I Introduction
Pathaware networks (PANs) are an innovative networking paradigm which has the potential to improve the dependability and efficiency of networks by increasing the flexibility in packet forwarding. In contrast to today’s Internet, PANs enable endhosts to choose the path at the level of autonomous systems (ASes), which is then embedded in the header of data packets. As such, they are not limited to using a single path between a pair of ASes, but can use all available paths simultaneously. This multipath approach has two important consequences. First, the availability of multiple paths increases the network’s resilience to link failures and its overall capacity through the possibility to avoid congested links. Second, the possibility of path selection enables endhosts to choose paths based on their applications’ requirements—e.g., low latency for voiceoverIP calls and high bandwidth for file transfers.
Over the past two decades, significant progress has been made regarding the technical prerequisites for realizing these PAN benefits. Numerous PAN architectures have been proposed—including Platypus [44, 45], PoMo [4], NIRA [54], Pathlets [20], NEBULA [2], and SCION [57, 42]—all of which enable endhost path selection between provideracknowledged paths (in contrast to source routing, where endhosts are trusted to construct paths themselves). In particular, SCION is already in production use since 2017, when a large Swiss bank switched a branch to only rely on SCION for communication with their data center. Since then, 7 ISPs are now commercially offering SCION connections [50, 1]. An important aspect of today’s SCION production deployment is that it is operating independently of BGP, so it not an overlay network over BGP.
While PAN architectures have thus experienced partial deployment, surprisingly little is known today about the interconnection agreements between ASes possible in such architectures. These interconnection agreements, however, are highly relevant for both ASes and endhosts. From the perspective of ASes, interconnection agreements determine the economic opportunities offered by PANs, which are critical to PAN adoption. From the perspective of endhosts, interconnection agreements play an essential role for path diversity; the extent of path diversity, in turn, influences the magnitude of above mentioned resilience and efficiency improvements of PANs.
In this context, we observe that PAN architectures enable new types of interconnection agreements that are not possible in today’s Internet. Nowadays, interconnection agreements are heavily influenced by the Gao–Rexford conditions (henceforth: GRC) [16, 10], which prescribe that traffic from peers and providers must not be forwarded to other peers or providers. It is important to distinguish between two aspects of the GRC which refer to independent concerns: a stability aspect and an economic aspect. Regarding stability, the GRC provably imply route convergence of the Border Gateway Protocol (BGP) [16], and from an economic perspective, the GRC signify that an AS only forwards traffic if the cost of forwarding can be directly recuperated from customer ASes or end hosts.
However, PAN architectures no longer require the GRC for providing stability. While paths in PAN architectures are discovered similarly as in BGP, namely by communicating path information to neighboring ASes, data packets are forwarded along a path selected by the packet source, which is embedded in the packet headers. Thus, PAN architectures trivially solve convergence issues in the sense of achieving a consistent view of the used forwarding paths, as we will explain in § II.
PAN architectures therefore present the exciting opportunity to create and use GRCviolating paths—if such paths can be made economically viable. In particular, we observe that PAN architectures may no longer require the GRC for reasons of stability, but must still respect the economic logic that makes the GRC a rational forwarding policy. For example, while the creation of GRCviolating path by in Fig. 1 may not lead to convergence problems, the path still is economically undesirable for , because would incur a charge from its provider for forwarding traffic of , which it cannot recuperate due to ’s status as a peer.
In this paper, we tackle this challenge by proposing new interconnection agreements based on mutuality, a concept that is already present in peering agreements today, but can be leveraged to set up more complex and flexible agreements. Concretely, mutuality means that the mentioned example path could be rendered economically viable for by requiring a quid pro quo from , the main beneficiary of the path. For example, could offer path to such that both and could save transit cost for accessing ASes and , respectively, but incur additional transit cost for forwarding their peer’s traffic to their respective provider. Moreover, ASes and might as well provide each other with access to their peers and , thereby saving transit cost while experiencing additional load on their network. If the flows over the new path segments are properly balanced and especially if the new path segments allow ASes and to attract additional revenuegenerating traffic from their customers, such unconventional agreements can be mutually beneficial. Hence, PANs offer opportunities for profit maximization which are not present in today’s Internet.
Concluding mutualitybased agreements affects revenue and cost of the AS parties in many ways, which requires a careful structuring of such agreements. We envisage that such agreements contain conditions that must be respected in order to preserve the positive value of the agreement for both parties. To this end, we further present a formal model of AS business calculations and AS interconnections that allows to derive two different types of agreement conditions, namely conditions based on flow volumes and conditions based on cash compensation. Moreover, we show how to shape mutualitybased agreements to maximize the utility (i.e., the profit) obtained by both parties, and how to negotiate them efficiently.
Finally, we investigate the effect of mutualitybased agreements on path diversity, building on a combination of several publicly available datasets [8, 9, 7, 32]. Our results underpin the benefits of mutualitybased agreements, which provide ASes access to thousands of additional paths, many of which are considerably more attractive regarding latency and bandwidth than the previously available paths. We believe that the the highly beneficial agreements investigated in this paper could represent a catalyst to overcome the still limited deployment of PAN architectures.
Ii The Relevance of GRC for BGP and PANs
To clarify why the GRC are needed in a BGP/IPbased Internet but not in PAN architectures, we compare their convergence requirements using the example topology of Fig. 1.
The fundamental issue with convergence in BGP is the nexthop principle: ASes can only select a nexthop AS for their traffic and thus rely on that AS to forward the traffic along the route that was originally communicated via BGP. If this assumption is violated—even temporarily—routing loops can arise. Put differently, in a BGP/IPbased Internet, all ASes need to share a common view of the used forwarding paths.
Now suppose that ASes and forwarded routes from their respective providers and to each other, which violates the GRC. Assuming both and prefer routes learned from peers, this results in a (slightly extended) instance of the classical DISAGREE example [24], which does converge with BGP but nondeterministically. The nondeterminism of such topologies, which are also known as “BGP wedgies” [22], is undesirable, but it does not constitute a fundamental problem for convergence in BGP. However, adding a single additional AS , which concludes similar agreements with both and , this topology leads to the famous BAD GADGET, which has been shown to cause persistent route oscillations [24].
This susceptibility to oscillations is also worrisome because seemingly benign topologies and policies may easily reduce to the BAD GADGET in case one network link fails [24]. This shows that GRCviolating policies need to be implemented very carefully and with coordination among all involved parties to ensure routing stability (e.g., using BGP communities). As a consequence, “sibling” agreements in which two ASes provide each other access to their respective providers (as presented above) generally only exist between ASes controlled by a single organization.
Unlike IP, PANs forward a packet along the path encoded in its header. Thus, there is no uncertainty about the traversed forwarding path after the nexthop AS and routing loops can be prevented. For example, if a source in would encode path in packets sent to a receiver in , would not send these packets back to . Precautions like the GRC are therefore not required for stability in a PAN and ASes have substantially more freedom in deciding which interconnection agreements to conclude and which paths to authorize.
Iii Modelling Interconnection Economics
In this section, we describe our model of the economic interactions between ASes in the Internet, which allows to derive quantitative conditions that must be fulfilled by interconnection agreements.
Iiia AS Business Calculation
We model the Internet as a mixed graph , where the nodes correspond to ASes, the undirected edges correspond to peering links, and the directed edges correspond to provider–customer links. An edge corresponds to a link from provider to customer . An AS node is connected to a set of neighbor ASes that can be decomposed into a provider set , a peer set , and a customer set . For simplicity of notation, we denote the customer endhosts of as a virtual stub , connected over a virtual provider–customer link .
Each provider–customer link has a corresponding pricing function , yielding the amount of money receives from given flow volume on link . This flow volume can be interpreted as is appropriate for the pricing function, e.g., as the median, average, or 95th percentile of traffic volume over a given time period. Each pricing function is of the form , where and are pricingpolicy parameters. For example, corresponds to flatrate pricing with flowindependent fee , corresponds to to payperusage pricing with trafficunit cost , and results in a superlinear pricing function, e.g., as given in congestion pricing. For simplicity, we assume that all peering links are settlementfree, as usual in the literature [28]. Paidpeering links can be represented in the model as provider–customer links. We write for brevity.
In addition to charges defined by pricing functions, an AS incurs an internal cost according to an internalcost function , which is nonnegative and monotonously increasing in the flow through . Furthermore, let the flow be the share of that also flows directly to or from its neighbor
. These subflows are represented in vector
, i.e., . Analogously, is the flow volume on the path segment consisting of ASes , , and in that order, independent of direction.The utility (or profit) of an AS is the difference between the revenue obtained and the costs incurred by traffic distribution : equationparentequation
(1a)  
(1b) 
This simple model can already formalize some important insights. For example, consider ASes , , and in Fig. 1, connected by provider–customer links and . For to make a profit, i.e., , it must hold that . This in turn implies , i.e., the revenue from and ’s customer endhosts must cover the cost induced by charges from as well as internal cost.
IiiB Interconnection Agreements
We denote an interconnection agreement between two ASes and in terms of the respective neighbor ASes to which and gain new paths thanks to the agreement:
(2) 
Here , and are the providers, peers, and customers of AS , respectively, to which obtains access through the agreements (analogous for , , ). Furthermore, we introduce the notation , and an analogous notation for .
Next, we formalize the utility of interconnection agreements. Let the utility of agreement to be the difference in produced by changes in flow composition due to agreement , i.e.,
(3) 
where is the distribution of traffic passing through if agreement is in force, and and are agreementinduced changes in revenue and cost of , respectively.
IiiB1 Example of Peering Agreement
Consider the negotiation of a classic peering agreement between ASes and in Fig. 1, which so far have been connected by providers and . We assume that ASes and are pure transit ASes, i.e., there are no customer endhosts within these ASes. In a classic peering agreement, both ASes provide each other access to all of their respective customers. Using the notation introduced above, this agreement is formalized as . The change in revenue for ,
(4) 
results from changes in flows to ’s customer , driven by the new peering link . The changes in cost to ,
(5) 
result from changes in internal and provider cost. The utility of a peering agreement to is then . The strongest rationale for peering agreements is that the agreement leads to considerable cost decrease, i.e., a strongly negative , as provider can be avoided for any traffic . The new peering link may also attract additional traffic from customer (e.g., due to the lower latency of the new connection), thus increasing ’s revenue. If , agreement has positive utility and is worth concluding from ’s perspective. However, may also experience a substantial increase in internal cost () due to peering, with little savings in provider cost and no extra income from the additionally attracted traffic (e.g., due to flatrate fees). In such a case, is negative, and the agreement is not attractive to . For agreement to be concluded, both and need to be nonnegative (or, if cash transfers as in paid peering [55] are used, would need to be nonnegative such that one party could compensate the other party and still benefit from the agreement).
IiiB2 Example of Novel MutualityBased Agreement
As discussed in § II, the GRC are not necessary for stability in a PAN, which allows for new types of interconnection agreements. In the example topology of Fig. 1, the following agreement could not be concluded in today’s BGPbased Internet, but could be concluded in a pathaware interdomain network:
(6) 
In this agreement , offers access to its provider , whereas in return provides with access to its provider and its peer .
The agreement utility of agreement to can be derived similar to the peeringagreement example in § IIIB1. Namely, the changes in revenue and cost of are equationparentequation
(7a)  
(7b)  
where  
(7c) 
is the flow from to one of its providers, , after conclusion of the agreement. This flow towards the provider is increased by the traffic that transfers to for in accord with the agreement. Simultaneously, flow is decreased by the flow to the destinations that was previously forwarded via provider , but is newly forwarded over thanks to agreement . As the new paths over agreement partner are the reason for newly attracted traffic from ’s customers, all such newly attracted traffic is forwarded over the agreement partner, not over ’s providers.
Clearly, agreement is not per se attractive to ASes and . For , the higher the amount of flow from that newly must be forwarded to a provider AS, the less attractive the agreement to , i.e., the higher . In contrast, the higher the amount of flow offloaded to , the higher the utility that can derive from agreement . Vice versa, the agreement utility for is conversely affected by the size of these new flows. Thus, the agreement must be qualified. Necessarily, these qualifications must guarantee positive agreement utility to both parties. Furthermore, it is desirable that the qualifications achieve Paretooptimal [12] and fair agreement utility, i.e., no party’s utility could be increased without decreasing the other party’s utility, and the utility obtained by both parties is as similar as possible. In § IV, we propose two different types of agreement qualifications to achieve these goals.
IiiB3 Extension of Agreement Paths
Thanks to agreement , ASes and obtain access to the new path segments and () and (). As the motivation behind the agreement is the attraction of additional customer traffic, the agreement parties would provide access to the new path segments only to their respective customers. For example, would extend the new path segment to , but not to or .
However, the new path segments can themselves become the matter of other agreements. For example, in an agreement between and , could provide with access to path segment if in return provides access to its peer . Note that agreement must be negotiated such that the conditions defined in agreement can still be respected, as these agreements are interdependent.
Iv Optimization of MutualityBased Agreements
The novel mutualitybased agreements should achieve Paretooptimal and fair utility in order to be attractive to both agreement parties. Moreover, a necessary economic condition for conclusion of the agreement is the guarantee of nonnegative agreement utility for both parties. Hence, defining an optimal interconnection agreement between two ASes and corresponds to solving the nonlinear program
(8) 
where the objective is given by the Nash product [39, 5], which is only optimized for Paretooptimal and fair values of and . Hence, if the Nash bargaining product is optimized, no party can increase its utility without decreasing the other party’s utility, and the utility of both parties is as similar as possible.
In the following, we present two methods to solve the nonlinear program in Eq. 8, i.e., two ways to qualify agreement such that the constrained optimization problem is solved: The optimization method in § IVA is based on defining flowvolume targets, which offers better predictability, whereas the method in § IVB is based on cash transfers between the agreement parties, which offers more flexibility.
Iva Optimization via FlowVolume Targets
The constrained optimization problem in Eq. 8 can be solved by determining volume limits for the flows that traverse the new path segment created by agreement . Concretely, the general optimization problem can be instantiated by the nonlinear program
(ID)  
(IID)  
(IIID)  
(9) 
Here, refers to the total flow volume on a new path segment allowed by the agreement, and is the volume of newly attracted customer traffic on path segment after agreement conclusion. Hence, the flow volume on new path segment that consists of rerouted existing traffic is at most .
The constraints (ID) and (IE) capture the fact that the agreement must be economically viable for both parties. The constraints (IID) and (IIE) capture the requirement that all the agreementinduced additional traffic from customers has to be accommodated within the flow allowances defined in the agreement. Finally, as any agreement could be made viable by attracting enough additional customer traffic, the constraints (IIID) and (IIIE) express that there is a limit to customer demand for new path segment . The optimization problem can be solved by appropriately adjusting , i.e., the total allowance for flows on the new path segments, and , i.e., the amount of additionally attracted customer traffic on the new path segments. The resulting can then be included into the agreement as flowvolume targets, whereas the resulting can be used by each AS to optimally allocate the flowvolume allowance among its customers. If agreement paths are extended as discussed in § IIIB3, additional constraints may hold; in this paper, we do not investigate these constraints.
IvB Optimization via Cash Compensation
An alternative optimization method to fixing flowvolume targets is given by a nontechnical approach that is based on cash transfers between the agreement parties. The idea of such an agreement structure is to abstain from limiting flow volumes, but to agree upon a cash payment for compensating the party that benefits less or even stands to lose from the agreement. Formally, negotiating an agreement between ASes and is equivalent to defining a cash sum from to (for negative , pays ) that solves the optimization problem
(10) 
In negotiation, the utilities and
are estimated based on the expected volume of the newly enabled flows.
IvC Comparison of Optimization Methods
The main advantage of flowvolume targets over cash transfers is their higher predictability: As flowvolume agreements allow the agreement parties to enforce volume limits, they are more likely to guarantee positive agreement utility than cashcompensation agreements. The latter depend on exante estimates of newly attracted customer traffic that might be incorrect, in which case the stipulated cash sum might not respect the constraints in Eq. 10.
Besides being easier to compute, an important advantage of cash compensation over volume targets is its larger flexibility, which translates into higher probability of the agreement being concluded as well as higher achievable joint utility. In certain settings where the revenues and costs of two ASes are very dissimilar, the flowvolume optimization problem in
Eq. 9 has a solution where all flowvolume targets are zero, i.e., the agreement cannot be concluded. In contrast, a cashcompensation agreement can always be concluded as long as the joint utility is positive.A common difficulty of both agreement structures is that they depend on private information of the negotiating parties, namely the charges from their respective providers, their internal forwarding cost, and the pricing for their customers, which determine the utility each party derives from the agreement. It cannot be assumed that the parties are willing to truthfully reveal this private information, as false claims about the cost structure strengthen a party’s bargaining position. In § V, we show how the inefficiency arising from such private information can be limited by means of a bargaining mechanism.
V MechanismAssisted Negotiation
In this section, we present a bargaining mechanism that we have designed to allow two interested parties to negotiate a mutualitybased interconnection agreement in an automated fashion, while reducing the negotiation inefficiency arising from bargaining under private information. However, while there are considerable advantages to using such a bargaining mechanism, there is no inherent necessity to use it; mutualitybased agreements might as well be negotiated by classic offline negotiations similar to classic peering agreements.
Va Problem Statement
When negotiating a mutualitybased interconnection agreement , the agreement parties and must agree on flowvolume targets or a cash sum transferred between the parties. The core difficulty of such negotiations is that the determination of the agreement conditions relies on and , i.e., the amount of utility that either party derives from the agreement, which is unknown to the respective other party. The presence of such private information allows each party to falsely report a lower agreement utility than it really obtains, which leads to more favorable terms of the agreement for the dishonest party. For example, when negotiating a cashcompensation agreement, the afternegotiation utility of party is determined by
(12) 
where and are the values of the utility which and claim to obtain from the agreement and which are used for determining the cashcompensation sum . To simplify our notation, we drop the reference to here and in the remainder of the section, as we always consider a single agreement. Clearly, party can increase by decreasing , i.e., its utility claim. However, if both parties follow such a dishonest strategy, the apparent utility surplus of the agreement tends to become negative, in which case the agreement seems to be not worth concluding, the negotiation breaks down and both parties derive zero utility. Hence, the challenge in negotiating mutualitybased agreements (as for paidpeering agreements in today’s Internet [55]) is the classic problem of noncooperative bilateral bargaining [37].
In the gametheoretic literature, this problem is tackled by mechanism design, i.e., by structuring the negotiation in a way that minimizes the inefficiency of the result. Especially for interAS negotiation, such mechanisms have the additional advantage that they enable the automation and mathematical characterization of negotiations which nowadays are often informal and risky [6]. In this section, we present a bargaining mechanism with multiple desirable properties. We focus on negotiating cashcompensation agreements (cf. § IVB); adapting the mechanism for flowvolume agreements (cf. § IVA) is an interesting challenge for future work.
VB Desirable Mechanism Properties
Typically, desirable properties of bilateralbargaining mechanisms include the following [37]:

[props]

Individual rationality: Participation in the mechanism should be associated with nonnegative utility in expectation (weak individual rationality) or in any outcome (strong individual rationality) for any party such that no party must be forced to take part in the mechanism.

Expost efficiency: The mechanism should lead to conclusion of the agreement if and only if the utility surplus is nonnegative.

Incentive compatibility: The mechanism should structure the negotiation such that it is in a party’s selfinterest to be honest about its valuation of the agreement.

Budget balance: The mechanism should neither require external subsidies nor end up with leftover resources (e.g., money) that are not ultimately assigned to the negotiating parties [40].
According to the famous Myerson–Satterthwaite theorem, no mechanism can satisfy the requirements 2, 1, and 4 simultaneously [38, 37]. The prominent Vickrey–Clarkes–Grove (VCG) mechanism, for example, guarantees individual rationality (1) and expost efficiency (2), but violates budget balance (4) [52, 11, 25]. Absent government intervention, individual rationality and budget balance are necessary conditions for an interAS negotiation mechanism; we therefore sacrifice perfect expost efficiency and instead aim at maximizing the Nash bargaining product:
(13) 
if , and 0 otherwise, where the cash transfer is .
While there are bargaining mechanisms that offer individual rationality, budget balance and incentive compatibility (according to the notion of Bayes–Nash incentive compatibility (BNIC) [35]), there are three arguments for relaxing the incentivecompatibility requirement as well. First, incentive compatibility might not be desired, because an AS might not want to disclose its true utility from an agreement for privacy reasons (e.g., not to hamper its prospects in future negotiations) and an incentivecompatible mechanism would allow the other party to learn the utility of a party from the mechanisminduced truthful claim . Second, incentive compatibility is in general unnecessary to achieve an optimal Nash bargaining product: For a viable agreement (i.e., ), the Nash bargaining product is optimized for all , with (i.e., equal dishonesty) and . Hence, while truthfulness, i.e., , is a sufficient condition for an optimal Nash bargaining product, it is not a necessary condition. Third, while incentive compatibility can be guaranteed with mechanisms, this guarantee often comes at the cost of introducing inefficiency: For example, the randomizedarbitration mechanism by Myerson [36] introduces a relatively high probability of negotiation cancellation such that even agreements with large surplus often cannot be concluded. Counterintuitively, mechanisms which allow small deviations from truthfulness might thus be more efficient than perfectly incentivecompatible mechanisms. In the following subsection, we present such a mechanism.
VC Bargaining in One Shot with Choice Optimization (BOSCO)
In this subsection, we present the BOSCO mechanism, which we have designed to enable automated negotiation of interAS agreements with high bargaining efficiency. The core idea of the BOSCO mechanism is as follows: The negotiating parties play a simple bargaining game supervised by an BOSCO service, in which each of them has a set of choices defined by the mechanism. Each combination of such choice sets is associated with at least one Nash equilibrium, i.e., a combination of strategies in which no party can profitably deviate from the strategy assigned to it. In turn, each such Nash equilibrium can be rated with respect to a bargainingefficiency metric. The benefit of the mechanism is thus realized by the BOSCO service, which appropriately constructs the choice sets and picks an associated Nash equilibrium such that a high bargainingefficiency results. In the following, we will present and formalize the components of the mechanism.
VC1 Utility Distributions
For executing the BOSCO mechanism, the two agreement parties and communicate the content of a mutualitybased agreement to an BOSCO service. While the BOSCO service does not know the true utility and that either party derives from the agreement, we assume (as usual in bargainingmechanism design) that the BOSCO service can estimate a utility distribution , which yields the probability that party derives utility
from the agreement. We envision that such an estimation can be performed on the basis of heuristics, taking standard transit and networkequipment prices into account.
VC2 Choice Sets
After deriving for each agreement party , the BOSCO mechanism constructs a choice set of possible claims for each agreement party . For BOSCO, these choice sets correspond to finite discrete sets with cardinality . To guarantee strong rationality, each choice set always contains the option , with which any party can cancel the negotiation. Moreover, let there be an ordering on the choices such that for all .
VC3 Bargaining Game
The utility distributions and the choice sets represent the basis of a bargaining game. In this bargaining game, each party picks a suitable choice and commits it to the BOSCO service. The BOSCO service then checks whether the apparent utility surplus is nonnegative, i.e., . If yes, the mechanism prescribes conclusion of the agreement with cash compensation , resulting in afternegotiation utility and . If not, the mechanism cancels the negotiation, resulting in afternegotiation utility .
VC4 Bargaining Strategies
In this bargaining game, the bargaining strategy of party is a function which yields a choice given the true utility of party . Party ’s bestresponse strategy to party ’s strategy consists of picking the choice with the highest expected afternegotiation utility given its true utility , i.e., the choice that maximizes
(14) 
where
(15) 
and is 1 if statement is true and 0 otherwise. Interestingly, the expected afternegotiation utility given a choice is a linear function of the true utility , with
(16)  
(17) 
where it holds that for all by nature of the CCDF in Eq. 16. For brevity, we write (analogous for ). This linear formulation allows an easy computation of the bestresponse strategy: A choice is the best choice given true utility if it holds that for all . If there exists with and , the choice is not optimal for any . Otherwise, is the best choice for only if
(18) 
for all . Let if , and otherwise. Symmetrically, is the best choice for only if for all , which is a set defined analogously to . Also analogously, let if is nonempty, and otherwise. Then, all for which is the best choice lie in the range . Hence, the bestresponse strategy is defined by a series of thresholds , where if . Algorithm 1 shows how to compute this threshold series. The loop at creftype 9 is needed to generate intervals which are disjoint, but cover all possible values.
VC5 Nash Equilibria
A Nash equilibrium in the bargaining game is a set of two bargaining strategies, each of which is the bestresponse strategy to the other strategy. An equilibrium can be computed by assuming arbitrary and (defined by arbitrary threshold series and ) and then compute the bestresponse strategies in an alternating fashion until the bestresponse strategy of any party is their existing strategy. While it can be shown that the considered bargaining game is not a potential game [34] (which would guarantee convergence to an equilibrium by alternating unilateral optimization), the bestresponse dynamics always converged to an equilibrium in our diverse simulations.
VC6 Bargaining Efficiency
Given a Nash equilibrium, a natural question arises concerning the efficiency of such an equilibrium . Clearly, if the BOSCO service knew and , it could simply compute the associated Nash bargaining product and compare it to the optimal Nash bargaining product that arises under universal truthfulness. However, as the BOSCO service has only probabilistic knowledge about the true utility of the agreement, it must evaluate the efficiency of an equilibrium by computing the the expected Nash bargaining product for this strategy, which is
(19) 
where is the joint utility distribution for parties and . The optimal expected Nash bargaining product is given by where is the truthful strategy for party . Similar to a Price of Anarchy formulation [46], we thus formalize the efficiency of an equilibrium with the following metric of Price of Dishonesty ():
(20) 
which is always in for reasons laid out in § VD. Note that is undefined if , i.e., if the agreement would be consistently unviable even under honesty, which is an uninteresting case that we henceforth disregard.
In summary, the BOSCO service is thus tasked with estimating and and constructing choice sets and such that the thereby defined bargaining game has an equilibrium with a low PoD. After the BOSCO service found such a configuration, it communicates the mechanisminformation set , to the communicating parties, which can verify that is indeed a Nash equilibrium and thus indeed follow the strategy that is assigned to them in the equilibrium. Hence, each party plays the bargaining game by applying the equilibrium strategy to its true utility value and commits the resulting claim to the BOSCO service, which then decides on agreement conclusion and, in case of negotiation success, on the exchanged cash compensation .
VD BOSCO Properties
After describing the BOSCO mechanism in the previous section, we now analyze the mechanism with respect to the properties listed in § VB. First of all, it is clear that the BOSCO mechanism is budgetbalanced, as the cash transfer paid by one party is exactly the cash transfer received by the other party. We prove other mechanism properties below.
Theorem 1.
The BOSCO mechanism offers strong individual rationality, i.e.,
(21) 
Proof.
Given utility of party , is the best choice for party . If is such that , then the agreement is not concluded and . Conversely, if , the agreement is concluded and appears in from Eq. 14. Now assume that . In that case, is negative for any with . Hence, could be increased by choosing with such that all the mentioned drop from the objective, as the summands associated with these only contribute negative values and the summands associated with the remaining choices of party increase. Thanks to , such a choice is always possible. However, this nonoptimality of contradicts the bestresponse character of , which invalidates the assumption of a negative . Hence, if an agreement is concluded, for any and (The case for is analogous). In summary, such nonnegativity of afternegotiation utility exists in any case (nonconclusion and conclusion), establishing strong individual rationality. ∎
Theorem 2.
The BOSCO mechanism is sound, i.e., it never leads to conclusion of a nonviable agreement:^{1}^{1}1In order to be expost efficient, the mechanism would additionally need to be complete in the sense that all viable agreements are concluded. However, as noted in § VB, this property is not achievable given other desirable properties.
(22) 
Proof.
If , the agreement is concluded and and . By strong rationality (Theorem 1), it holds that and , which implies and . By addition of the inequalities, . Hence, . ∎
Theorem 3.
The BOSCO mechanism always leads to an equilibrium with .
Proof.
We show that for all , , which implies the theorem. If , the agreement is neither concluded under truthfulness nor, by soundness (Theorem 2), given the equilibrium strategy, resulting in . Conversely, if , if and if by optimality of . Note that by strong rationality (Theorem 1), the case where , and is not possible. ∎
Theorem 4.
The BOSCO mechanism is privacypreserving, i.e., an exact reconstruction of the true utility of a party from its choice is impossible:
(23) 
Proof.
In terms of privacy, the only problematic case would arise if the range contained only one value, which would allow the derivation of that value from the associated choice . However, since halfopen intervals on the real numbers cannot contain a single value, this problematic case cannot arise. ∎
While exact reconstruction of the true utility is thus impossible, it might still be possible to predict the true utility with high precision if the interval associated with a choice is very small. Hence, the degree to which an equilibrium preserves privacy could be quantified (e.g., by the length of the shortest nonempty interval) and then taken into account by the BOSCO service when picking an equilibrium.
VE ChoiceSet Construction
It remains to analyze how the choice sets should be constructed such that equilibria with a low Price of Dishonesty result. Surprisingly, we have found that random generation of such choice sets works reasonably well in practice. In particular, the choice set for any party can be constructed by sampling a high enough number of choices from the utility distribution . With multiple trials of such random choiceset generation, choice sets with a relatively low Price of Dishonesty can be found.
In Fig. 2, for example, we analyze the resulting from random choiceset generation for two uniform utility distributions, namely
, which is a uniform distribution of
on , and , which is a uniform distribution on . For each choiceset cardinality , we generate 200 random choiceset combinations and find the mean and the minimum of the associated values. Clearly, a higher number of choices generally helps to reduce the Price of Dishonesty, but given around 50 choices, adding more choices does not improve the mechanism efficiency. Interestingly, we also observe that the number of equilibrium choices (i.e., choices which have a nonempty associated interval in the equilibrium strategy) for each party reaches 4 at that point and is not further increased for more possible choices. Hence, the BOSCO service can increase the number of possible choices until the resulting values do not substantially decrease anymore. With this procedure, the BOSCO mechanism could guarantee a Price of Dishonesty of around 10% for both and in the example at hand, meaning that the negotiation can be expected to be 10% less efficient than under the unrealistic assumption of perfect honesty.Vi Effect on Path Diversity
In this section, we attempt to quantify the effect of mutualitybased agreements on path diversity in the Internet. Starting from the CAIDA ASrelationship dataset [8], we construct a network of ASes where a provider–customer or peering relationship results in a single provider–customer or peering link, respectively. In this graph, we generate all possible mutualitybased agreements (MAs) for the whole topology: For every pair of peers, we generate an MA in which gives access to all its providers and peers which are not customers of , and vice versa. As MAs consist of an AS giving its peer access to a provider or another peer, these agreements enlarge the set of paths with 3 AS hops and 2 interAS links (henceforth: length3 paths) for , as well as the set of ASes that can reach with such length3 paths (henceforth: nearby destinations).
Given this graph and these MAs, we perform the following analysis for 500 randomly chosen ASes. First, we find the GRCconforming length3 paths starting at the given AS. Then, we find the MAcreated length3 paths for which the given AS is an endpoint. The number of these additional paths and the number of additional nearby destinations are thus metrics for the increased path diversity that the given AS enjoys thanks to MAs.
Via Number of Paths and Nearby Destinations
Figure 3 shows the substantial increase in the number of length3 paths with that are potentially available to these ASes thanks to mutualitybased agreements: For example, whereas none of the analyzed ASes have more than 45,000 GRCconforming paths with length 3, 20% of the analyzed ASes have more than 45,000 length3 paths if all MAs are concluded (CDF for ’MA’). Note that for a fixed source and a fixed destination, all length3 paths are disjoint by definition.
Since the conclusion of all possible MAs is an extreme case (although MAs could be negotiated in an automated fashion with the mechanism presented in § V), we further analyze the effects of noncomprehensive agreement conclusion. Initially, we note that an MA can provide an AS with new paths in two manners. First, an AS can directly gain an MA path by concluding an MA that includes the path (e.g., as AS gains the path in Fig. 1 from the MA with AS ). Second, an AS can indirectly gain an MA path by being the subject of an MA that includes the path (e.g., as AS or AS gain paths to AS from the MA between AS and AS in Fig. 1). Interestingly, most additional MA paths are directly gained paths, as the similarity of the CDFs for all MA paths (MA) and directly gained MA paths () in Fig. 3 suggests. Hence, the ASes bearing the negotiation effort of an MA have a strong incentive to negotiate that MA despite the effort, because they typically are its biggest beneficiaries. Moreover, we find that an AS already tends to obtain substantial gains in path diversity with only a handful of MAs. This point is demonstrated by the results for the scenarios where an AS only concludes the MAs which provide it with the most new paths (annotated with ‘ (Top )’ in Fig. 3): Even if an AS only concludes the single most attractive agreement from its perspective, it stands to gain several thousands of new paths.
Figure 4 also illustrates that mutualitybased agreements enlarge the set of destinations reachable with paths of length 3: For example, whereas 40% of the analyzed ASes can reach more than 5,000 destinations over length3 paths, 57% of ASes can reach more than 5,000 destinations over such paths if all MAs are concluded. Interestingly, very few MAs per AS already suffice to reap most of these benefits, as the results for noncomprehensive agreement conclusion demonstrate.
For the set of analyzed ASes, the average number of additional length3 paths thanks to mutualitybased agreements is 22,891 paths (maximum: 196,796 paths), and the average number of additionally reachable destinations over length3 paths is 2,181 ASes (maximum: 7,144 ASes). Interestingly, the gains in terms of additionally reachable destinations are more broadly distributed than the gains regarding paths. The explanation for this phenomenon is that mutualitybased agreements in very densely connected regions of the Internet lead to a high number of additional length3 paths, but have little impact on the number of ASes reachable over such paths.
ViB Geodistance
In order to gain a more qualitative perspective on the additional paths enabled by MAs, we also investigate the geographical length (henceforth: geodistance) of these new paths. Such geodistance is an important determinant of path latency [49], which is typically considered a core aspect of path diversity. As the CAIDA ASrelationship dataset [8] does not directly contain the necessary information, we additionally build on the CAIDA prefixtoAS dataset [9], the GeoLite2 database [32], and the CAIDA geographic ASrelationship dataset [7]. In particular, we determine the geolocation of any AS by finding the IP prefixes associated with the AS number in the prefixtoAS dataset, determining the geolocation of the IP prefixes via the GeoLite2 database, and averaging the resulting coordinates to obtain the center of gravity of the AS. With such averaging, the potentially considerable intraAS latency of geographically distributed toptier ASes is automatically taken into account. Moreover, we obtain the geolocation of an AS interconnection from the CAIDA geographic ASrelationship dataset. The geodistance of a length3 path , where are ASes and are interAS links, is then computed as , where is the geodistance between two points. If there are multiple known AS interconnections, the geodistance of the ASlevel path is computed for and that minimize .
Using this measure of path geodistance, we again compare the set of paths that conform to the GRC and the set of paths enabled by novel MAs. For every analyzed AS pair connected by at least one length3 GRC path, we determine the maximum, median, and minimum geodistance given the length3 GRC paths connecting the AS pair. In a next step, we determine the geodistance of the additional MA paths and check for each MA path whether it is lower than the maximum, median, or minimum GRC geodistance, respectively. Each AS pair is then characterized by the number of MA paths below these comparison thresholds. The aggregate results of this comparison method are presented in Fig. 4(a).
Figure 4(a) shows that through MAs, around 50% of AS pairs gain at least 1 path with a lower geodistance than the minimumgeodistance GRC path, suggesting that interAS latency can be decreased by MAs in these cases. Around 25% of AS pairs even gain at least 5 paths that improve upon the minimum GRC geodistance, and at least 7 and 8 paths that improve upon the median and maximum GRC geodistance, respectively. Another 20% of AS pairs only gain MA paths with a higher geodistance than the maximum GRC geodistance (or no new paths at all); however, also these additional paths have value in terms of reliability. Regarding the AS pairs experiencing a reduction in minimum geodistance, Fig. 4(b) illustrates the considerable extent of the geodistance reduction for these AS pairs: For example, 50% of AS pairs that experience a geodistance reduction obtain a reduction of more than 24%.
ViC Bandwidth
We perform an analogous analysis as in the preceding section with respect to the bandwidth of additional paths. To infer the bandwidth of interAS links, we employ a degreegravity model [47] which endows each link with a capacity value proportional to the product of the node degrees of the link endpoints. The path bandwidth is then the minimum such computed link bandwidth of all links in the path.
With such an analysis, we find that 35% of all investigated AS pairs obtain a new MA path that has more bandwidth than the corresponding maximumbandwidth GRC path (cf. Fig. 5(a)). Of these benefiting AS pairs, 50% gain an MA path with at least 150% more bandwidth than the respective maximumbandwidth GRC path (cf. Fig. 5(b)).
Vii Related Work
After the growth of the Internet had led to considerable BGP stability problems in the late 1990s [21, 30], the research of AS interconnection agreements, their stability properties, and their optimal structures received significant interest. The commercial reality of the Internet has been shown to mainly contain two basic types of agreements that determine routeforwarding policies, namely provider–customer agreements and peering agreements [28, 41]. The relative exclusiveness of these two agreement types was reinforced by the important result of Gao and Rexford, showing that BGP route convergence is guaranteed if ASes stick to these two forms of routeforwarding policies [16].
However, it is wellknown that such strict BGP policies reduce path quality: For a majority of routes selected in BGP, there exists a route that is more attractive with respect to metrics such as bandwidth, latency, or loss rate [48, 29, 26, 19, 17, 43]. In fact, motivated by such improvements, already today, many ASes do not always follow the Gao–Rexford conditions [17]. For example, some ISPs use alternative paths to reach content distribution networks such as Akamai [3, 33, 18], other ISPs prefer the peer route through their Tier1 neighbor over a longer customer route [3], and so on. Still, these deviations are narrow in scope, with most nonGRC policies being explainable by “sibling” ASes, which belong to the same organization and provide mutual transit services [15, 3], and partial/hybrid provider relationships [18]. This is due to the fact that more complex policies would threaten the convergence of the routing process unless they are supported through multiAS coordination efforts. These restrictions have also been acknowledged by previous efforts to provide multipath routing based on BGP such as MIRO [53].
While interconnection agreements in PAN architectures [44, 45, 4, 54, 20, 2, 56, 42, 51] do not need to follow the guidelines devised to achieve BGP stability, these agreements should definitely also respect the economic selfinterest of ASes. The Gao–Rexford guidelines for BGP policies have been proven to be rational in that sense [14]. Notable proposals for agreement structures that attempt to satisfy both AS selfinterest and global efficiency include Nash peering [13, 55], where the cooperative surplus of the agreement is shared among the parties according to the Nash bargaining solution [39], and ISPsettlement mechanisms based on the Shapley value [31]. It is important to note that unlike traditional source routing and similar to MIRO [53], PANs still offer transit ASes control over the traffic traversing their network, and hence to maximize their revenue. In contrast to MIRO, however, PANs guarantee path stability.
Finally, our paper has parallels to the work by Haxell and Wilfong [27], who showed that a fractional relaxation of the stablepaths problem of BGP [23] guarantees a solution and that a more flexible routing paradigm can thus defuse BGP stability issues. In contrast to this work, however, our focus lies on the interconnection agreements under this new paradigm, the extent to which these agreements increase path diversity, and their economic rationality and bargaining aspects.
Viii Conclusion
This work shows that PAN architectures enable novel types of interconnection agreements, thereby substantially improving path diversity in the Internet and creating new business opportunities. Such new possibilities exist in PAN architectures as they do not rely on the nowadays essential routeforwarding policy guidelines formulated by Gao and Rexford [16] for route convergence.
Our results show that path diversity in the Internet benefits enormously by enabling paths beyond the Gao–Rexford constraints: By using previously impossible path types, an AS can reach thousands of new destinations with 3hop paths and benefit from hundreds of thousands of additional paths, some of which have more desirable characteristics than the previously available paths. There is thus a largely unknown advantage to PAN architectures: Not only do these architectures enable endhosts to select a forwarding path, they also allow network operators to offer new (and often shorter) forwarding paths. As PANs are not limited to using a single path between a pair of ASes, all these paths can be used simultaneously according to the requirements of endhosts and their applications (e.g., low latency for voice over IP and high bandwidth for file transfers). These direct benefits to endhosts in turn incentivize providers to explore new interconnection agreements and offer diverse paths to attract new customers.
We present two methods for designing agreements that are Paretooptimal, fair, and thus attractive to both parties. We also show that, assisted by an appropriate bargaining mechanism, the negotiation of such agreements can lead to efficient agreements although necessary information is private.
We see this work merely as a first step in exploring the new possibilities for interconnection agreements in PAN architectures. There are many exciting opportunities for future research in designing and evaluating interconnection agreements that can achieve desirable goals of network operators, such as network utilization, predictability, and security.
Ix Acknowledgments
We gratefully acknowledge support from ETH Zurich, from the Zurich Information Security and Privacy Center (ZISC), from SNSF for project ESCALATE (200021L_182005) and from WWTF for project WHATIF (ICT19045, 20202024). Moreover, we thank Giacomo Giuliari and Joel Wanner for helpful discussions that improved this research.
References
 [1] Anapaya Systems. SCIONInternet: The new way to connect. https://www.anapaya.net/scionthenewwaytoconnect.
 [2] T. Anderson, K. Birman, R. Broberg, M. Caesar, D. Comer, C. Cotton, M. J. Freedman, A. Haeberlen, Z. G. Ives, A. Krishnamurthy, W. Lehr, B. T. Loo, D. Mazières, A. Nicolosi, J. M. Smith, I. Stoica, R. van Renesse, M. Walfish, H. Weatherspoon, and C. S. Yoo. The NEBULA future Internet architecture. In The Future Internet. Springer, 2013.
 [3] R. Anwar, H. Niaz, D. Choffnes, Í. Cunha, P. Gill, and E. KatzBassett. Investigating interdomain routing policies in the wild. In Internet Measurement Conference (IMC), 2015.
 [4] B. Bhattacharjee, K. Calvert, J. Griffioen, N. Spring, and J. P. G. Sterbenz. Postmodern internetwork architecture. NSF Nets FIND Initiative, 2006.
 [5] K. Binmore, A. Rubinstein, and A. Wolinsky. The Nash bargaining solution in economic modelling. The RAND Journal of Economics, 1986.
 [6] K. L. Calvert, J. Griffioen, A. Nagurney, and T. Wolf. A vision for a spot market for interdomain connectivity. In 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), pages 1860–1867. IEEE, 2019.
 [7] Center for Applied Internet Data Analysis. The CAIDA AS relationships dataset with Geographic Annotations. https://data.caida.org/datasets/asrelationshipsgeo/, 2016.
 [8] Center for Applied Internet Data Analysis. The CAIDA AS relationships dataset. http://data.caida.org/datasets/asrelationships/serial2/20200401.asrel2.txt.bz2, 2020.
 [9] Center for Applied Internet Data Analysis. The CAIDA Routeviews PrefixtoAS dataset. http://data.caida.org/datasets/routing/routeviewsprefix2as/, 2020.
 [10] L. Cittadini, G. Di Battista, T. Erlebach, M. Patrignani, and M. Rimondini. Assigning AS relationships to satisfy the GaoRexford conditions. In IEEE International Conference on Network Protocols, 2010.
 [11] E. H. Clarke. Multipart pricing of public goods. Public Choice, 11(1), 1971.
 [12] G. Debreu. Valuation equilibrium and Pareto optimum. US National Academy of Sciences, 1954.
 [13] A. Dhamdhere, C. Dovrolis, and P. Francois. A valuebased framework for Internet peering agreements. In International Teletraffic Congress (ITC), 2010.
 [14] J. Feigenbaum, V. Ramachandran, and M. Schapira. Incentivecompatible interdomain routing. In ACM Conference on Electronic Commerce, 2006.
 [15] L. Gao. On inferring autonomous system relationships in the Internet. IEEE/ACM Transactions on Networking, 9(6), 2001.
 [16] L. Gao and J. Rexford. Stable Internet routing without global coordination. IEEE/ACM Transactions on Networking, 2001.
 [17] P. Gill, M. Schapira, and S. Goldberg. A survey of interdomain routing policies. ACM SIGCOMM Computer Communication Review (CCR), 44(1), 2013.
 [18] V. Giotsas, M. Luckie, B. Huffaker, and K. Claffy. Inferring complex AS relationships. In Internet Measurement Conference (IMC), 2014.
 [19] V. Giotsas, S. Zhou, M. Luckie, and K. Claffy. Inferring multilateral peering. In ACM Conference on Emerging Networking Experiments and Technologies (CoNEXT), 2013.
 [20] P. B. Godfrey, I. Ganichev, S. Shenker, and I. Stoica. Pathlet routing. ACM SIGCOMM Computer Communication Review (CCR), 2009.
 [21] R. Govindan and A. Reddy. An analysis of Internet interdomain topology and route stability. In IEEE Conference on Computer Communications (INFOCOM), volume 2. IEEE, 1997.
 [22] T. Griffin and G. Huston. BGP wedgies. RFC 4264, IETF, 2005.
 [23] T. G. Griffin, F. B. Shepherd, and G. Wilfong. The stable paths problem and interdomain routing. IEEE/ACM Transactions on Networking, 10(2), 2002.
 [24] T. G. Griffin and G. Wilfong. An analysis of BGP convergence properties. ACM SIGCOMM Computer Communication Review (CCR), 29(4), 1999.
 [25] T. Groves. Incentives in teams. Econometrica: Journal of the Econometric Society, 1973.
 [26] A. Gupta, L. Vanbever, M. Shahbaz, S. P. Donovan, B. Schlinker, N. Feamster, J. Rexford, S. Shenker, R. Clark, and E. KatzBassett. SDX: A software defined Internet exchange. ACM SIGCOMM Computer Communication Review (CCR), 2015.
 [27] P. E. Haxell and G. T. Wilfong. A fractional model of the Border Gateway Protocol (BGP). In ACMSIAM Symposium on Discrete Algorithms, USA, 2008. Society for Industrial and Applied Mathematics.
 [28] G. Huston. Interconnection, peering and settlements. The Internet Protocol Journal, 2(1), 1999.
 [29] V. Kotronis, R. Kloti, M. Rost, P. Georgopoulos, B. Ager, S. Schmid, and X. Dimitropoulos.
Comments
There are no comments yet.