u imtrn u jmtrn ( j > i) B. Sfety n Robustness of the Policy Guielines The sfety n robustness of the policy guielines presente in section V-A cn be gurntee when AS grph G hs certin topologicl properties. Remember tht the Go-Rexfor policy guieline gurntees routing sfety n robustness when AS grph G is cyclic, i.e., the irecte eges in grph G o not form ny cycles. When ASes enter into mutul trnsit greements so tht bi-irecte eges re present in AS grph G, we nee to re-estblish the topologicl properties tht gurntee routing sfety n robustness.

10 8 We sy tht n orere sequence of noes, C = u 0...u m+1 where m > 1 n u m+1 = u 0, is cycle with steps if ll irecte eges in C point in the sme irection, n C hs t lest one irecte ege n one bi-irecte ege. Further, if the wiest step in C is k-step, C is referre to s cycle with k-steps, or n s k Cycle. For exmple, we refer to irecte cycle (without steps) s n s 0 Cycle. Fig. 8 shows exmples of s 0 Cycle n s 1 Cycle. Fig. 8. () s 0 Cycle Exmples of s 0 Cycle n s 1 Cycle. (b) s 1 Cycle To cpture the AS grph topologicl properties tht will gurntee the sfety n robustness of our policy guielines, we introuce the efinition of AS grph fmily ASG k s follows. Definition V.1 (ASG k ) An grph G is s k Cycle-free if it contins no s h Cycles, where 0 h k. The collection of ll s k Cycle-free grphs is enote s ASG k. Note tht there my be n s h Cycle (h > k) in G ASG k. Hence, we hve ASG k+1 ASG k. In prticulr, ASG 0 is the fmily of cyclic AS grphs, which hve no cycle in the provier-customer reltionships. The Go-Rexfor policy guieline is sfe n robust for G ASG 0. The k-step policy gurntees routing sfety n robustness s long s AS grph G hs no s k Cycles, i.e., G ASG k, s stte in Theorem V.1. Theorem V.1 For ny AS grph G ASG k, the k-step policy is sfe n robust. One intuitive but rther informl wy to unerstn Theorem V.1 is s follows. If the AS grph G ASG 0, i.e., provier-customer reltionships in G o not hve ny cycles, Theorem V.1 essentilly resttes tht the Go-Rexfor policy is sfe n robust. With the presence of mutul trnsit greements in AS grph G, we cn consier tht provier-customer reltionship inictes two ASes in ifferent tiers of G n mutul trnsit reltionship inictes two ASes in the sme tier. Hence, if AS grph G ASG k for k > 0, G is still hierrchicl n the k-step policy gurntees routing sfety n robustness. To formlly prove Theorem V.1, we first introuce Lemm V.2. Lemm V.2 For ny AS grph G ASG k, if there is ispute wheel W = (U, Q, R) by opting the k-step policy, the rim of W cnnot hve only MTrn links. Proof: For n AS grph G ASG k where the k-step policy is opte, we first ssume tht ispute wheel W = (U, Q, R) of size m exists, where R i hs only MTrn links, i [0, m 1]. Obviously, becuse u i prefers R i Q i+1 over Q i, i [0, m 1], Q i cnnot be customer route of u i ; Q i cnnot be provier route or peer route of u i either. Therefore, i [0, m 1], Q i must be n MTrn pth of u i. Besies, ll Q i s re umtrn routes of u i, or ll Q i s re MTrn routes of u i. Cse 1: If i [0, m 1], Q i is u i s umtrn pth, let H(R) be the step with t the beginning of pth R, we hve H(R 0 ) + H(Q 1 ) H(Q 0 ) H(R 1 ) + H(Q 2 ) H(Q 1 )... H(R k 1 ) + H(Q 0 ) H(Q k 1 ) From the bove inequtions, we cn hve k 1 i=0 H(R i) 0, which is impossible becuse min(h(r i )) = 1. Cse 2: If i [0, m 1], Q i is MTrn route of u i, we cn similrly erive contriction. Hence, the rim of W cnnot hve only MTrn links. With Lemm V.2, we further prove tht if the k-step policy is opte n there is ispute wheel W, the rim of W must be n s h Cycle where h k. Lemm V.3 If ispute wheel W = (U, Q, R) exists in routing system opting the k-step policy, the rim of W must be n s h Cycle where h k. Proof: Without loss of generlity, we first consier the cse where Q 0 is customer route of u 0. If Q 0 is u 0 s customer pth, R 0 Q 1 must be customer route of u 0 too. Hence, R 0 is ownhill pth from u 0 to u 1. Becuse no vlley is llowe, Q 1 is customer pth or MTrn pth of u 1. For either cse, R 1 Q 2 must be either customer pth or MTrn pth of u 1, so tht u 1 cn prefer R 1 Q 2 over Q 1. Therefore, R 1 is ownhill pth from u 1 to u 2. By repeting this, we hve R 0 R 1...R m 1 is ownhill pth from u 0 to itself. Accoring to Lemm V.2, the rim of W cnnot be ll MTrn links, so it is n scycle. Next we show tht R 0 R 1...R m 1 cnnot hve segment with more thn k consecutive MTrn links. Assuming the rim of W hs such segment, it must be locte t the conctention point of R i n R (i+1)%k. Let H(R) n T (R) represent the with of the step t the beginning n t the en of pth R, respectively. Without loss of generlity, we ssume T (R m 1 ) + H(R 0 ) > k (1) This lso implies R 0 Q 1 is n MTrn pth of u 0. We consier the following two cses: Cse 1: If R 0 Q 1 is umtrn pth u 0, Q 0 must lso be umtrn pth of u 0. Becuse u 0 prefers R 0 Q 1, we hve H(R 0 Q 1 ) H(Q 0 ) (2) Also becuse R m 1 Q 0 is vli pth of u m 1, it shoul not hve steps wier thn k, i.e., T (R m 1 ) + H(Q 0 ) k (3) From (2) n (3), we cn erive T (R m 1 ) + H(R 0 Q 1 ) k. This contricts (1) becuse H(R 0 Q 1 ) H(R 0 ). Cse 2: If R 0 Q 1 is MTrn pth of u 0, Q 0 cn be MTrn pth, peer pth, provier pth, or umtrn pth of u 0. Cse 2.1: If Q 0 is MTrn of u 0, we cn erive

11 9 contriction similr to cse 1. Cse 2.2: If Q 0 is provier pth, peer pth, or umtrn pth of u 0, R m 1 Q 0 must be umtrn pth or provier pth of u m 1. Becuse u m 1 prefers R m 1 Q 0 over Q m 1, Q m 1 must umtrn pth or provier pth of u m 1. Hence, R m 2 Q m 1 is umtrn pth or provier pth of u m 2. By keeping oing this, we cn erive tht R 0 Q 1 is umtrn pth or provier pth of u 0, this contricts with the ssumption tht R 0 Q 1 is MTrn pth of u 0. Since ineqution (1) oes not hol for cse 1 or cse 2, the rim of W is n s h Cycle where h k. For other cses where Q 0 is provier pth, peer pth, MTrn pth, or umtrn pth of u 0, we cn similrly erive the sme conclusion, i.e., R 0 R 1...R m 1 is n s h Cycle where h k. With Lemm V.2 n Lemm V.3, now we cn prove Theorem V.1. Proof: When the k-step policy is opte n ispute wheel exists, Lemm V.3 tells us tht the rim of the ispute wheel must be n s h Cycle where h k. This contricts the fct tht the AS grph G ASG k. Therefore, the ispute wheel oes not exist n the k-step gurntees routing sfety n robustness. As specil cse of Theorem V.1, we hve Corollry V.4, which estblishes the sfety n robustness of the 1-step policy. The 1-step policy ccommotes the mutul trnsit greements where ll pths except MTrn pths cn be nnounce to MTrn neighbors. Therefore, mong the three policy guielines presente in this pper, the sfety n robustness of the 1-step policy require the lest restrictions to AS grph G, i.e., G ASG 1. Corollry V.4 For ny AS grph G ASG 1, the 1-step policy is sfe n robust. Finlly, if AS grph G is scycle-free (G ASG ), the ny-step policy is sfe n robust. This fct is formlly stte in Corollry V.5. The ny-step policy hs the lest constrints on wht pths cn be nnounce to MTrn neighbors. However, to gurntee routing sfety n robustness, we hve to plce the most restrictive ssumptions on AS grph G, nmely, G contins no s i Cycles for ny i (thus G is strictly hierrchicl). Corollry V.5 For ny AS grph G ASG, the ny-step policy is sfe n robust. VI. PRACTICAL IMPLICATIONS After presenting the policies n stuying their sfety n robustness properties, in this section we iscuss some prcticl implictions of our policy guielines. We show how these policies cn be relize in BGP without significnt configurtion effort. Other prcticl issues re lso iscusse, such s which ASes cn sfely estblish mutul trnsit greements, n how to hnle selective mutul trnsit. A. Relizing the Policy Guielines in BGP Relizing the policies put forth in section V oes not require significntly more configurtion efforts beyon wht re require for BGP toy, n the extr configurtion efforts re only impose on those ASes hving mutul trnsit greements. In relizing the 1-step policy, the only extr cre require is to istinguish between 1 MTrn n u 1 MTrn routes. For the k-step policy n the ny-step policy, we lso nee the initil step with inex i in i MTrn n u i MTrn routes to rnk them. In the following, we provie n exmple implementtion of how such informtion cn be incorporte in the BGP community ttribute. Recll tht the 4-octet community ttribute is typiclly represente s x:y (n AS:VALUE pir), where the first two octets x enote the AS number n the secon two octets y enote the vlue. We efine the two octets y in such mtter tht the first octet y 1 in y=y 1 :y 2 represents the type of routes: customer, MTrn, peer, provier, or umtrn routes. For MTrn n umtrn routes, the secon octet y 2 represents the initil step with. When n AS imports route from customer, peer or provier, it sets octet y 1 to customer, peer or provier ccoringly 4, n sets octet y 2 = 0. Before exporting customer route to n MTrn neighbor, it sets the two octets in y to y 1 =MTrn n y 2 =1. Likewise, before exporting provier or peer route to n MTrn neighbor, it sets y 1 =umtrn n y 2 =1. Hence, when n AS imports route from n MTrn neighbor, the y 1 :y 2 vlue cn inicte whether it is MTrn or umtrn route n the initil step with. If n AS nees to further export n MTrn route to nother MTrn neighbor, it simply increments y 2 by one before exporting it. On the other hn, if this AS exports M T rn or um T rn route to customer, peer or provier, it sets y 2 =0, y 1 =customer, peer, or provier before exporting the route. B. Sfely Estblishing Mutul Trnsit Agreements Certin cre must be tken when estblishing mutul trnsit greements between ASes, becuse the sfety n robustness of the policy guielines presente in this pper hinge on certin AS grph topologicl properties. However, given tht the provier-customer reltionships re usully cyclic, it immeitely implies tht ny two tier-1 ASes cn estblish mutul trnsit greement where they expose to ech other ll their pths, n the AS grph still hs no scycles. Similrly, ny two stub ASes cn lso sfely estblish mutul trnsit greement where they nnounce to ech other ll their pths, n the resulting AS grph remins to be scycle-free. Stub ASes cn sfely estblish mutul trnsit greements is prticulrly useful insight, becuse the mjority of ASes in the Internet re stubs. In generl, for ASes other thn stub ASes n tier-1 ASes, one cn ensure tht the resulting AS grph is free of ny scycles n the policies guielines presente in section V-A gurntee sfe n robust routing, s long s mutul trnsit greements re estblishe only between ASes of similr size n coverge. Note tht it is to n AS s own vntge to estblish mutul trnsit greements only with ASes of similr 4 Depening on the rrngement between neighboring ASes, the community ttribute my in fct be set by the neighboring AS before the route is exporte.

12 10 size n coverge. Otherwise, the lrger AS woul rther be provier of the smller AS to generte higher revenue. C. Hnling Selective Mutul Trnsit Agreements In previous iscussion, we ssume tht mutul trnsit greement between two ASes ws in effect for ll prefixes, i.e., n MTrn link hs unique mening. In prctice, however, mutul trnsit cn be pplie selectively so tht the semntics of link vry for ifferent sets of prefixes. A relistic exmple coul be two peering ASes greeing to use their peering link to o mutul trnsit only for certin estintions. Ielly, we coul configure ifferent policies for ifferent prefixes. However, configuring policies for ech prefix is ifficult in prctice becuse of the lrge number of prefixes in the Internet. Doing policy configurtion on per-neighbor mnner is more prcticl. We show such n exmple in Fig. 9, which is similr to Fig. 1. Here Tiscli n Pipex cn hve selective mutul trnsit greement where Tiscli is willing to trnsit trffic for Pipex s customer c n Pipex is willing to trnsit trffic for Tiscli s customer. As before, the BGP community ttribute cn be use to relize this per-neighbor bse mutul trnsit configurtion. Tiscli n Pipex cn loclly gree on some community number to inicte mutul trnsit greement for certin prefixes. When Tiscli imports routes from customer, Tiscli uses import filters to ssign community number to those routes. Tht community number shoul be preserve when Tiscli nnounces those routes to Pipex, so tht Pipex cn know the mutul trnsit semntic of those routes. Fig. 9. Tiscli AS3257 Ti Te TeliSoner AS1299 Pipex AS5413 Pi b c Per-neighbor bse selective mutul trnsit greement. VII. POTENTIAL BENEFITS OF MUTUAL TRANSIT AGREEMENTS In this section, we provie some quntifictions of the potentil benefits if ASes enter into mutul trnsit greements. We stuy the benefits of tolerting severl types of filures, when two peering ASes cn sfely inclue mutul trnsit in their greement by following the policy guielines presente in section V (ssuming they re willing to o so). Peering ASes re the most nturl cnites to enter into mutul trnsit greements, becuse peering reltionships re typiclly estblishe between ASes of similr size n coverge. A. Experiment Setting We crry out our investigtion by performing number of experiments on n AS grph erive from the Routeviews BGP tbles [20]. We use 160 BGP tble snpshots rchive in Jnury 2008 s our t set. The AS reltionships re inferre using the lgorithm in [8]. To spee up our experiments, ll stub ASes re remove n only trnsit ASes re inclue in the AS grph [21]. Note tht the ctul benefit of extening peering greements into mutul trnsit greements cn be more significnt thn inicte by the experimentl results presente in this section. First, becuse Routeviews oes not hve complete BGP tbles, our AS grph erive from Routeviews BGP tbles misses lrge set of peering links [22]. If more peering links re present in the AS grph, more ASes cn potentilly benefit from extening their peering greements to mutul trnsit greements. Secon, the AS reltionships re inferre by heuristic lgorithm, which cn misclssify some links. Most of the inccurcy is in misclssifying peering links into proviercustomer links [8,23]. Agin, if those links re correctly clssifie so tht the AS grph hs more peering links, more ASes will be ble to benefit from extening mutul trnsit greements to their peering links. B. Fult Tolernce Benefits We re intereste in few common filure scenrios n how mutul trnsit greements cn help better tolerte those filures. In our experiments, we compre the Go-Rexfor policy guieline (which ccommotes only the trnsit n peering greements) to the 1-step policy n the ny-step policy. For ech filure scenrio, we count the number of rechble AS pirs before n fter the filure. If AS u cn rech AS v n AS v cn rech AS u using pths permitte by the corresponing routing policy, we sy u n v re rechble AS pir. If u n v re rechble n they become unrechble fter the filure, we sy u n v re isconnecte AS pir. 1) Access link filures: Access links re the links connecting n AS to its proviers. An AS with peer neighbor cn tolerte ccess link filures by expning its peer greement into mutul trnsit greement. Tht is, if ll ccess links of n AS fil, the peering neighbor cn trnsit its trffic. We rn 50 instnces of filure experiments. In ech instnce, one AS mong ll the ASes tht cn sfely convert one of their peer greements into mutul trnsit greements is selecte, n ll its ccess links re file. We count the number of isconnecte AS pirs in ech experiment instnce. The results of isconnecte AS pirs re presente in Fig. 10. As we cn see, significnt number of AS pirs become isconnecte when using the Go-Rexfor policy. In some cses, s mny s 18,000 AS pirs get isconnecte becuse one AS hs its ccess links file. However, uner either the 1-step or the ny-step policies, no AS pirs re isconnecte in this filure scenrio. 2) Tier-1 e-peering: This correspons to scenrio where two tier-1 ASes ecie to terminte their connection. As the stuy in [21] shows, tier-1 e-peering cn hve huge impct on the rechbility of ASes single-home to the e-peere tier- 1 ASes. We select some well-known tier-1 AS pirs [19] n let them e-peer in our experiments. Not unexpectely, the 1-step policy oes not offer ny improvement over the Go- Rexfor policy. However, s shown in TABLE I, the ny-step policy is ble to entirely eliminte ny loss of connectivity.

13 11 # of AS pirs ( 10 3 ) Go-Rexfor Policy 1-Step Policy simultion instnces Fig. 10. Number of isconnecte AS pirs in ccess link filures when the Go-Rexfor policy n the 1-step policy re opte, respectively. The result for ny-step policy is the sme s the 1-step policy result. This is becuse the ny-step policy llows AS pths with multiple consecutive peering links (now they hve the mutul trnsit semntics) to be use. As result, the e-peere tier-1 ASes cn use other tier-1 ASes to bypss the file peering link. TABLE I NUMBER OF DISCONNECTED AS PAIRS UNDER TIER-1 DE-PEERING. peering link # of isconnecte AS pirs Go-Rexfor ny-step ) AS prtition: This lst scenrio consiers filures tht prtition tier-1 AS into two isconnecte components. Using the NetGeo service [24], we clssify the US customers of tier-1 AS into three ctegories: est cost customers, west cost customers, n other customers. We ssume tht fter prtition the est cost customers n west cost customers of the tier-1 AS cnnot rech ech other through tht tier-1 AS. We test two well-known tier-1 ASes, Quest n AT&T, n present the results of isconnecte AS pirs in TABLE II. As with the tier-1 e-peering scenrio, the ny-step policy offers full protection ginst AS prtition filures. This is gin becuse the ny-step policy llows secon tier-1 AS to trnsit trffic between the est cost n west cost customers of the prtitione tier-1 AS. TABLE II NUMBER OF DISCONNECTED AS PAIRS UNDER TIER-1 AS PARTITION. tier-1 AS # of isconnecte AS pirs Go-Rexfor ny-step 209 Quest AT&T VIII. CONCLUSION This pper stuies the funmentl problem of sfely ccommoting iverse mutul trnsit greements in interomin routing. These mutul trnsit greements cn tke severl possible forms n some of them lrey exist in the Internet, e.g., when two ASes merge or two ASes estblish sibling reltion. We propose series of policy guielines tht support mutul trnsit greements with progressively richer semntics n stuy the sfety n robustness of those policy guielines. Bse on those theoreticl insights, we further iscuss how iverse mutul trnsit greements cn be sfely estblishe n esily implemente in BGP. We lso emonstrte the benefits, in terms of routing relibility uner vrious representtive filure scenrios, of extening Internet peering greements to mutul peering greements. ACKNOWLEDGMENT The uthors re sincerely grteful to the eitor, Prof. Olivier Bonventure, n the nonymous reviewers for mny helpful comments n constructive suggestions. This work is supporte by NSF grnts CNS , CNS , n CNS REFERENCES [1] V. Vlncius, N. Femster, R. Johri, n V. Vzirni, MINT: A Mrket for INternet Trnsit, in CoNEXT 08: Proceeings of the 2008 ACM CoNEXT Conference. New York, NY, USA: ACM, 2008, pp [2] J. Feigenbum, V. Rmchnrn, n M. Schpir, Incentivecomptible interomin routing, in EC 06: Proceeings of the 7th ACM conference on Electronic commerce, 2006, pp [3] J. R. Lne n A. Nko, Pth brokering for en-host pth selection: towr pth-centric billing metho for multipth internet, in CoNEXT 08: Proceeings of the 2008 ACM CoNEXT Conference. New York, NY, USA: ACM, 2008, pp [4] T. G. Griffin n G. Wilfong, An nlysis of BGP convergence properties, SIGCOMM Comput. Commun. Rev., vol. 29, [5] L. Go n J. Rexfor, Stble internet routing without globl coorintion, in SIGMETRICS 00: Proceeings of the 2000 ACM SIGMETRICS interntionl conference on Mesurement n moeling of computer systems. New York, NY, USA: ACM, 2000, pp [6] L. Go, T. G. Griffin, n J. Rexfor, Inherently sfe bckup routing with BGP, in Proceeings of INFOCOM 01, [7] N. Femster, R. Johri, n H. Blkrishnn, Implictions of utonomy for the expressiveness of policy routing, in Proceeings of SIGCOMM 05, Philelphi, Pennsylvni, USA, [8] L. Go, On inferring utonomous system reltionships in the Internet, IEEE/ACM Trns. Netw., vol. 9, no. 6, pp , [9] K. Vrhn, R. Govinn, n D. Estrin, Persistent route oscilltions in inter-omin routing, Computer Networks, vol. 32, no. 1, Jn [10] T. G. Griffin, F. B. Shepher, n G. Wilfong, Policy isputes in pthvector protocols, in Proceeings of ICNP 99. Wshington, DC, USA: IEEE Computer Society, [11] T. G. Griffin n G. Wilfong, A sfe pth-vector protocol, in Proceeings of INFOCOM 00, [12] C. T. Ee, V. Rmchnrn, B.-G. Chun, K. Lkshminrynn, n S. Shenker, Resolving inter-omin policy isputes, in SIGCOMM 07: Proceeings of the 2007 conference on Applictions, technologies, rchitectures, n protocols for computer communictions. New York, NY, USA: ACM, 2007, pp [13] A. D. Jggr n V. Rmchnrn, Robustness of clss-bse pthvector systems, in ICNP 04: Proceeings of the 12th IEEE Interntionl Conference on Network Protocols. Wshington, DC, USA: IEEE Computer Society, 2004, pp [14] J. Sobrinho, Network routing with pth vector protocols: theory n pplictions, in SIGCOMM 03: Proceeings of the 2003 conference on Applictions, technologies, rchitectures, n protocols for computer communictions, 2003, pp [15] J. L. Sobrinho, An lgebric theory of ynmic network routing, IEEE/ACM Trns. Netw., vol. 13, no. 5, pp , [16] T. G. Griffin n J. L. Sobrinho, Metrouting, in SIGCOMM 05: Proceeings of the 2005 conference on Applictions, technologies, rchitectures, n protocols for computer communictions. New York, NY, USA: ACM, 2005, pp [17] G. Huston, Interconnection, peering, n settlements, in Proceeings of INET 99, Jun [18] Tiscli cquires Pipex brobn business. [Online]. Avilble: [19] Tier 1 network. [Online]. Avilble: 1 crrier [20] The RouteViews Project,

14 12 [21] J. Wu, Y. Zhng, Z. M. Mo, n K. G. Shin, Internet routing resilience to filures: nlysis n implictions, in Proceeings of CoNEXT 07, New York, NY, Dec [22] Y. He, G. Signos, M. Floutsos, n S. Krishnmurthy, Lor of the links: frmework for iscovering missing links in the internet topology, IEEE/ACM Trns. Netw., vol. 17, no. 2, pp , [23] J. Xi n L. Go, On the evlution of AS reltionship inferences, in Proceeings of Globecom 04, [24] NetGeo API. [Online]. Avilble: netgeo/ngapi/inex.xml A. Dispute Wheel APPENDIX The sfety n robustness of our routing policy guielines re estblishe by sufficient conition prove in [10], i.e., no ispute wheel ensures sfety n robustness. A ispute wheel W of size m, s shown in Fig. 11, is triple (U, Q, R), where U is sequence of m noes u 0, u 1...u m 1 clle the pivot noes; Q is sequence of m non-empty pths Q 0, Q 1...Q m 1, which re often referre to s the spoke pths; n R represents m non-empty pths R 0, R 1...R m 1. This triple is such tht for ech 0 i < m, we hve (1) R i is pth from u i to u i+1 ; (2) Q i n R i Q i+1 re vli pths t u i ; n (3) u i prefers R i Q i+1 over Q i. All subscripts re to be interprete moulo m. R i Q i+1 is often clle the rim pth. R 0 R 1...R m 1 is often referre to s the rim of W. u m 1 u i+1 u 0 R R m R i Q m 1 Q i+1 Q 0 o Q Q i i 1 u i R i 1 Q 1 u 1... u i 1 Fig. 11. A ispute wheel W = (U, Q, R) of size m. Yong Lio grute with B.S. egree in 2001 from University of Science n Technology of Chin. In 2004, he receive his M.S. egree from the Grute School of Chinese Acemy of Sciences. Since fll 2004, he hs been working s reserch ssistnt in University of Msschusetts t Amherst, where now he is Ph.D. cnite in the Electricl n Computer Engineering eprtment. His current reserch interests inclue inter-omin routing, t center network, n network virtuliztion. Lixin Go (F IEEE 10) is professor of Electricl n Computer Engineering t the University of Msschusetts t Amherst. She receive her Ph.D. egree in computer science from the University of Msschusetts t Amherst in Her reserch interests inclue multimei networking, n Internet routing n security. Between My 1999 n Jnury 2000, she ws visiting resercher t AT&T Reserch Lbs n DIMACS. She is n Alfre P. Slon Fellow n receive n NSF CAREER Awr in She hs serve on number of technicl progrm committees incluing SIGCOMM2006, SIGCOMM2004, SIGMETRICS2003, n INFOCOM2004, n is on the Eitoril Bor of IEEE Trnsctions on Networking. Roch Guérin (F IEEE 01 / F ACM 06) receive n engineer egree from ENST, Pris, Frnce, n M.S. n Ph.D. egrees in EE from Cltech. From 1986 till 1998 he ws with the IBM T. J. Wtson Reserch Center, Yorktown Heights, NY. In 1998 he joine the Electricl n Systems Engineering eprtment of the University of Pennsylvni, s the Alfre Fitler Moore Professor of Telecommunictions Networks. His reserch hs spnne core networking issues, e.g., routing, trffic engineering, qulity-of-service, etc., s well s topics relte to the use of networks by pplictions n the explortion of how economic fctors ffect the evolution of networke systems. Dr. Guérin hs been n eitor for severl ACM n IEEE publictions, n hs been involve in the orgniztion of numerous ACM n IEEE sponsore ctivities. He ws Generl Chir of the IEEE INFOCOM 98 conference, Technicl Progrm co-chir of the ACM SIGCOMM 01 conference, Generl Chir of the ACM SIGCOMM 05 conference, n Progrm co-chir of the ACM CoNEXT 07 conference. He currently serves on the ACM CoNEXT steering committee. In 1994 he receive n IBM Outstning Innovtion Awr for his work on trffic mngement n the concept of equivlent bnwith, n in 2010 he receive the IEEE INFOCOM Achievement Awr for Pioneering Contributions to the Theory n Prctice of QoS in Networks. He ws on the Technicl Avisory Bor of Frnce Telecom for two consecutive terms from 2001 to 2006, n on tht of Smsung Electronics in He joine the Scientific Avisory Bor of Simul in Zhi-Li Zhng receive B.S. egree in Computer Science from Nnjing University, Chin, in 1986 n his M.S. n Ph.D. egrees in computer science from the University of Msschusetts t Amherst in 1992 n In 1997 he joine the Computer Science n Engineering fculty t the University of Minnesot, where he is currently professor. From 1987 to 1990, he conucte reserch in Computer Science Deprtment t Arhus University, Denmrk, uner fellowship from the Chinese Ntionl Committee for Euction. He hs hel visiting positions t Sprint Avnce Technology Lbs, IBM T.J. Wtson Reserch Center, Fujitsu Lbs of Americ, Microsoft Reserch Chin, n INRIA, Sophi-Antipolis, Frnce.