View - Dept. of IE, CUHK Personal User Web Server

Network Monitors and Contracting Systems:Competition and InnovationPaul LaskowskiJohn ChuangUC Berkeley{paul,chuang}@sims.berkeley.eduABSTRACTToday’s Internet industry suffers from several well-knownpathologies, but none is as destructive in the long term as itsresistance to evolution. Rather than introducing new services, ISPsare presently moving towards greater commoditization. It isapparent that the network’s primitive system of contracts does notalign incentives properly. In this study, we identify the network’slack of accountability as a fundamental obstacle to correcting thisproblem: Employing an economic model, we argue that optimalroutes and innovation are impossible unless new monitoringcapability is introduced and incorporated with the contractingsystem. Furthermore, we derive the minimum requirements amonitoring system must meet to support first-best routing andinnovation characteristics. Our work does not constitute a newprotocol; rather, we provide practical and specific guidance for thedesign of monitoring systems, as well as a theoretical framework toexplore the factors that influence innovation.Categories and Subject DescriptorsC.2.4 [Computer-Communication Networks]: DistributedSystems; J.4 [Social And Behavioral Sciences]: EconomicsGeneral TermsEconomics, Theory, Measurement, Design, Legal Aspects.KeywordsInnovation, Commoditization, Monitoring, Contracts, Incentives.1. INTRODUCTIONMany studies before us have noted the Internet’s resistance to newservices and evolution. In recent decades, numerous ideas havebeen developed in universities, implemented in code, and evenwritten into the routers and end systems of the network, only tolanguish as network operators fail to turn them on on a large scale.The list includes Multicast, IPv6, IntServ, and DiffServ. Lackingthe incentives just to activate services, there seems to be little hopeof ISPs devoting adequate resources to developing new ideas. In thelong term, this pathology stands out as a critical obstacle to thenetwork’s continued success (Ratnasamy, Shenker, and McCanneprovide extensive discussion in [11]).Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies arenot made or distributed for profit or commercial advantage and that copiesbear this notice and the full citation on the first page. To copy otherwise, orrepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.SIGCOMM’06, September 11–15, 2006, Pisa, Italy.Copyright 2006 ACM 1-59593-308-5/06/0009...$5.00.On a smaller time scale, ISPs shun new services in favor of costcutting measures. Thus, the network has characteristics of acommodity market. Although in theory, ISPs have a plethora ofrouting policies at their disposal, the prevailing strategy is to route inthe cheapest way possible [2]. On one hand, this leads directly tosuboptimal routing. More importantly, commoditization in the shortterm is surely related to the lack of innovation in the long term.When the routing decisions of others ignore quality characteristics,ISPs are motivated only to lower costs. There is simply no rewardfor introducing new services or investing in quality improvements.In response to these pathologies and others, researchers have putforth various proposals for improving the situation. These can bedivided according to three high-level strategies: The first attemptsto improve the status quo by empowering end-users. Clark, et al.,suggest that giving end-users control over routing would lead togreater service diversity, recognizing that some payment mechanismmust also be provided [5]. Ratnasamy, Shenker, and McCannepostulate a link between network evolution and user-directedrouting [11]. They propose a system of Anycast to give end-usersthe ability to tunnel their packets to an ISP that introduces adesirable protocol. The extra traffic to the ISP, the authors suggest,will motivate the initial investment.The second strategy suggests a revision of the contracting system.This is exemplified by MacKie-Mason and Varian, who propose a“smart market” to control access to network resources [10]. Pricesare set to the market-clearing level based on bids that users associateto their traffic. In another direction, Afergan and Wroclawskisuggest that prices should be explicitly encoded in the routingprotocols [2]. They argue that such a move would improve stabilityand align incentives.The third high-level strategy calls for greater networkaccountability. In this vein, Argyraki, et al., propose a system ofpacket obituaries to provide feedback as to which ISPs drop packets[3]. They argue that such feedback would help reveal which ISPswere adequately meeting their contractual obligations. Unlike thefirst two strategies, we are not aware of any previous studies thathave connected accountability with the pathologies ofcommoditization or lack of innovation.It is clear that these three strategies are closely linked to each other(for example, [2], [5], and [9] each argue that giving end-usersrouting control within the current contracting system isproblematic). Until today, however, the relationship between themhas been poorly understood. There is currently little theoreticalfoundation to compare the relative merits of each proposal, and aparticular lack of evidence linking accountability with innovationand service differentiation. This paper will address both issues.183

We will begin by introducing an economic network model thatrelates accountability, contracts, competition, and innovation. Ourmodel is highly stylized and may be considered preliminary: it isbased on a single source sending data to a single destination.Nevertheless, the structure is rich enough to expose previouslyunseen features of network behavior. We will use our model fortwo main purposes:First, we will use our model to argue that the lack of accountabilityin today’s network is a fundamental obstacle to overcoming thepathologies of commoditization and lack of innovation. In otherwords, unless new monitoring capabilities are introduced, andintegrated with the system of contracts, the network cannot achieveoptimal routing and innovation characteristics. This result providesmotivation for the remainder of the paper, in which we explore howaccountability can be leveraged to overcome these pathologies andcreate a sustainable industry. We will approach this problem from aclean-slate perspective, deriving the level of accountability neededto sustain an ideal competitive structure.When we say that today’s Internet has poor accountability, we meanthat it reveals little information about the behavior – or misbehavior– of ISPs. This well-known trait is largely rooted in the network’shistory. In describing the design philosophy behind the Internetprotocols, Clark lists accountability as the least important amongseven “second level goals.” [4] Accordingly, accountabilityreceived little attention during the network’s formative years. Clarkrelates this to the network’s military context, and finds that had thenetwork been designed for commercial development, accountabilitywould have been a top priority.Argyraki, et al., conjecture that applying the principles of layeringand transparency may have led to the network’s lack ofaccountability [3]. According to these principles, end hosts shouldbe informed of network problems only to the extent that they arerequired to adapt. They notice when packet drops occur so that theycan perform congestion control and retransmit packets. Details ofwhere and why drops occur are deliberately concealed.The network’s lack of accountability is highly relevant to adiscussion of innovation because it constrains the system ofcontracts. This is because contracts depend upon externalinstitutions to function – the “judge” in the language of incompletecontract theory, or simply the legal system. Ultimately, if a judgecannot verify that some condition holds, she cannot enforce acontract based on that condition. Of course, the vast majority ofcontracts never end up in court. Especially when a judge’s ruling iseasily predicted, the parties will typically comply with the contractterms on their own volition. This would not be possible, however,without the judge acting as a last resort.An institution to support contracts is typically complex, but weabstract it as follows: We imagine that a contract is an algorithmthat outputs a payment transfer among a set of ISPs (the parties) atevery time. This payment is a function of the past and presentbehaviors of the participants, but only those that are verifiable.Hence, we imagine that a contract only accepts “proofs” as inputs.We will call any process that generates these proofs a contractiblemonitor. Such a monitor includes metering or sensing devices onthe physical network, but it is a more general concept. Constructinga proof of a particular behavior may require readings from variousdevices distributed among many ISPs. The contractible monitorincludes whatever distributed algorithmic mechanism is used tomotivate ISPs to share this private information.Figure 1 demonstrates how our model of contracts fits together. Wemake the assumption that all payments are mediated by contracts.This means that without contractible monitors that attest to, say,latency, payments cannot be conditioned on latency.NetworkBehaviorMonitorProofContractFigure 1: Relationship between monitors and contractsWith this model, we may conclude that the level of accountability intoday’s Internet only permits best effort contracts. Nodes cannotcondition payments on either quality or path characteristics.Is there anything wrong with best-effort contracts? The readermight wonder why the Internet needs contracts at all. After all, innon-network industries, traditional firms invest in research anddifferentiate their products, all in the hopes of keeping theircustomers and securing new ones. One might believe that suchmarket forces apply to ISPs as well. We may adopt this as our nullhypothesis:Null hypothesis: Market forces are sufficient to maintain servicediversity and innovation on a network, at least to the same extentas they do in traditional markets.There is a popular intuitive argument that supports this hypothesis,and it may be summarized as follows:Intuitive argument supporting null hypothesis:Payments1. Access providers try to increase their quality to get moreconsumers.2. Access providers are themselves customers for second hopISPs, and the second hops will therefore try to provide highqualityservice in order to secure traffic from accessproviders. Access providers try to select high quality transitbecause that increases their quality.3. The process continues through the network, giving everyISP a competitive reason to increase quality.We are careful to model our network in continuous time, in order tocapture the essence of this argument. We can, for example, specifyequilibria in which nodes switch to a new next hop in the event of aquality drop.Moreover, our model allows us to explore any theoretically possiblepunishments against cheaters, including those that are costly forend-users to administer. By contrast, customers in the real worldrarely respond collectively, and often simply seek the best dealcurrently offered. These constraints limit their ability to punishcheaters.Even with these liberal assumptions, however, we find that we mustreject our null hypothesis. Our model will demonstrate thatidentifying a cheating ISP is difficult under low accountability,limiting the threat of market driven punishment. We will define anindex of commoditization and show that it increases without boundas data paths grow long. Furthermore, we will demonstrate aframework in which an ISP’s maximum research investmentdecreases hyperbolically with its distance from the end-user.184

41 BackgroundIn 1969, I was employed at the “Swedish Pulp and Paper Research Institute” (in the followingreferred to as STFI, see footnote) with the task to build up a Physics Department. This was aconsequence of a major reorganization during 1968, when the governmentally operated“Svenska Träforskninginstitutet” was merged with surrounding laboratories run by differentsectors of the forest industry, for example the pulping industry and the papermakingindustry. In 1979, I was appointed vice president of STFI. I remained in that position till 2003when STFI merged with the packaging research institute “Packforsk” and I was approachingthe normal retirement age in Sweden of 65. However, I kept working full time for anotherfive years, mainly concerned with European research matters and in particular with theForest-based Sector Technology Platform (FTP) as described in chapter 4.Rather early, I had in mind to one day write the history of STFI as I had experienced so muchof its developments after the reorganization in 1968. In the summer of 2010 I finally gotstarted and in December 2011 a quite extensive book “STFIs öden och äventyr 1942-2010,fakta - minnen - reflexioner” was published. In English, the title would be something like“STFI´s fates/destinies and adventures 1942-2010, facts - memories - reflections”. One of thechapters deals with the development of the European pulp and paper research co-operation.Later, the idea came up that this chapter might perhaps be of interest also to some readersoutside Sweden. So, an edited English version is presented here. The book also containschapters on public research policies with respect to the forest-based sector. One of thesechapters deals with the research and innovation policies of the EU over the years. Thatmaterial is not covered here.2. The early daysThe major part of this document covers the period after I got involved in EU-sponsoredresearch, i.e. after the early 1980s. It might, however, be of interest to just briefly try tosketch out to what extent research co-operation across national borders in Europe existedFootnote: The institute, where I have been working for so long, was originally named“Svenska Träforskningsinstitutet”–most often referred to as “STFI” and in English “SwedishPulp and Paper Research Institute”. When the wood-technology research was moved to anew institute, the name was changed to “Skogsindustrins Tekniska Forskningsinstitut”. Later,the institute changed its legal status from being a foundation to an incorporated company,and the name was changed to “STFI AB”. Following a merger with the packaging researchinstitute Packforsk, the name was changed to “STFI-Packforsk AB”. In 2004, the institute PFIin Norway was incorporated in STFI. Today, the name of the institute is “Innventia AB”,working as an international research company under the slogan “Boosting business withscience”.

By adding verifiability to our monitors, identifying a single cheateris straightforward. The cheater is the node that cannot produceproof that the rest of path quality decreased. This means that thenegative results of the previous section no longer hold. Forexample, the following lemma stands in contrast to Lemma 1.Lemma 2. With monitors E2E v , ROP v , and PR c , and provided thatthe node before each potential cheater has an alternate next hop thatisn’t more expensive, it is possible to enforce any data path in SPEso long as the maximum temptation is less than what can be deterredin finite time, y 1 ≤(5) πt0max −rtre0Proof. This lemma follows because nodes can share proofs toidentify who the cheater is. Only that node must be punished inequilibrium, and the preceding node does not lose any payoff inadministering the punishment. With this lemma in mind, it is easy to construct counterexamples toClaim 1 and Claim 2 in this new environment.Unfortunately, there are at least four reasons not to be satisfied withthis improved monitoring system. The first, and weakest reason isthat the maximum temptation remains finite, causing somedistortion in routes or payments. Each node along a route mustextract some positive profit unless the next hop is also the cheapest.Of course, if t 0 is small, this effect is minimal.The second, and more serious reason is that we have always givenour source the ability to commit to any punishment. Real worldusers are less likely to act collectively, and may simply search forthe best service currently offered. Since punishment phases aregenerally characterized by a drop in quality, real world end-usersmay take this opportunity to shop for a new access provider. Thiswill make nodes less motivated to administer punishments.The third reason is that Lemma 2 does not apply to cheating bycoalitions. A coalition node may pretend to punish its successor,but instead enjoy a secret payment from the cheating node.Alternately, a node may bribe its successor to cheat, if thepunishment phase is profitable, and so forth. The requireddiscounted time for punishment may increase exponentially in thenumber of coalition members, just as in the previous section!The final reason not to accept this monitoring system is that when acheater is punished, the path will often be routed around not just theoffender, but around other nodes as well. Effectively, innocentnodes will be punished along with the guilty. In our abstract model,this doesn’t cause trouble since the punishment falls off theequilibrium path. The effects are not so benign in the real world.When ISPs lie in sequence along a data path, they contributecomplementary services, and their relationship is vertical. From theperspective of other source-destination pairs, however, these samefirms are likely to be horizontal competitors. Because of this, anode might deliberately cheat, in order to trigger punishment foritself and its neighbors. By cheating, the node will save money tosome extent, so the cheater is likely to emerge from the punishmentphase better off than the innocent nodes. This may give the cheatera strategic advantage against its competitors. In the extreme, thecheater may use such a strategy to drive neighbors out of business,and thereby gain a monopoly on some routes.5. CONTRACTIBLE MONITORSAt the end of the last section, we identified several drawbacks thatpersist in an environment with E2E v , ROP v , and PR c . In thissection, we will show how all of these drawbacks can be overcome.To do this, we will require our third and final category of monitor:A contractible monitor is simply a verifiable monitor that generatesproofs that can serve as input to a contract. Thus, contractible isjointly a property of the monitor and the institutions that must verifyits proofs. Contractibility requires that a court,1. Can verify the monitor’s proofs.2. Can understand what the proofs and contracts represent tothe extent required to police illegal activity.3. Can enforce payments among contracting parties.Understanding the agreements between companies has traditionallybeen a matter of reading contracts on paper. This may prove to be aharder task in a future network setting. Contracts may plausibly benegotiated by machine, be numerous, even per-flow, and be furthercomplicated by the many dimensions of quality.When a monitor (together with institutional infrastructure) meetsthese criteria, we will label it with a subscript c, for contractible.The reader may recall that this is how we labeled the packetsreceived monitor, PR c , which allows ISPs to form contracts withper-packet payments. Similarly, E2E c and ROP c are contractibleversions of the monitors we are now familiar with.At the end of the previous section, we argued for some desirableproperties that we’d like our solution to have. Briefly, we wouldlike to enforce optimal data paths with an equilibrium concept thatdoesn’t rely on re-routing for punishment, is coalition proof, anddoesn’t punish innocent nodes when a coalition cheats. We will callsuch an equilibrium a fixed-route coalition-proof protect-theinnocentequilibrium.As the next claim shows, ROP c allows us to create a system oflinear (price, quality) contracts under just such an equilibrium.Claim 3. With ROP c , for any feasible and consistent assignment ofrest of path qualities to nodes, and any corresponding paymentschedule that yields non-negative payoffs, these qualities can bemaintained with bilateral contracts in a fixed-route coalition-proofprotect-the-innocent equilibrium.Proof: Fix any data path consistent with the given rest of pathqualities. Select some monetary punishment, P, large enough toprevent any cheating for time t 0 (the discounted total payment fromthe source will work). Let each node on the path enter into acontract with its parent, which fixes an arbitrary payment scheduleso long as the rest of path quality is as prescribed. When the parentnode, which has ROP c , submits a proof that the rest of path qualityis less than expected, the contract awards her an instantaneoustransfer, P, from the downstream node. Such proofs can besubmitted every t 0 for the previous interval.Suppose now that a coalition, C, decides to cheat. The sourcemeasures a decrease in quality, and according to her contract, isawarded P from the first hop. This means that there is a net outflowof P from the ISPs as a whole. Suppose that node i is not in C. Inorder for the parent node to claim P from i, it must submit proof thatthe quality of the path starting at i is not as prescribed. This means190

that there is a cheater after i. Hence, i would also have detected achange in quality, so i can claim P from the next node on the path.Thus, innocent nodes are not punished. The sequence of paymentsmust end by the destination, so the net outflow of P must come fromthe nodes in C. This establishes all necessary conditions of theequilibrium. Essentially, ROP c allows for an implementation of (price, quality)contracts. Building upon this result, we can construct competitiongames in which nodes offer various qualities to each other atspecified prices, and can credibly commit to meet theseperformance targets, even allowing for coalitions and a desire todamage other ISPs.Example 1. Define a Stackelberg price-quality competition gameas follows: Extend the partial order of nodes induced by the graphto any complete ordering, such that downstream nodes appearbefore their parents. In this order, each node selects a contract tooffer to its parents, consisting of a rest of path quality, and a linearprice. In the routing game, each node selects a next hop at everytime, consistent with its advertised rest of path quality. TheStackelberg price-quality competition game can be implemented inour model with ROP c monitors, by using the strategy in the proof,above. It has the following useful property:Claim 4. The Stackelberg price-quality competition game yieldsoptimal routes in SPE.The proof is given in the appendix. This property is favorable froman innovation perspective, since firms that invest in high quality willtend to fall on the optimal path, gaining positive payoff. In general,however, investments may be over or under rewarded. Extraconditions may be given under which innovation decisions approachperfect efficiency for large innovations. We omit the full analysishere. Example 2. Alternately, we can imagine that players report theirprivate information to a central authority, which then assigns allcontracts. For example, contracts could be computed to implementthe cost-minimizing VCG mechanism proposed by Feigenbaum, etal. in [7]. With ROP c monitors, we can adapt this mechanism tomaximize welfare. For node, i, on the optimal path, L, the netpayment must equal, essentially, its contribution to the welfare of S,D, and the other nodes. If L’ is an optimal path in the graph with iremoved, the profit flow to i is,( qL) − u( qL') − cj + u c j , (6)j∈L,j≠ij∈L'where q L and q L'are the qualities of the two paths. Here, (price,quality) contracts ensure that nodes report their qualities honestly.The incentive structure of the VCG mechanism is what motivatesnodes to report their costs accurately.A nice feature of this game is that individual innovation decisionsare efficient, meaning that a node will invest in an innovationwhenever the investment cost is less than the increased welfare ofthe optimal data path. Unfortunately, the source may end up payingmore than the utility of the path. Notice that with just E2E c , a weaker version of Claim 3 holds.Bilateral (price, quality) contracts can be maintained in anequilibrium that is fixed-route and coalition-proof, but not protectthe-innocent.This is done by writing contracts to punish everyoneon the path when the end to end quality drops. If the path length isn, the first hop pays nP to the source, the second hop pays ( n − 1)Pto the first, and so forth. This ensures that every node is punishedsufficiently to make cheating unprofitable. For the reasons we gavepreviously, we believe that this solution concept is less than ideal,since it allows for malicious nodes to deliberately triggerpunishments for potential competitors.Up to this point, we have adopted fixed-route coalition-proofprotect-the-innocent equilibrium as our desired solution concept,and shown that ROP c monitors are sufficient to create somecompetition games that are desirable in terms of service diversityand innovation. As the next claim will show, rest of pathmonitoring is also necessary to construct such games under oursolution concept.Before we proceed, what does it mean for a game to be desirablefrom the perspective of service diversity and innovation? We willuse a very weak assumption, essentially, that the game is not fullycommoditized for any node. The claim will hold for this entire classof games.Definition: A competition game is nowhere-commoditized if foreach node, i, not adjacent to D, there is some assignment of qualitiesand marginal costs to nodes, such that the optimal data path includesi, and i has a positive temptation to cheat.In the case of linear contracts, it is sufficient to require that I C < ∞ ,and that every node make positive profit under some assignment ofqualities and marginal costs.Strictly speaking, ROP c monitors are not the only way to constructthese desirable games. To prove the next claim, we must broadenour notion of rest of path monitoring to include the similar ROP c ’monitor, which attests to the quality starting at its own node,through the end of the path. Compare the two monitors below:ROP c : gives a node proof that the path quality from the next nodeto the destination is not correct.ROP c ’: gives a node proof that the path quality from that node tothe destination is correct.We present a simplified version of this claim, by including anassumption that only one node on the path can cheat at a time(though conspirators can still exchange side payments). We willdiscuss the full version after the proof.Claim 5. Assume a set of monitors, and a nowhere-commoditizedbilateral contract competition game that always maintains theoptimal quality in fixed-route coalition-proof protect-the-innocentequilibrium, with only one node allowed to cheat at a time. Thenfor each node, i, not adjacent to D, either i has an ROP c monitor, ori’s children each have an ROP c ’ monitor.Proof: First, because of the fixed-route assumption, punishmentsmust be purely monetary.Next, when cheating occurs, if the payment does not go to thesource or destination, it may go to another coalition member,rendering it ineffective. Thus, the source must accept somemonetary compensation, net of its normal flow payment, whencheating occurs. Since the source only contracts with the first hop,it must accept this money from the first hop. The source’s contractmust therefore distinguish when the path quality is normal fromwhen it is lowered by cheating. To do so, it can either accept proofs191

from the source, that the quality is lower than required, or it canaccept proofs from the first hop, that the quality is correct. Thesenodes will not rationally offer the opposing type of proof.By definition, any monitor that gives the source proof that the pathquality is wrong is an ROP c monitor. Any monitor that gives thefirst hop proof that the quality is correct is a ROP c ’ monitor. Thus,at least one of these monitors must exist.By the protect-the-innocent assumption, if cheating occurs, but thefirst hop is not a cheater, she must be able to claim the same sizereward from the next ISP on the path, and thus “pass on” thepunishment. The first hop’s contract with the second must thendistinguish when cheating occurs after the first hop. By argumentsimilar to that for the source, either the first hop has a ROP cmonitor, or the second has a ROP c ’ monitor. This argument can beiterated along the entire path to the penultimate node before D.Since the marginal costs and qualities can be arranged to make anypath the optimal path, these statements must hold for all nodes andtheir children, which completes the proof. The two possibilities for monitor correspond to which node has theburden of proof. In one case, the prior node must prove thesuboptimal quality to claim its reward. In the other, the subsequentnode must prove that the quality was correct to avoid penalty.Because the two monitors are similar, it seems likely that theyrequire comparable costs to implement. If submitting the proofs iscostly, it seems natural that nodes would prefer to use the ROP cmonitor, placing the burden of proof on the upstream node.Finally, we note that it is straightforward to derive the full version ofthe claim, which allows for multiple cheaters. The onlycomplication is that cheaters can exchange side payments, whichmakes any money transfers between them redundant. Because ofthis, we have to further generalize our rest of path monitors, so theyare less constrained in the case that there are cheaters on either side.5.1 Implementing MonitorsClaim 5 should not be interpreted as a statement that each node mustcompute the rest of path quality locally, without input from othernodes. Other monitors, besides ROP c and ROP c ’ can still be used,loosely speaking, as building blocks. For instance, networktomography is concerned with measuring properties of the networkinterior with tools located at the edge. Using such techniques, oursource might learn both individual node qualities and the data path.This is represented by the following two monitors:SHOP c i : (source-based hop quality) A monitor that gives thesource proof of what the quality of node i is.SPATH c : (source-based path) A monitor that gives the sourceproof of what the data path is at any time, at least as far as itmatches the equilibrium path.With these monitors, a punishment mechanism can be designed tofulfill the conditions of Claim 5. It involves the source sharing theproofs it generates with nodes further down the path, which usethem to determine bilateral payments. Ultimately however, theproof of Claim 5 shows us that each node i’s bilateral contractsrequire proof of the rest of path quality. This means that node i (orpossibly its children) will have to combine the proofs that theyreceive to generate a proof of the rest of path quality. Thus, thecombined process is itself a rest of path monitor.What we have done, all in all, is constructed a rest of path monitoriusing SPATH c and SHOP c as building blocks. Our new monitorincludes both the component monitors and whatever distributedalgorithmic mechanism exists to make sure nodes share their proofscorrectly.This mechanism can potentially involve external institutions. For aconcrete example, suppose that when node i suspects it is gettingpoor rest of path quality from its successor, it takes the downstreamnode to court. During the discovery process, the court subpoenasproofs of the path and of node qualities from the source (ultimately,there must be some threat to ensure the source complies). Finally,for the court to issue a judgment, one party or the other mustcompile a proof of what the rest of path quality was. Hence, theentire discovery process acts as a rest of path monitor, albeit a rathercostly monitor in this case.Of course, mechanisms can be designed to combine these monitorsat much lower cost. Typically, such mechanisms would call forautomatic sharing of proofs, with court intervention only as a lastresort. We defer these interesting mechanisms to future work.iAs an aside, intuition might dictate that SHOP c generates moreinformation than ROP c ; after all, inferring individual node qualitiesseems a much harder problem. Yet, without path information,iSHOP c is not sufficient for our first-best innovation result. Theproof of this demonstrates a useful technique:iClaim 6. With monitors E2E, ROP, SHOP c and PR c , and anowhere-commoditized bilateral contract competition game, theoptimal quality cannot be maintained for all assignments of qualityand marginal cost, in fixed-route coalition-proof protect-theinnocentequilibrium.Proof: Because nodes cannot verify the data path, they cannot forma proof of what the rest of path quality is. Hence, ROP c monitors donot exist, and therefore the requirements of Claim 5 cannot hold. 6. CONCLUSIONS AND FUTURE WORKIt is our hope that this study will have a positive impact in at leastthree different ways. The first is practical: we believe our analysishas implications for the design of future monitoring protocols andfor public policy.For protocol designers, we first provide fresh motivation to createmonitoring systems. We have argued that the poor accountability ofthe Internet is a fundamental obstacle to alleviating the pathologiesof commoditization and lack of innovation. Unless accountabilityimproves, these pathologies are guaranteed to remain.Secondly, we suggest directions for future advances in monitoring.We have shown that adding verifiability to monitors allows forsome improvements in the characteristics of competition. At thesame time, this does not present a fully satisfying solution. Thispaper has suggested a novel standard for monitors to aspire to – oneof supporting optimal routes in innovative competition games underfixed-route coalition-proof protect-the-innocent equilibrium. Wehave shown that under bilateral contracts, this specifically requirescontractible rest of path monitors.This is not to say that other types of monitors are unimportant. Weincluded an example in which individual hop quality monitors and apath monitor can also meet our standard for sustaining competition.However, in order for this to happen, a mechanism must be included192

to combine proofs from these monitors to form a proof of rest ofpath quality. In other words, the monitors must ultimately becombined to form contractible rest of path monitors. To supportservice differentiation and innovation, it may be easier to design restof path monitors directly, thereby avoiding the task of designingmechanisms for combining component monitors.As far as policy implications, our analysis points to the need forlegal institutions to enforce contracts based on quality. Theseinstitutions must be equipped to verify proofs of quality, and policeillegal contracting behavior. As quality-based contracts becomenumerous and complicated, and possibly negotiated by machine,this may become a challenging task, and new standards andregulations may have to emerge in response. This remains aninteresting and unexplored area for research.The second area we hope our study will benefit is that of clean-slatearchitectural design. Traditionally, clean-slate design tends to focuson creating effective and elegant networks for a static set ofrequirements. Thus, the approach is often one of engineering,which tends to neglect competitive effects. We agree withRatnasamy, Shenker, and McCanne, that designing for evolutionshould be a top priority [11]. We have demonstrated that thenetwork’s monitoring ability is critical to supporting innovation, asare the institutions that support contracting. These elements shouldfeature prominently in new designs. Our analysis specificallysuggests that architectures based on bilateral contracts shouldinclude contractible rest of path monitoring. From a clean-slateperspective, these monitors can be transparently and fully integratedwith the routing and contracting systems.Finally, the last contribution our study makes is methodological.We believe that the mathematical formalization we present isapplicable to a variety of future research questions. While asignificant literature addresses innovation in the presence ofnetwork effects, to the best of our knowledge, ours is the first modelof innovation in a network industry that successfully incorporatesthe actual topological structure as input. This allows the discoveryof new properties, such as the weakening of market forces with thenumber of ISPs on a data path that we observe with lowaccountability.Our method also stands in contrast to the typical approach ofdistributed algorithmic mechanism design. Because this field isbased on a principle-agent framework, contracts are usuallyproposed by the source, who is allowed to make a take it or leave itoffer to network nodes. Our technique allows contracts to emergefrom a competitive framework, so the source is limited to selectingthe most desirable contract. We believe this is a closer reflection ofthe industry.Based on the insights in this study, the possible directions for futureresearch are numerous and exciting. To some degree, contractingbased on quality opens a Pandora’s Box of pressing questions: Doquality-based contracts stand counter to the principle of networkneutrality? Should ISPs be allowed to offer a choice of contracts atdifferent quality levels? What anti-competitive behaviors areenabled by quality-based contracts? Can a contracting systemsupport optimal multicast trees?In this study, we have focused on bilateral contracts. This systemhas seemed natural, especially since it is the prevalent system on thecurrent network. Perhaps its most important benefit is that eachcontract is local in nature, so both parties share a common, familiarlegal jurisdiction. There is no need to worry about who will enforcea punishment against another ISP on the opposite side of the planet,nor is there a dispute over whose legal rules to apply in interpretinga contract.Although this benefit is compelling, it is worth considering othersystems. The clearest alternative is to form a contract between thesource and every node on the path. We may call these sourcecontracts. Source contracting may present surprising advantages.For instance, since ISPs do not exchange money with each other, anISP cannot save money by selecting a cheaper next hop.Additionally, if the source only has contracts with nodes on theintended path, other nodes won’t even be willing to accept packetsfrom this source since they won’t receive compensation for carryingthem. This combination seems to eliminate all temptation for asingle cheater to cheat in route. Because of this and otherencouraging features, we believe source contracts are a fertile topicfor further study.Another important research task is to relax our assumption thatquality can be measured fully and precisely. One possibility is toassume that monitoring is only probabilistic or suffers from noise.Even more relevant is the possibility that quality monitors arefundamentally incomplete. A quality monitor can never anticipateevery dimension of quality that future applications will care about,nor can it anticipate a new and valuable protocol that an ISPintroduces. We may define a monitor space as a subspace of thequality space that a monitor can measure, M ⊂ Q , and acorresponding monitoring function that simply projects the fullrange of qualities onto the monitor space, m : Q → M .Clearly, innovations that leave quality invariant under m are noteasy to support – they are invisible to the monitoring system. In thisenvironment, we expect that path monitoring becomes moreimportant, since it is the only way to ensure data reaches certaininnovator ISPs. Further research is needed to understand thisprocess.7. ACKNOWLEDGEMENTSWe would like to thank the anonymous reviewers, Jens Grossklags,Moshe Babaioff, Scott Shenker, Sylvia Ratnasamy, and Hal Varianfor their comments. This work is supported in part by the NationalScience Foundation under ITR award ANI-0331659.8. REFERENCES[1] Afergan, M. Using Repeated Games to Design Incentive-Based Routing Systems. In Proceedings of IEEE INFOCOM(April 2006).[2] Afergan, M. and Wroclawski, J. On the Benefits andFeasibility of Incentive Based Routing Infrastructure. In ACMSIGCOMM'04 Workshop on Practice and Theory of Incentivesin Networked Systems (PINS) (August 2004).[3] Argyraki, K., Maniatis, P., Cheriton, D., and Shenker, S.Providing Packet Obituaries. In Third Workshop on Hot Topicsin Networks (HotNets) (November 2004).[4] Clark, D. D. The Design Philosophy of the DARPA InternetProtocols. In Proceedings of ACM SIGCOMM (1988).193

[5] Clark, D. D., Wroclawski, J., Sollins, K. R., and Braden, R.Tussle in cyberspace: Defining tomorrow's internet. InProceedings of ACM SIGCOMM (August 2002).[6] Dang-Nguyen, G. and Pénard, T. Interconnection Agreements:Strategic Behaviour and Property Rights. In Brousseau, E. andGlachant, J.M. Eds. The Economics of Contracts: Theories andApplications, Cambridge University Press, 2002.[7] Feigenbaum, J., Papadimitriou, C., Sami, R., and Shenker, S.A BGP-based Mechanism for Lowest-Cost Routing.Distributed Computing 18 (2005), pp. 61-72.[8] Huston, G. Interconnection, Peering, and Settlements. Telstra,Australia.[9] Liu, Y., Zhang, H., Gong, W., and Towsley, D. On theInteraction Between Overlay Routing and Traffic Engineering.In Proceedings of IEEE INFOCOM (2005).[10] MacKie-Mason, J. and Varian, H. Pricing the Internet. InKahin, B. and Keller, J. Eds. Public access to the Internet.Englewood Cliffs, NJ; Prentice-Hall, 1995.[11] Ratnasamy, S., Shenker, S., and McCanne, S. Towards anEvolvable Internet Architecture. In Proceeding of ACMSIGCOMM (2005).[12] Shakkottai, S., and Srikant, R. Economics of Network Pricingwith Multiple ISPs. In Proceedings of IEEE INFOCOM(2005).9. APPENDIXProof of Claim 2. Node i must fall on the equilibrium data path toreceive any payment. Let the prices along the data path bePS = p1 , p2,...pn= p , with marginal costs, c 1 ,..., cn. We mayassume the prices on the path are greater than p l or the claimfollows trivially. Each node along the data path can cheat in routeby giving data to the bargain path at price no more than p l . Sonode j’s temptation to cheat is at leastp j − c j − plp − p≥ l . Then Lemma 1 gives,p j − c j − p j+ 1 p j − p j+1n−1 p − p − − − ≥ l p pl p p ⋅...⋅ l p pT > 1 n − l(7)p1− p2p2− p3pn−1− p PS1/ ( n−1T)This can be rearranged to give p ≤ pl+ Ps, as required.( n −1) The rest of the claim simply recognizes that p / r is the greatestreward node i can receive for its investment, so it will not investsums greater than this. Proof of Claim 4. Label the nodes 1,2,.. N in the order in whichthey select contracts. Let subgame n be the game that begins with nchoosing its contract. Let L n be the set of possible paths restricted tonodes n,…,N. That is, L n is the set of possible routes from S toreach some node that has already moved.For subgame n, define the local welfare over pathspossible next hops,j < n as follows,l ∈ Ln, and theirV ( l, j) = u( ql* q j path ) −ci− p j , (8)i∈lwhere q l is the quality of path l in the set {n,…,N}, and q j path andp j are the quality and price of the contract j has offered.For induction, assume that subgame n + 1 maximizes local welfare.We show that subgame n does as well. If node n selects next hop k,we can write the following relation,V( l n) = V (( l,n), k) − pn+ cn+ pk= V (( l,n), k ) −πn, , (9)where n is node n’s profit if the path to n is chosen. This path ischosen whenever V ( l, n)is maximal over L n+1 and possible nextV l, n , k is maximal over L n , it is also maximal over thehops. If (( ) )paths in L n+1 that don’t lead to n. This means that node n can choosesome n small enough so that V ( l, n)is maximal over L n+1 , so theroute will lead to k.Conversely, if V (( l n), k), is not maximal over L n , either V is greaterfor another of n’s next hops, in which case n will select that one inorder to increase n , or V is greater for some path in L n+1 that don’tlead to n, in which case V ( l, n)cannot be maximal for any nonnegative n .Thus, we conclude that subgame n maximizes local welfare. For theinitial case, observe that this assumption holds for the source.Finally, we deduce that subgame 1, which is the entire game,maximizes local welfare, which is equivalent to actual welfare.Hence, the Stackelberg price-quality game yields an optimal route.194