1. Distributed Algorithms for Secure Multipath Routing Patrick P. C. Lee, Vishal Misra, Dan Rubenstein Distributed Network Analysis (DNA) Lab,Columbia University March 17, 2005

2. Outline • Motivation: • Why do we use multipath routing to achieve security? • Security objectives • Distributed algorithms: • Bound-Control algorithm • Lex-Control algorithm • Simulation results

3. Motivation • Problem of single-path routing: source sink • An attack/failure shuts down the entire session.

4. Motivation • Protection with multipath routing: source sink • An attack/failure causes less damage.

5. Goals • Determine the multipath routes that achieve the “best” security: • Minimize the worst-case data loss with/without bandwidth constraints • Minimize “severe” data loss with/without bandwidth constraints based on lexicographic optimization • Implement a distributed solution: • No need to know the global network topology • Allow nodes to locally decide link costs • Suitable for independently administered networks (e.g., RON)

6. Previous Work • Lexicographic optimization: Minimize a non-increasing link-cost sequence a = (a1, a2, …, an) • Find a*, where a* = (a1*, a2*, …, an*) ≤ a = (a1, a2, …, an) for every link-cost sequence a • Georgiadis et al.’s solution [ToN ’02]: • Recursively solve minimax problems on subgraphs • Limitations: • Centralized solution • Does not consider varied bandwidth constraints

7. Our Work • Develop two distributed algorithms Bound-Control and Lex-Control: • Support fixed-rate model and maximal-rate model • Fixed rate: a data session sends data at a fixed rate • Maximal rate: a data session sends data at the maximal rate across all network links (i.e., equiv. to min-cut) • Suitable for overlay networks and ad hoc networks • Prove their optimality in response to single-link attacks. • Evaluate the algorithms via simulations in response to single-link and multi-link attacks.

8. Model Assumptions • Static network topology • Single source-sink pair • Easily generalized to networks with multiple customers/providers • Infrequent link attacks/failures • Optimize solutions for single-link attacks • Evaluate performance for both single-link and multi-link attacks

9. How to Quantify the Cost of a Single-link Attack? • Attack cost of link l: al = xl * cl • xl – proportion of session data allocated to link l • cl - security constant • Measure the vulnerability of link l to an attack • Possible physical interpretations: • Attack success probability • Proportion of xl lost during an attack • In practice, security constants can be obtained from security monitoring systems or statistical measurements

10. Example of Setting Security Constants More vulnerable to attacks (e.g., cl = 0.9) • In subsequent discussion of objectives, assume cl = 1 for all links, i.e.,attack cost = data loss. Wireless link sink source Wired link Less vulnerable to attacks (e.g., cl = 0.1)

11. Objective 1 One possible data allocation. • Minimize the worst-case data loss under the single-link attack 5 5 Fixed data rate 10Mb/s 5 source sink 5 5 5

12. Objective 1 Another possible data allocation. Fixed data rate 10Mb/s 5 5 5 5 source sink 5 5

13. Objective 1 Another possible data allocation. • Worst-case data loss cannot be less than 50% 5 5 Fixed data rate 10Mb/s 5 5 source sink 5 5

14. Bandwidth-limited link (Only 4Mb/s allowed) Objective 2 • Minimize the worst-case data loss subject to bandwidth constraints 6 6 Fixed data rate 10Mb/s 6 source sink 4 4 4

15. (6, 6, 6, 4, 4, 4, 0, 0, 0, 0)  (6, 4, 3, 3, 3, 3, 2, 2, 2, 2) Lexicographic Optimization 3 6 3 6 3 6 6 3 2 source source sink sink 2 4 4 2 4 Bandwidth-limited link (Only 4Mbs allowed) 2 4 Objective 3 • Minimize the ith worst-case data loss subject to bandwidth constraints, given already minimized attack costs for the worst-case, 2nd worst-case,…, (i-1)th worst-case. Fixed data rate 10Mb/s

16. Solving Objective 1: Preflow-Push • Map minimax problem to max-flow problem • Preflow-push algorithm [Goldberg & Tarjan, 89]: • Nodes find the maximum flow from source to sink in a distributed fashion. • Basic idea of solving Objective 1 [Ahuja, 86]: • Each node sets capacity constraints of its outgoing links: cap(l) = 1/cl. • Nodes solve max-flow problem under capacity constraints in a distributed fashion. • Each node allocates data for its outgoing links:(link flow) / (max flow).

17. Solving Objective 2: Bound-Control • Bandwidth constraint: fraction boundbl • bl = (bandwidth of link l) / (session data rate) • Capacity constraint: cap(l) = min(1/cl, bl*f) • f = flow reaching the sink • Upper bound in max-flow problem • Basic idea of solving Objective 2: • Repeat • Distributed execution of Preflow-Push • Each node adjusts capacity constraints for its outgoing links • Until capacity constraints satisfied

18. Lexicographic iteration Solving Objective 3: Lex-Control • Basic idea – solve lexicographic optimization: • Repeat • Distributed execution of Bound-Control • Each node identifies critical linksamong its outgoing links • Until all critical links spotted • Critical Links • Links whose data allocation has to be fixed to preserve the optimal attack cost • In practice, Lex-Control provides the necessary resilience in 3 or 4 lexicographic iterations.

19. Recap of Algorithms Lex-Control algorithm Bound-Control algorithm Preflow-Push algorithm Hierarchical solution to the three security objectives

20. Experimental Setup • Consider three random networks generated by BRITE: • 200 nodes, 600 links • 200 nodes, 800 links • 200 nodes, 1000 links • Randomly assign security constants (0 to 1) and bandwidths (1 to 5 Mb/s) for all links • Metrics: • Attack cost • Number of executions of Preflow-push • Routing overhead

21. Experiment 1 – Bound-Control • Minimized worst-case attack cost vs. different session throughputs

22. Experiment 1 – Bound-Control • Single shortest path approach • Bound-Control (for maximal-rate model) • Bound-Control reduces the worst-case attack cost by 50-70%.

23. Experiment 2 – Lex-Control • Number of links with severe attack cost vs. number of lexicographic iterations. • Attack cost is severe if it’s at least 25% of the worst-case attack cost. • E.g., for the attack-cost sequence (1, 0.5, 0.25, 0.1, 0.1), number of links with severe attack cost is 3.

24. Summary of Experiments • Bound-Control vs. Single-Path Routing: • Reduce the worst-case attack cost by 50-70% • Lex-Control vs. Bound-Control • Reduce # of links with severe attack costs by ~50% • Reduce aggregate attack cost in multi-link attacks: • by ~40% in the uniform 50-link attack • by ~23% in the proportional 5-link attack • by ~12% in the worst-case 5-link attack • 3 or 4 lexicographic iterations are enough

25. Conclusions • In this talk: • Proposed two distributed algorithms Bound-Control and Lex-Control that optimize respective security objectives. • Illustrated performance of Bound-Control and Lex-Control via simulation analysis. • More details in the paper: • Optimality proof • Simulation results for multi-link attacks