Bo ycotting and Extor ting Nodes in an Internetw ork D - PDF document

BoycottingandExtortingNodesinanInternetworkDaveLevinAdamBenderCristianLumezanuNeilSpringBobbyBhattacharjeeUniversityofMaryland,CollegeParkEmails:fdml,bender,lume,nspring,bobbyg@cs.umd.edu1.INTRODUCTIONAboycottisaprotestorademandforchangebasedonconsumersfollowingasimplerule:donotpurchaseserviceorgoodsfromspecicproducers.Inanynetwork,andespeciallyintheInternet,suchgrass-rootsprotestisclosetoimpossible.Thebignetworksdonotconnectdirectlytoconsumersandroutingisbasedonlocallychoosingtheshortest,cheapest,ormostprotablepaths.Inthisenvironment,individualconsumershavenoin\ruenceonrouteselectionandenterprisecustomersverylittle.Yet,protest-worthyactionsbynetworkprovidersarenotinfrequent.AOLcompromisedtheprivacyofitsusersbypublishingsearchqueries(August2006);Googlecom-pliedwithChina'scensorshiplaws,tothedisapprovalofmany(February2006);VerisignredirectedmistypedDNSnamestotheirownadvertising(September2003);andtheElectronicFrontierFoundationhassuedAT&TtostopNSAsurveillance(January2006;legalactioncontinues).WeenvisionanInternetinwhichusershavetheabilitytomake,oratleastin\ruence,routingdecisions.Userswillhavethisabilitysothattheymaytakeadvantageofincreasinglyrichfunctionalityinnetworks;userswillneedtobeabletochoosenetworksthatprovideaserviceoravoidthosethatlterorcensor.Amongthemanypoliciesusersmightchooseinroutingpackets,usersmayselectnodestoboycott.Tostudytheeconomicsofboycottingaproviderinanabstractnetwork,weadapttheVickrey-Clarke-Groves(VCG)routingmechanismtosupportboycotting.Alllinkcostsaregloballyadvertised.Sourcesinthisnetworktypicallychoosetheshortestcostpathtoadestination,andmicropaymentsrewardeachentityalongthepath.EachoftheseassumptionsisdistinctfromtherealitiesofBGP;wedescribetheimplicationsofthismismatchlateinthispaper.Webegintheinvestigationintothefollowingquestions:(1)DoesVCGcontinuetoencouragenodestoreportcoststruthfullyinthepresenceofboycotting?(2)Donodesgainfromlearningusers'boycottlists?Dousersgainfromdivulgingwhomtheyareboycotting?and(3)HowdotheresultsfromVCGapplytoadhocnetworksandtheInternet?Toanswerthesequestions,wemodifyVCG(x2)andshowthatonlywhenmassivelyboycotteddonodeshaveincentivetolieaboutlinkcosts(x3).WesimulateourmodiedVCG(x4)toshowthepriceinconnectivity,anddiscussdeploymentrequirementsandimplications(x5).Wereviewrelatedwork(x6)andconclude(x7).2.AMECHANISMFORBOYCOTTING2.1Model,Assumptions,andProblemWemodelthenetworktopologyasadirected,weightedgraphG=(V;E).Foranytwonodesu;v2V,c(u;v)isthenonnegativecostincurredbyutosendonthedi-rectededge(u;v)2E.Anodecanhaveatleastoneofthefollowingroles:source,destination,ortransit.Eachsourcenodeshasa(possiblyempty)setBsofnodesthatitwishestoboycott.Thatis,sprefersthatnotracsentbysfollowsapaththatcontainsanyb2Bs.Weassumethatsourceroutingissupported,butshownextthatsourceroutingaloneisnotenoughtoboycott.Weassumeapaymentmechanismbywhichscansecurelypayothernodesinthenetwork,andanaccountabilitymechanismwithwhichscanverifythatitssourceroutewasused.Foraccountability,eachnodemightberequiredtosignthepacketsitforwards,butthisstrawmanap-proachveriesonlythatthepacketvisitedatleastthosenodesthatsignedit.Inthissection,thecentralchallengeistoallowasourcetocompelthenodesonitschosenpathtoforwarditspacketsalongonlythatchosenpath,evenwhenmoreprotablealternatepathsexist.2.2VCGRoutingMechanismWerstreviewtheVickrey-Clarke-Groves(VCG)mech-anism[6,9,19].Eachtransitnodeiknowsthecostc(i;j)tosendtonodejwhere(i;j)2E.Asourcesroutestoadestinationdbyrstrequestingfromeachtransitnodeitscosts,c(i;?).Inresponse,iclaimscostc0(i;j)forall(i;j)2E.ThegoalofVCGistoensurethateveryc(i;j)=c0(i;j):thateachireportsitscoststruthfully.LetSCP(s;d;H)denotetheshortestcostpathfromstodingraphH,C(SCP(s;d;H))thesumoftheedgecostsonthepath,andletHidenotethegraphinducedbyre-movingifromH.VCGaccomplishestruthfulreportingofcostsbyemployingthefollowingpayoutfunctionfromstoi:ifiisnotontheshortestcostpath,andthusdoesnowork,ps(i)=0,otherwise:ps(i)=C(SCP(s;d;Gi))C(SCP(s;d;G))+c0(i;j)(1)WesummarizeVCGwiththepseudocodeinAlgorithm1.Toseewhythisinducestruthfulreportingonbehalfofeachtransitnodei,observethatishouldneitherunder-statenoroverstateitscost:ishouldnotunderstate:Bydenition,C(SCP(s;d;Gi))C(SCP(s;d;G)),soeachnodeontheshortestcostpathreceivesatleastitsstatedcosttoforward.Ifc0(i;j)1 c(i;j),theniisnotguaranteedtorecoveritsactualcosttoforward,henceishouldensurethatc0(i;j)c(i;j).ishouldnotoverstate:ps(i)isindependentofc0(i;j)becauseC(SCP(s;d;G)),inEq.(1),includesc0(i;j).In-creasingc0(i;j)�c(i;j)could,however,removeifromtheshortestpath,soishouldensurethatc0(i;j)c(i;j).Algorithm1StandardVCG1.Gatherc0(i;j)fromeachiforeach(i;j)2E.2.ComputetheshortestcostpathPfromstodusingDijkstra'salgorithm.3.ForeachintermediatehopionP,payps(i)fromEq.(1)toi.2.3VCGwithBoycottingMechanismCulled­VCG.SupposesourceswishestoboycottasetofnodesBs.OnecouldrunVCGonthegraphinducedbyremovingallboycottednodes,GBs;werefertothisasculled-VCG.ThisapproachissimilartoMIRO[20],whichemployssource-routingtoallowfornodestovisit(oravoid)nodesoftheirchoosing.WeshowinFigure1,however,thatcullingtheboycottednodealonedoesnotsuce.Init,nodesissendingtonodedbutwishestoboycottB.TheshortestcostpathcomputedbystandardVCGisfs;A;B;C;dg,andbyculled-VCG,fs;A;C;dg.A,however,couldgainmoreprotbytunnelings'spack-etsthroughBatacostof2+,givingBprot,andgivingAprot(1)inadditiontotheprotmadefroms'spayment.Culled-VCGfailsbecause,althoughnodeshaveincentivetotruthfullyreporttheircosts(thankstoVCG),itprovidesnoincentivefornodestoforwardonthepaththesourcespecied.VCGwithBoycotting.Wecandrawfromculled-VCGthefollowingobservation:foreachedge(i;j)intheshortestcostpathcomputedbyculled-VCG,ifthereisalower-costpathfromitojthatincludesaboycottednode(suchasthe(A;C)edgeinFigure1),thenthepacketswillmostlikelygothroughtheboycottednode.WeintroduceamodiedVCGmechanisminAlgorithm2.2.4TheCostofBoycottingBoycottinganodeislikelytoincuradditionalcost.WhensappliesAlgorithm2toFigure1,theresultingpathisfs;X;Y;dg,withpayoutsps(X)=ps(Y)=4,andc(s;X)=2,foratotalcosttosof10.WerestoapplystandardVCG,thepathwouldhavebeenfs;A;B;C;dg,withpayoutsps(A)=ps(C)=3,ps(B)=2,andc(s;A)=1,foratotalcostof9.WedenethecostofboycottingtobetheratioofthetotalpricepaidbyswhenrunningVCGwithboycotting(Alg.2)tothepricepaidwhenrun-ningstandardVCG(Alg.1).IntheexampleofFigure1,shasacostofboycottingof10=9whensendingtodandboycottingB.Ifsvaluesboycottinginnitely,thensiswillingtoac-ceptanycostofboycotting,evenatthecostofnotbeingAlgorithm2VCGwithboycotting1.Gatherc0(i;j)fromeachiforeach(i;j)2E.2.Computeall-pairsshortest-costpathsontheweightedgraphG=(V;E;C),withtheweightofedge(i;j)equaltoc0(i;j).3.LetG0=(V;E0;C),whereE0=f(i;j)2Ejtheleast-costpathfromitojdoesnotcontainanyb2Bsg.4.Computetheleast-costpathPfromstodusingDijkstra'salgorithmonG0s(i.e.,runculled-VCGonG0).5.ForeachintermediatehopionP,payps(i)fromEq.(1)toi.abletoreachthedestination.However,if,foreachb2Bs,sassignssomeniteutilityu(b)toboycottingb,thensmaynotbewillingtoboycottifthedierenceinpriceisgreaterthanu(b).Insuchasituation,smaybewill-ingtoacceptsomesubsetSofBstoboycottsuchthattheadditionalcostincurredtoboycottSislessthantheutilitysgains,Pb2Su(b).Weleavecombinatorialboy-cottingpolicies(e.g.,\sendtononodesinSBs,ornomorethan3nodesfromTBs")tofuturework.3.BEHAVIORINANETWORKWITHBOY­COTTINGBeyondtheroutedeterminationgame,therearead-ditionalstrategiesthatbothboycottersandboycottednodesmustmake.Aslongasboycottersdonotvalueboycottinginnitely,boycottednodesmaymakeratio-nal,competitiveresponses.First,atransitnodeicanattempttodetermineifitisbeingboycotted,why,andtheimpacttoi'sprots.Second,imayattempttoregainmarketshare,eitherviapolicychange(soastostopbeingboycotted)orbyextortingthosewhoarenotboycotted.Weaddresstheseinturn,andnishthissectionwithadiscussionofhownodesareexpectedtoreporttheircosts.3.1KnowingYourBoycottersRoutingentityimaywishtolearnaboutusers'boycottsets.Forinstance,imayask:(1)AreusersboycottingmeduetoaspecicpolicyIdo(ordonot)exhibit?(2)Howmanyusersareboycottingme,andhowmuchprotamIlosingasaresult?Boycottednodesmaynditextremelydiculttoan-swerthesequestionswithoutbeingabletoviewthetraf-cthattheywouldotherwisecarry.Inawirednetwork,wheniisboycotted,itreceivesnopackets,andhence,withoutaprioriknowledgeoftracdistributions,hasnowayofinferringhowmuchtracitisnotseeing.Inomnidirectionalwirelessnetworks,suchas802.11,eachtransmissioniseectivelyalsoabroadcast,soicouldper-hapslearnmoreoftheexistingtrac\rows,butonlyinclosephysicalproximity.Still,ihasseveraltoolsatitsdisposal:theobservedamountoftracandpayments2 411113422211311442223442221112 +dXZAACBsdYXZCBsdYXZ(a)(b)(c)(d)ACBsdYXZACsdYFigure1:(a)Examplenetwork:swishestoboycottB.(b)EdgesthatwouldinvolveBareculled.(c)Theshortestpathintheresultinggraphischosenwithcostofboycotting10=9.(d)AnexamplewhereBcouldextortA.ithasreceivedwithagivenc0(i;?),andthestated(andhencetruthful)costsofothers'edges.Ourinsightisthaticanperiodicallyperform\marketresearch"byloweringitsstatedcosts1andcomparethetracitisaskedtoforwardduringthelower-costpe-riodtonormalperiods.Suppose,forinstance,ireceivespacketswithsource-destinationpair(s;d)onlywhenitstatesalowercost,butiisontheleast-costpathfromstodevenwheniistruthful.Thenihasrevealedaninstancewheresisboycottingibut,uponstatinglowercost,iinducesacostofboycottingthatistoohighforstocover,atwhichpointitisnoteconomicallyfeasibleforstoboycotti.3.2ElicitingChangeWhywouldaboycottednodehavetoperformthismar-ketresearch?Wouldaboycotternotwanttobeoutspo-kenastowhomandwhyitisboycotting?Indeed,boycottingisamethodtoelicitpolicychange.Ifenoughend-usersboycottatransitnode,themessageshouldbeclear:changepolicytoearngreaterprots.Boycottingis,inasense,ameansofresolvingthetus-slebetweenend-userswhowantnodesthatforwardtheirpacketstoenforceaparticularpolicy(orlackthereof)andtheroutingentitiesthatdoordonotsupportthatpol-icy.Todoso,boycottersmustmakecleartotheroutingentitieswhytheyarebeingboycotted.Intwocases,however,anodesmaywishto\silently"boycottsomeroutingentityi.First,smaybesendingcondentialmaterial,usingtheboycottasameanstoavoidsnoopingortoaccessdiversepaths,anddoesnotwanttopubliclyannouncethatitisboycottingitodoso.Second,smaywishtohelptheboycottgathermo-mentumandbecomesignicantbeforestatinggrievances,hopingtodenyitheabilitytoquelltheboycottwithhalf-measures.Hence,marketresearchaswehavedescribeditmayservepowerfulroutingentitieswhowishtolearnaboutgrowing,grass-rootsboycottingeorts.3.3ExtortingNon­BoycottedNodesAsanalternativetochangingitspolicy,routingentityimayextortother,non-boycottedroutingentitiestogainprot.ConsidertheexampleinFig.1(d);nodeB'struecosttosendtoCis2+forsomepositive.Inthiscase,ourmechanism(Alg.2)wouldnotremoveedge(A;C),1perhapsforonlyashortperiodoftime,soasnottoincurtoogreatalossandthepathfs;A;C;dgwouldbechosen,withpaymenttoA,ps(A)=(65+3)=4.Awouldreceiveaprotof1(afterpayingitscostof3toforward).Bmaythreatentounderstateitscostto1(resultinginFig.1)unlessAforwardssomeamount1ofitsprottoB.AhasincentivetopayB(andearn1)ratherthanallowBtounderstateitscost(andearn0).Ofcourse,byunderstatingitscost,Brunstheriskofnotcoveringitscosttoforwardtracforother(s;d)pairsforwhichBisontheleast-costpath.Ifthetotalprotfromextortingisgreaterthanthelossinprotfromunderstating,thenBhasincentivetoextort.Sourcenodesmaywishtopreventb2Bsfromextort-ingforthesamereasonsthatitwishestoboycottb:toprotectagainstbearningmoneyortomakeiteconom-icallyinfeasibleforbtoinspects'spackets.Topreventagainstextortionattacks,wemodifyAlgorithm2asfol-lows:Algorithm3VCGwithboycottingandanti-extortion1.Gatherc0(i;j)fromeachiforeach(i;j)2E.Ifi2Bs,ignorethestatedcostandsetitto0instead.2.Runsteps2{5ofAlgorithm2asstated.Theintuitionbehindthismodicationisthatsoughttoprovisionfortheworst-casescenario,inwhichbthreatenstounderstateitscostsasmuchaspossible(tozero).If,insodoing,bwouldnotmodifythechosenpath,thenbcannotextortanynodesonthepath.3.4CostRevelationWeinvestigatewhetherAlg.3givesincentivetonodeitotruthfullystateitsedgecosts.3.4.1BoycottedNodesSupposei2Bs.Asdiscussedabove,icouldemploypolicychangetotrytoremoveitselffromBs,butcanigainanyutilityfrommodifyingitsstatedcost?Evenifiweretoknowthatheisbeingboycottedbys,theanswertothisquestionis\no"byconstruction;therststepstakesistoignorei'sstatedcosts.Thisremoveseventhepossibilityofextortingothernodes,asihasnoleverageovers'sroutingdecisions.Thus,withrespecttoanynodeswithBs3i,i'sstrategysetiseectivelynil,andtruth-tellingisaweaklydominantstrategy(therearenootherstrategiesthatimprovei'spayout).3 3.4.2Non­BoycottednodesOurmechanismispowerfulinthatitisimpervioustoanycountermeasuresmadebytheboycottednodes.Weshowherethat,surprisingly,itisthenodesthatarenotboycottedwhomayhaveincentivetolieabouttheircosts.Fixnowani62Bs,andletusconsiderunderstatingandoverstatingc(i;j)separately.UnderstatingCosts.AsinstandardVCG,foranyi62Bs,ishouldnotunderstateitscosts.Considertheoutcomesofsettingc0(i;j)c(i;j).SinceourmechanismusesthesamepayoutsasVCG,wehavethesamepropertyoutlinedinSection2.2;icannotcontrolthepaymentthatitreceives:onlywhetherornotitisontheshortestcostpathfromstod,SCP(s;d;G).Ifbystatingitstruecostiwouldhavebeenontheshortestpathfromstod,thenigainsnoadditionalutilityfromunderstatingitscost.IfbystatingitstruecostiwasnotonSCP(s;d;G),thenstatingac0(i;j)c(i;j)couldputiontheshortestpath.However,asdescribedinSection2.2,theonlyassuranceihasisthatps(i)c0(i;j),henceihasnoguaranteethatitscostofforwardingwouldberecovered,andmightthereforedecreaseitsutility.OverstatingCosts.Supposerstthatbytruthfullyre-portingitscost,iwouldbeonSCP(s;d;G).Thenbyoverstatingitscost,iwouldrisknotbeingontheshortest-costpath;further,asabove,evenifitremainedonthepath,itwouldnotincreaseitsprot.InthecasewheretruthfulreportingwouldnotplaceionSCP(s;d;G),theproofofstandardVCGgoesasfollows:increasingitscostcannotmakeitspathshorter,andhenceicangainnoutilityinoverstating.However,inourmechanism,therearetwocasesinwhichidoesnotappearinSCP(s;d;G):Intherstcase,noneofi'sedgeswereculled;i'spathsimplycoststoomuchtobeconsideredbys,ashappenedwithnodeZinFig.1.AsinstandardVCG,suchanodeexperiencesnochangeinutilityfromoverstating.Inthesecondcasewhere,fori62SCP(s;d;g),iwouldhavebeenontheshortestpathbutatleastoneofitsedgeswasculledtoavoidaboycottednode,aswithnodeAinthegure.IfAweretohaveoverstateditscosttoB2Bstosomevaluegreaterthan2,thenswouldnothaveculledthe(A;C)edge.Aswiththeextortionattack,nodeAwillonlyhaveincentivetooverstateitscosttoBiftheprotgainedfromnodesboycottingBisgreaterthantheprotlostfromthosewhowouldhavegonethroughAtoBiftheedgecostless.Themostlikelyscenarioinwhichthisoccursiswhenamajorityofend-usersboycottB.3.4.3ASybilAttackAtransitnodecanincreasetheincentivethatithastooverstateitscoststoboycottednodeswiththefollowingSybilattack[7].SupposenodeihasnneighborsingraphG.Toensurethatiisaviabletransitnodeforanyend-usersforwhichiandatleasttwoofi'sneighborsarenotinBs,icancreaten2
pseudo-identities(\Sybils"),oneforeachpairofneighbors.EachsuchSybilconnectsonlythatpairofneighbors;weshowanexampleinFigure2.11313111311AsBAssdBsddBAABdFigure2:Acreates3
Sybils,atleastoneofwhichhasanedgetodthatswillnotcullwhileboy-cottingB.VariousschemesprotectagainstSybilattacks,suchaschargingeachparticipantanentryfee.Wedonotattempttoprovideasolutionhere,onlytopointoutthattransitnodesmayhaveincentivetoperformaSybilattackandacounter-measuremaybenecessarytosupportboycotting.AnISPisunlikelytobeabletolaunchsuchaSybilattack.3.5AddressingtheOverstatingofCostsUnfortunately,ourmechanismdoesnotensurethatnon-boycottednodeswilltruthfullyreporttheiredgecosts.Althoughthisholdsonlyinextremecases|whentheboy-cottednodeisboycottedbysomanyend-usersthatin-creasingitsstatedcostwouldnotcausealossofprot|wewouldliketohaveamechanismthatalwaysgivesincentivefortruthfulness.Webelievethatthereisnopaymentschemethatwillprovidethisincentive,butareunabletoprovideaproofatthistime.Addressingover-statingisthemostimportantopenprobleminthislineofwork.Weareconsideringheuristicstoaddressthisproblem,suchas:(1)IfatanypointAisfoundtobeoverstatingitscosts,orifitisfoundtobeforwardings'spacketsthroughsomenodeb2Bs,thensboycottsA,aswell.(2)scouldrequirethatAproveitscoststob.4.SIMULATIONRESULTSToobservethecostofboycotting,weevaluatedAlgo-rithms2and3withasimulator.Ourpreliminaryresultsindicatethatifanodecanbeboycotted,itcanbeboy-cottedcheaply.Weevaluateourmechanismbothinadhoctopologies(totestitongeneral,shortest-costpathnetworks)andonasubsetoftheInternetAStopology(whichallowsonlypolicy-compliantpaths).WirelessAdHocTopology.Thesimulationsusedaxedtopologyof130nodesthatwastakenfromawirelessadhocnetworkinPortland,OR[3].Nodeswithin250me-tersofeachothersharedanedge.Weassignededgescostsbetween1and20fromaZipfdistribution(mostedgeshavesmallercost).WechosetheZipfdistributiontomodelanetworkwithmanyhomogeneouslinksthatallowmostnodestocommunicatecheaplyandasmallnumberofmoreimportantlinkswhoseservicecomesatapremium.Foreachhsource,destinationipair,chosenatrandom,wecalculatedthecostoftheshortestpathfromthesourcetothedestinationusingVCG.Then,wesimu-latedthesourceboycottingeachnodealongthatshortestpathindividually,andwerantheboycottingmechanism4 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 0.1 1 10Cumulative fractionRatio to standard VCG paymentBoycottAnti-extortion 0 0.2 0.4 0.6 0.8 1 0 0.5 1 1.5 2 2.5 3 3.5 4Cumulative fractionRatio to shortest path costBoycottAnti-extortionFigure3:Comparingtheboycotting(Alg.2)andboycottingwithanti-extortion(Alg.3)mechanismstostandardVCG.Left:sumpaymentsmadebythesourcenode,normalizedtostandardVCG.Right:costofshortest-costpath,normalizedtostandardVCG.ThecostdistributionisZipf.andtheboycottingwithanti-extortionmechanism.WepresentourresultsinFigure3.VCGrequiresatleasttwopathsbetweenagivensourceanddestination(inordertocomputethemarginalbenetofeachedgeontheshortest-costpath),andourproposedmechanismsgenerallyrequiremore(toallowforcullededges).Otherwise,themechanismwillreturnaninnitecost.InthesamplerundepictedinFigure3,VCGre-turnedanitecostfor62.7%ofthehsource,destinationipairs,VCGwithboycottingreturnedanitecostfor51.6%ofthehsource,destination,boycottednodeitu-ples(10.6%ofthegraphsweredisconnected),andVCGwithboycottingandanti-extortionreturnedanitecostfor38.6%oftuples(17.2%ofgraphsweredisconnected).TheplotsinFigure3aretakenacross1082hsource,destination,boycottednodeituples,andarenormalizedtothestandardVCGcosts(whenthesourceisnotboy-cotting).IntermsofbothVCGcostandpathlength,thecostofboycottingandthecostofboycottingwithanti-extortionaresimilar.Webelievethisisbecausepathsarelikelytoincludecheapedges.Whenanodeonthepathisboycotted,itislikelythatthecostofitsoutgoingedgesisnearly1,sosettingthemto0(Alg.3)haslittleeectonwhetherornotthatpathisculled.Forabout25%ofpaths,thepathcostischeaperwhenanodeisboycotted.Thisispossibleinthefollowingscenario:thereisasinglecheappathfromthesourcetothedestination,andseveralmoreexpensivepathsthathavesimilarcoststoeachother.Whenanodeonthecheappathisboycotted,amoreexpensivepathmustbechosen.Sincetheexpensivepathsarepricedsimilarly,themarginalbenetofoneovertheotherislessthanthemarginalbenetofthecheappathovertheexpensivepaths.Inthiscase,VCGmayreportthatthecostofboycottingischeaperthanwhennoboycottingisdone.Thismayresultinsendersboycottingcertainnodestodecreasethecostoftheirpaths.InternetASTopology.Wealsoranexperimentstotrytodeterminehowfeasibleitwastoboycott\majorplayers"intheInternet.Forthissimulation,weusedagraphofthe1170nodeswithhighestdegreeintheInternetAStopology[18].Wesettheedgecostsofnodeitoblog2(degree(i))c+1,tomodelhigher-degreenodesasbe-ingmoreexpensive,buttakingthelogarithmtolimitthecostdisparity.Tomakesureourresultsdidnotdependonthechoiceofcostfunction,wealsoranseparateex-perimentssettingtheedgecostsofnodeitodegree(i)andtob1024=degree(i)c.Boycottingmany(upto15)tier-1ISPssimultaneously,nodeswerestillabletomain-tainconnectivityforalmostallrandomlychosenhsource,destinationipairs,forallmodelsofcostfunctions.How-ever,ourresultalmostcertainlyoverestimatesthecon-nectivitysinceweassumethatallremaininglinkscanbeusedforforwardinganypacket(regardlessoforigin).Inreality,manylinkswillbesubjecttoAS-localpolicy,andmaynotbeusedtoforwardthird-partytrac.5.IMPLICATIONSINTHEINTERNETTheboycottingmechanismwedescribedisnotfeasibleintoday'snetwork.Althoughtherearemechanismsforchoosingpaths(loosesourcerouting)andfordeterminingwhichAS-pathanext-hopISPmaychoose,boycottingisinfeasibleforthreereasons.First,sourcesdonot(andhavenomechanismto)payentitiesbeyondtheirneigh-bors.Paymentisinsteadachievedthroughlongstanding,pairwiseagreementsthatareunlikelytochangewhenaboycottbegins.Second,thecostofeachlinkiskeptse-cret,andmayvary,whichmeanssourcescannotreliablyestimatethe\cost"ofpreferringonepathoveranother,anestimatethatwouldbeneededtocompensatethenet-workimplementingtheroutechoice.Third,thepathapackettakescannotbeveried:aprovidermightacceptpaymentforboycottinganupstreamAS,butproceedtouseitanyway.Theeectivenessofaboycottderivesfromaquanti-ablelossinprotthatcanbetracedtoaspeciceventorgroupofaggrievedsources.Eithersuddenlyshiftingtracawayfromaboycottednodethreatenscongestion,oritrisksbeingnulliedbytracengineering.Overlays,andperhapsloosesourcerouting,provideamechanismforuserstobypassnetworkroutingtoemulateboycottpolicies.Toboycottmanynodeswouldrequiremanycooperatingoverlayparticipants.Toboycottwithhighvolumesoftracmaybeinfeasible,forperformance(forwardingmaybedicult)andbecauseISPtracen-5 gineersmayreadjusttracawayfromnewly-congestedlinks.Wewonderwhetheranoverlayroutingapproachcan(andshould)adaptquicklyenoughtocounteranytracengineeringinthemiddleofthenetwork.WithinBGP,oneASmaybeabletopartiallyboycottanotherbyinspectingpathsadvertisedbydierentup-streamprovidersandpreferringtheproviderwhoseroutesdonotincludetheboycottedISP.ThepartialboycottdoesnotchangeBGPinanyway.MIRO[20]wouldpro-videadditionalpowertothisapproachbyallowingastubAStochooseamongpathsoeredbyitsprovider.The\cost"ofthedecisionislocal,inthattheASchangingroutestoeectaboycottisnolongeroptimizingthepriorpathchoice.BeyondBGP,inter-domainroutingproposalshavebeenproposedtoallowusersortheirimmediateproviderISPstoexercisegreatercontroloverthepathstraversedbytheirpackets.Tracebackapproacheswouldallowuserstoverifythepathtakenbytheirpackets.Thecombina-tionofsourcecontrolandvericationproposedmaybesucientforimplementinganyboycottingschemeinafutureInternet.Thepotential\rexibilityoeredbysuchnetworksmotivatesourstudyofabstractVCGnetworks.6.RELATEDWORKResearchershaveappliedVCG-like[6,9,19]mecha-nismstoimproveroutingindistributedenvironments.NisanandRonen[14]provedthefeasibilityofstrate-gyproof,polynomialtimeVCGmechanismsfornetworksofselshusers.Thisresultmotivatedsignicantwork[1,8,11,15].AndereggandEidenbenzproposeAdhoc-VCG[1],aprotocoltondminimum-energypathsinmo-bileadhocnetworkswithselshparticipantsthatacceptpaymentsforforwardingdata.Feigenbaumetal.[8]builduponBGPtocomputeleast-costASpaths.TheyshowthatadistributedimplementationofVCGdoesnotre-quireconsiderablecost.Thesealgorithmscomputepathsthatareshortestbyasinglecostmetricanddonotcon-sideruser-speciedcriteriaforchoosingpaths.Providinguserswithautonomytochoosepathshasbeenproposedasameanstocircumventfailures[2]andimproveperformance[10,17].Usersoradministratorsofsmallernetworksgainthisautonomythroughsourcerout-ing[16,21],overlays[2,17],oralterationstoBGP[13,20].Thesemechanismsmaybeusefultowardimplement-ingaboycott,buttheresearchhasbeenfocusedonmorequantiablebenetsinperformanceandreliability.Inwirelessnetworks,blacklistingcanpreventlowqual-itylinksornodesfrombeingconsideredinthepathselec-tionprocess[4,5,12].However,blacklistingisnotdoneattherequestofthesender:anodeorlinkisremovedfromthenetworkifitsperformance,bysomemeasure,fallsbelowapredenedthreshold.7.CONCLUSIONSWeintroducedtheboycottasapolicygoalapplicabletoanetwork.WeshowedhowtoadapttheVCGroutingmodeltosupportboycottinggroupsofnodesandfoundthattruthfulreportingoflinkcostsremainsaweaklydominantstrategywhenboycottingisinfrequent.WesimulatedtheroutingpoliciesonadhocnetworkandAS-graphtopologiestoshowthatthecostofboycottingistypicallysmallandthatdisconnectednessisrare.Manyopenproblemsandresearchdirectionsremain.Currently,nodeshaveincentivetooverstatetheircoststoboycottednodes(eectivelydisassociatingthemselves),albeitonlywhentheboycottingiswide-spread.Ourworkassumesshortest-costrouting,butBGPrequirespathsto(also)bepolicy-compliant.Extendingourmechanismtoworkinthissettingiscrucialtounderstandingitsfeasi-bilityintheInternet.Also,webelieveboycottingmaybeusedasameansofsimulatingandestimatingthenet-work'sresiliencetocatastrophicfailure.8.ACKNOWLEDGMENTSThisworkwaspartiallysupportedbyNSFAwardsCNS-626636,CAREERANI-0092806,andafellowshipfromtheSloanFoundation.DaveLevinwasalsosupportedinpartbyaUMDCSDDeansfellowship.9.REFERENCES[1]L.AndereggandS.Eidenbenz.Adhoc-VCG:Atruthfulandcost-ecientroutingprotocolformobileadhocnetworkswithselshagents.InProc.ofMobiCom,2003.[2]D.G.Andersen,H.Balakrishnan,M.F.Kaashoek,andR.Morris.Resilientoverlaynetworks.InACMSOSP,2001.[3]H.Balakrishnan,etal.TheDistance-2MatchingProblemanditsRelationshiptotheMAC-LayerCapacityofAdHocWirelessNetworks.IEEEJSAC,22(6):1069{1079,2004.[4]M.Busse,T.Haenselmann,andW.Eelsberg.Energy-ecientforwardingschemesforwirelesssensornetworks.InWoWMoM,2006.[5]K.-W.Chin,J.Judge,A.Williams,andR.Kermode.ImplementationexperiencewithMANETroutingprotocols.SIGCOMMCCR,32(5):49{59,2002.[6]E.Clarke.Multipartpricingofpublicgoods.Publicchoice,11,1971.[7]J.Douceur.TheSybilAttack.InIPTPS,2002.[8]J.Feigenbaum,C.Papadimitriou,R.Sami,andS.Shenker.ABGP-basedmechanismforlowest-costrouting.InPODC,2002.[9]T.Groves.Incentivesinteams.Econometrica,41,1973.[10]K.Gummadi,etal.ImprovingthereliabilityofInternetpathswithone-hopsourcerouting.InOSDI,2004.[11]J.HershbergerandS.Suri.Vickreypricesandshortestpaths:Whatisanedgeworth?InFOCS,2001.[12]H.Lundgren,E.Nordstro,andC.Tschudin.CopingwithcommunicationgrayzonesinIEEE802.11bbasedad-hocnetworks.InWoWMoM,2002.[13]R.Mahajan,D.Wetherall,andT.Anderson.Negotiation-basedroutingbetweenneighboringISPs.InNSDI,2005.[14]N.NisanandA.Ronen.Algorithmicmechanismdesign.InACMSymposiumonTheoryofComputing,1999.[15]D.C.ParkesandJ.Shneidman.DistributedimplementationsofVickrey-Clarke-Grovesmechanisms.InACMAAMAS,2004.[16]B.RaghavanandA.C.Snoeren.Asystemforauthenticatedpolicycompliantrouting.InSIGCOMM,2004.[17]S.Savage,etal.Detour:InformedInternetroutingandtransport.IEEEMicro,19(1):50{59,1999.[18]http://www.caida.org/data/active/as-relationships/.[19]W.Vickrey.Counterspeculation,auctions,andcompetitivesealedtenders.JournalofFinance,16,1961.[20]W.XuandJ.Rexford.MIRO:Multi-pathinterdomainrouting.InACMSIGCOMM,2006.[21]X.Yang.NIRA:AnewInternetroutingarchitecture.InFDNA,2003.6