Survivability Design for Multiple Link Failures in MPLS Networks with Bandwidth Guarantees to Minimize Spare Capacity Allocation

Transcription

1 Survivability Design for Multiple Link Failures in MPLS Networks with Bandwidth Guarantees to Minimize Spare Capacity Allocation Deepa Srinivasan North Carolina State University (Advisor: Dr. Rudra Dutta) Abstract Survivability is an important design consideration for high-speed backbone networks and gains even more significance in the context of delay-sensitive applications that require bandwidth guarantees. Spare capacity allocation is a primary component of survivability design. Extensive research has been done to address the problem of a single link failure in such networks and several algorithms exist in current literature. However, these algorithms do not address the problem of simultaneous multiple link failures in such networks. This paper provides a formal definition for the multiple link failure problem, explores various approaches to handling multiple link failure and presents an algorithm to solve a sub-problem: i.e. to determine which multiple link failures the survivability design needs to handle. 1. Introduction Multiprotocol Label Switching (MPLS) networks [1] have several advantages over conventional IP networks for use in high-speed Internet backbones. The primary function in MPLS is to perform flow-aggregation when there is a large amount of traffic between the same source and destination in the network, such flows are grouped and assigned a label. Label Switch Routers (LSRs) in the network route the packets based on this label rather than by examining each individual packet s header, thus enabling high-speed routing and also providing the ability to guarantee bandwidth. Emerging commercially important applications that are delay-sensitive, such as Voice over IP (VoIP), audio/video streaming, Virtual Leased lines etc., necessitate the requirement that there are end-end protection planning mechanisms in the network. Furthermore, the restoration time in case of failures in the network should be within an acceptable limit such that the end-end quality of service is not affected. With optical network technology being deployed in backbones, such mechanisms gain even more significance since, in the absence of backup mechanisms, a single or multiple failures in the network will lead to disruption of service to a large number of users. Thus, survivability is an important characteristic and design consideration for high-speed Internet backbone networks, which provide users with Service Level Agreement (SLA) guarantees. Aggregated flows in MPLS networks are called traffic trunks and are routed through specific Label Switch Paths (LSPs). This is illustrated in Figure 1 (from [2]). Typically, such LSPs are used for big trunks in backbone networks. Label Edge Routers (LERs) handle the entrance and exit of all traffic to and from the MPLS network, i.e. they are responsible for assigning and removing labels to aggregated flows. Label Edge Router (LER) Label Switch Router (LSR) Label Switch Router (LSR) Label Switch Path Label Edge Router (LER) Figure 1. Label Switch Path (from [2]) In optical networks, a light path corresponds to a LSP. Since LSPs typically represent big trunks in the backbone networks, that require bandwidth guarantees, a backup path is also setup when the LSP is initially setup. The

2 backup path is used to route traffic in case there is a failure on the original path. The basic approach to setting up the backup is: whenever an LSP is setup, a similar path with equivalent bandwidth is also reserved solely for the LSP being setup that is guaranteed to be available in case of failure on the primary path. This backup path is reserved from the spare capacity that is available in the network. However, consider the case where two LSPs in the network are independent i.e. do not share any common network elements. In this case, a single path can be setup that is reserved as the backup for both these LSPs, thus reducing the spare capacity that is allocated in the network. This problem of minimizing spare capacity allocation (SCA) is significant in protection planning algorithms design. [7] presents a survey of existing approaches and algorithms for SCA using MPLS-related techniques and presents in detail some of these ([3], [4], [5], [6]). Networks that require restoration time guarantees are considered in this context and [7] also explores existing algorithms that handle this. While extensive research has been done and several algorithms/approaches exist in current literature to address the problem of single link failures within the context of SCA, there has not been much work done in the same area to address the case where multiple links in a network fail simultaneously. Depending on the failure probabilities of individual links in a network, a multiple link failure probability may exist in the network that violates the guaranteed SLA of the network. In such cases, survivability design and SCA for the network need to handle the occurrence of multiple link failures. Also, if the network does not address the probable multiple link failures, this also introduces the problem of possible contention for shared backup paths. We briefly discuss the concept of Shared Risk Groups (SRGs) [3] now. When two or more paths share a common network element (e.g. a node or link) of failure, they belong to the same SRG. SRGs are defined based on the physical relation of nodes or links. For example, links that belong physically to a single conduit belong to a single SRG because if that conduit gets damaged, then all the links in that conduit are likely to get damaged. It is a well-known idea that paths that contain links that belong to the same SRG should not share the same backup path. A more detailed explanation of this concept is given in [3]. Thus, SRGs provide a limited mechanism for protecting against multiple link failures. However, SRGs do not include the case where two links that do not belong to a single physical element fail simultaneously. Some prior work exists to address multiple link failures in a limited fashion. [8] defines multiple link failures (in the context of its work) as that which occurs when a conduit that accommodates two or more links has been cut. Specifically, it considers the case where two failed links connected to one node fail simultaneously. Similarly, [9] addresses the case of any two links failing simultaneously in a network by allocating two backup paths for every working path. However, these approaches cannot be generalized for more than two simultaneous link failures as it would lead to an explosion in the amount of spare capacity required. This goes against the goal of SCA which is to minimize the spare capacity required. This paper focuses on the generic problem of multiple link failure problem, presents a formal definition for the problem, presents an interesting sub-problem and presents three different algorithms to address the sub-problem. It also lists future work items to be completed to address the overall problem of multiple link failures. For the purpose of this paper, we define multiple link failures as the failure of any two or more links, that do not necessarily belong to the same SRG, that occur simultaneously. We define the term simultaneously as the two or more failures occurring before the network has recovered from the previous failures i.e. the backup path for one failure is still being used when another failure occurs. Also, for purposes of this paper, we assume that the given link failure probabilities are independent. The rest of this paper is organized as follows. Section 2 presents a detailed problem definition for SCA in the context of multiple link failures and the sub-problem of determining the set of multiple link failures to be handled. Three different algorithms are presented and analyzed in Section 3. Section 4 lists the future work items that need to be completed to address the overall problem of multiple link failures. 2. Problem Definition This section first presents a formal definition for the problem of multiple link failures in SCA/survivability design. It then presents a formal definition of the subproblem of determining the set of multiple link failures that the algorithm needs to handle. Various SCA terminology and concepts are defined in Table 1. We slightly modify the problem definition previously presented (in [5] and [7]) as follows, to address the multiple link failure scenario in the network. The SCA problem can be formulated as an Integer Linear Programming problem as below (from [4]). Assume the following notation: The network is formulated as (N, L) N: Set of nodes. L: Set of directional links. D: Set of flows. M: is the set of identified simultaneous multiple link failures that need to be handled. M is of the form { (l a, l b, l c..l n ), (l x,l y l z ) } where each element represents a

3 multiple link failure scenario and each la, lb, is an element of L. n = N is number of nodes in the network. l = L is number of links in the network. m r : Traffic demand of flow r, r in D. w l : unit cost of bandwidth along link l. s l : spare capacity required along link l. x r,p : binary decision variable which is 1 if flow r uses p for backup. y r,p l : binary decision variable which is 1 if path p uses link l. P r : candidate set of loop-free backup paths that are linkdisjointed from a given working path. D f : set of flows affected by a multiple-link failure F, where F is an element of M. Term Failure scenario Linkoriented vs. pathoriented schemes Survivability level Network redundancy Failure dependency Table 1. SCA Terminology Description Represents all the simultaneously failed network devices or components. Restoration schemes can either handle restoration for individual links or for the entire end-end working path. Also related to this is the concept of path-oriented vs. spanoriented schemes for choosing the spare capacity to be allocated. The percentage of restorable network traffic upon a failure. The ratio of total spare capacity over total working capacity. In the naïve case, this is 1. The goal of protection planning algorithms is to minimize this ratio. In failure-dependent mechanisms, a different backup path can be chosen for different failures on a single working path. In failure-independent mechanism, only one backup path exists for a given working path and that path is always used irrespective of the failure in the working path. The latter requires a backup path that is link-disjoint from the working path. The objective of SCA is to minimize the total cost of spare capacity in the network this is given in equation (1). w l.s l min (1) s l, x r,p l in L This objective is subject to two constraints. Constraint (2) ensures that only one link-disjoint backup path is chosen for each flow, i.e. considering all candidate backup paths for flow r, the sum of all x r,p is 1. Since x r,p is a binary decision variable, this means exactly one instance is true and all others all false. p in P r x r,p = 1 V r in D (2) ( m s l >= r y r,p l.x r,p ) (3) r in D F p in P r V l in L, F c L, l not in F The second constraint is given in (3). It ensures that the spare capacity allocated for each link is the maximum bandwidth required under a previously identified simultaneous multiple link failure scenario. An interesting sub-problem arises which is the procedure for determining which multiple link failures the SCA algorithm must handle. Given a network topology and the flows in the network, it may be prohibitive in terms of network resources to be able to handle every combination of multiple link failures. Hence, we consider a new parameter that comes into play here the SLA guarantee provided by the network to its customers. This can be specified in terms of minimum percentage up-time for example, 80% or 99.99%. Depending on this, we can calculate the maximum failure probability in the network, that can be tolerated to meet the SLA. This probability is calculated as the reciprocal of the percentage up-time (given by SLA min ) - i.e. P max = 1/SLA min. For example, in case of 80% SLA guarantee up-time, P max is ; in case of 99.99% SLA guaranteed up-time, P max is Thus, the higher the SLA guarantee, the lower the maximum failure probability that can be tolerated in the network. We define the sub-problem as follows: Input: the network (N,L, F, SLA min ) where N is the set of nodes and L is the set of links, F is the set of failure probabilities for links in L, SLA min for the network. Output: the set M, each element of which is a set of links belonging to L which have a combined probability > P max for the network - i.e. each element in M represents a multiple link failure scenario that needs to be addressed by the SCA algorithm. The set M is of the form { (l a, l b, l c..l n ), (l x,l y l z ) } where each element represents a multiple link failure scenario and each la, lb, are elements of L. Solving this sub-problem is a significant step towards solving the overall problem of addressing multiple-link failures in a network. Since this sub-problem will output the network-specific set of multiple link failures,

4 dependent on the guaranteed SLA, the SCA algorithm will only need to address those specific failures and not all 3-link or all 4-link or all n-link failures which can be prohibitively expensive in terms of resources required. 3. Algorithms This section presents three different algorithms, each improving on the previous one in terms of computational complexity. Since failure probabilities of individual links are considered to be independent, the probability of multiple links failing simultaneously is given by calculating the product of the individual probabilities Algorithm 1 This section presents the straightforward naïve algorithm (ALGO1) to find the set M. Basically, it generates the P(F) the power set of F and computes the product (of failure probabilities) for each subset of P(F). 1. M ( the maximum number of simultaneous link failures) and M (the set of specific multiple link failures that need to be handled) are the outputs. 2. Let k range from 1 to l. 3. For each k, repeat the steps 4 to Generate the combinatorial set C which contains elements f F grouped together in k-member groups. Then C = lc k. For example, when k = 2, C is the set { (f 1, f 2 ), (f 1, f 3 ).. (f 1,f l ), (f 2, f 3 ), (f 2, f 4 ).. (f 2, f l ),... (f l-1, f l ) } In general, C = { (f i1, f i2.. f ik ) i 1 i 2 i 3 i k } V f i F Let each element in C be represented by c j. 5. Let j range from 1 to lc k. For each j, repeat steps 6 & For each cj = (f 1, f 2.. f k ), find its product P cj = f 1 x f 2 x x f k. This gives the probability of the links in set cj failing simultaneously. 7. If P cj > P max, then: o add c j to set M. M = M U {cj} o assign true -> max_hit 8. End of j loop. 9. If max_hit is false, then exit k loop. 10. End of k loop. 11. Output M and M. Figure 2. Naïve algorithm (ALGO1) It then compares this to the P max value of the network to build the set M. The algorithm is listed in Figure 2. The drawback for this naïve approach is that the space and time complexity for this algorithm is O(2 l ), or it requires exponential time and space. One optimization that could be done is as follows: When, for some value of i, there are no combinations of failures found such that its product is > P max, exit the k-loop. However, this still has worst-case complexity of O(2 l ) Algorithm 2 This algorithm is more sophisticated and intelligent than the one presented in 3.1 in terms of using the property of failure probabilities being < 1. If a set of link failure probabilities is less than P max, then multiplying it by any other link s failure probability will produce a value that is less than P max. 1. M (the set of specific multiple link failures that need to be handled) and M (the maximum number of simultaneous link failures) are output variables. 2. Assign F -> R. 3. Divide R into 2 subsets R1 and R2 such that elements in R1 are >= Pmax. Discard elements in R2 from R. i.e. R = R R2 or R = R1. 4. Empty R1 and R2. 5. Copy R into G. 6. Let k range from 2 to l. 7. For each k, repeat the steps 5 to R is a set with elements of the form (x1, x2 xk), i.e. the number of elements in this is k. 9. Let j range from 1 to R. 10. For each j, repeat steps 10 to 11. Let i range from 1 to G. 12. Take the element rj in R, gi in G, such that ri gi, form the set (x1, x2, xk, gi). If x1.x2 xk.gi >= Pmax, add it to R1. (Note: remember the previous product, so the entire product doesn t have to be computed everytime) 13. End of i-loop. 14. If R1 is empty, go to step End of j loop. 16. Add R1 to M. Assign R1 to R. 17. End of k-loop. 18. Output M and M. Figure 3. Algorithm 2 (ALGO2) Hence, once we have determined that a set of links do not need to be protected against, any superset of such

5 links also need not be protected. Figure 2 presents this algorithm (ALGO2). While this algorithm performs better than ALGO1 in the average case, its worst case performance is still O(2 l ) Algorithm 3 This algorithm builds on the idea presented in 3.2 using the fact that failure probabilities are less than Procedure Generate_Nodes (start: used for recursion, n: Number of elements in set, k: number of elements taken at one time, maxk: used for recursion, Input links set ). 2. If k > maxk, return ret_set. 3. For i = start to n 4. ret_set = ret_set U Generate_Nodes(i+1, n, k+1, maxk, set) 5. End of i-loop 6. End Procedure Generate_Nodes Procedure Check_Nodes (Upper end height u, Lower End height e, Height mid_row, Root node). 9. Nodes = Generate_Nodes( node, mid_row, node) 10. For i = 1 to lcmid_row, repeat steps Calculate H(node mid_row,i ). If node mid_row,i is marked, go to step Calculate combined failure probability pi of nodei. 13. If pi > Pmax, Mark H(node mid_row,i ) = vulnerable ; add node mid_row,i to M; tmp = mid_row; mid_row = (u+ i/2)/2; u = tmp. 14. If pi <=Pmax, Mark H(node mid_row,i ) = invulnerable ; tmp = mid_row; mid_row = (e + i/2)/2; e = tmp. 15. Call Check_Nodes(u, e, mid_row, mid_row, node mid_row,i ) 16. End of i-loop 17. End Procedure Check_Nodes Procedure Main 20. Call Check_Nodes(l, 1, l/2, L) 21. Output M and M. 22. End Procedure Main Figure 4. Algorithm 3 (ALGO3) i.e. Accordingly, we define the following terms: Vulnerable subset - a subset of links belonging to L is termed as vulnerable if the product of the failure probabilities of its individual links > Pmax; Invulnerable subset - a subset of links belonging to L is termed as invulnerable if the product of the failure probabilities of its individual links <= Pmax. It then follows that: all supersets of an invulnerable set are also invulnerable; all subsets of a vulnerable set are also vulnerable. Algorithm 3 (ALGO3) works on this basic observation. The algorithm is listed in Figure 4. It follows a dynamic programming [10] approach where the powerset P(L) is not generated up-front, but portions of it are methodically and selectively generated to determine the vulnerable subsets at each step that are incrementally added to set M. The algorithm works by processing selected nodes in a digraph where each node represents a subset of L. If a node at a given height in the digraph is found to be vulnerable, it is marked and added to the set M and all its progeny are ignored since they are also vulnerable. Then, the node s ancestors are examined by starting with the nodes in the middle row of its ancestry graph. A similar process is followed if the node is found invulnerable and its progeny nodes are examined. Thus at each step, half of the ancestor or progeny nodes are marked or ignored and only the other half is examined further. This is done recursively until a node that is already marked is encountered. When a node is marked as either vulnerable or invulnerable, a unique hash value is calculated for that node (by taking the individual link numbers represented in that node) and the decision is recorded in a hash table. Next time this node is encountered by the algorithm, the hash value is first calculated and the table is looked up to see if this node is already marked, indicating that its ancestor and progeny trees have been marked. If so, the algorithm does not further examine this node and moves on to the next node at the same height, thus optimizing the algorithm. H(node) in Figure 4 represents the hash value for node. As an optimization, subsets of vulnerable sets are not generated. If the multiple-link failure represented by a vulnerable subset is protected by the SCA algorithm, then the multiple-link failures represented by every subset of that vulnerable set are also protected. To better explain the algorithm, we use a digraph for illustration as shown in Figure 5. (The entire digraph is not generated upfront). The height of this digraph is l. At each level i (representing the height of a node), the nodes are generated by taking l elements i at a time i.e. the lc i. Bi-directed edges connect a node at level i to its subsets at height i-1 and to its supersets at height i+1. Hence, the following are true: At height i, the number of nodes = lc i. For a node at height i, the number of child nodes = i. For a node at height i, the number of parent nodes = l i. For a node at height i, the number of ancestor nodes = (l-i)c1 + (l-i)c2 + + (l-i)cl-i = 2 (l-i) - 1.

6 (i = 7) (i = 6) (i = 5) (i = 4) For a node at height i, the number of progeny nodes = ic(i-1) + ic(i-2) +. ic1 = 2 i Figure 4. Example (partial) digraph to illustrate ALGO3 The algorithm then works as follows. Taking the example of l = 7, we calculate mid_row =(7+1)/2 = 4. Hence, we first generate the 7C 4 = 35 nodes at height 4 in the digraph. For each of these 35 nodes, we repeat the loop shown in Figure. Taking the example of the first node at this height = ( ), we calculate its product of failure probabilities. If this is greater than Pmax, this node is marked Vulnerable. Assuming that this node is vulnerable, we ignore its progeny nodes from further examination since they are known to be vulnerable. We add the set ( ) to M and then start examining its ancestor tree. We calculate the next mid_row = ( )/2 = 6. Now, we generate the (l - i)c6 nodes at height 6 in the digraph that are. And for each node, we repeat the loop in Figure. Take the first node at height 6 ( ) and calculate its product of failure probabilities. If this is <= Pmax, this node is marked Invulnerable. Assuming that this node is invulnerable, we ignore its ancestors from further examination since they are known to be invulnerable. We then start examining its progeny tree by calculating mid_row = (6+4)/2 = 5 and generating the nodes at height 5 that are progeny of node ( ) Depending on whether this is vulnerable or invulnerable, we calculate the next mid_row = (6 + 5)/2. However, since this row has already been examined, we exit from the loop for this node and go on to the next node at height 4. Thus, at each jump, we either eliminate 2(l-i) or 2i nodes. 4. Future work This section lists the work items that need to be completed in order to address the overall problem of addressing multiple link failures in a network. First, the algorithm (ALGO3) presented in section 3.3 needs to be thoroughly tested (possibly by implementing) and its computational complexity needs to be precisely defined. The work that we have done so far suggests that the algorithm has a polylogarithmic time complexity. However, it needs to be analyzed in detail to accurately define this. Also, M may contain sets of links that are subsets of other sets in M. In such cases, the subsets can be coalesced into the larger supersets since protecting against multiple link failures represented by the superset will automatically protect against those represented by the subset. ALGO3 needs to be extended for this. Then, an existing algorithm needs to be found that is suitable for modification to address specific multiple link failures and the modifications need to be implemented. If such an algorithm cannot be found, a new algorithm that addresses specific multiple link failures needs to be formulated. Finally, the computational complexity of the resultant algorithm needs to be determined and if needed, further optimizations should be done. 5. Conclusion Spare Capacity Allocation is an important component of survivability design in networks. Survivability is especially significant in high-speed backbone networks employing MPLS technology which offer bandwidthguaranteed traffic. This paper has presented a brief survey of some existing approaches in current literature. It has then described open problems related to SCA and survivability and where possible, listed some possible solution approaches. 6. References [1] The MPLS Resource Center, [2] MPLS Beginner s Guide, [3] P.-H. Ho and H.T. Mouftah, A Framework for Service-Guaranteed Shared Protection in WDM Mesh Networks, IEEE Communication Magazine, February 2002, pp

7 [4] Y.Liu, D.Tipper, and P. Siripongwutikorn, Approximating optimal spare capacity allocation by successive survivable routing, Proceedings of IEEE INFOCOM, April 2001, pp [5] P.-H. Ho and H. T. Mouftah, "Reconfiguration of Spare Capacity for MPLS-Based Recovery in the Internet Backbone Networks", IEEE/ACM Transactions on Networking, February 2004, pp [6] M. Kodialam and T. Lakshman, "Dynamic Routing of Bandwidth Guaranteed Tunnels with Restoration", Proceedings of IEEE INFOCOM, April 2000, pp [7] D. Srinivasan, Design of Protection Planning Algorithms in MPLS Networks with Bandwidth Guarantees to Minimize Spare Capacity Allocation, North Carolina State University, [8] K. Miyazaki, T. Chujo, H. Komine, T. Ogura, Spare Capacity Assignment for Multiple-Link Failures, Proceedings of International Workshop on Advanced Communications and Applications for High Speed Networks, March 1992, pp [9] B. G. Jozsa, D. Orincsay and A. Kern, Surviving Multiple Network Failures Using Shared Backup Path Protection, Proceedings of IEEE International Symposium on Computers and Communications, June 2003, pp [10] T. H. Cormen, C. E. Leiserson, R. L. Rivest, C. Stein, Introduction to Algorithms, 2 nd Edition, Published by MIT Press, 2001, ISBN

8 This document was created with Win2PDF available at The unregistered version of Win2PDF is for evaluation or non-commercial use only.