SAFETY CRITERION IN INTER-DOMAIN ROUTING PROTOCOL WITH PSEUDO RENEWALS

Past analytical analyses does not fully include safety of BGP and its convergence to stable routing in terms of various operational features of BGP such as route flap damping, MRAI timers. Present proposal shows that these features can cause router to send pseudo advertisement of less preferred path. In this study it is made evident that in simple network scenario the pseudo advertisement of less preferred paths can result in situation where it can take more time to converge to stable routing. A generalized model PRP is proposed so that impact of pseudo advertisement on BGP safety can be examined. The connection of pseudo renewals with dispute wheel and dispute reel structure is also established


INTRODUCTION
The Border Gateway Protocol (BGP) (Rekhter et al., 2006;Sami et al., 2009;Stewart and Stewart, 1999) is truly the inter-domain routing protocol in internet. It allows the Autonomous Systems (ASes) to exchange reach ability information with each other. This information is exchanged through independent routing decisions established by each ASes. This flexibility of independent routing decisions may result in steady cycles. These cycles increases the number of BGP path renewals packets which leads to increased traffic in network.
Previous researches have shown that how routing decisions made by independent ASes leads to cycles (Feamster et al., 2005;Griffin et al., 2002;2003;Cittandini et al., 2009;Sami et al., 2009;. Most of these researches have used a theoretical model Simple Path Vector Protocol (SPVP) (Griffin et al., 1999;. In SPVP each node advertises only its best path to reach destination which is steady with its neighbour's decision. This study proposes Progressive Route Procedure (PRP) which captures the effect of various local operational features of BGP (RFD, MRAI timer) on global convergence. PRP establish a necessary and sufficient condition of convergence but it is more complex than SPVP. Fabrikant et al. (2011) and Rekhter et al. (2006) determines the minimum time between advertisements of paths to a particular destination. Increasing this time can cause router to select less-preferred path. The value of MRAI timer used in practice range between 0 and 30 sec.

Minimum Route Advertisement Interval (MRAI) Timer
All the pseudo renewals generated by above factors will have following characteristics: • Pseudo renewals are transmitted for only short period of time, only when higher rank path is unavailable • Pseudo renewals can select path from list of recently available paths

Safety of PRP
This study shows that the conditions under which SPVP was safe apply even to PRP also i.e., PRP is safe if dispute wheel is absent. Next review of the sufficient condition of safety under filtering will be done which will prove that absence of dispute reel structure does not guarantee safety of network under filtering. A modified structure mega-reel is introduced which shows the safety of PRP under filtering.

PRP: Model with Pseudo Renewals
To study the impact of pseudo renewals on network, Progressive Route Procedure (PRP) model is introduced. This model transmits the old information about paths in form of pseudo renewals. PRP uses the SPP framework to show formation of cycles with pseudo renewals.

Stable Path Problem (SPP)
The Stable Path Problem (SPP) (Griffin et al., 1999; consists of a simple undirected graph G = (V, E) where V is a vertex set and E is edge set. Node 0 is assumed to be destination node which all others nodes try to reach. Each node v ε V has its own set Pv of permitted paths to origin and each path have a ranking function λ v . If P 1 , P 2 ε P v and λ v (P1)< λ v (P 2 ) then node v will prefer P 2 over P 1 . Solution to SPP is a path assignment π that maps each node v ε V to path π(v) ε P v . the path assignment π is stable at node v if π(v) = best (choices (π, v), v) where: If W is subset of P v such that each path in W have distinct next hop then best path in W is defined as:

Structures Used in PRP
The PRP algorithm uses following structures: • Current time of global clock is denoted by T • The internal state of node 'a' consists of following: π(a) denotes allocated path which represents the most preferred path, NODE_INFO(a←d) maintained by node 'a' contains list of most recently available information received from node 'd', LATEST(a) contains all paths that node 'a' has had recently available, ST(a) denotes stable time of node 'a' • A fixed constant δ is used. It serves as an upper bound on communication delay caused by pseudo renewals The stability of node is determined by following property: The node 'a' is stable if T≥ST(a) otherwise it is not stable. If node 'a' is stable then the neighbours of node 'a' will learn the accurate most recent path π(a). If node is not stable then neighbours of node 'a' will receive old information which will consists of any one path from LATEST(a).

Progressive Route Procedure (PRP)
The swapping of vital route information is done by provocation of the edges. More than one edge can be stimulated at same time. When edge (d, a) stimulates, following algorithm is executed.

JCS
When node 'd' is stable then step-2 is executed. The structure NODE_INFO(a←d) is updated with most recent information from node 'd'. If node 'd' is not stable then step-3 is executed and node gets old information which may consist of path revocation or advertisement of path that was recently available at node 'd'.
Step-4 updates the list of available paths. New paths are added and those paths are removed which become unavailable at time T.
Step-5 determines the best path available to node 'd' which contains the consistent information. If there is change in route then π(a) is updated according to that information and node is marked as unstable for time period δ.

Example of Cycles
Here two simple examples of cycles due to pseudo renewals in PRP are presented. First example shows the cycles caused by Route Flap Damping (RFD) (Mao et al., 2002;Villamizar et al., 1998) and second example shows cycles due to MRAI (Fabrikant and Papadimitriou, 2008;Rekhter et al., 2006) timer.

Cycles Due to RFD
The network in Fig. 1 contains four nodes that try to reach node 0 which is a destination node. Each node has its own set of privileged paths. The above network is safe if no pseudo renewals are transmitted and it has following path assignment: (10, 20, 340, 40) as shown in Fig. 2.
To show that above network is unsafe in PRP, there should be cycle i.e., a primary route allocation, provocation track that stimulates nodes and edges and pseudo renewals that cause cyclical change of path allocation. The cycle in above network in shown in Table 1 below.
First column in Table 1 shows the provocation track that in which sequence the nodes and edges are stimulated. According to node and edge provocation each node drops its path and selects a new path in order to reach destination node0 which is shown in second column. This process of selecting and dropping of paths is pseudo renewals i.e., nodes leaves their preferred path to select less-preferred paths. The path assignment (π) is shown in last column.
Suppose node 1 starts flapping its route. So route 10 is suppressed. Then node1 advertises route 1230. This is pseudo renewal because after the penalty and suppression limit on route 10 will exceed its threshold limit, the path 10 will become available. Then node 1 will stop announcing path 1230 which is pseudo renewal and network will again reach its primary path allocation which is (10, 20, 340, 40).

Cycles due to MRAI timer
The network in Fig. 1 again shows that cycle can occur in case of MRAI timer. Cycle occur when node uses MRAI timer. The Table 2 shows that cycle. Initial path is selected. Node 1 which is using MRAI timer drops its initial path and selects a new path. But due to MRAI timer, it cannot propagate this new path to its neighbours. Rest of the nodes have stale information which is depicted in table. Again when node 1 drops its path 1230 and selects 120, stale information is passed i.e., neighbours of node 1 are not able to learn new path and so on if this process is continued, cycle occurs.

Safety of BGP with Pseudo Renewals
Section 1.13 will demonstrate that no dispute wheel condition which was sufficient for BGP safety in SPVP model, still hold for safety with pseudo renewals in PRP.
Next Section 1.14 shows the absence of dispute reel is not sufficient condition for safety under filtering with pseudo renewals. Section 1.15 shows a revised model mega-reel.

Safety Under Dispute Wheel
Dispute wheel is classical result of Griffin et al. (1999;2003) and Griffin (2010) which shows the safety of BGP in SPVP model. BGP is safe if there is no dispute wheel. We will prove that this condition holds for PRP also. A dispute wheel is W = (U, Q, R) of size k is a set nodes U = {u 0 , u 1 ,…….,u k-1 } and set of paths Q = {Q 0 ,Q 1 ,…….,Q k-1 } and R = {R 0 ,R 1 ,……..,R K-1 } such that following conditions hold: • Q i is a path from u i to the origin • R i is a path from u i to ui+1 To show safety of PRP under dispute wheel, it is needed to prove the following statement: "PRP exponent with no dispute wheel is safe". Absence of dispute wheel only guarantees the sufficient condition for safety but not the necessary condition in both SPVP and PRP. This means that dispute wheel can occur in safe exponents of routing problem.

Safety under Filtering (Dispute Reel)
Prior work by Cittandini et al. (2009) proved that exponents that do not contain a dispute reel are safe under filtering and if an exponent contains a dispute reel, then there exist a filtering that allow cycles. The dispute reel is a dispute wheel which satisfies following conditions: • Pivot vertices appear in exactly three paths • Spoke and rim paths do not intersect • Spoke path form a tree Above results by Cittandini does not hold in case of pseudo renewals. If PRP has no dispute reel then it does not guarantee safety under filtering with pseudo renewals. This can be shown in following way: Consider the same network that appears in original work of Cittandini et al. (2009) as shown in Fig. 3, where it is proved that network is safe because it does not contain dispute reel but section 1.15 will show that this network contains a cycle.  From Table 3 it is clear that cycle is formed that is initial state is reached again. This cycle has occurred in network which does not have dispute reel and this cycle is valid under PRP. Hence it is proved that absence of dispute reel does not guarantee safety under filtering.

Mega-Reel
A modified structure is introduced which will show safety of PRP under filtering. A mega-reel is a dispute wheel which satisfies the second and third condition of dispute reel: • Spoke and rim paths do not intersect • Spoke paths form a tree PRP is safe under filtering if and only if network does not contain mega-reel. This is established by proving following two implications: 1.15.1 If a PRP exponent P is not safe under filtering then it contains a mega-reel 1.15.2 If a PRP exponent P contains a mega-reel then it is unsafe under filtering Before proving the above implications, it is needed to describe the notation that is used in section 1.15 a PRP Measure Period (MP). A PRP measure period MP = (π, I, ɤ) consists of a path allocation cycle π = (π 1 , I 1 , ɤ 1 )→(π 2 , I 2 , ɤ 2 )→………….(π k , I k , ɤ k )→π k+1 where I is information and ɤ is edge provocation track. Pseudo advertisements do not depend on events that occur before PRP measure period. Also every node that is sending information modifies its selected path once during MP.
Let path (MP, u) be paths that node 'u' selects at some point in MP. Let St be set of static nodes which have static path allocation throughout MP. Let Vb be vibrating nodes. Following another implication is needed in proving above statements: 1.15.3 Let P ε P v is used by node v ε Vb in MP. Then it can be written P = QR where first node on path R is in Vb and all other next nodes are in St.

Proof of 1.15.1
Here it is proved that an unsafe exponent has a megareel Let MP = (π, I,ɤ) be well formed non-worthy period. Let U St be nodes that select a path from a set that contains static nodes. U is nonempty since there are vibrating nodes and when 1.15.3 is applied to one of them, it gives a node in U. Now construct dispute wheel. Let u0 be node in U. let Q 0 = (u 0 , w 0 )Q' 0 be path of u 0 such that w 0 ε St. Since w 0 does not transmit pseudo renewals in MP, then there exists only one such Q 0 which has lowest rank path in path (MP,u 0 ). Let H 0 ε nodes (MP, u 0 ) be highest rank path u0 ever selects, then λ u0 (H 0 ) >λ u0 (Q 0 ). Using 1.15.3, it can be deduce that H 0 = R 0 Q 1 with Q 1 = (u 1 , w 1 )Q' 1 and u 1 ε U. If this process is repeated a track (u i ) is established, which reverts back to u 0 since U is finite. Node u i , spoke Q i and rim R i form a dispute wheel.
Next it will be proved that above constructed dispute wheel also satisfies the conditions defined under new modified structure mega-reel. Suppose that condition (i) is not satisfied and there exists a node u ε Q i ∩R j i.e., u is a node which common between spoke and rim paths. It is known that u ε Q i , u and rest of Q i [u] lie in St. Since fixed nodes cannot transmit pseudo renewals, so any recurring advertisement of route via u will end with Q [u].Then R j [u] must be prefix of Q i [u], which means that R j [u] St but it is against the following condition which states that R j [u] end in u j+1 ∉St. Now suppose even (ii) condition is violated. There exists a spoke paths Q i , Q j ε Q and node v ε Q i ∩Q j such that Q i [v] ≠ Q j [v], then spoke paths does not form a tree. Hence it is proved that any exponent that is not safe under filtering will have mega-reel.

Proof of 1.15.2
Suppose a mega-reel exists then first find the cause of cycle. For this find the path allocations that cause cycle and show provocation track that allows infinite alteration between these path allocations.
Suppose exponent E of SPP contains dispute wheel 'W'. E[W] is minimal exponent which contains vertices, edges and path of W i.e., remove all edges and vertices that lie outside dispute wheel.

Path Allocation Techniques in Mega-Reel
There are two ways by which path allocation can be done in mega-reel. These allocation techniques were given by Cittandini et al. (2009) The all spoke path assignment in Fig. 4 (Cittandini et al., 2009) is path allocation π such that: According to second condition of two-third reel, spoke paths form a tree, so we can form all-spoke path allocation by activating edges of each spoke path Q i starting from 0, which will give an provocation track.
A one rim assignment in Fig. 5 (Cittandini et al., 2009) is defined as: Now suppose E is an exponent that contains twothird reel R = (U, Q, R) of size l. we consider minimal exponent E[R] and construct a impartial provocation track which leads to cycles. The system cycles if allspoke and one-rim path allocation are done alternatively i.e.:

JCS
One-rim path allocation i π All-spoke path allocation π One-rim path allocation i 1 + π And so on the track repeats itself with index i+1 calculated modulo l.
The paths of the nodes on rim changes which make the node to send pseudo renewals. In Fig. 6 black nodes are nodes that have static path throughout MP. White nodes change their path and make pseudo renewals. Network will have cycles when every rim node cycles: • Start with empty state, π(v) = ф for all v • Stimulate the edges of each spoke path Q i starting from 0 i.e., assign all-spoke path assignment π • Suppose each node u ε R j sends pseudo revocation (ε) to every neighbour • Stimulate edges on path R 0 = (x 0 = u 0 , x 1 = u 1 ,……….. x k = u 1 ) starting from node u 1 • Node xi advertises pseudo route R 0 [x i ]Q 1 to node x i-1 . Hence path assignment πҧ 0 is achieved • If all edges of each rim node are stimulated to make pseudo revocation, then we get all-spoke path assignment • Repeating above steps will give infinite track i.e., a cycle is created Proof of statement given in section 1.15 can be directly achieved from proof of 1.15.1 and 1.15.2. If there is no dispute wheel, there is no mega-reel which is a special type of wheel. This results in safety under filtering.

CONCLUSION
In this study a model PRP is introduced. This model establishes the impact of pseudo advertisements on BGP safety and the effect of various local operational features of BGP on global convergence. This study also shows that how cycles can occur in network which were otherwise considered safe in past researches. Further it establishes the safety of PRP under well known structures such as dispute wheel and dispute reel. Safety of PRP was also considered under a new structure megareel which proved that PRP is safe under filtering.
Based on the above results a problem of finding necessary and sufficient conditions for safety can be solved. This can be done by using PRP model which proved to be safe under various conditions.