On the Feasibility and Efficacy of Protection Routing in IP Networks

Transcription

1 University of Pennsylvania ScholarlyCommons Departmental Papers (ESE) Department of Electrical & Systems Engineering On the Feasibility an Efficacy of Protection Routing in IP Networks Kin-Wah (Eric) Kwong University of Pennsylvania, Lixin Gao University of Massachusetts - Amherst Roch A. Guérin University of Pennsylvania, guerin@acm.org Zhi-Li Zhang University of Minnesota - Twin Cities Follow this an aitional works at: Part of the Digital Communications an Networking Commons, an the Theory an Algorithms Commons Recommene Citation Kin-Wah (Eric) Kwong, Lixin Gao, Roch A. Guérin, an Zhi-Li Zhang, "On the Feasibility an Efficacy of Protection Routing in IP Networks",. December Copyright 200 IEEE. Reprinte from: Kin-Wah (Eric) Kwong, Lixin Gao, Roch A. Guérin, Zhi-Li Zhang. On the Feasibility an Efficacy of Protection Routing in IP Networks. Proceeings of the IEEE 200 Conference on Computer Communications (INFOCOM 200), San Diego, CA, March 200 This material is poste here with permission of the IEEE. Such permission of the IEEE oes not in any way imply IEEE enorsement of any of the University of Pennsylvania's proucts or services. Internal or personal use of this material is permitte. However, permission to reprint/republish this material for avertising or promotional purposes or for creating new collective works for resale or reistribution must be obtaine from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this ocument, you agree to all provisions of the copyright laws protecting it. This paper is poste at ScholarlyCommons. For more information, please contact repository@pobox.upenn.eu.

2 On the Feasibility an Efficacy of Protection Routing in IP Networks Abstract With network components increasingly reliable, routing is playing an ever greater role in etermining network reliability. This has spurre much activity in improving routing stability an reaction to failures, an rekinle interest in centralize routing solutions, at least within a single routing omain. Centralizing ecisions eliminates uncertainty an many inconsistencies, an offers ae flexibility in computing routes that meet ifferent criteria. However, it also introuces new challenges; especially in reacting to failures where centralization can increase latency. This paper leverages the flexibility affore by centralize routing to aress these challenges. Specifically, we explore when an how stanby backup forwaring options can be activate, while waiting for an upate from the centralize server after the failure of an iniviual component (link or noe). We provie analytical insight into the feasibility of such backups as a function of network structure, an quantify their computational complexity. We also evelop an efficient heuristic reconciling protectability an performance, an emonstrate its effectiveness in a broa range of scenarios. The results shoul facilitate eployments of centralize routing solutions. Keywors network, routing, protection, stanby Disciplines Digital Communications an Networking Theory an Algorithms Comments Copyright 200 IEEE. Reprinte from: Kin-Wah (Eric) Kwong, Lixin Gao, Roch A. Guérin, Zhi-Li Zhang. On the Feasibility an Efficacy of Protection Routing in IP Networks. Proceeings of the IEEE 200 Conference on Computer Communications (INFOCOM 200), San Diego, CA, March 200 This material is poste here with permission of the IEEE. Such permission of the IEEE oes not in any way imply IEEE enorsement of any of the University of Pennsylvania's proucts or services. Internal or personal use of this material is permitte. However, permission to reprint/republish this material for avertising or promotional purposes or for creating new collective works for resale or reistribution must be obtaine from the IEEE by writing to pubs-permissions@ieee.org. By choosing to view this ocument, you agree to all provisions of the copyright laws protecting it. This conference paper is available at ScholarlyCommons:

3 On the Feasibility an Efficacy of Protection Routing in IP Networks Kin-Wah Kwong, Lixin Gao, Roch Guérin, an Zhi-Li Zhang University of Pennsylvania, University of Massachusetts, University of Minnesota Abstract With network components increasingly reliable, routing is playing an ever greater role in etermining network reliability. This has spurre much activity in improving routing stability an reaction to failures, an rekinle interest in centralize routing solutions, at least within a single routing omain. Centralizing ecisions eliminates uncertainty an many inconsistencies, an offers ae flexibility in computing routes that meet ifferent criteria. However, it also introuces new challenges; especially in reacting to failures where centralization can increase latency. This paper leverages the flexibility affore by centralize routing to aress these challenges. Specifically, we explore when an how stanby backup forwaring options can be activate, while waiting for an upate from the centralize server after the failure of an iniviual component (link or noe). We provie analytical insight into the feasibility of such backups as a function of network structure, an quantify their computational complexity. We also evelop an efficient heuristic reconciling protectability an performance, an emonstrate its effectiveness in a broa range of scenarios. The results shoul facilitate eployments of centralize routing solutions. I. INTRODUCTION Intra-omain routing in IP networks has traitionally relie on istribute computations among routers, with the concatenation of iniviual forwaring ecisions eventually resulting in packet elivery. In spite of their inherent aaptability an scalability, istribute computations can make troubleshooting harer, because of the many sources of inconsistencies they allow. This has renewe interest in centralize routing solutions [4], [6], [2] for IP networks, at least in settings where scalability is less of a concern, e.g., intra-omain routing. Centralizing ecisions not only guarantees full visibility into the forwaring state of iniviual routers (now essentially cheap forwaring engines or FEs), it also affors ae flexibility in computing paths that meet ifferent requirements. In spite of its avantages an even when scalability is not an issue, centralizing ecisions has isavantages. Of particular concern for reliability is latency in reacting to failures, i.e., the central server nees to be notifie, react to the failure, an communicate upate forwaring information to all affecte FEs. This can result in non-negligible gaps after failures, uring which FEs have no vali forwaring states for some estinations, an translate into substantial packet losses. A natural approach to the problem is through preventive mechanisms, e.g., by having the central server pre-compute This work was supporte by NSF grants CNS , CNS , an CNS forwaring ecisions for common (most) failure scenarios, an pre-loa those in the FEs so that upate forwaring state is locally available. However, even such solutions have their limitations. For one, the sheer volume of alternate forwaring states across failure scenarios will likely require that it be store in slow memory to keep costs low. As a result, upating ata path forwaring tables coul take time. More importantly, even if the central server oes not have to ownloa upate forwaring state, it remains responsible for coorinating when an which FEs switch-over to the new state. As iscusse in [3], failure to o so can introuce forwaring loops, whose effect can be worse than failures. Ensuring uninterrupte (or minimally interrupte) packet forwaring in the presence of failures remains, therefore, a significant challenge in centralize routing systems. Our goal in this paper is to explore a possible solution to this problem, an in the process take centralize routing one step closer to offering an effective alternative for intra-omain routing. Furthermore, because a corollary of centralize routing is simplifie FEs, we seek to realize this goal with no or minimal impact on ata plane complexity. In particular, we want to avoi either encapsulation-base solutions that require aitional packet manipulations, as well as packet marking an interface specific forwaring solutions that often call for significant expansion to the size (an therefore cost) of forwaring tables. Instea, our goal is to allow all (most) FEs to have, for each estination present in their forwaring tables, a pre-configure next-hop to which packets for that estination can be forware in case of failure of the primary next-hop(s). The trigger to switch to backup forwaring is entirely local (i.e., unavailability of the primary next-hop(s)), an forwaring loops shoul be preclue. In other wors, we consier an IP network where (intraomain) routing is uner the responsibility of a central server, so that routers (FEs) are only responsible for (estinationbase) packet forwaring. Because of the use of a central server, path computation is not restricte to shortest paths base on a common set of link weights. Instea, each estination prefix is associate with an inepenently compute (primary) forwaring tree (more generally a irecte acyclic graph, or DAG), roote at the egress noe associate with the estination. Our goal is then to compute a set of primary routing trees (or DAGs), one for each estination, so that all

4 noes in the tree, or when not feasible as many noes as possible, have a stanby alternate next-hop available when the primary next-hop becomes unreachable. We term such a routing, protection routing, an introuce it more formally in Section III. Protection routing is reaily realize when each noe in the DAG has two or more inepenent nexthops towars the estination, e.g., as sought in [8], [4]. Its simplicity not withstaning, this is easily shown not to be simultaneously feasible for all noes (at least one noe is limite to only one next-hop). Furthermore, it ignores the option for two noes to mutually protect each other, an exploring the benefits this affors is one of the motivations for this paper. In aition, while stanby protection to failures is esirable, its impact on operational performance shoul also be accounte for. Incorporating this aspect when computing protection routing is another goal of the paper. The concept of protection routing as just efine bears similarities with a number of relate concepts, an we expan on this in Section II. The paper nevertheless makes a number of novel contributions an in particular: ) It offers new insight into network topological properties that ensure the feasibility of protection routing; 2) It establishes that computing a protection routing is an NP-har problem; 3) It evelops a heuristic for computing a routing that reconciles the often conflicting goals of protectability an performance; 4) It emonstrates the heuristic s ability to realize an effective trae-off between protectability an performance across a range of network topologies. The rest of the paper is structure as follows. Section II reviews relate works an contrasts the approach an finings of the paper against them. Section III introuces the concept of protectability more formally an efines protection routing. Section IV is evote to an analytical investigation of protection routing, while Section V leverages insight from this analysis to evelop a heuristic for computing protection routings. The heuristic favors protectability, while trying to minimize its impact on performance. The unerlying traeoff is further investigate in Section VI, which evelops a moifie heuristic that allows relaxe protectability goals for the sake of improving performance. Section VII evaluates the efficacy of the heuristics in several ifferent scenarios, an Section VIII summarizes the paper s finings. II. RELATED WORKS This paper consiers a centralize routing system similar to that propose in [4], [6], [2]. In those works, the primary motivation for centralizing path computation was manageability. In [3], an efficient message-issemination solution was propose to minimize signaling overhea an avoi the formation of transient loops in such an environment. This paper buils on these earlier works by assuming a centralize It is easy to construct network graphs for which no matter what routing is chosen, one or more noes have no alternate next-hop. routing solution, but iffers in its focus. Its aim is to overcome problems associate with the potential for increase latency after failures, because of the system s reliance on a central server responsible for coorinating upates to the forwaring states of FEs. Our motivations an general approach for hanling this issue are similar in principle to those behin many of the IP fast re-routing (IPFRR) schemes that have been propose (see [9] for a generic introuction to IPFRR an its goals). We expan below on specific ifferences between our solution an iniviual IPFRR mechanisms, but an important contributor to those ifferences comes from our ability to exploit the flexibility affore by centralize path computations to prouce routing solutions that are ifficult, if not impossible, to realize in the traitional, istribute environment assume by most IPFRR solutions. IPFRR s main goal is to ensure fast (sub-50ms) convergence of intra-omain routing protocols, as soon as failures have been etecte. Current proposals fall in either one of two categories: those that can operate with an unmoifie IP forwaring plane; an those that involve the use of a ifferent (usually more complex) forwaring paraigm. The former category is the more relevant to this paper, which also seeks to offer protection to failure while preserving the simplicity an scalability of IP forwaring. In particular, one of our goals is to maximize the fast re-routing coverage achievable in any network by taking avantage of the flexibility of centralize routing in computing paths an controlling local forwaring ecisions at each FE. Examples of IPFRR mechanisms belonging to the first category inclue Loop-free alternate (LFA) [], [8], [6], [5], DIV-R [4] an MARA [2]. The LFA proposal of [] is aime primarily at IP networks that run istribute, shortest-path-base routing algorithms. Furthermore, it relies on a criterion for ensuring loop freeom when selecting nexthop alternates (backups) (see [][Inequality ]) similar to the invariant of [4]. As allue to earlier, imposing such a requirement prevents neighboring noes from backing each other up (the criterion enforces an orering among noes, so that only one is eligible as a backup for the other). Both factors limit the coverage that the scheme is able to provie. This limitation is not present in [8], which is not restricte to using shortest paths an that introuces the concept of joker links specifically for the purpose of allowing mutual backups. These similarities make the boy of work [8], [6], [5] the most relevant to this paper, an it is, therefore, important to articulate ifferences in both scope an contributions. shares with this paper its applicability to (or more precisely, nee for) a centralize routing system, an the goal of maximizing the number of noes that are protecte against any single link or noe failure. In, this is realize by ensuring that every noe has an out-egree (number of nexthops) of two - hence the name - with one of them available as a backup in case of failures. This is similar to our goal as state in Section I, with the ifference that we o not seek to impose a limit of two on the out-egree, an will often allow more, especially when trying to reconcile the nee for loa-

5 balancing with protectability. As a matter of fact, exploring the trae-off that exists between protectability an performance is one of the important ifferences between our work an. This ifference is further reflecte in the path computation algorithm we propose to jointly optimize protectability an performance. We emonstrate in Section VII the benefits of our algorithm in terms of both performance an protectability, when compare to algorithms [5]. Another ifference between our work an the contributions is our focus on ientifying specific conitions for the feasibility of a protection routing, an conversely the complexity of fining one when it exists. In particular, we formally establish in Section IV that the problem of computing a protection routing is NP-har, an provie several characterizations of network topology that affect the feasibility of protection routing. The DIV-R algorithm of [4] an the several MARA algorithms of [2] have similar goals as an this paper, but iffer in their approaches. DIV-R proposes a istribute algorithm to maximize a metric that reflects the number of next-hops available to each noe. This may be effective against link failures, but as shown in Section VII, less so when consiering noe failures. The MARA algorithms consier several path computation problems aime at improving minimum connectivity an fully utilizing all available links; hence afforing greater resilience to failures (MARA s all-toone maximum connectivity problem is the most relevant, an similar in spirit to DIV-R). As with DIV-R, protection against noe failures is not explicitly taken into account an neither is the trae-off between performance an protectability. The secon category of IPFRR works inclues [22], [7], [20], [0], which seek to eliver protectability irrespective of network topological limitations at the cost of possible changes to packet forwaring. For example, [22] consiers the use of interface-specific forwaring tables to hanle packet re-routing after failures while preventing loops. Multiple topologies are use in [7], each covering ifferent failures, with routers switching from one to another upon etecting a given failure an marking packets accoring to the topology to be use to overcome it. In [20], protection is achieve by using tunnels to etour packets aroun failures; hence requiring packet encapsulation an ecapsulation. Finally, [0] proposes carrying root-cause failure information in packets to allow routers to iagnose problems an select alternate paths. III. MODEL AND OBLEM FORMULATION We moel the network as a irecte graph G = (V,E), with V the noe set, E the link set, an V = n. A irecte link from noe i to noe j is enote by (i,j). N G (i) = {j V (i,j) E} is the neighbor set of noe i in G. As iscusse in Section I, we assume that information such as network topology an link banwith is available to a central server for the purpose of path computation. We further assume that packet forwaring is estination-base without reliance on packet marking or encapsulation even in the presence of failures, i.e., the stanar IP forwaring paraigm. For a estination 2 V, let R = (V,E ) be a routing for traffic estine to, where E E. R is a irecte acyclic graph (DAG) roote at an efines a estinationbase routing. In R, every noe i V \ {} has at least one outgoing link. A noe j is calle a primary next-hop (PNH) of noe i if (i,j) E, an the link (i,j) is calle a primary link of noe i. If a noe has multiple PNHs, traffic is split evenly across them. One avantage of centralize routing is that R s can be compute inepenently of each other. In contrast, a stanar IGP such as OF computes routings that are couple by a common set of link weights. Thus, without loss of generality, in the remainer of this section we focus on a single estination. When computing R, our goal is to preserve uninterrupte packet forwaring in the presence of any single component (link or noe) failure, except for that of itself. Definition 3.: After a single component failure f, the resulting network an routing for estination are enote by G f an R f, respectively. Gf an R f are constructe by removing the faile component (noe an/or link(s)) associate with f from G an R respectively. Definition 3.2: Noe i is sai to be upstream of noe j in a routing R if there exists a path from noe i to noe j in R. Conversely, noe j is then ownstream of noe i. Definition 3.3: In a routing R, noe i is sai to be protecte (with respect to ), if after any single component failure f that affects noe i s PNH(s), there exists a noe k N G f (i) such that the following two conitions are satisfie: ) Noe k is not upstream of noe i in R f. 2) Noe k an all its ownstream noes (except ) have at least one PNH in R f. Noe k is calle a seconary next-hop (SNH) of noe i for f an. By convention, estination is always protecte. Definition 3.3 is inspire by LFA but oes not manate the use of shortest paths, nor oes it require [][Inequality ] to prevent loops. The two conitions of Definition 3.3 imply that when the PNH of noe i fails an packets are reroute to noe k: (i) routing loops never form (conition ()); an (ii) packets are elivere to through noe k an its ownstream noes in R f (conition (2)). Examples illustrating the feasibility or infeasibility of these conitions are provie in Section III-A. Definition 3.4: R is sai to be a protection routing if every noe i V is protecte in R. Definition 3.5: A graph G = (V, E) is sai to be protectable if a protection routing exists V. By Definition 3.4, if R is a protection routing, packet forwaring (an elivery) to can procee uninterrupte in the presence of any single component failure (besies that of itself). The main challenges are in ientifying when such routings are feasible, an in computing them, or when not feasible, computing routings that maximize the number of protecte noes. We iscuss these in Sections IV, V, an VI, but procee first with some illustrative examples. 2 For simplicity, we associate each noe with a single estination, while in practice this woul encompass all prefixes for which a noe is the egress.

6 (a) Fig.. A. Discussion (c) (b) () Different R s (enote by arrows) of a network. Fig. illustrates on a simple network topology how ifferent routing choices affect protectability for a estination. The routing of Fig. (a) oes not protect noes, 2, 3 an 6 uner Definition 3.3. For example, although noe has two PNHs, it is not protecte against a failure of noe 2. This is because its other PNH, noe 4, is itself upstream of the faile noe 2 (this violates conition (2) of Definition 3.3). Similarly, noe 6 is not protecte against a failure of link (6,), as its two neighbors, noes 4 an 5, are both upstream of itself (this violates conition () of Definition 3.3). The routing of Fig. (b) succees in protecting noe 6 against the failure of link (6,), because noe 5 is now a vali SNH. However, accoring to conition (2) of Definition 3.3, noe is still not protecte against a failure of noe 2, as even if noe 4 now has a PNH (i.e., noe 6) that oes not rely on noe 2, it will still forwar some packets estine to towars noe 3 (noe 4 is unaware of the failure of noe 2 an loabalances across its two PNHs) that remains unprotecte. This last issue is resolve in Fig. (c), where all noes are now protecte. Note that to ensure protectability, more links are left unuse uring normal operations, so that they are available for mutual backups after failures. This illustrates the tension that exists between performance an protectability, an is one of the issues we explore further in Sections VI an VII. Fig. () illustrates a subtle issue that arises from the choice of conitions in Definition 3.3, an in particular conition (2) that calls for backup paths to only use PNHs. Fig. () gives an example of a routing that noe 2 is not protecte accoring to Definition 3.3, but that is still able to eliver packets to after a failure of noe 5. This is because, when noe 5 fails, noe 2 forwars packets to its SNH, noe 3, which passes them to its PNH, noe 4. Noe 4 s PNH, however, was also noe 5, so that it must also forwar packets to its own SNH, noe 6, which fins itself in a similar situation an forwars packets to its own SNH, namely,. This oes ensure elivery of packets to, but violates conition (2) of Definition 3.3. An intuitive fix might seem to simply relax conition (2) to allow packet forwaring using both PNH an SNH. This is unfortunately not possible, as such a relaxation coul allow the formation of loops. In general, instances where backup paths such those of Fig. () improve protectability appear to be limite. Furthermore, systematically exploring them can a significant computational complexity, as all possible combinations of PNHs an SNHs nee to be consiere. Section V-D introuces a compromise base on an algorithm that iterates over possible SNH assignments once a choice of PNHs has been finalize, an allows the iscovery of paths such as those of Fig. (). IV. ANALYSIS In this section, we moel a network as an unirecte graph G = (V,E), so that fining a protection routing is equivalent to ientifying an orientation for a subset of links such that every noe is protecte, i.e., an orering among noes that makes re-routing possible without creating loops. Its existence epens on routing choices an the topological structure of the network. The goal of this section is to analyze what topological properties are sufficient to ensure protectability an characterize the algorithmic complexity of fining it. Due to space limitations, all proofs are in [9]. Graph terminology not efine in the paper can be foun in [3]. A. Does a simple sufficient conition exist? We first consier the existence of sufficient conitions for protectability. A necessary conition for a graph to be protectable is for every noe to have two neighbors. Thus, it is natural to ask if the noe egree of a graph can be use to characterize protectability. A simple sufficient conition for a graph to be protectable is as follows. Theorem 4.: Every graph with n 5 noes an minimum egree at least n/2 is protectable. Theorem 4. cannot be improve in that we cannot replace the boun of n/2 with n/2, as there exists a -noeconnecte graph 3 with minimum egree n/2, which is obviously not protectable. Theorem 4. implies that in the absence of any global graph property, a high minimum egree is neee to guarantee protectability. A natural next step is to explore if introucing global graph properties such as link- an noe-connecteness can yiel less stringent sufficient conitions for protectability. Intuitively, k-link-connecteness, for k large enough, woul seem sufficient to ensure protectability. Surprisingly, this is not true in general, no matter how large k is. The result is summarize as follows. Theorem 4.2: For any given k Z +, there exists a k-linkconnecte graph that is unprotectable. Theorem 4.2 establishes that even with arbitrarily many link-isjoint paths, a protection routing is not guarantee to exist. A similar question can be aske using the stronger conition of noe-connecteness. In this setting, we only have the weaker result of Theorem 4.3 an a conjecture as follows. 3 If n is o, such a graph can be constructe by taking the union of two copies of complete graph K n/2 connecte at one noe.

7 Theorem 4.3: For k = 2,3, there exists a k-noe-connecte graph that is unprotectable. Conjecture 4.: For any given k 4, there exists a k-noeconnecte graph that is unprotectable. The reason the relatively strong properties of Theorems 4.2 an 4.3 fail to ensure protectability is because estinationbase routing inuces an orering among noes; something that is not present when, for example, computing noe-isjoint paths. Hence, even if each noe iniviually has several isjoint paths to a estination, this nee not hol when coupling them through a common estination-base routing. B. On ranom graphs The previous results showe that even graphs with very rich connectivity, e.g., large egree or connecteness, were not guarantee to be protectable. However, the proofs of these results involve graphs with very specific structure. A natural question is whether such graphs are the norm or the exception. To explore this question, we rely on a family of graphs with little or no special structure, i.e., ranom graphs, an investigate what can be sai about their protectability. We use Erös- Rényi ranom graphs G(n, p), where n enotes the number of noes an p is the link probability, an analyze uner what conitions such graphs are protectable as n becomes large. This calls for fining routings for each estination such that all noes have a suitable SNH to reroute traffic after failures. The ranom an relatively homogeneous structure of ranom graphs makes it possible to establish the following result. Theorem 4.4: Let G G(n,p) an p = (4 + ε) log n/n where ε > 0 is any constant an log is the natural logarithm. Then asymptotically almost surely G is protectable. Theorem 4.4 implies that a mean egree that grows like O (log n) is sufficient to ensure that a ranom graph is protectable with probability tening to as n. In other wors, in the absence of structure explicitly aime at efeating it, the level of connectivity require to ensure protectability is significantly lower than that require by Theorem 4.. Although ranom graphs are not representative of all network topologies, this provies some hope that protectability is feasible in many practical networks with reasonable connectivity. The next section is evote to assessing how ifficult a task computing such protection routings is. C. NP-completeness of protection routing This section analyzes the algorithmic complexity of computing a protection routing. For that purpose, we formulate the problem as follows. Instance: Given an unirecte graph G = (V,E) an a estination noe V. Question: Does a protection routing estine to exist? Theorem 4.5: The problem is NP-complete. Theorem 4.5 inicates that in an arbitrary graph there is no known polynomial-time algorithm to solve the problem unless P=NP. The proof (see [9]) is base on a reuction from the 3SAT problem. Heuristics are, therefore, require to compute protection routings. V. HEURISTIC DESIGN Our goal is to compute n routings (one for each estination) to maximize protectability while realizing goo network performance (e.g., congestion) in normal (failure-free) situations. Computing a routing to minimize the number of unprotecte noe for a estination is NP-har because the ecision version of the problem is NP-complete. Because all n routings contribute to link loas, aing the imension of performance introuces a coupling that only makes the problem harer. Practical solutions must, therefore, rely on heuristics. A. Heuristic outline Our heuristic seeks routings R, V, that minimize the number Ω of unprotecte noes for their respective estination, an that together minimize network congestion in the absence of failure. Network congestion is measure through a cost function Φ. For illustration purposes, we select the function Φ = l E Φ l of [5], where Φ l enotes the congestion cost of link l as a function of its loa. Other expressions for Φ can be reaily use. To keep computational complexity low an preserve the ability to inepenently compute routings that minimize Ω for each V while accounting for performance (congestion), we esign a two-phase heuristic. Phase allows inepenent computations of protection routings for each estination, while Phase 2 consiers them jointly an attempts to moify them to optimize performance without hurting protectability. B. Phase - Greey search Phase uses a greey search with a cost function F, V, that focuses on Ω but remains congestion aware. Congestion is not explicitly accounte for in F to preserve inepenent computations across estinations. It is use to influence the greey exploration of the solution space. Specifically, prior to Phase, a stanar traffic optimization routine, e.g., [5], is run to assess the best network congestion cost Φ opt in the absence of protectability consierations. This provies routings, R opt, V, that achieve Φopt, as well as a benchmark against which to compare network congestion costs uner protection routing. Each routing R opt can be compute using a shortest path algorithm with appropriate link weights. These link weights are use in Phase to compute a eviation R R opt between a propose protection routing R an R opt. This eviation is measure4 using Γ = i V Γ i,, where Γ i, enotes the istance from noe i to estination uner R, with istances compute using the link weights of R opt. The smaller Γ, the closer R is to R opt. This metric guies the selection of solutions uring Phase as follows. The cost function F is efine as F = Ω,Γ where a,b > a 2,b 2 if an only if a > a 2, or a = a 2 an b > b 2. This gives preceence to protectability, while favoring solutions with lower congestion costs (as measure through 4 Other measures can easily be accommoate.

8 Γ ) when it oes not affect protectability. The optimization carrie out in Phase is then of the form V minimize R F = Ω,Γ. () Note that although Γ in F accounts for congestion, computations for ifferent estinations are still ecouple. This is because Γ is compute base on a fixe reference point (i.e., the link weights that prouce R opt ). This also avois evaluating the cost function Φ for each caniate routing, an operation that in itself has a significant computational cost. A Greey-search heuristic (see [9] for etails) is use to minimize Eq.. It was inspire by approximation algorithms for the 3SAT problem from which the NPC of the problem is reuce, an operates on routings limite to trees (i.e., each noe except the estination has only one PNH). There are two motivations for the latter. First, assigning multiple PNHs to a noe may affect the protectability of other noes as iscusse in Section III-A. Secon, the sheer number of possible combinations involving multiple PNHs makes it computationally impractical to consier them all. Allowing multiple PNHs can obviously reuce congestion through better loa-balancing. This aspect is consiere separately in Phase 2. The heuristic starts with an initial routing R = T ( R opt ) obtaine by extracting a tree from R opt (when multiple nexthops are available, one is ranomly selecte). The main loop uses local feasibility checks to explore improvements in F when swapping the PNH of noe i V \ {}. This process repeats until F shows no improvement for all noes. A iversification step is then execute, an generates a new ranom shortest path tree roote at. Unlike the first tree base on R opt, the new tree is generate using ranom link weights uniformly selecte in [, 000]. This ensures that after exploring the neighborhoo of R opt, the search restarts at a ifferent point of the solution space 5. The heuristic stops after P iversifications without improvement to F. C. Phase 2 - Loa-balancing The routing trees R, V, of Phase are use as inputs to Phase 2. Phase 2 seeks to assign multiple PNHs to noes to better istribute traffic (loa-balance), subject to the constraint that the number of unprotecte noes cannot increase. Its main loop (see again [9] for etails) examines each noe i in ecreasing orer 6 of its congestion, an tries to assign it multiple PNHs to better loa-balance traffic an reuce its congestion cost. Note that Phase 2 involves evaluating Φ for each caniate routing, an this is where the bulk of its computational cost lies. The heuristic stops when Φ cannot be further reuce through new PNH assignments. D. SNH assignment The first two phases of the heuristic prouce a set of routings that maximize the number of protecte noes while minimizing congestion cost by loa-balancing across multiple PNHs, as long as it oes not affect protectability. By efinition of protectability, all protecte noes have at least one SNH they can use in case of failure to forwar packets on an alternate path that elivers packets to the estination solely through PNH forwaring. As iscusse earlier, the restriction to PNH forwaring impose by Definition 3.3 preclues backup paths involving multiple SNHs, which coul improve protectability. Allowing such paths, however, requires some care to avoi loops. In this section, we escribe an algorithm that assigns SNH (when a choice is available) to allow backup paths involving multiple SNHs, while ensuring the absence of loops. The algorithm is outline for a given with etails in [9]. R = (V,E ) enotes the routing for prouce by Phases an 2, where E E is the set of primary links. After failure f, R f = (V f,e f ) enotes the resiual routing after removing the faile component(s). Let S f : V V { } enote the SNH assignment mapping for failure f, with S f (i) V { } the SNH assigne to noe i. An empty assignment, i.e., S f (i) =, implies that there is either no nee to assign an SNH to noe i because its PNH is not affecte by f, or no suitable SNH can be foun. Our goal is to explore SNH assignments that maximize protectability when allowing backup paths that involve multiple SNHs. ) Let H f (V = f,e f i V,S f (i) (i,sf (i)) be a routing uner failure f. Note that H f combines Rf an Sf, an hence permits the use of multiple SNHs. This calls for aitional precautions when assigning SNHs. Specifically, assume that noe k is a caniate SNH for noe i after failure f. Noe k can be selecte if the following two conitions are satisfie: (H) H f remains a DAG after the aition of link (i,k); (H2) Noe k an all its ownstream noes (except ) have an outegree of at least one in H f. Conition (H) ensures that loops are avoie, while Conitions (H) an (H2) together guarantee packets elivery to. Using these two conitions, SNHs can be assigne (again, see [9] for etails) to improve protectability of noes affecte by failure f an with initially (after Phases an 2) no feasible SNH, i.e., S f (i) =. This continues until no SNH assignment satisfying conitions (H) an (H2) is foun. Note that the fact that PNHs remain fixe is in part what keeps computational complexity manageable. VI. TRADING OTECTABILITY FOR PERFORMANCE The cost function F gives strict preceence to protectability. A natural question is whether this can be relaxe to traeoff protectability for performance. Such a trae-off can be formulate using the following optimization: 5 Other iversification methos were trie, e.g., shuffling a subset of PNHs in the tree, generating increasingly perturbe versions of R opt, etc. The more iverse starting points of a ranom iversification consistently resulte in a better exploration of the solution space. 6 Other orers, e.g., ranom, fixe, were trie an foun to perform worse. subject to minimize R, V Φ (2) Ω ( + ε ) Ω V (3)

9 where Ω enotes the smallest possible number of unprotecte noes for estination, an ε 0 controls how much protectability can be trae-off for performance. In realizing such a trae-off, computational complexity is again the main concern. Our propose solution is base on two observations: (i) computing Ω, V, as require by Eq. 3, calls for performing Phase ; an (ii) a large number of routings are examine uring Phase. A natural option is to take avantage of the availability of those routings. Specifically, we keep all routings examine uring Phase, an at the en of Phase we ientify those that satisfy Eq. 3. We then select for each estination, the routing that minimizes Γ. Those routings can subsequently be further improve by invoking Phase 2. This approach leverages the computational tractability of the previous heuristic (it has the same computational complexity, an avois most expensive computations of the cost function Φ), an the aitional memory it requires to store the routings examine uring Phase is relatively small. Intelligently iscaring routings whenever they fail to satisfy Eq. 3 base on the current estimate of Ω can further reuce this memory. VII. EVALUATION This section assesses the extent to which our heuristic can fin efficient protection routings, an explores the trae-off between performance an protectability. It starts with a review of the environment in which this evaluation is conucte. A. Evaluation settings ) Network topologies: Both real an synthesize topologies are use. RN: Ranom topology of given average noe egree. PL: Power-law topology base on the preferential attachment moel [2]. AS: Real topologies from the Rocketfuel project [7] an labele by their AS numbers 7. Link capacities are all set equal to unity with traffic eman (see below) use to generate heterogeneous loa levels because heterogeneous loas can be generate either by varying traffic eman or link capacity. 2) Traffic matrix: The traffic matrix M = [r (s,t)] V V is generate using a gravity moel [8], [] as follows: Traffic volume from noe s to noe t is efine as r (s, t) = e b a t s Pi V where b \{s} ea i s is the total traffic originating at noe s, an is given by Uniform(0, 50), with prob (4a) b s = Uniform(80, 30), with prob 0.35 (4b) Uniform(50, 200), with prob 0.05 (4c) Uniform(a, b) enotes a ranom variable uniformly istribute in [a,b], a t is the mass of noe t which is proportional to the number of links it has an i V a i =. The larger a noe s mass, the more traffic it attracts. Using b s, it generates three ifferent levels of heterogeneous loa. Finally, M is scale to prouce a reasonable link utilization in the network. 7 Noes isolate from the giant component are remove. 3) Heuristic setting: Our heuristic involves only one parameter, P, use as the stopping criterion of Phase. We set P = 0, so that Phase is stoppe if there is no improvement after 0 iversification rouns. This value was chosen as it balances solution quality an computational time in our experiments. 4) Comparison: We use the propose two-phase heuristic an the SNH assignment algorithm to compute protection routing solutions, an the results are enote by. Our solutions are compare to the following previous works: : Routings compute by the OF optimization in [5]. : Routings compute by DIV-R from [4]. : Routings compute by the pattern-base algorithm 8 of [5]. We believe that this provies a reasonable coverage of both the heuristic s performance across ifferent networks, an its comparison to other alternatives. is commonly use for intra-omain routing in large I s, e.g., [], an focuses solely on performance., like [2], seeks to maximize the number of PNHs at each noe but without consiering the use of SNHs after failures. optimizes for protectability, but is oblivious to performance. In the experiments, a noe is sai to be protecte with respect to a estination if it has a vali re-routing option for that estination after any single component failure. B. Benefits of protection routing We first investigate the effectiveness of on synthesize topologies with mean egree varying from three to five. Fig. 2 shows the numbers of protecte noes across estinations, with the x-axis showing estination IDs sorte in ascening orer of the number of protecte noes uner. The results illustrate that significantly improves protectability when compare to other solutions. Moreover, the results show that the gap is still present even in richly connecte topologies for which, as inicate by Theorems 4. an 4.4, a protection routing is more likely to exist. Hence, even in those topologies, protection routings remain ifficult to fin unless an efficient heuristic such as is use. It shoul be note that the relatively poor performance of can, as mentione earlier, be partly attribute to its focus on link failures that makes it more susceptible to noe failures. Another fining from the figure is that a mean egree of 4 (i.e., 70 noes an 40 links) appears sufficient to realize near 00% protectability with. This inicates that protectability shoul be feasible in practice uner reasonable connectivity. The results of another set of evaluations carrie out on real I topologies are shown in Fig. 3, where the mean egrees of AS22, AS755 an AS3967 are 2.90, 3.70 an 3.72, respectively. The figure offers similar conclusions, namely, is effective in computing protection routings, an its avantage over other solutions remains even in richly connecte ASes such as AS This algorithm is chosen among several heuristics, because, as reporte in [5], it provies better protectability.

10 TABLE I NETWORK PERFORMANCE ACROSS TOPOLOGIES. Topology [# noes, # links] RN [70,05] RN [70,40] RN [70,75] PL [70,05] PL [70,40] PL [70,75] AS 22 AS 755 AS 3967 Avg link loa () Avg link loa () Avg link loa () Avg link loa () Max link loa () Max link loa () Max link loa () Max link loa () Increase in Φ uner (%) Increase in Φ uner (%) Increase in Φ uner (%) Table I shows network performance metrics across topologies, where comparisons with reflect the cost of protectability. In the case of Φ, increases relative to are reporte for, an. Uner, network performance typically egraes slightly compare to. This is expecte because leaves some links unuse uner normal conitions to ensure they are available for protection after failures. This cost is, however, small, especially in comparison to that incurre by an, which often result in very high levels of congestion. This is in part because both are oblivious to performance goals when computing routings, an emonstrates that is successful at reconciling both. C. Traing protectability for performance Following the iscussion of Section VI, we stuy whether it is possible to improve performance if we are willing to sacrifice some protectability. For simplicity, we assume that in Eq. 3, ε = ε, V. Table II illustrates the trae-off between protectability an performance for two topologies. The table uses results for ε = 0 (i.e., no trae-off) as a benchmark for the ecrease 9 in Φ realize by an increase in Ω, the average number of unprotecte noes across all estinations for ifferent ε s. For reference, we also give Ω in the table. The traffic matrices use in the experiments prouce roughly 70% maximum link utilization when ε = 0. The main observation from the results of Table II is that the propose heuristic successfully realizes ifferent traeoffs between protectability an performance. As a result, it provies network operators with a tunable solution for selecting a routing that provies the esire balance between protectability an performance. In aition, since the solution has essentially the same computational complexity as the base heuristic, it can be reaily use in practice as we iscuss next. D. Computational complexity To support our claim of computational efficiency, we report computational times for some large topologies. Specifically, run times were.7 hours,.63 hours, an 9 hours for the RN [70,75], PL [70,75], an AS 22 topologies, respectively. These results are obtaine with a Pentium Xeon 2.66 GHz machine. Note that the computation times are realize 9 The relative ecrease in Φ is at most 00% which correspons to Φ = 0. TABLE II TRADEOFF BETWEEN OTECTABILITY AND PERFORMANCE. ε Ranom topology (70 noes, 05 links) Decrease in Φ (%) Increase in Ω (%) Ω (in noes) AS3967 (79 noes, 47 links) Decrease in Φ (%) Increase in Ω (%) Ω (in noes) without trying to explicitly take avantage of the inherent parallelism of the computations (the n routings of Phase are inepenent an can be compute in parallel). The other metric of importance when assessing computational cost is memory consumption. None of the experiments require more than 300MB of memory. VIII. CONCLUSION This paper has investigate the feasibility of protection routing in a centralize routing system, which isplays heightene sensitivity to failures ue to latency in responses from the central server. The paper ientifie topological properties that affect the feasibility of protection routing an establishe that computing protection routings is NP-har. It evelope an efficient heuristic to compute routings that not only optimize protectability, but also minimize its performance cost. The heuristic was shown to outperform earlier proposals, an its efficacy emonstrate for a range of topologies. There are many irections in which this work can be extene or built on. The first is to emonstrate the feasibility of protectability in a centralize routing system through an implementation. Another irection of interest is to evelop weighte protectability solutions, i.e., to account for the fact that certain noes are more important than others. Yet another area is to evelop upate mechanisms at the central server that are aware of which noes have protection an which o not, an select upate orerings base on this information an the nee to avoi loops when upating forwaring states. REFERENCES [] A. Atlas an A. Zinin, Basic specification for IP fast reroute: Loop-free alternates, IETF RFC 5286, September [2] A.-L. Barabási an R. Albert, Emergence of scaling in ranom networks, Science, vol. 286, no. 5439, pp , October 999.

11 Fraction of protecte noes Fraction of protecte noes Sorte estination ID (a) RN (70 noes, 05 links) Sorte estination ID () PL (70 noes, 05 links) Fraction of protecte noes Fraction of protecte noes Sorte estination ID (b) RN (70 noes, 40 links) Sorte estination ID (e) PL (70 noes, 40 links) Fraction of protecte noes Fraction of protecte noes Sorte estination ID (c) RN (70 noes, 75 links) Sorte estination ID (f) PL (70 noes, 75 links) Fig. 2. Protectability across synthesize topologies. Fraction of protecte noes Sorte estination ID (a) AS 22 (04 noes, 5 links) Fraction of protecte noes Sorte estination ID (b) AS 755 (87 noes, 6 links) Fraction of protecte noes 80 Sorte estination ID (c) AS 3967 (79 noes, 47 links) Fig. 3. Protectability across real topologies. [3] R. Diestel, Graph Theory, 3r e. Springer, [4] N. Feamster, H. Balakrishnan, J. Rexfor, A. Shaikh, an J. van er Merwe, The case for separating routing from routers, in Proc. ACM SIGCOMM FDNA workshop, [5] B. Fortz an M. Thorup, Internet traffic engineering by optimizing OF weights, in Proc. IEEE INFOCOM, [6] A. Greenberg, G. Hjalmtysson, D. A. Maltz, A. Myers, J. Rexfor, G. Xie, H. Yan, J. Zhan, an H. Zhang, A clean slate 4D approach to network control an management, ACM SIGCOMM Computer Communication Review, vol. 35, no. 5, October [7] A. Kvalbein, A. F. Hansen, T. Cicic, S. Gjessing, an O. Lysne, Fast IP network recovery using multiple routing configurations, in Proc. IEEE INFOCOM, [8] K.-W. Kwong, R. Guérin, A. Shaikh, an S. Tao, Improving service ifferentiation in IP networks through ual topology routing, in Proc. ACM CoNEXT, [9] K.-W. Kwong, L. Gao, R. Guérin, an Z.-L. Zhang, On the feasibility an efficacy of protection routing in IP networks, University of Pennsylvania, Tech. Rep., July [0] K. Lakshminarayanan, M. Caesar, M. Rangan, T. Anerson, S. Shenker, an I. Stoica, Achieving convergence-free routing using failure-carrying packets, in Proc. ACM SIGCOMM, [] A. Nucci, S. Bhattacharyya, N. Taft, an C. Diot, IGP link weight assignment for operational Tier- backbones, IEEE/ACM Transactions on Networking, vol. 5, no. 4, pp , August [2] Y. Ohara, S. Imahori, an R. V. Meter, MARA: Maximum alternative routing algorithm, in Proc. IEEE INFOCOM, [3] H. Peterson, S. Sen, J. Chanrashekar, L. Gao, R. Guérin, an Z.- L. Zhang, Message-efficient issemination for loop-free centralize routing, ACM SIGCOMM Comp. Comm. Rev., vol. 38, no. 3, July [4] S. Ray, R. Guérin, K.-W. Kwong, an R. Sofia, Always acyclic istribute path computation, To appear in IEEE/ACM Transactions on Networking, [5] C. Reichert, Y. Glickmann, an T. Mageanz, Two routing algorithms for failure protection in IP networks, in Proc. ISCC, [6] C. Reichert an T. Mageanz, Topology requirements for resilient IP networks, in Proc. 2th GI/ITG Conf. on Meas., Mo. & Eval. of Comp. & Comm. Sys, [7] Rocketfuel project. [Online]. Available: research/networking/rocketfuel [8] G. Schollmeier, J. Charzinski, A. Kirstäter, C. Reichert, K. Schroi, Y. Glickman, an C. Winkler, Improving the resilience in IP networks, in Proc. HPSR, [9] M. Shan an S. Bryant, IP fast reroute framework, Internet Draft, June 2009, (work in progress). [20] M. Shan, S. Bryant, an S. Previi, IP fast reroute using Not-Via aresses, Internet raft, July 2009, (work in progress). [2] H. Yan, D. A. Maltz, T. S. E. Ng, H. Gogineni, H. Zhang, an Z. Cai, Tesseract: A 4D network control plane, in Proc. NSDI, [22] Z. Zhong, S. Nelakuiti, Y. Yu, S. Lee, J. Wang, an C.-N. Chuah, Failure inferencing base fast rerouting for hanling transient link an noe failures, in Proc. IEEE Global Internet, 2005.