Toward a Lightweight Model of BGP Safety

For the past ten years, researchers have used the Stable Paths Problem (SPP) to analyze the stability properties of the Border Gateway Protocol (BGP). Analysis of SPP has revealed several combinations of topologies and routing configurations (or gadgets) where BGP cannot converge to a unique stable solution. Researchers typically analyze SPP by hand, using a trial-anderror process to (i) generate small SPP instances that exhibit undesirable properties and (ii) prove sufficient conditions for SPP solvability. In this paper, we present a formal, machine-readable SPP model encoded in the Alloy lightweight modeling language. The model consists of nodes with ranked sets of permitted paths, and a set of predicates for analyzing SPP instances. We also present an automated way to generate the smallest set of unique gadgets with no stable solution, or multiple stable solutions, including some previously-unknown gadgets. We use our model to verify sufficient conditions on SPP instances (e.g., “no dispute wheel implies a unique stable solution”), illustrating how our Alloy model can aid researchers in analyzing BGP.