PROPUESTA ECONÓMICA

This section presents a rewriting calculus for policy-based routing systems, based on the idea of reducing a given network to one which is smaller, but has the same safety property. We define two specific rules, called duplicate and complementary

reduction, for merging two router nodes in an EPD. Both of these are purelylocal, meaning that the operations only require examination of the relevant nodes and their immediate neighbors. In the following, assume we are working with a given EPD instanceG= (P, Ev, Ep, s)on a graph(V, E, d).

Definitions To ease the discussion of these reductions, we first introduce three auxiliary notions: ‘consistent node’, ‘node rewrite’, and ‘strongly adjacent’. We say two nodes are consistent if their configurations do not form a cycle in the EPD representation, formalized as follows:

Definition 9(Consistent nodes). Given a policy configuration’s EPD(P, Ev, Ep, s)on

the network graph(V, E, d), nodesu andv inV areconsistentif there is no cycle in the EPD which consists only of pathspfor whichs(p)∈ {u, v}.

An example of nodes violating consistency is in Figure 7.4: nodes1 and2 are not consistent since there is a cycle of paths (120,10,210and20) that only involves

these two nodes. This conflicting configuration causes route oscillation behavior. Such examples of consistency violation, where two nodes have a policy conflict,

Chapter 7. Scalability Techniques for Analysis

should not be eliminated during reduction, in order for the problem to be detected in the final analysis. A consistency check is hence a precondition for reduction.

Figure 7.4: The EPD notation for theDisagreeconfiguration.

Definition 10(Strongly adjacent). Two nodesuandvinV arestrongly adjacentif for every path inPu, eitherv does not appear, or it appears as the next node followingu; and

likewise forPv.

Strong adjacency implies that two nodes are either immediate neighbors, or one does not route to destination through the other. It is also a precondition for reduction.

Definition 11(Node rewrite). The procedure to rewrite nodeutovis as follows: Rewrite the path p ∈ Pu in utop0 ∈ Pv inv by: If p = u◦w◦r, and w 6= v, then rewritepto

w◦r; Ifp = u◦v◦r, then rewriteptor; For all other cases, abort rewrite. Rewrite the preference amongPuto that amongPvby: Rewrite preference arc(p, q)to(p0, q0), wherep

rewrites top0 andqtoq0.

The global rewrite on the EPD is straightforward, once the two nodes have been merged. All paths inP are rewritten according to the procedure of Definition 11, as is the transmission relationEv. Writep[u, v 7→w]for a pathpwhere all occurrences

ofuorvare replaced withw, eliding any ‘ww’ subpath. The preferences at the new nodew are determined by the specific reduction procedure; for anyother nodet,

7.1. Network Reduction

the new path preferences onPtare obtained as follows. For a path p, let pˆdenote

the path that is minimal according toEp among{q ∈ Pt | q[u, v 7→ w] = p}. Then

the written Ep on t is {(ˆp,q)ˆ | (p, q) ∈ Ep}: that is, a path ‘inherits’ the relative

preference of the highest ranked path in its preimage.

Duplicate Reduction

Definition 12 (Duplicate condition). Suppose that u and v are two consistent and strongly adjacent nodes. Then v is a duplicate of u, if after rewriting v to u, the fol- lowing conditions hold: (1)v’s pathP_v0 is equivalent to (or a subset of) theu’s pathsPu; (2)

For every preference arc(p, q)inv, there exists(p0, q0)inu.

Figure 7.5: Nodes u, v are merged by duplicate reduction if they agree on how to route to destination d through their neighborsx, y, . . . , z: For any pathpi, qj, u, v

agree on their preference.

The duplicate precondition ensures two nodes agree on the paths and their preference to reach the destination. The duplicate ‘redundancy’ ofuandbis char- acterized in terms of the neighbors through which they route to destination d. The general duplicate reduction process is shown in Figure 7.5, where u and v

are merged into one nodeu. One can view the local change as merging the paths ofv into u, and this operation can be done consistently since they have the same routing preference.

Chapter 7. Scalability Techniques for Analysis Complementary Reduction In contrast to duplicate reduction, complementary reduction captures the redundancy observed from the point of the view of the neighbors ofuandv. The intuition is that if all the neighbors route to destinations throughuandv in a consistent way, thenuandv can be combined into one node without changing the routing behavior of these neighbors. This is formalized as follows.

Definition 13(Complementary Condition). Two consistent and strongly adjacent nodes uandv arecomplementaryif, for any pathspandqinPu ∪Pv, and any nodesxandy

which are immediately downstream fromu andv, the preference(x◦p, x◦q)is in Ep if

and only if(y◦p, y◦q)is inEp.

Figure 7.6: Nodesu, v are merged by complementary reduction if their neighbors

x, y, . . . , z agree on how to route to destination d through them: After merging,

the route preference for any path pi, qj are set according to the consensus among

x, y, . . . , z.

The general complementary reduction process is illustrated in Figure 7.6 where nodes u and v, whose neighbors x, y, . . . , z agree upon routes through them, are merged into one node. The merging is more subtle than the duplicate one: (1) The merged nodew’s pathscombine those fromu andv, i.e.Pw is the union of Pu

7.1. Network Reduction

consensus of preferences of their neighbors (in cases where the preference could not be derived from eitheruorv). That is, ifuhas pathp(and notq) andvhas path

q (and notp) then we set pto be preferred over qin wif and only if all upstream neighborsxagree thatx◦pis preferred overx◦q.

Example Consider the configuration in Figure 7.7, Here, there is an AS with three border routers (3, 7and4) and two internal routers (4and6), as well as three ex-

ternal router nodes (1_, 2_{, and the destination} 0_{). The nodes}3 _and 4 _{are comple-}

mentary because their downstream neighbors (the internal nodes 5and 6) agree

on the preference among paths to0_{. After merging them, the new node is again}

complementary to node7. Following a second complementary reduction step, the

two internal nodes are both duplicate, and can also be eliminated.

Figure 7.7: Application of complementary and duplicate reduction to border and internal routers, respectively.

Another example configuration is in Figure 7.8 (left), it consists of an AS con- sists of 5 nodes3,7,4_{(border gateway routers) and}5,6_{(internal routers), two ex-}

ternal nodes1,2, and the destination0. Nodes3,4 are complementary because their downstream neighbors (i.e. internal nodes 5,6_{) agree upon the preference}

among paths to 0. Therefore 3,4 can be merged. On the other hand, node 7 is not complementary with3_nor4_because5,6_{have different preferences: while}5

Chapter 7. Scalability Techniques for Analysis

Figure 7.8: One-step reduction of complementary nodes3,4

Figure 7.9: Two-steps reduction: when internal nodes have consensus on how to rank paths from border gateway nodes, all the border gateway nodes can be re- duced into one.

In a configuration with same topology but different route preference, as shown in Figure 7.9 (left), all 3,4,7 are complementary nodes and can be reduced to one in two steps, because5,6 _{agree upon the same route preference. Note that,}

after merging all border gateway routers, we are left with two internal routers that are duplicate. This is due to the dual nature of duplicate and complementary reduction, which we will revisit in details in Section 7.2.