WO2007121627A1

WO2007121627A1 - A system for detecting the running information consistency of border gateway protocol nodes and a method thereof

Info

Publication number: WO2007121627A1
Application number: PCT/CN2006/003238
Authority: WO
Inventors: Ye Zhao
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-04-24
Filing date: 2006-11-30
Publication date: 2007-11-01
Also published as: WO2007121627A8; CN101047565A

Abstract

A system for detecting the running information consistency of BGP nodes including more than one BGP node still comprises: a management module, for maintaining the anticipative running information and transferring the anticipative running information to a consistency detection module; the consistency detection module, for determining whether the anticipative running information transferred by the management module is consistent with the actual running information obtained from the BGP node. Also a method detecting the running information consistency of BGP nodes includes: the consistency detection module obtains the anticipative running information from the management module and the actual running information from the BGP node; the consistency detection module determines whether the anticipative running information is consistent with the actual running information. Using the technical solution according to the invention, the running information consistency detection in the AS domain is implemented without initiating manually and reflexes whether there is any problem in the network. Thereby the security of BGP is ensured in real time and automatically, and the solution has broad applicability.

Description

System and method for detecting boundary information of node gateway protocol node operation

The present invention relates to the field of Internet (Internet) technology, and in particular, to a system and method for detecting consistency of operation information of a Border Gateway Protocol (BGP) node in an autonomous system (AS) with expected operational information. Background of the invention

Currently, BGP is the core routing protocol of the Internet, and AS is the processing unit of BGP. The ASs and their internals are interconnected by BGP. BGP includes two modes: External BGP (EBGP) and Internal BGP (IBGP). EBGP is used to interconnect ASs. EBGP is used to exchange routing information within ASs.

BGP security has been a hot topic for many years, but people pay attention to the security of inter-AS communication and ignore the operational errors caused by problems in the AS domain. The internal configuration of the AS is not working properly, which also causes inter-domain BGP notification errors, so security within the domain is also important. Usually the following two problems may occur in the AS:

The IBGP session does not form a logical network-wide interconnection. As a result, the routing information obtained by the BGP nodes in the domain is missing. As a result, the external routes are different. Problem

2. The local policy configured by each BGP node conflicts with the expected policy of the AS. The routing information of the external advertisement is inconsistent with the expected one. Although policy enrichment is a feature of BGP, each node can be configured with different policies, but a considerable part of the internal AS strategy should be consistent to ensure the consistency of AS external behavior.

The above problem is more likely to occur in large ASs that internally include a large number of BGP nodes. The root cause of the above two problems is that the BGP nodes in the AS do not have a unified view, including policies and interconnections. This is because in the existing IBGP, the full mesh connection must be implemented by manual configuration, and automatic topology discovery cannot be realized; and the policy must be manually configured on each node, so there is no guarantee that each node has the same Expected operational information.

The industry generally uses the configuration detection scheme shown in Figure 1 to overcome the above problems. Referring to Figure 1, the scheme is manually driven to input the current planned rules of the AS and the device configuration files in the current AS. According to the current planned planning rules of the AS and the device configuration files in the current AS, the two are judged. Whether they are consistent and output inconsistencies.

However, in the above prior art, the detection is manually driven, so that the problem in the AS network cannot be automatically and dynamically reflected in real time, and errors introduced after the configuration change cannot be checked in time. Moreover, the running status of the current network cannot be accurately understood only from the device configuration file, and thus the result of the detection of the method cannot accurately reflect the actual problem of the network. Summary of the invention

In view of this, the present invention proposes a system for detecting the consistency of the running information of a BGP node, for automatically performing consistency detection, and reflecting the consistency problem in real time. The present invention also proposes a method for detecting consistency of BGP node operation information by automatically performing consistency detection and reflecting consistency problems in real time.

A system for detecting a border gateway protocol BGP node running information consistency, including at least one BGP node, further includes:

a management module, configured to maintain expected running information and deliver the expected running information to the consistency detecting module;

A consistency detection module, configured to determine expected operation information delivered by the management module and from BGP Whether the actual running information obtained by the node is consistent.

A method for detecting consistency of running information of a BGP node includes the following steps: The consistency detection module obtains the running information from the management module and obtains the actual running information from the BGP node;

The consistency detecting module determines whether the expected running information and the actual running information are consistent. As can be seen from the foregoing solution, the present invention sends the expected running information maintained by the management module to the consistency detecting module, and the consistency detecting module determines whether the expected running information is consistent with the running information of the actual running of each BGP node, and In the case of inconsistency, an alarm is sent to the management module, so that the present invention realizes the detection of the consistency of the running information in the AS domain without manual startup, thereby automatically ensuring the security of the BGP. The invention uses the actual running information of the BGP node, so that the actual condition of the network can be truly prepared, so that the detection result can truly reflect whether the network has a problem. The management module is located in the management device, and the consistency detection module may be located in the BGP node or in the management device, or may be located in an independently existing arbitration device, and provides various manners for implementing the present invention. The detection of the running information consistency may be performed after the management module sends new expected running information, or after the running information of the BGP node actually changes, so the present invention can also perform consistency detection in real time, thereby ensuring real-time protection. BGP security. Moreover, in the present invention, the existing BGP or its extended attribute or its extended message may be used to transmit various information between the management device and the BGP node, between the management device and the arbitration device, and between the arbitration device and the BGP node. Various other protocols may also be transmitted by other custom protocols or existing protocols (e.g., Simple Network Management Protocol SNMP), and thus the present invention has wide applicability. BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a schematic diagram of the prior art.

FIG. 2 is a schematic structural diagram of a system according to an embodiment of the present invention. Figure 3 is a schematic diagram of a connection method in the AS domain.

FIG. 4 is a schematic structural diagram of another system in an embodiment of the present invention.

FIG. 5 is a schematic structural diagram of still another system in the embodiment of the present invention. Mode for carrying out the invention

The present invention will be further described in detail below with reference to the accompanying drawings.

In the present invention, two embodiments are proposed based on whether the BGP node performs consistency determination.

The first is the active model, and the BGP node itself determines whether the actual running information is consistent with the expected running information. In this mode, the BGP node needs to know the expected running information, which mainly includes the expected topology information and/or policy information.

Figure 2 is a schematic diagram of the structure of the active model. Referring to Figure 2, the management device and one or more BGP nodes are included in the AS domain. The management device includes a management module; each BGP node internally includes a consistency detection module. A BGP node is connected to all or part of other BGP nodes in the same domain, and each BGP node is connected to the management device.

Each BGP node runs BGP in IBGP mode to deliver routing information within the AS. Boundary BGP nodes can also serve as advertisers of external routes and route routes to other ASs through EBGP. The consistency detection module on a BGP node can exchange information with other BGP nodes in the AS domain through the internal interface between the BGP nodes to obtain the actual operation information of the BGP node. The consistency detection module further compares the expected operation information delivered by the management module. And the actual running information of the BGP node to determine whether the two are consistent, and notify the management module when they are inconsistent. The alerting can be done by an alert sub-module within the mobility detection module.

The management module is responsible for maintaining the expected operational information of the AS and distributing this information to each BGP node. The expected operational information mainly includes, but is not limited to, topology information and/or policy information expected within the AS. The topology information in the AS mainly refers to the AS nodes planned by the management module and the logical and/or physical interconnection between the nodes. For example, the internal BGP nodes in the AS are required to form a full mesh interconnection. The policy information is mainly the AS policy information that the management module is interested in, including but not limited to: the prefix filtering policy, the oscillation suppression policy, the attributes of the special prefix, and the prefix generated by the AS domain. In active mode, these operational information is propagated within the AS and is not sent to EBGP neighbors. The operation information may also include prefix information generated by the local AS domain that is allowed to be advertised, and the like.

The above management device and each BGP node may use the existing BGP protocol or its standard extension (such as extending new attributes and extending new message types), or using existing transport protocols (such as SNMP), or custom Protocol to transmit a variety of information.

In the active model, the process of running the information consistency detection includes the following steps: Step 11: The management module sends the expected running information to the consistency detecting module, where the expected topology information and the expected policy information are taken as an example. The management module delivers the expected intra-domain topology information and expected policy information to the consistency detection module in the BGP node in the AS according to the design plan of the AS domain. Since the consistency detection module in the active model is located in the BGP node, the management module described in the following embodiment delivers the expected operation information to the consistency detection module, that is, the management device delivers the expected operation information to the BGP node.

The way in which the running information is delivered can be in-band and out-of-band. That is, the management device can use the BGP protocol or its standard extensions, such as extending new attributes and extending new message types, and sending information to other BGP nodes. Other protocols, such as the Simple Network Management Protocol (SNMP), can also be used in the outband mode. Embodiments of the invention do not limit the manner in which the invention is issued.

The delivery of the running information can be delivered by the management standby when the expected running information is changed in the domain, or when a new BGP node establishes a connection with the management device. The management device delivers the configuration, and can also be delivered after the request is made by the consistency detection module of the BGP node in the domain.

In the embodiment of the present invention, the representation method of the topology information is not limited. For example, a logical connection can be used for description. Take the full mesh interconnection topology as an example. Assume that there are five BGP nodes in the AS domain: A, B, C, D, and E. You only need to deliver the {A, B, C, D, E} collection to represent the topology information; the non-full interconnection situation can be defined in a similar way. You can also use the way to describe the connection. Take the topology in Figure 3 as an example. You can use the following description to represent the topology information: "A, B, C are a cluster, where C is a reflector, C is a non-customer D. Adjacent, B is adjacent to E. "The BGP node can calculate the interconnection according to the topology information.

The embodiment of the present invention does not limit the content of the policy. For example, the possible policy is as follows: The prefix filtering policy, for example, the pre-processing of the private address space should be filtered, and the oscillation suppression policy, for example, Whether the oscillation suppression and the oscillation suppression strategy should be implemented; the attributes of the special prefix, for example, the specific route to the important resource should be kept valid; the prefix generated by the AS domain, that is, the AS is allowed to generate and advertise The prefix. The strategy in the embodiments of the present invention includes any one of the above or any combination thereof.

In addition, according to the scope of the policy, the policies in the AS can be divided into: a common policy used by all BGP nodes in the AS; a local policy used by some BGP nodes in the AS, such as a policy used within the alliance; and a specific node in the AS. Node policy. The policies referred to in the embodiments of the present invention may include any of the above types of policies.

The BGP nodes in the AS domain can be classified into two types: the advertising node and the internal node. In addition to running the IBGP protocol, the advertised node also advertises the route to the outside of the AS. The BGP protocol in the IBGP mode and the EBGP mode has the global influence. The internal node refers to the internal EBGP protocol. Node. Therefore, not all expected operational information needs to be delivered to all BGP nodes, and can be sent to different nodes. The corresponding running information is sent to the BGP node that uses the local policy, and the local policy is not sent to other BGP nodes.

Step 12: The BGP node obtains actual running information.

For example, taking the connection relationship in FIG. 3 as an example, the formation of topology information includes: transmitting actual interconnection information between adjacent BGP nodes, and C notifying A to connect with customer B and non-client D, so that A knows It can communicate with A, B, and D. In the end, each node knows its own logical interconnection. Each BGP node combines the neighbor information sent by the neighbor node with its neighboring node information. The calculation results in the topology information of the internal interconnections as shown in FIG. 3, that is: A, B, and C form a cluster, and thus are logically completely interconnected; the neighbor D is connected to the reflector C, so A, B, C, and D are all interconnected; and neighbor E is connected to client B of reflector C.

The process of obtaining topology information can be motivated by a variety of situations. For example, if a new BGP neighbor or neighbor is disconnected, the node needs to announce new connection information to other neighbors. In this way, each BGP node in the AS can know the topology information in the current domain in real time.

The policy information on the BGP node may be configured or learned from an IBGP neighbor, and embodiments of the present invention do not limit its source.

The above steps 11 and 12 are performed in a non-sequential relationship, and are divided into two steps only to make the description of the present invention clearer.

Step 13: The consistency detection module in the BGP node determines whether the expected operation information delivered by the management module is consistent with the actual operation information, and alarms the management module when the information is inconsistent, and further limits the effectiveness of the actual operation information, for example, The restriction inconsistency notification is sent out. In the case of consistency, other operations or no operations may be performed.

For the topology information, the consistency detection module of each BGP node detects the topology information sent by the management module according to the topology information of the currently configured interconnection, and determines whether the two are consistent. If an inconsistency is found, that is, a connectivity problem is found, the management module is alerted. As shown in Figure 3, the actual connection situation is: A, B, C, D form a logical full mesh connection, E through the reflector C customer B is associated with the full connection, so E can not receive A, C The information of D does not form a full mesh connection on the global logic. If the expected topology information is A, B, C, D, and E form a global full mesh connection, the consistency detection module in the BGP determines that the two are inconsistent, thereby issuing an alarm to the management module. In general, the possible topology information is inconsistent. For example, the connectivity required by the management module is not implemented. In this case, the route advertisement may be missing. There are additional connected nodes, for example, BGP connections may be established with non-planned neighbors. May cause information leakage, etc.

For the policy information, the consistency detection module of each BGP node determines whether the policy information sent by the management module is consistent with the local policy. If an inconsistency is detected, an alarm is sent to the management module, and the actual operation information is further restricted, for example, Inconsistent notifications are sent out.

The second is a passive model, which is determined by the management device or the arbitration device. In this model, a normal BGP node does not have expected operational information throughout the AS. Therefore, the passive model can avoid the problem that the BGP node in the active model has the expected operational information and may cause leakage.

Figure 4 is a schematic diagram of the structure of a system for consistency detection by a management device in a passive model. When the consistency check is performed by the management device, the system structure diagram is similar to that of FIG. 2, except that the consistency detection module is located in the management device. In this case, the management module is responsible for maintaining the expected operational information of the AS and sending the information to the consistency detection module through the internal interface. The consistency detection module determines whether the two are consistent according to the expected running information and the actual running information obtained from the BGP node, and alarms the management module through the internal interface when the information is inconsistent. The BGP node sends the actual running information to the consistency detecting module in the management device when the self-running information changes, the consistency detecting module sends a notification, or other conditions.

In the passive mode, the method for performing consistency detection using the system shown in FIG. 4 includes the following steps. Step:

Step 21: The management module sends the expected running information to the consistency detecting module through the internal interface.

Step 22: The BGP node obtains the actual running information, and sends the obtained actual running information to the consistency detecting module in the management device. The process in which the BGP node obtains the actual running information is the same as the active mode, and is not described here.

Here, the BGP node may actively send the actual running information to the management device, for example, when the actual running information changes; or the management device sends a notification to the BGP node, and the BGP node sends the actual running information to the management device after receiving the notification. .

The above steps 21 and 22 are not sequential, and are divided into two steps for the purpose of clarity.

Step 23: The causality detecting module determines whether the expected running information is consistent with the actual running information obtained from the BGP node, and sends an alarm to the management module through the internal interface if the information is inconsistent. In the case of consistency, other operations or no operations may be performed. The specific judgment process is the same as the judgment process in the active mode, and will not be described here.

Figure 5 is a schematic diagram of the structure of a system for consistency detection by an arbitration device in a passive model. Referring to FIG. 5, each BGP node, arbitration device, and management device are included in the AS domain. A BGP node is connected to all or part of other BGP nodes in the same domain. Each BGP node is connected to the quorum device, and the quorum device is connected to the management device. The management device is responsible for maintaining the deployment information expected by the AS and delivering the information to the arbitration device. The arbitrating device is an independent consistency detection module. It collects the current running information of the BGP node and compares it with the expected running information sent by the management device to determine whether the two devices are consistent and send alarms to the management device when they are inconsistent. . The BGP node sends the actual running information to the arbitration device when the self-running information changes, the arbitration device sends a notification, or other conditions. The existing BGP protocol or its extended attributes or a customized protocol may be used to transfer various information between the management device and the BGP node, between the management device and the arbitration device, and between the arbitration device and the BGP node.

In the passive mode, the detection of the consistency condition using the system shown in Figure 5 includes the following steps:

Step 31: The management device sends the expected running information to the arbitration device.

Step 32: The BGP node obtains actual running information, and sends the obtained actual running information to the arbitration device. The process in which the BGP node obtains the actual running information is the same as the active mode, and is not described here.

Here, the BGP node may actively send the actual running information to the arbitrating device, for example, when the actual running information changes; or the arbitrating device sends a notification to the BGP node, and the BGP node sends the actual running information to the arbitrating device after receiving the notification. .

The above steps 31 and 32 are performed in no order, and are divided into two steps for the purpose of clarity.

Step 33: The arbitrating device determines whether the expected running information delivered by the management device is consistent with the actual running information obtained from the BGP node, and reports the alarm to the management device if the information is inconsistent. In the case of consistency, other operations or no operations may be performed. The specific judgment process is the same as the judgment process in the active mode, and will not be described here.

The following description of the passive model is mainly based on the case where the consistency detection module is independently present as an arbitration device, and the case where the consistency detection module is located in the management device is similar.

In the above embodiment, in order to protect the security of the expected operational information, a similar public key infrastructure (PKI) system may be used within the AS. Specifically, the management module uses the private key to sign the expected operational information in the AS, and arbitrate. The device or BGP node can verify the authenticity of the expected operational information using the public key of the management module.

In addition, the transmission channel between the AS internal node and the management module or the arbitration device can be used. Encrypted transmission, which guarantees the privacy of the transmission. At the same time, the integrity protection mode can also be adopted to ensure that the content is not modified during the information transmission.

In addition, when the management module delivers the expected running information, the management module may carry a timestamp field in the expected running information, and the consistency detecting module determines, according to the timestamp field, whether the received expected running information is newer than the local expected running information, if , replace the local old expected running information with the expected running information received, and compare the new expected running information with the actual running information after replacement, otherwise it will not be replaced.

In actual use, consistency detection can be performed when system operating conditions change or new planning information is sent. In order not to affect the system operation, the consistency detection module can choose to perform background detection in the central processing unit (CPU) idle time. In the case where the judgment is inconsistent, the BGP node or the arbitrating device may use an in-band or out-of-band measure to alert the management module or other network management station to notify the administrator to perform troubleshooting. Further, the actual operation information may be further restricted. For example, the notification information related to the inconsistent policy is restricted. In the embodiment of the present invention, the alarm can be performed not only when the judgment is inconsistent, but also after the topology information and the policy information are restored, the consistency detection module reports the consistent notification information to the management module, or is periodically determined by the consistency detection module. Report consistent results on the ground in order to deal with the loss of information.

Through the implementation of the present invention, external attacks on BGP nodes can be detected. Assuming that the BGP node is compromised, the attacker modifies the operating environment, changes the policy of the BGP node, and interconnects. At this point, the consistency detection module will detect the inconsistency and perform subsequent processing, so the attack will be discovered in time. If an attacker wants to achieve an undetected attack, it must simultaneously capture the BGP node and arbitrate or manage the device, which is often difficult to achieve in practice.

The authentication mechanism may be adopted for the information sent between the internal BGP node of the AS and the management device or the arbitration device. The authentication device or the two-way authentication device may also be used between the management device and the arbitration device. System to avoid sending information to forged attackers.

In addition, in order to avoid the routing problem caused by the wrong route caused by the misconfiguration of the BGP advertising node, the network may be forced to synchronize. That is, when the configuration is updated for the BGP node and the actual running information is changed, the new configuration must take effect after the consistency check is performed and the consistency is determined. If the consistency check is not performed, the configuration does not take effect. This is a good solution to the overall impact of current BGP misconfigurations.

A specific embodiment of the present invention is specifically described below for a policy that can be generated by the AS domain. This embodiment mainly detects the validity of the prefix source. A security problem faced by BGP today is the problem of prefix source authentication. That is, there is no way in the BGP protocol mechanism to detect whether the AS has the right to declare whether a specific prefix is generated by the AS itself. This problem may be caused by misconfiguration, or it may be caused by an attacker if the device is captured. However, most of the cases are caused by the former. Therefore, if each AS performs consistency detection within the domain by using the present invention, the problem can be well alleviated.

First, the acquisition of the prefix expected to be generated by the AS domain will be explained. The methods of obtaining include but are not limited to the following methods:

1. Manually configure the management module. Since the expected prefix range is specific for each AS at a particular moment, it can be manually configured on the management module.

2. Obtained from an authority. For example, the International Internet Assigned Numbers Authority (IANA) and the four major address allocation agencies around the world may maintain similar databases in the future, from which the management module can obtain the prefixes expected from the AS domain.

3. Get it by trust. If a maintainer (such as an ISP) responsible for maintaining the prefix relationship with the prefix is implemented by a PKI or the like for performing authorization verification on the allocation, the maintainer can ensure the reliability of the information by digitally signing the information. . The actual generated prefix source of the advertised BGP node may be configured using, for example, the network command, or may be an actually generated prefix learned by learning from an IBGP neighbor or by redistribution from an IGP and/or static route.

The following describes the detection process of the prefix generated by the AS domain:

In the active mode, the management module sends the prefix generated by the AS to the BGP node. Each of the advertised BGP nodes compares the prefix generated by the local AS with the prefix actually generated by the local device, and determines whether the two are consistent. If the two are inconsistent, the BGP node sends an alarm to the management module, that is, reports the inconsistency information, and further restricts the actual operation. The information is valid, for example, the restriction inconsistency notification is sent out.

In the passive mode, if the management device performs the consistency check, the management module sends the prefix generated by the AS to the AS to the consistency detection module. The consistency detection module collects the actual generated BGP nodes. The prefix information is compared and compared to determine whether the two are consistent. In the case of inconsistency, the management module is alerted. The actual operation information can be further restricted. For example, the related inconsistency notification is restricted from being sent out.

If the quorum device performs the consistency check, the management module sends the prefix generated by the AS to the arbitrating device, and the arbitrating device collects the prefix information actually generated by each BGP node, and compares it to determine whether the two are Consistently, in the case of inconsistency, the management module is alerted, that is, the inconsistency information is reported, and the actual operation information can be further restricted. For example, the related inconsistency notification is restricted from being sent out.

Further, after the consistency check is performed, the prefix generated by the BGP node can be validated, that is, in the active mode, after the BGP node is determined to be consistent, the actual generated prefix is validated. External transmission; In the passive mode, after the arbitration device determines that the agreement is consistent, it sends a permission to the advertising BGP node or does not intervene to notify the transmission of the BGP node related advertisement.

The management device and the quorum device can use the intranet IP address to perform the BGP node in the same domain. Communication, such that an external attacker is not easy to implement an attack behavior against the management device and the arbitration device. An attacker may perform attacks in various ways, such as attacking a BGP node or injecting false routing information into the routing table through IGP and BGP. At this point, these attacks can be dealt with by the above-mentioned consistency detection method and by means of detection.

In summary, the above description is only the preferred embodiment of the present invention and is not intended to limit the scope of the present invention. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claim

A system for detecting a boundary gateway protocol BGP node running information consistency, comprising at least one BGP node, wherein the system further comprises:

The consistency detection module is configured to determine whether the expected running information delivered by the management module is consistent with the actual running information obtained from the BGP node.

The system according to claim 1, wherein the management module is located in the management device, and the consistency detection module is located in each BGP node or in the management device.

The system according to claim 2, wherein the management device and the BGP node communicate in an in-band manner or in an out-of-band manner.

The system of claim 1 wherein the system further comprises an independently existing arbitration device, the consistency detection module being located within the arbitration device.

The system according to claim 4, wherein the BGP node and the arbitration device communicate in an in-band manner or in an out-of-band manner.

The system according to claim 3 or 5, wherein the in-band mode comprises a BGP message, or an extended BGP message, or an extended BGP message attribute; the out-of-band mode includes a simple network management protocol SNMP. .

The system according to claim 1, wherein the consistency detecting module further comprises:

The alarm submodule is configured to send an alarm to the management module if the expected running information and the actual running information are inconsistent.

8. A method for detecting consistency of running information of a BGP node, characterized in that the party The method includes the following steps:

The consistency detection module obtains expected operation information from the management module and obtains actual operation information from the BGP node;

The consistency detecting module determines whether the expected running information and the actual running information are consistent.

The method according to claim 8, wherein the method further comprises: the consistency detecting module issuing an alarm to the management module if the expected running information and the actual running information are inconsistent.

The method according to claim 8, wherein the consistency detecting module further comprises: before determining whether the expected running information and the actual running information are consistent:

The consistency detecting module determines whether the obtained expected running information is newer than the existing expected running information, and if so, replaces the existing expected running information with the obtained expected running information;

The expected running information in step B is the expected running information after the replacement.

The method according to claim 8, wherein the method further comprises: the consistency detecting module validating the actual running information if the expected running information and the actual running information are consistent; otherwise, limiting the actual running information. Effective.

12. The method according to claim 8, wherein the step of obtaining, by the consistency detecting module, the expected running information from the management module is:

The management module delivers the expected operation information to the consistency detection module.

13. The method according to claim 12, wherein the management module, after the expected operational information change in the AS domain, or when the new BGP node establishes a connection with the management module, or receives the request of the consistency detection module , the expected running information is sent down.

The method according to claim 12, wherein the management module sends the expected operation information to the consistency detection module:

The management module adopts encryption and/or integrity protection to the consistency detection module. Send the expected operational information.

The method according to claim 12, wherein the management module further includes: before the delivering the expected running information to the consistency detecting module:

The management module and the consistency detection module perform authentication, and the management module delivers the expected operation information to the consistency detection module when the authentication is passed.

The method according to claim 8, wherein the management module is located in a management device, and the consistency detection module is located in each BGP node;

The consistency detecting module performs step B when the actual running information of the BGP node changes or when the BGP node receives the new expected running information.

The method according to claim 8, wherein the management module is located in the management device, and the consistency detection module is located in the independent arbitration device or in the management device.

The method according to claim 17, wherein the step of obtaining, by the consistency detecting module, the actual running information from the BGP node is:

The consistency detection module obtains actual operation information by analyzing the communication traffic of the BGP node.

The method according to claim 17, wherein the step of obtaining the actual running information from the BGP node by the consistency detecting module is:

The BGP node reports the actual running information to the consistency detection module.

The method according to claim 19, wherein the BGP node, when its actual running information changes, or when it receives new expected running information, or when it receives the consistency detecting module When notified, the actual running information is reported to the consistency detection module.