INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
Management Information Base
for DOCSIS Cable Modems and Cable Modem Termination Systems
for Baseline Privacy Plus
draft-ietf-ipcdn-bpiplus-mib-03.txt
Fri Jun 23 12:34:59 EDT 2000
Stuart M. Green
Arris Interactive
stu.green@ne.arris-i.com
Status of this Memo
This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. Internet-Drafts are working
documents of the Internet Engineering Task Force (IETF), its areas,
and its working groups. Note that other groups may also distribute
working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at:
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at:
http://www.ietf.org/shadow.html.
Abstract
This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols in the Internet community.
In particular, it defines a set of managed objects for SNMP-based
management of the Baseline Privacy Plus features [17] of
DOCSIS1.1-compliant[16] Cable Modems and Cable Modem Termination
Systems.
This memo specifies a MIB module in a manner that is compliant to the
SNMP SMIv2 [5][6][7]. The set of objects are consistent with the
SNMP framework and existing SNMP standards.
This memo is a product of the IPCDN working group within the Internet
Engineering Task Force. Comments are solicited and should be
addressed to the working group's mailing list at ipcdn@terayon.com
and/or the authors.
Table of Contents
1. The SNMP Network Management Framework..............................2
2. Overview...........................................................3
Expires December 2000 [Page 1]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
2.1. Structure of the MIB.............................................3
2.1.1. Cable Modem....................................................3
2.1.2. Cable Modem Termination System.................................4
2.1.3. Common.........................................................4
3. Definitions........................................................4
4. Acknowledgments...................................................58
5. References........................................................59
6. Security Considerations...........................................60
7. Author's Address..................................................61
1. The SNMP Network Management Framework
The SNMP Management Framework presently consists of five major
components:
o An overall architecture, described in RFC 2571 [1].
o Mechanisms for describing and naming objects and events for the
purpose of management. The first version of this Structure of
Management Information (SMI) is called SMIv1 and described in STD
16, RFC 1155 [2], STD 16, RFC 1212 [3] and RFC 1215 [4]. The
second version, called SMIv2, is described in STD 58, RFC 2578
[5], STD 58, RFC 2579 [6] and STD 58, RFC 2580 [7].
o Message protocols for transferring management information. The
first version of the SNMP message protocol is called SNMPv1 and
described in RFC 1157 [8]. A second version of the SNMP message
protocol, which is not an Internet standards track protocol, is
called SNMPv2c and described in RFC 1901 [9] and RFC 1906 [10].
The third version of the message protocol is called SNMPv3 and
described in RFC 1906 [10], RFC 2572 [11] and RFC 2574 [12].
o Protocol operations for accessing management information. The
first set of protocol operations and associated PDU formats is
described in STD 15, RFC 1157 [8]. A second set of protocol
operations and associated PDU formats is described in RFC 1905
[13].
o A set of fundamental applications described in RFC 2573 [14] and
the view-based access control mechanism described in RFC 2575
[15].
Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. Objects in the MIB are
defined using the mechanisms defined in the SMI.
This memo specifies a MIB module that is compliant to the SMIv2. A
MIB conforming to the SMIv1 can be produced through the appropriate
translations. The resulting translated MIB MUST be semantically
equivalent, except where objects or events are omitted because no
translation is possible (use of Counter64). Some machine readable
information in SMIv2 will be converted into textual descriptions in
Expires December 2000 [Page 2]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
SMIv1 during the translation process. However, this loss of machine
readable information is not considered to change the semantics of the
MIB.
2. Overview
This MIB provides a set of objects required for the management of the
Baseline Privacy Plus features of DOCSIS Cable Modem (CM) and Cable
Modem Termination Systems (CMTS). The specification is derived from
the operational model described in the DOCSIS Baseline Privacy Plus
Specification [17].
DOCSIS Baseline Privacy Plus is composed of four distinct functional
and manageable areas:
o Key Exchange and Data Encryption
o Cable Modem Authentication
o Multicast Encryption
o Authentication of Downloaded Software Images
This MIB is an extension of the DOCSIS 1.0 Baseline Privacy MIB [19]
which is derived from the operational model described in the DOCSIS
Baseline Privacy Specification [18]. The original Baseline Privacy
MIB structure has been mostly preserved in the Baseline Privacy Plus
MIB.
2.1. Structure of the MIB
This MIB is structured into several tables and objects:
2.1.1. Cable Modem
o The docsBpi2CmBaseTable contains authorization key exchange
information for one CM MAC interface.
o The docsBpi2CmTEKTable contains traffic key exchange and
data encryption information for a particular security
association ID of the cable modem.
o Multicast Encryption information is maintained under
Docsbpi2CmMulticastObjects. There is currently one multicast
table object which manages IP multicast encryption,
docsBpi2CmIpMulticastMapTable.
o Digital certificates used for cable modem authentication are
accessible via docsBpi2CmDeviceCertTable.
o Cryptographic suite capabilities for a CM MAC are maintained
in the docsBpi2CmCryptoSuiteTable.
Expires December 2000 [Page 3]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
2.1.2. Cable Modem Termination System
o The docsBpi2CmtsBaseTable contains default settings and
summary counters for the cable modem termination system.
o The DocsBpi2CmtsAuthTable contains Authorization Key Exchange
information for each CM MAC interface, as well as data
from CM certificates used in cable modem authentication.
o The docsBpi2CmtsTEKTable contains traffic key exchange and
data encryption information for a particular security
association ID.
o Multicast Encryption information is maintained under
Docsbpi2CmtsMulticastObjects. There are currently two
multicast table objects. DocsBpi2CmtsIpMulticastMapTable
is specifically designed for IP multicast encryption,
whereas docsBpi2CmtsMulticastAuthTable is meant to manage
all multicast security associations.
o DocsBpi2CmtsCertObjects contains 2 manageable tables: one
for provisioned cable modem certificates, the other for
certification authority certificates.
2.1.3. Common
o The docsBpi2CodeDownloadControl objects manage the
authenticated software download process for a given device.
3. Definitions
DOCS-BPI2-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
Counter32,
IpAddress,
Integer32
FROM SNMPv2-SMI
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB
TEXTUAL-CONVENTION,
DisplayString,
MacAddress,
RowStatus,
TruthValue,
DateAndTime
FROM SNMPv2-TC
OBJECT-GROUP,
MODULE-COMPLIANCE
FROM SNMPv2-CONF
ifIndex
Expires December 2000 [Page 4]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
FROM IF-MIB
docsIfMib
FROM DOCS-IF-MIB
;
docsBpi2MIB MODULE-IDENTITY
LAST-UPDATED "0006231930Z"
ORGANIZATION "IETF IPCDN Working Group"
CONTACT-INFO "---------------------------------------
Stuart M. Green
Postal:
Arris Interactive / Nortel Networks
6 Riverside Drive
Andover, MA 01810
U.S.A.
Tel: +1 978 946 4664
Fax: +1 978 946 4800
E-mail: stu.green@ne.arris-i.com
---------------------------------------
Kaz Ozawa
Postal:
Cable Television Laboratories
400 Centennial Parkway
Louisville, CO 80027
U.S.A.
Tel: +1 303 661 3860
Fax: +1 303 661 9199
E-mail: k.ozawa@cablelabs.com
---------------------------------------
Mike St. Johns
Postal:
@Home Network
425 Broadway
Redwood City, CA 94063
U.S.A.
Tel: +1 650 569 5368
E-mail: stjohns@corp.home.net
---------------------------------------
Rich Woundy (BPI MIB)
Postal:
Cisco Systems
300 Apollo Drive
Chelmsford, MA 01824
U.S.A.
Tel: +1 978 244 8545
Fax: +1 978 244 8917
E-mail: rwoundy@cisco.com"
DESCRIPTION
"This is the MIB Module for the DOCSIS Baseline Privacy
Plus Interface (BPI+) at cable modems (CMs) and cable modem
termination systems (CMTSs)."
::= { docsIfMib 6 }
Expires December 2000 [Page 5]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
-- Textual conventions
X509Certificate ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"An X509 digital certificate encoded as an ASN.1 DER
object."
SYNTAX OCTET STRING (SIZE (0..1487))
docsBpi2MIBObjects OBJECT IDENTIFIER ::= { docsBpi2MIB 1 }
-- Cable Modem Group
docsBpi2CmObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 1 }
--
-- The BPI+ base and authorization table for CMs, indexed by ifIndex
--
docsBpi2CmBaseTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmBaseEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the basic and authorization
related Baseline Privacy Plus attributes of each CM MAC
interface."
::= { docsBpi2CmObjects 1 }
docsBpi2CmBaseEntry OBJECT-TYPE
SYNTAX DocsBpi2CmBaseEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing attributes of
one CM MAC interface. An entry in this table exists for each
ifEntry with an ifType of docsCableMaclayer(127)."
INDEX { ifIndex }
::= { docsBpi2CmBaseTable 1 }
DocsBpi2CmBaseEntry ::= SEQUENCE {
docsBpi2CmPrivacyEnable TruthValue,
docsBpi2CmPublicKey OCTET STRING,
docsBpi2CmAuthState INTEGER,
docsBpi2CmAuthKeySequenceNumber Integer32,
docsBpi2CmAuthExpiresOld DateAndTime,
docsBpi2CmAuthExpiresNew DateAndTime,
docsBpi2CmAuthReset TruthValue,
docsBpi2CmAuthGraceTime Integer32,
docsBpi2CmTEKGraceTime Integer32,
docsBpi2CmAuthWaitTimeout Integer32,
docsBpi2CmReauthWaitTimeout Integer32,
Expires December 2000 [Page 6]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmOpWaitTimeout Integer32,
docsBpi2CmRekeyWaitTimeout Integer32,
docsBpi2CmAuthRejectWaitTimeout Integer32,
docsBpi2CmSAMapWaitTimeout Integer32,
docsBpi2CmSAMapMaxRetries Integer32,
docsBpi2CmAuthentInfos Counter32,
docsBpi2CmAuthRequests Counter32,
docsBpi2CmAuthReplies Counter32,
docsBpi2CmAuthRejects Counter32,
docsBpi2CmAuthInvalids Counter32,
docsBpi2CmAuthRejectErrorCode INTEGER,
docsBpi2CmAuthRejectErrorString DisplayString,
docsBpi2CmAuthInvalidErrorCode INTEGER,
docsBpi2CmAuthInvalidErrorString DisplayString
}
docsBpi2CmPrivacyEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This object identifies whether this CM is
provisioned to run Baseline Privacy Plus. This is analogous
to the presence (or absence) of the Baseline Privacy Plus
Configuration Settings. In addition, the Privacy Enable RFI
encoding must be enabled for this object to be true."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1."
::= { docsBpi2CmBaseEntry 1 }
docsBpi2CmPublicKey OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (74|106|140|204|270))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is a DER-encoded
RSAPublicKey ASN.1 type string, as defined in the RSA
Encryption Standard (PKCS #1) [10], corresponding to the
public key of the CM. The 74, 106, 140, 204, and 270 byte key
encoding lengths correspond to 512 bit, 768 bit, 1024 bit,
1536 bit, and 2048 public moduli respectively."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.4."
::= { docsBpi2CmBaseEntry 2 }
docsBpi2CmAuthState OBJECT-TYPE
SYNTAX INTEGER {
start(1),
authWait(2),
authorized(3),
reauthWait(4),
Expires December 2000 [Page 7]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
authRejectWait(5),
silent(6)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the state of the CM
authorization FSM. The start state indicates that FSM is in
its initial state."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.1.2.1."
::= { docsBpi2CmBaseEntry 3 }
docsBpi2CmAuthKeySequenceNumber OBJECT-TYPE
SYNTAX Integer32 (0..15)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the most recent
authorization key sequence number for this FSM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.2 and 4.2.2.10."
::= { docsBpi2CmBaseEntry 4 }
docsBpi2CmAuthExpiresOld OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the actual clock time
when the immediate predecessor of the most recent
authorization for this FSM expires. If the CM does not have
an active authorization, then the value is of the expiration
date and time of the last active authorization."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.2 and 4.2.2.9."
::= { docsBpi2CmBaseEntry 5 }
docsBpi2CmAuthExpiresNew OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the actual clock time
when the most recent authorization for this FSM expires. If
the CM does not have an active authorization, then the value
is of the expiration date and time of the last active
authorization."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Expires December 2000 [Page 8]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
Sections 4.2.1.2 and 4.2.2.9."
::= { docsBpi2CmBaseEntry 6 }
docsBpi2CmAuthReset OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Setting this object to TRUE generates a Reauthorize
event in the authorization FSM. Reading this object always
returns FALSE."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.1.2.3.4."
::= { docsBpi2CmBaseEntry 7 }
docsBpi2CmAuthGraceTime OBJECT-TYPE
SYNTAX Integer32 (1..6047999)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the grace time for an
authorization key. A CM is expected to start trying to get a
new authorization key beginning AuthGraceTime seconds before
the authorization key actually expires. The value of this
object cannot be changed while the authorization state
machine is running."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.3."
::= { docsBpi2CmBaseEntry 8 }
docsBpi2CmTEKGraceTime OBJECT-TYPE
SYNTAX Integer32 (1..302399)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the grace time for
the TEK in seconds. The CM is expected to start trying to
acquire a new TEK beginning TEK GraceTime seconds after
the expiration of the immediate predecessor of the most
recent TEK. The value of this object cannot be changed
while the authorization state machine is running."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.6."
::= { docsBpi2CmBaseEntry 9 }
docsBpi2CmAuthWaitTimeout OBJECT-TYPE
SYNTAX Integer32 (1..30)
UNITS "seconds"
Expires December 2000 [Page 9]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Authorize Wait
Timeout. The value of this object cannot be changed while the
authorization state machine is running."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.1."
::= { docsBpi2CmBaseEntry 10 }
docsBpi2CmReauthWaitTimeout OBJECT-TYPE
SYNTAX Integer32 (1..30)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Reauthorize Wait
Timeout in seconds. The value of this object cannot be
changed while the authorization state machine is running."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.2."
::= { docsBpi2CmBaseEntry 11 }
docsBpi2CmOpWaitTimeout OBJECT-TYPE
SYNTAX Integer32 (1..10)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Operational Wait
Timeout in seconds. The value of this object cannot be
changed while the authorization state machine is running."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.4."
::= { docsBpi2CmBaseEntry 12 }
docsBpi2CmRekeyWaitTimeout OBJECT-TYPE
SYNTAX Integer32 (1..10)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Rekey Wait Timeout
in seconds. The value of this object cannot be changed while
the authorization state machine is running."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.5."
::= { docsBpi2CmBaseEntry 13 }
Expires December 2000 [Page 10]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmAuthRejectWaitTimeout OBJECT-TYPE
SYNTAX Integer32 (1..600)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Authorization Reject
Wait Timeout in seconds. The value of this object cannot be
changed while the authorization state machine is running."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.7."
::= { docsBpi2CmBaseEntry 14 }
docsBpi2CmSAMapWaitTimeout OBJECT-TYPE
SYNTAX Integer32 (1..10)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the retransmission
interval, in seconds, of SA Map Requests from the MAP Wait
state."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.8."
::= { docsBpi2CmBaseEntry 15 }
docsBpi2CmSAMapMaxRetries OBJECT-TYPE
SYNTAX Integer32 (0..10)
UNITS "count"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the maximum number of
Map Request retries allowed."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.9."
::= { docsBpi2CmBaseEntry 16 }
docsBpi2CmAuthentInfos OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has transmitted an Authentication Information message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.9."
::= { docsBpi2CmBaseEntry 17 }
Expires December 2000 [Page 11]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmAuthRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has transmitted an Authorization Request message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.1."
::= { docsBpi2CmBaseEntry 18 }
docsBpi2CmAuthReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has received an Authorization Reply message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.2."
::= { docsBpi2CmBaseEntry 19 }
docsBpi2CmAuthRejects OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has received an Authorization Reject message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.3."
::= { docsBpi2CmBaseEntry 20 }
docsBpi2CmAuthInvalids OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has received an Authorization Invalid message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.7."
::= { docsBpi2CmBaseEntry 21 }
docsBpi2CmAuthRejectErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
unauthorizedCm(3),
Expires December 2000 [Page 12]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
unauthorizedSaid(4),
permanentAuthorizationFailure(8),
timeOfDayNotAcquired(11)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in most recent Authorization
Reject message received by the CM. This has value unknown(2)
if the last Error-Code value was 0, and none(1) if no
Authorization Reject message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.3 and 4.2.2.15."
::= { docsBpi2CmBaseEntry 22 }
docsBpi2CmAuthRejectErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
most recent Authorization Reject message received by the CM.
This is a zero length string if no Authorization Reject
message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.3 and 4.2.2.6."
::= { docsBpi2CmBaseEntry 23 }
docsBpi2CmAuthInvalidErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
unauthorizedCm(3),
unsolicited(5),
invalidKeySequence(6),
keyRequestAuthenticationFailure(7)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in most recent Authorization
Invalid message received by the CM. This has value unknown(2)
if the last Error-Code value was 0, and none(1) if no
Authorization Invalid message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.7 and 4.2.2.15."
::= { docsBpi2CmBaseEntry 24 }
Expires December 2000 [Page 13]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmAuthInvalidErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
most recent Authorization Invalid message received by the CM.
This is a zero length string if no Authorization Invalid
message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.7 and 4.2.2.6."
::= { docsBpi2CmBaseEntry 25 }
--
-- The CM TEK Table, indexed by ifIndex and SAID
--
docsBpi2CmTEKTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmTEKEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the attributes of each CM
Traffic Encryption Key(TEK) association. The CM maintains (no
more than) one TEK association per SAID per CM MAC interface."
::= { docsBpi2CmObjects 2 }
docsBpi2CmTEKEntry OBJECT-TYPE
SYNTAX DocsBpi2CmTEKEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing the TEK
association attributes of one SAID. The CM MUST create one
entry per SAID, regardless of whether the SAID was obtained
from a Registration Response message, from an Authorization
Reply message, or from any future dynamic SAID establishment
mechanisms."
INDEX { ifIndex, docsBpi2CmTEKSAId }
::= { docsBpi2CmTEKTable 1 }
DocsBpi2CmTEKEntry ::= SEQUENCE {
docsBpi2CmTEKSAId Integer32,
docsBpi2CmTEKSAType INTEGER,
docsBpi2CmTEKDataEncryptAlg INTEGER,
docsBpi2CmTEKDataAuthentAlg INTEGER,
docsBpi2CmTEKState INTEGER,
docsBpi2CmTEKKeySequenceNumber Integer32,
docsBpi2CmTEKExpiresOld DateAndTime,
Expires December 2000 [Page 14]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmTEKExpiresNew DateAndTime,
docsBpi2CmTEKKeyRequests Counter32,
docsBpi2CmTEKKeyReplies Counter32,
docsBpi2CmTEKKeyRejects Counter32,
docsBpi2CmTEKInvalids Counter32,
docsBpi2CmTEKAuthPends Counter32,
docsBpi2CmTEKKeyRejectErrorCode INTEGER,
docsBpi2CmTEKKeyRejectErrorString DisplayString,
docsBpi2CmTEKInvalidErrorCode INTEGER,
docsBpi2CmTEKInvalidErrorString DisplayString
}
docsBpi2CmTEKSAId OBJECT-TYPE
SYNTAX Integer32 (1..16383)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The value of this object is the DOCSIS Security
Association ID (SAID)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.12."
::= { docsBpi2CmTEKEntry 1 }
docsBpi2CmTEKSAType OBJECT-TYPE
SYNTAX INTEGER {
none(0),
primary(1),
static(2),
dynamic(3)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the type of security
association."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 2.1.3."
::= { docsBpi2CmTEKEntry 2 }
docsBpi2CmTEKDataEncryptAlg OBJECT-TYPE
SYNTAX INTEGER {
none(0),
des56CbcMode(1),
des40CbcMode(2)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the data encryption
algorithm being utilized."
REFERENCE
Expires December 2000 [Page 15]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
::= { docsBpi2CmTEKEntry 3 }
docsBpi2CmTEKDataAuthentAlg OBJECT-TYPE
SYNTAX INTEGER {
none(0)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the data authentication
algorithm being utilized."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
::= { docsBpi2CmTEKEntry 4 }
docsBpi2CmTEKState OBJECT-TYPE
SYNTAX INTEGER {
start(1),
opWait(2),
opReauthWait(3),
operational(4),
rekeyWait(5),
rekeyReauthWait(6)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the state of the
indicated TEK FSM. The start(1) state indicates that FSM is
in its initial state."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.1.3.1."
::= { docsBpi2CmTEKEntry 5 }
docsBpi2CmTEKKeySequenceNumber OBJECT-TYPE
SYNTAX Integer32 (0..15)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the most recent TEK
key sequence number for this TEK FSM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.2.10 and 4.2.2.13."
::= { docsBpi2CmTEKEntry 6 }
docsBpi2CmTEKExpiresOld OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
Expires December 2000 [Page 16]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
STATUS current
DESCRIPTION
"The value of this object is the actual clock time for
expiration of the immediate predecessor of the most recent TEK
for this FSM. If this FSM has only one TEK, then the value is
the time of activation of this FSM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.5 and 4.2.2.9."
::= { docsBpi2CmTEKEntry 7 }
docsBpi2CmTEKExpiresNew OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the actual clock time for
expiration of the most recent TEK for this FSM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.5 and 4.2.2.9."
::= { docsBpi2CmTEKEntry 8 }
docsBpi2CmTEKKeyRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has transmitted a Key Request message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.4."
::= { docsBpi2CmTEKEntry 9 }
docsBpi2CmTEKKeyReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has received a Key Reply message, including a message whose
authentication failed."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.5."
::= { docsBpi2CmTEKEntry 10 }
docsBpi2CmTEKKeyRejects OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
Expires December 2000 [Page 17]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
"The value of this object is the count of times the CM
has received a Key Reject message, including a message whose
authentication failed."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.6."
::= { docsBpi2CmTEKEntry 11 }
docsBpi2CmTEKInvalids OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the CM
has received a TEK Invalid message, including a message whose
authentication failed."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.8."
::= { docsBpi2CmTEKEntry 12 }
docsBpi2CmTEKAuthPends OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times an
Authorization Pending (Auth Pend) event occurred in this FSM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.1.3.3.3."
::= { docsBpi2CmTEKEntry 13 }
docsBpi2CmTEKKeyRejectErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
unauthorizedSaid(4)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in most recent Key Reject
message received by the CM. This has value unknown(2) if the
last Error-Code value was 0, and none(1) if no Key Reject
message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.1.2.6 and 4.2.2.15."
::= { docsBpi2CmTEKEntry 14 }
docsBpi2CmTEKKeyRejectErrorString OBJECT-TYPE
Expires December 2000 [Page 18]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
most recent Key Reject message received by the CM. This is a
zero length string if no Key Reject message has been received
since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.1.2.6 and 4.2.2.6."
::= { docsBpi2CmTEKEntry 15 }
docsBpi2CmTEKInvalidErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
invalidKeySequence(6)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in most recent TEK Invalid
message received by the CM. This has value unknown(2) if the
last Error-Code value was 0, and none(1) if no TEK Invalid
message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.1.2.8 and 4.2.2.15."
::= { docsBpi2CmTEKEntry 16 }
docsBpi2CmTEKInvalidErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
most recent TEK Invalid message received by the CM. This is a
zero length string if no TEK Invalid message has been received
since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.1.2.8 and 4.2.2.6."
::= { docsBpi2CmTEKEntry 17 }
--
-- The CM Multicast Objects Group
--
docsBpi2CmMulticastObjects OBJECT IDENTIFIER
::= { docsBpi2CmObjects 3 }
Expires December 2000 [Page 19]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
--
-- The CM Dynamic IP Multicast Mapping Table, indexed by IP multicast
-- address and by ifindex
--
docsBpi2CmIpMulticastMapTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmIpMulticastMapEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table maps multicast IP addresses to SAIDs.
It is intended to map DYNAMIC multicast IP addresses only."
::= { docsBpi2CmMulticastObjects 1 }
docsBpi2CmIpMulticastMapEntry OBJECT-TYPE
SYNTAX DocsBpi2CmIpMulticastMapEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing the mapping of
one multicast IP address to one SAID, as well as
associated state, message counters, and error information."
INDEX { ifIndex, docsBpi2CmIpMulticastAddress }
::= { docsBpi2CmIpMulticastMapTable 1 }
DocsBpi2CmIpMulticastMapEntry ::= SEQUENCE {
docsBpi2CmIpMulticastAddress IpAddress,
docsBpi2CmIpMulticastSAId Integer32,
docsBpi2CmIpMulticastSAMapState INTEGER,
docsBpi2CmIpMulticastSAMapRequests Counter32,
docsBpi2CmIpMulticastSAMapReplies Counter32,
docsBpi2CmIpMulticastSAMapRejects Counter32,
docsBpi2CmIpMulticastSAMapRejectErrorCode INTEGER,
docsBpi2CmIpMulticastSAMapRejectErrorString DisplayString
}
docsBpi2CmIpMulticastAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object represents the IP multicast address
to be mapped."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 5.4."
::= { docsBpi2CmIpMulticastMapEntry 1 }
docsBpi2CmIpMulticastSAId OBJECT-TYPE
SYNTAX Integer32 (0..16383)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
Expires December 2000 [Page 20]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
"This object represents the SAID to which the IP
multicast address has been mapped. If no SA Map Reply has
been received for the IP address, this object should have the
value 0."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.12."
::= { docsBpi2CmIpMulticastMapEntry 2 }
docsBpi2CmIpMulticastSAMapState OBJECT-TYPE
SYNTAX INTEGER {
start(1),
mapWait(2),
mapped(3)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the state of the SA
Mapping FSM for this IP."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 5.3.1."
::= { docsBpi2CmIpMulticastMapEntry 3 }
docsBpi2CmIpMulticastSAMapRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CM has transmitted an SA Map Request message for this IP."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.10."
::= { docsBpi2CmIpMulticastMapEntry 4 }
docsBpi2CmIpMulticastSAMapReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CM has received an SA Map Reply message for this IP."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.11."
::= { docsBpi2CmIpMulticastMapEntry 5 }
docsBpi2CmIpMulticastSAMapRejects OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
Expires December 2000 [Page 21]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
DESCRIPTION
"The value of this object is the count of times the
CM has received an SA MAP Reject message for this IP."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.12."
::= { docsBpi2CmIpMulticastMapEntry 6 }
docsBpi2CmIpMulticastSAMapRejectErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
noAuthForRequestedDSFlow(9),
dsFlowNotMappedToSA(10)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in the most recent SA Map
Reject message sent in response to an SA Map Request for this
IP. It has value unknown(2) if the last Error-Code value
was 0, and none(1) if no SA MAP Reject message has been
received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.12 and 4.2.2.15."
::= { docsBpi2CmIpMulticastMapEntry 7 }
docsBpi2CmIpMulticastSAMapRejectErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
the most recent SA Map Reject message sent in response to an
SA Map Request for this IP. It is a zero length string if
no SA Map Reject message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.12 and 4.2.2.6."
::= { docsBpi2CmIpMulticastMapEntry 8 }
--
-- CM Cert Objects
--
docsBpi2CmCertObjects OBJECT IDENTIFIER
::= { docsBpi2CmObjects 4 }
--
-- CM Device Cert Table
Expires December 2000 [Page 22]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
--
docsBpi2CmDeviceCertTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmDeviceCertEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the Baseline Privacy Plus
device certificates for each CM MAC interface."
::= { docsBpi2CmCertObjects 1 }
docsBpi2CmDeviceCertEntry OBJECT-TYPE
SYNTAX DocsBpi2CmDeviceCertEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains the device certificates of
one CM MAC interface. An entry in this table exists for each
ifEntry with an ifType of docsCableMaclayer(127)."
INDEX { ifIndex }
::= { docsBpi2CmDeviceCertTable 1 }
DocsBpi2CmDeviceCertEntry ::= SEQUENCE {
docsBpi2CmDeviceCmCert X509Certificate,
docsBpi2CmDeviceManufCert X509Certificate
}
docsBpi2CmDeviceCmCert OBJECT-TYPE
SYNTAX X509Certificate
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The X509 DER-encoded cable modem certificate.
Note: This object can be set only when the value is the null
string. Once the object contains the certificate, its access
MUST be read-only."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.1."
::= { docsBpi2CmDeviceCertEntry 1 }
docsBpi2CmDeviceManufCert OBJECT-TYPE
SYNTAX X509Certificate
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The X509 DER-encoded manufacturer certificate which
signed the cable modem certificate."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.1."
::= { docsBpi2CmDeviceCertEntry 2 }
Expires December 2000 [Page 23]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
--
-- CM Crypto Suite Table
--
docsBpi2CmCryptoSuiteTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmCryptoSuiteEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the Baseline Privacy Plus
cryptographic suite capabilites for each CM MAC interface."
::= { docsBpi2CmObjects 5 }
docsBpi2CmCryptoSuiteEntry OBJECT-TYPE
SYNTAX DocsBpi2CmCryptoSuiteEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains a cryptographic suite pair
which this CM MAC supports."
INDEX { ifIndex, docsBpi2CmCryptoSuiteIndex }
::= { docsBpi2CmCryptoSuiteTable 1 }
DocsBpi2CmCryptoSuiteEntry ::= SEQUENCE {
docsBpi2CmCryptoSuiteIndex Integer32,
docsBpi2CmCryptoSuiteDataEncryptAlg INTEGER,
docsBpi2CmCryptoSuiteDataAuthentAlg INTEGER
}
docsBpi2CmCryptoSuiteIndex OBJECT-TYPE
SYNTAX Integer32 (1..1000)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The index for a cryptographic suite row."
::= { docsBpi2CmCryptoSuiteEntry 1 }
docsBpi2CmCryptoSuiteDataEncryptAlg OBJECT-TYPE
SYNTAX INTEGER {
none(0),
des56CbcMode(1),
des40CbcMode(2)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the data encryption
algorithm for this cryptographic suite capability."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
::= { docsBpi2CmCryptoSuiteEntry 2 }
Expires December 2000 [Page 24]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmCryptoSuiteDataAuthentAlg OBJECT-TYPE
SYNTAX INTEGER {
none(0)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the data authentication
algorithm for this cryptographic suite capability."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
::= { docsBpi2CmCryptoSuiteEntry 3 }
-- Cable Modem Termination System Group
docsBpi2CmtsObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 2 }
--
-- The BPI+ base table for CMTSs, indexed by ifIndex
--
docsBpi2CmtsBaseTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmtsBaseEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the basic Baseline Privacy
attributes of each CMTS MAC interface."
::= { docsBpi2CmtsObjects 1 }
docsBpi2CmtsBaseEntry OBJECT-TYPE
SYNTAX DocsBpi2CmtsBaseEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing attributes of
one CMTS MAC interface. An entry in this table exists for
each ifEntry with an ifType of docsCableMaclayer(127)."
INDEX { ifIndex }
::= { docsBpi2CmtsBaseTable 1 }
DocsBpi2CmtsBaseEntry ::= SEQUENCE {
docsBpi2CmtsDefaultAuthLifetime Integer32,
docsBpi2CmtsDefaultTEKLifetime Integer32,
docsBpi2CmtsDefaultSelfSignedManufCertTrust INTEGER,
docsBpi2CmtsCheckCertValidityPeriods TruthValue,
docsBpi2CmtsAuthentInfos Counter32,
Expires December 2000 [Page 25]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmtsAuthRequests Counter32,
docsBpi2CmtsAuthReplies Counter32,
docsBpi2CmtsAuthRejects Counter32,
docsBpi2CmtsAuthInvalids Counter32,
docsBpi2CmtsSAMapRequests Counter32,
docsBpi2CmtsSAMapReplies Counter32,
docsBpi2CmtsSAMapRejects Counter32
}
docsBpi2CmtsDefaultAuthLifetime OBJECT-TYPE
SYNTAX Integer32 (1..6048000)
UNITS "seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The value of this object is the default lifetime, in
seconds, the CMTS assigns to a new authorization key."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.2."
::= { docsBpi2CmtsBaseEntry 1 }
docsBpi2CmtsDefaultTEKLifetime OBJECT-TYPE
SYNTAX Integer32 (1..604800)
UNITS "seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The value of this object is the default lifetime, in
seconds, the CMTS assigns to a new Traffic Encryption Key
(TEK)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.2."
::= { docsBpi2CmtsBaseEntry 2 }
docsBpi2CmtsDefaultSelfSignedManufCertTrust OBJECT-TYPE
SYNTAX INTEGER {
trusted (1),
untrusted (2)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"This object determines the default trust of all (new)
self-signed manufacturer certificates obtained after setting
the object."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.4.1"
::= { docsBpi2CmtsBaseEntry 3 }
docsBpi2CmtsCheckCertValidityPeriods OBJECT-TYPE
Expires December 2000 [Page 26]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Setting this object to TRUE causes all certificates
obtained thereafter to have their validity periods (and their
chain's validity periods) checked against the current time of
day. A FALSE setting will cause all certificates obtained
thereafter to not have their validity periods (nor their
chain's validity periods) checked against the current time of
day."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.4.2"
::= { docsBpi2CmtsBaseEntry 4 }
docsBpi2CmtsAuthentInfos OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has received an Authentication Information message from
any CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.9."
::= { docsBpi2CmtsBaseEntry 5 }
docsBpi2CmtsAuthRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has received an Authorization Request message from any
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.1."
::= { docsBpi2CmtsBaseEntry 6 }
docsBpi2CmtsAuthReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an Authorization Reply message to any
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.2."
Expires December 2000 [Page 27]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
::= { docsBpi2CmtsBaseEntry 7 }
docsBpi2CmtsAuthRejects OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an Authorization Reject message to any
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.3."
::= { docsBpi2CmtsBaseEntry 8 }
docsBpi2CmtsAuthInvalids OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an Authorization Invalid message to any
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.7."
::= { docsBpi2CmtsBaseEntry 9 }
docsBpi2CmtsSAMapRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has received an SA Map Request message from any CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.10."
::= { docsBpi2CmtsBaseEntry 10 }
docsBpi2CmtsSAMapReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an SA Map Reply message to any CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.11."
::= { docsBpi2CmtsBaseEntry 11 }
docsBpi2CmtsSAMapRejects OBJECT-TYPE
Expires December 2000 [Page 28]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an SA Map Reject message to any CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.12."
::= { docsBpi2CmtsBaseEntry 12 }
--
-- The CMTS Authorization Table, indexed by ifIndex and CM MAC
-- address
--
docsBpi2CmtsAuthTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmtsAuthEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the attributes of each CM
authorization association. The CMTS maintains one
authorization association with each Baseline Privacy-enabled
CM on each CMTS MAC interface."
::= { docsBpi2CmtsObjects 2 }
docsBpi2CmtsAuthEntry OBJECT-TYPE
SYNTAX DocsBpi2CmtsAuthEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing attributes of
one authorization association. The CMTS MUST create one entry
per CM per MAC interface, based on the receipt of an
Authorization Request message, and MUST not delete the entry
before the CM authorization permanently expires."
INDEX { ifIndex, docsBpi2CmtsAuthCmMacAddress }
::= { docsBpi2CmtsAuthTable 1 }
DocsBpi2CmtsAuthEntry ::= SEQUENCE {
docsBpi2CmtsAuthCmMacAddress MacAddress,
docsBpi2CmtsAuthCmBpiVersion INTEGER,
docsBpi2CmtsAuthCmPublicKey OCTET STRING,
docsBpi2CmtsAuthCmKeySequenceNumber Integer32,
docsBpi2CmtsAuthCmExpiresOld DateAndTime,
docsBpi2CmtsAuthCmExpiresNew DateAndTime,
docsBpi2CmtsAuthCmLifetime Integer32,
docsBpi2CmtsAuthCmGraceTime Integer32,
docsBpi2CmtsAuthCmReset INTEGER,
docsBpi2CmtsAuthCmInfos Counter32,
docsBpi2CmtsAuthCmRequests Counter32,
docsBpi2CmtsAuthCmReplies Counter32,
Expires December 2000 [Page 29]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmtsAuthCmRejects Counter32,
docsBpi2CmtsAuthCmInvalids Counter32,
docsBpi2CmtsAuthRejectErrorCode INTEGER,
docsBpi2CmtsAuthRejectErrorString DisplayString,
docsBpi2CmtsAuthInvalidErrorCode INTEGER,
docsBpi2CmtsAuthInvalidErrorString DisplayString,
docsBpi2CmtsAuthPrimarySAId Integer32,
docsBpi2CmtsAuthBpkmCmCertValid INTEGER,
docsBpi2CmtsAuthBpkmCmCert X509Certificate
}
docsBpi2CmtsAuthCmMacAddress OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The value of this object is the physical address of
the CM to which the authorization association applies."
::= { docsBpi2CmtsAuthEntry 1 }
docsBpi2CmtsAuthCmBpiVersion OBJECT-TYPE
SYNTAX INTEGER {
bpi (0),
bpiPlus (1)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the version of Baseline
Privacy for which this CM has registered."
::= { docsBpi2CmtsAuthEntry 2 }
docsBpi2CmtsAuthCmPublicKey OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (0|74|106|140|204|270))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is a DER-encoded
RSAPublicKey ASN.1 type string, as defined in the RSA
Encryption Standard (PKCS #1) [10], corresponding to the
public key of the CM. The 74, 106, 140, 204, and 270 byte key
encoding lengths correspond to 512 bit, 768 bit, 1024 bit,
1536 bit, and 2048 public moduli respectively. This is a
zero-length string if the CMTS does not retain the public
key."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.4."
::= { docsBpi2CmtsAuthEntry 3 }
docsBpi2CmtsAuthCmKeySequenceNumber OBJECT-TYPE
SYNTAX Integer32 (0..15)
MAX-ACCESS read-only
Expires December 2000 [Page 30]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
STATUS current
DESCRIPTION
"The value of this object is the most recent
authorization key sequence number for this CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.2 and 4.2.2.10."
::= { docsBpi2CmtsAuthEntry 4 }
docsBpi2CmtsAuthCmExpiresOld OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the actual clock time
when the immediate predecessor of the most recent
authorization for this CM expires. If this CM does not have
an active authorization, then the value is of the expiration
date and time of the last active authorization.
Note: Implementation of this object is optional and MAY vary
for CMs running in BPI mode."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.2 and 4.2.2.9."
::= { docsBpi2CmtsAuthEntry 5 }
docsBpi2CmtsAuthCmExpiresNew OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the actual clock time
when the most recent authorization for this CM expires. If
this CM does not have an active authorization, then the value
is of the expiration date and time of the last active
authorization."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.2 and 4.2.2.9."
::= { docsBpi2CmtsAuthEntry 6 }
docsBpi2CmtsAuthCmLifetime OBJECT-TYPE
SYNTAX Integer32 (1..6048000)
UNITS "seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The value of this object is the lifetime, in seconds,
the CMTS assigns to an authorization key for this CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.2 and Appendix A.2."
::= { docsBpi2CmtsAuthEntry 7 }
Expires December 2000 [Page 31]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmtsAuthCmGraceTime OBJECT-TYPE
SYNTAX Integer32 (1..6047999)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the grace time for the
authorization key in seconds. The CM is expected to start
trying to get a new authorization key beginning AuthGraceTime
seconds before the authorization key actually expires.
Note: Tracking this value is optional on certain CMTS
implementations."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.3."
::= { docsBpi2CmtsAuthEntry 8 }
docsBpi2CmtsAuthCmReset OBJECT-TYPE
SYNTAX INTEGER {
noResetRequested(1),
invalidateAuth(2),
sendAuthInvalid(3),
invalidateTeks(4)
}
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Setting this object to invalidateAuth(2) causes the
CMTS to invalidate the current CM authorization key(s), but
not to transmit an Authorization Invalid message nor to
invalidate unicast TEKs. Setting this object to
sendAuthInvalid(3) causes the CMTS to invalidate the current
CM authorization key(s), and to transmit an Authorization
Invalid message to the CM, but not to invalidate unicast TEKs.
Setting this object to invalidateTeks(4) causes the CMTS to
invalidate the current CM authorization key(s), to transmit an
Authorization Invalid message to the CM, and to invalidate all
unicast TEKs associated with this CM authorization. Reading
this object returns the most-recently-set value of this
object, or returns noResetRequested(1) if the object has not
been set since the last CMTS reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5."
::= { docsBpi2CmtsAuthEntry 9 }
docsBpi2CmtsAuthCmInfos OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has received an Authentication Information message from
Expires December 2000 [Page 32]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
this CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.9."
::= { docsBpi2CmtsAuthEntry 10 }
docsBpi2CmtsAuthCmRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has received an Authorization Request message from this
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.1."
::= { docsBpi2CmtsAuthEntry 11 }
docsBpi2CmtsAuthCmReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an Authorization Reply message to this
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.2."
::= { docsBpi2CmtsAuthEntry 12 }
docsBpi2CmtsAuthCmRejects OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an Authorization Reject message to this
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.3."
::= { docsBpi2CmtsAuthEntry 13 }
docsBpi2CmtsAuthCmInvalids OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an Authorization Invalid message to this
CM."
Expires December 2000 [Page 33]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.7."
::= { docsBpi2CmtsAuthEntry 14 }
docsBpi2CmtsAuthRejectErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
unauthorizedCm(3),
unauthorizedSaid(4),
permanentAuthorizationFailure(8),
timeOfDayNotAcquired(11)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in most recent Authorization
Reject message transmitted to the CM. This has value
unknown(2) if the last Error-Code value was 0, and none(1) if
no Authorization Reject message has been transmitted to the
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.3 and 4.2.2.15."
::= { docsBpi2CmtsAuthEntry 15 }
docsBpi2CmtsAuthRejectErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
most recent Authorization Reject message transmitted to the
CM. This is a zero length string if no Authorization Reject
message has been transmitted to the CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.3 and 4.2.2.6."
::= { docsBpi2CmtsAuthEntry 16 }
docsBpi2CmtsAuthInvalidErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
unauthorizedCm(3),
unsolicited(5),
invalidKeySequence(6),
keyRequestAuthenticationFailure(7)
}
MAX-ACCESS read-only
STATUS current
Expires December 2000 [Page 34]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in most recent Authorization
Invalid message transmitted to the CM. This has value
unknown(2) if the last Error-Code value was 0, and none(1) if
no Authorization Invalid message has been transmitted to the
CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.7 and 4.2.2.15."
::= { docsBpi2CmtsAuthEntry 17 }
docsBpi2CmtsAuthInvalidErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
most recent Authorization Invalid message transmitted to the
CM. This is a zero length string if no Authorization Invalid
message has been transmitted to the CM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.7 and 4.2.2.6."
::= { docsBpi2CmtsAuthEntry 18 }
docsBpi2CmtsAuthPrimarySAId OBJECT-TYPE
SYNTAX Integer32 (0..16383)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Primary Security
Association identifier."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 2.1.3."
::= { docsBpi2CmtsAuthEntry 19 }
docsBpi2CmtsAuthBpkmCmCertValid OBJECT-TYPE
SYNTAX INTEGER {
unknown (0),
validCmChained (1),
validCmTrusted (2),
invalidCmUntrusted (3),
invalidCAUntrusted (4),
invalidCmOther (5),
invalidCAOther (6)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Contains the reason why a CM's certificate is deemed
valid or invalid.
Expires December 2000 [Page 35]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
Return unknown if the CM is running BPI mode.
ValidCmChained means the certificate is valid because
it chains to a valid certificate.
ValidCmTrusted means the certificate is valid because
it has been provisioned (in the docsBpi2CmtsProvisionedCmCert
table) to be trusted.
InvalidCmUntrusted means the certificate is invalid
because it has been provisioned (in the
docsBpi2CmtsProvisionedCmCert table) to be untrusted.
InvalidCAUntrusted means the certificate is invalid
because it chains to an untrusted certificate.
InvalidCmOther and InvalidCAOther refer to errors in
parsing, validity periods, etc, which are attributable to the
cm certificate or its chain respectively; additional
information may be found in docsBpi2AuthRejectErrorString for
these types of errors."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.4.2."
::= { docsBpi2CmtsAuthEntry 20 }
docsBpi2CmtsAuthBpkmCmCert OBJECT-TYPE
SYNTAX X509Certificate
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The X509 CM Certificate sent as part of a BPKM
Authorization Request.
Note: The NULL string must be returned if the entire
certificate is not retained in the CMTS."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.2."
::= { docsBpi2CmtsAuthEntry 21 }
--
-- The CMTS TEK Table, indexed by ifIndex and SAID
--
docsBpi2CmtsTEKTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmtsTEKEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the attributes of each CM
Traffic Encryption Key (TEK) association. The CMTS maintains
one TEK association per SAID on each CMTS MAC interface."
::= { docsBpi2CmtsObjects 3 }
docsBpi2CmtsTEKEntry OBJECT-TYPE
SYNTAX DocsBpi2CmtsTEKEntry
MAX-ACCESS not-accessible
STATUS current
Expires December 2000 [Page 36]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
DESCRIPTION
"Each entry contains objects describing attributes of
one TEK association on a particular CMTS MAC interface. The
CMTS MUST create one entry per SAID per MAC interface,
based on the receipt of a Key Request message, and MUST not
delete the entry before the CM authorization for the SAID
permanently expires."
INDEX { ifIndex, docsBpi2CmtsTEKSAId }
::= { docsBpi2CmtsTEKTable 1 }
DocsBpi2CmtsTEKEntry ::= SEQUENCE {
docsBpi2CmtsTEKSAId Integer32,
docsBpi2CmtsTEKSAType INTEGER,
docsBpi2CmtsTEKDataEncryptAlg INTEGER,
docsBpi2CmtsTEKDataAuthentAlg INTEGER,
docsBpi2CmtsTEKLifetime Integer32,
docsBpi2CmtsTEKGraceTime Integer32,
docsBpi2CmtsTEKKeySequenceNumber Integer32,
docsBpi2CmtsTEKExpiresOld DateAndTime,
docsBpi2CmtsTEKExpiresNew DateAndTime,
docsBpi2CmtsTEKReset TruthValue,
docsBpi2CmtsKeyRequests Counter32,
docsBpi2CmtsKeyReplies Counter32,
docsBpi2CmtsKeyRejects Counter32,
docsBpi2CmtsTEKInvalids Counter32,
docsBpi2CmtsKeyRejectErrorCode INTEGER,
docsBpi2CmtsKeyRejectErrorString DisplayString,
docsBpi2CmtsTEKInvalidErrorCode INTEGER,
docsBpi2CmtsTEKInvalidErrorString DisplayString
}
docsBpi2CmtsTEKSAId OBJECT-TYPE
SYNTAX Integer32 (1..16383)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The value of this object is the DOCSIS Security
Association ID (SAID)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.12."
::= { docsBpi2CmtsTEKEntry 1 }
docsBpi2CmtsTEKSAType OBJECT-TYPE
SYNTAX INTEGER {
none(0),
primary(1),
static(2),
dynamic(3)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
Expires December 2000 [Page 37]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
"The value of this object is the type of security
association. Dynamic does not apply to CMs running in
BPI mode."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 2.1.3."
::= { docsBpi2CmtsTEKEntry 2 }
docsBpi2CmtsTEKDataEncryptAlg OBJECT-TYPE
SYNTAX INTEGER {
none(0),
des56CbcMode(1),
des40CbcMode(2)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the data encryption
algorithm being utilized."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
::= { docsBpi2CmtsTEKEntry 3 }
docsBpi2CmtsTEKDataAuthentAlg OBJECT-TYPE
SYNTAX INTEGER {
none(0)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the data authentication
algorithm being utilized."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
::= { docsBpi2CmtsTEKEntry 4 }
docsBpi2CmtsTEKLifetime OBJECT-TYPE
SYNTAX Integer32 (1..604800)
UNITS "seconds"
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"The value of this object is the lifetime, in
seconds, the CMTS assigns to keys for this TEK association."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.5 and Appendix A.2."
::= { docsBpi2CmtsTEKEntry 5 }
docsBpi2CmtsTEKGraceTime OBJECT-TYPE
SYNTAX Integer32 (1..302399)
Expires December 2000 [Page 38]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the grace time for
the TEK in seconds. The CM is expected to start trying to
acquire a new TEK beginning TEK GraceTime seconds after
the expiration of the immediate predecessor of the most
recent TEK.
Note: A CM in BPI mode is expected to start trying to
acquire a new TEK beginning TEK GraceTime seconds before
the expiration of the most recent TEK.
Note: Tracking this value is optional on certain CMTS
implementations."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Appendix A.1.1.1.6."
::= { docsBpi2CmtsTEKEntry 6 }
docsBpi2CmtsTEKKeySequenceNumber OBJECT-TYPE
SYNTAX Integer32 (0..15)
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the most recent TEK
key sequence number for this SAID."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.2.10 and 4.2.2.13."
::= { docsBpi2CmtsTEKEntry 7 }
docsBpi2CmtsTEKExpiresOld OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the actual clock time
for expiration of the immediate predecessor of the most
recent TEK for this FSM. If this FSM has only one TEK, then
the value is the time of activation of this FSM."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.5 and 4.2.2.9."
::= { docsBpi2CmtsTEKEntry 8 }
docsBpi2CmtsTEKExpiresNew OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the actual clock time
for expiration of the most recent TEK for this FSM."
REFERENCE
Expires December 2000 [Page 39]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.5 and 4.2.2.9."
::= { docsBpi2CmtsTEKEntry 9 }
docsBpi2CmtsTEKReset OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Setting this object to TRUE causes the CMTS to
invalidate the current active TEK(s) (plural due to key
transition periods), and to generate a new TEK for the
associated SAID; the CMTS MAY also generate an unsolicited
TEK Invalid message, to optimize the TEK synchronization
between the CMTS and the CM. Reading this object always
returns FALSE."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.1.3.3.5."
::= { docsBpi2CmtsTEKEntry 10 }
docsBpi2CmtsKeyRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has received a Key Request message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.4."
::= { docsBpi2CmtsTEKEntry 11 }
docsBpi2CmtsKeyReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted a Key Reply message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.5."
::= { docsBpi2CmtsTEKEntry 12 }
docsBpi2CmtsKeyRejects OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted a Key Reject message."
REFERENCE
Expires December 2000 [Page 40]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.6."
::= { docsBpi2CmtsTEKEntry 13 }
docsBpi2CmtsTEKInvalids OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted a TEK Invalid message."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.8."
::= { docsBpi2CmtsTEKEntry 14 }
docsBpi2CmtsKeyRejectErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
unauthorizedSaid(4)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in the most recent Key Reject
message sent in response to a Key Request for this SAID.
This has value unknown(2) if the last Error-Code value
was 0, and none(1) if no Key Reject message has been received
since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.6 and 4.2.2.15."
::= { docsBpi2CmtsTEKEntry 15 }
docsBpi2CmtsKeyRejectErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
the most recent Key Reject message sent in response to a Key
Request for this SAID. This is a zero length string if no
Key Reject message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.6 and 4.2.2.6."
::= { docsBpi2CmtsTEKEntry 16 }
docsBpi2CmtsTEKInvalidErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
Expires December 2000 [Page 41]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
unknown(2),
invalidKeySequence(6)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in the most recent TEK Invalid
message sent in association with this SAID. This has value
unknown(2) if the last Error-Code value was 0, and none(1) if
no TEK Invalid message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.8 and 4.2.2.15."
::= { docsBpi2CmtsTEKEntry 17 }
docsBpi2CmtsTEKInvalidErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
the most recent TEK Invalid message sent in association with
this SAID. This is a zero length string if no TEK Invalid
message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.8 and 4.2.2.6."
::= { docsBpi2CmtsTEKEntry 18 }
--
-- The CMTS Multicast Objects Group
--
docsBpi2CmtsMulticastObjects OBJECT IDENTIFIER
::= { docsBpi2CmtsObjects 4 }
--
-- The CMTS IP Multicast Mapping Table, indexed by IP multicast
-- address and prefix, and by ifindex
--
docsBpi2CmtsIpMulticastMapTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmtsIpMulticastMapEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table maps multicast IP addresses to SAIDs.
It is intended to map BOTH dynamic and static multicast IP
addresses."
::= { docsBpi2CmtsMulticastObjects 1 }
Expires December 2000 [Page 42]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmtsIpMulticastMapEntry OBJECT-TYPE
SYNTAX DocsBpi2CmtsIpMulticastMapEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing the mapping of
one multicast IP address and prefix to one SAID, as well as
associated message counters and error information.
Note: For dynamic multicast IP addresses, create access
does not apply."
INDEX { ifIndex, docsBpi2CmtsIpMulticastAddress,
docsBpi2CmtsIpMulticastPrefixLength }
::= { docsBpi2CmtsIpMulticastMapTable 1 }
DocsBpi2CmtsIpMulticastMapEntry ::= SEQUENCE {
docsBpi2CmtsIpMulticastAddress IpAddress,
docsBpi2CmtsIpMulticastPrefixLength Integer32,
docsBpi2CmtsIpMulticastSAId Integer32,
docsBpi2CmtsIpMulticastSAMapRequests Counter32,
docsBpi2CmtsIpMulticastSAMapReplies Counter32,
docsBpi2CmtsIpMulticastSAMapRejects Counter32,
docsBpi2CmtsIpMulticastSAMapRejectErrorCode INTEGER,
docsBpi2CmtsIpMulticastSAMapRejectErrorString DisplayString,
docsBpi2CmtsIpMulticastMapControl RowStatus
}
docsBpi2CmtsIpMulticastAddress OBJECT-TYPE
SYNTAX IpAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object represents the IP multicast address
to be mapped, in conjunction with
docsBpi2CmtsIpMulticastPrefixLength."
::= { docsBpi2CmtsIpMulticastMapEntry 1 }
docsBpi2CmtsIpMulticastPrefixLength OBJECT-TYPE
SYNTAX Integer32 (0..32)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object represents the IP multicast address prefix
length for this row. The value of this object represents
the length in bits of docsBpiIpMulticastAddress for
multicast address comparisons, using big-endian ordering.
An IP multicast address matches this row if the
(docsBpi2CmtsIpMulticastPrefixLength) most significant bits
of the IP multicast address and of the
(docsBpi2CmtsIpMulticastAddress) are identical.
This object is similar in usage to an IP address mask.
The value 0 corresponds to IP address mask 0.0.0.0,
the value 1 corresponds to IP address mask 128.0.0.0,
the value 8 corresponds to IP address mask 255.0.0.0, and
Expires December 2000 [Page 43]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
the value 32 corresponds to IP address mask 255.255.255.255."
::= { docsBpi2CmtsIpMulticastMapEntry 2 }
docsBpi2CmtsIpMulticastSAId OBJECT-TYPE
SYNTAX Integer32 (1..16383)
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object represents the multicast SAID to be
used in this IP multicast address mapping entry."
::= { docsBpi2CmtsIpMulticastMapEntry 3 }
docsBpi2CmtsIpMulticastSAMapRequests OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has received an SA Map Request message for this IP."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.10."
::= { docsBpi2CmtsIpMulticastMapEntry 4 }
docsBpi2CmtsIpMulticastSAMapReplies OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an SA Map Reply message for this IP."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.11."
::= { docsBpi2CmtsIpMulticastMapEntry 5 }
docsBpi2CmtsIpMulticastSAMapRejects OBJECT-TYPE
SYNTAX Counter32
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the count of times the
CMTS has transmitted an SA Map Reject message for this IP."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.1.12."
::= { docsBpi2CmtsIpMulticastMapEntry 6 }
docsBpi2CmtsIpMulticastSAMapRejectErrorCode OBJECT-TYPE
SYNTAX INTEGER {
none(1),
unknown(2),
noAuthForRequestedDSFlow(9),
Expires December 2000 [Page 44]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
dsFlowNotMappedToSA(10)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the enumerated
description of the Error-Code in the most recent SA Map
Reject message sent in response to a SA Map Request for this
IP. It has value unknown(2) if the last Error-Code value
was 0, and none(1) if no SA MAP Reject message has been
received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.12 and 4.2.2.15."
::= { docsBpi2CmtsIpMulticastMapEntry 7 }
docsBpi2CmtsIpMulticastSAMapRejectErrorString OBJECT-TYPE
SYNTAX DisplayString (SIZE (0..128))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Display-String in
the most recent SA Map Reject message sent in response to an
SA Map Request for this IP. It is a zero length string if
no SA Map Reject message has been received since reboot."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Sections 4.2.1.12 and 4.2.2.6."
::= { docsBpi2CmtsIpMulticastMapEntry 8 }
docsBpi2CmtsIpMulticastMapControl OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object controls and reflects the IP multicast
address mapping entry."
::= { docsBpi2CmtsIpMulticastMapEntry 9 }
--
-- The CMTS Multicast SAID Authorization Table, indexed by ifIndex by
-- multicast SAID by CM MAC address
--
docsBpi2CmtsMulticastAuthTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmtsMulticastAuthEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the multicast SAID
authorization for each CM on each CMTS MAC interface.
Note: The CMTS need only track those CMs actively using
Expires December 2000 [Page 45]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
the SAID."
::= { docsBpi2CmtsMulticastObjects 2 }
docsBpi2CmtsMulticastAuthEntry OBJECT-TYPE
SYNTAX DocsBpi2CmtsMulticastAuthEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing the key
authorization of one cable modem for one multicast SAID
for one CMTS MAC interface.
Note: For dynamic multicast SAIDs, create access does not
apply."
INDEX { ifIndex, docsBpi2CmtsMulticastAuthSAId,
docsBpi2CmtsMulticastAuthCmMacAddress }
::= { docsBpi2CmtsMulticastAuthTable 1 }
DocsBpi2CmtsMulticastAuthEntry ::= SEQUENCE
{
docsBpi2CmtsMulticastAuthSAId Integer32,
docsBpi2CmtsMulticastAuthCmMacAddress MacAddress,
docsBpi2CmtsMulticastAuthControl RowStatus
}
docsBpi2CmtsMulticastAuthSAId OBJECT-TYPE
SYNTAX Integer32 (1..16383)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object represents the multicast SAID for
authorization."
::= { docsBpi2CmtsMulticastAuthEntry 1 }
docsBpi2CmtsMulticastAuthCmMacAddress OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This object represents the MAC address of the CM
to which the multicast SAID authorization applies."
::= { docsBpi2CmtsMulticastAuthEntry 2 }
docsBpi2CmtsMulticastAuthControl OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object controls and reflects the CM
authorization for each multicast SAID."
::= { docsBpi2CmtsMulticastAuthEntry 3 }
--
Expires December 2000 [Page 46]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
-- CMTS Cert Objects
--
docsBpi2CmtsCertObjects OBJECT IDENTIFIER
::= { docsBpi2CmtsObjects 5 }
--
-- CMTS Provisioned CM Cert Table
--
docsBpi2CmtsProvisionedCmCertTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmtsProvisionedCmCertEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A table of CM certificate trust entries provisioned
to the CMTS. This table overrides CM Certificate entries
located in the CMTS' authorization table."
::= { docsBpi2CmtsCertObjects 1 }
docsBpi2CmtsProvisionedCmCertEntry OBJECT-TYPE
SYNTAX DocsBpi2CmtsProvisionedCmCertEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"An entry in the CMTS' provisioned CM certificate
table."
INDEX { docsBpi2CmtsProvisionedCmCertMacAddress }
::= { docsBpi2CmtsProvisionedCmCertTable 1 }
DocsBpi2CmtsProvisionedCmCertEntry ::= SEQUENCE
{
docsBpi2CmtsProvisionedCmCertMacAddress MacAddress,
docsBpi2CmtsProvisionedCmCertTrust INTEGER,
docsBpi2CmtsProvisionedCmCertSource INTEGER,
docsBpi2CmtsProvisionedCmCertStatus RowStatus,
docsBpi2CmtsProvisionedCmCert X509Certificate
}
docsBpi2CmtsProvisionedCmCertMacAddress OBJECT-TYPE
SYNTAX MacAddress
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The index of this row."
::= { docsBpi2CmtsProvisionedCmCertEntry 1 }
docsBpi2CmtsProvisionedCmCertTrust OBJECT-TYPE
SYNTAX INTEGER {
trusted (1),
untrusted (2)
}
MAX-ACCESS read-create
Expires December 2000 [Page 47]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
STATUS current
DESCRIPTION
"Trust state for the provisioned CM certificate entry.
Note: Setting this object need only override the validity of
CM certificates sent in future authorization requests."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.4.1."
DEFVAL { untrusted }
::= { docsBpi2CmtsProvisionedCmCertEntry 2 }
docsBpi2CmtsProvisionedCmCertSource OBJECT-TYPE
SYNTAX INTEGER {
snmp (1),
configurationFile (2),
externalDatabase (3),
other (4)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This object indicates how the certificate reached the
CMTS. Other means it originated from a source not identified
above."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.4.1."
::= { docsBpi2CmtsProvisionedCmCertEntry 3 }
docsBpi2CmtsProvisionedCmCertStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" Standard RowStatus object except:
a) if a row has ever been activated,
docsBpi2CmtsProvisionedCmCert need not be changeable,
b) inactive rows need not be timed out."
::= { docsBpi2CmtsProvisionedCmCertEntry 4 }
docsBpi2CmtsProvisionedCmCert OBJECT-TYPE
SYNTAX X509Certificate
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"An X509 DER-encoded certificate authority
certificate.
Note: The NULL string must be returned, on reads, if the
entire certificate is not retained in the CMTS."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.2."
::= { docsBpi2CmtsProvisionedCmCertEntry 5 }
Expires December 2000 [Page 48]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
--
-- CMTS CA Cert Table
--
docsBpi2CmtsCACertTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmtsCACertEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The table of known certificate authority certificates
acquired by this device."
::= { docsBpi2CmtsCertObjects 2 }
docsBpi2CmtsCACertEntry OBJECT-TYPE
SYNTAX DocsBpi2CmtsCACertEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"A row in the Certificate Authority certificate
table."
INDEX { docsBpi2CmtsCACertIndex }
::= {docsBpi2CmtsCACertTable 1 }
DocsBpi2CmtsCACertEntry ::= SEQUENCE {
docsBpi2CmtsCACertIndex Integer32,
docsBpi2CmtsCACertSubject SnmpAdminString,
docsBpi2CmtsCACertIssuer SnmpAdminString,
docsBpi2CmtsCACertSerialNumber OCTET STRING,
docsBpi2CmtsCACertTrust INTEGER,
docsBpi2CmtsCACertSource INTEGER,
docsBpi2CmtsCACertStatus RowStatus,
docsBpi2CmtsCACert X509Certificate
}
docsBpi2CmtsCACertIndex OBJECT-TYPE
SYNTAX Integer32 (1..10000)
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"The index for this row."
::= { docsBpi2CmtsCACertEntry 1 }
docsBpi2CmtsCACertSubject OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Printable representation of (at least) the
organizationName portion of the certificate's subject name.
Additional fields MAY be present and SHOULD be separated by
CR LF. Ordering of fields is CMTS vendor specific."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Expires December 2000 [Page 49]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
Section 9.2.4"
::= { docsBpi2CmtsCACertEntry 2 }
docsBpi2CmtsCACertIssuer OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"Printable representation of (at least) the
commonName portion of the certificate's issuer name.
Additional fields MAY be present and SHOULD be separated by
CR LF. Ordering of fields is CMTS vendor specific."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.2.4"
::= { docsBpi2CmtsCACertEntry 3 }
docsBpi2CmtsCACertSerialNumber OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (1..32))
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This CA certificate's serial number represented as
an octet string."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.2.2"
::= { docsBpi2CmtsCACertEntry 4 }
docsBpi2CmtsCACertTrust OBJECT-TYPE
SYNTAX INTEGER {
trusted (1),
untrusted (2),
chained (3),
root (4)
}
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"This object controls the trust status of this
certificate. Root certificates must be given root trust;
manufacturer certificates must not be given root trust.
Trust on root certificates must not change.
Note: Setting this object need only affect the validity of
CM certificates sent in future authorization requests;
instantaneous effect need not occur."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.4.1"
DEFVAL { chained }
::= { docsBpi2CmtsCACertEntry 5 }
docsBpi2CmtsCACertSource OBJECT-TYPE
Expires December 2000 [Page 50]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
SYNTAX INTEGER {
snmp (1),
configurationFile (2),
externalDatabase (3),
other (4),
authentInfo (5),
compiledIntoCode (6)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"This object indicates how the certificate reached
the CMTS. Other means it originated from a source not
identified above."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.4.1"
::= { docsBpi2CmtsCACertEntry 6 }
docsBpi2CmtsCACertStatus OBJECT-TYPE
SYNTAX RowStatus
MAX-ACCESS read-create
STATUS current
DESCRIPTION
" Standard RowStatus objects except:
a) if a row has ever been activated, docsBpi2CmtsCACert need
not be changeable,
b) inactive rows need not be timed out,
c) if a row has ever been activated, a destroy setting need
not succeed."
::= { docsBpi2CmtsCACertEntry 7 }
docsBpi2CmtsCACert OBJECT-TYPE
SYNTAX X509Certificate
MAX-ACCESS read-create
STATUS current
DESCRIPTION
"An X509 DER-encoded certificate authority
certificate.
Note: The NULL string must be returned, on reads, if the
entire certificate is not retained in the CMTS."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 9.2."
::= { docsBpi2CmtsCACertEntry 8 }
--
-- Authenticated Software Download Objects
--
--
Expires December 2000 [Page 51]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
-- Note: the authenticated software download objects are a
-- CM requirement only.
--
docsBpi2CodeDownloadControl OBJECT IDENTIFIER
::= { docsBpi2MIBObjects 4 }
docsBpi2CodeDownloadStatusCode OBJECT-TYPE
SYNTAX INTEGER {
configFileCvcVerified (1),
configFileCvcRejected (2),
snmpCvcVerified (3),
snmpCvcRejected (4),
codeFileVerified (5),
codeFileRejected (6),
other (7)
}
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value indicates the result of the latest config
file CVC verification, SNMP CVC verification, or code file
verification."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.3.2 & D.3.5.1."
::= { docsBpi2CodeDownloadControl 1 }
docsBpi2CodeMfgCodeDownloadStatusString OBJECT-TYPE
SYNTAX DisplayString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object indicates the additional
information to the status code. The value will include
the error code and error description which will be defined
separately."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section TBD (see D.3.7)"
::= { docsBpi2CodeDownloadControl 2 }
docsBpi2CodeMfgOrgName OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the device manufacturer's
organizationName."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.2.2."
::= { docsBpi2CodeDownloadControl 3 }
Expires December 2000 [Page 52]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CodeMfgCodeAccessStart OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the device manufacturer's
current codeAccessStart value referenced to Greenwich Mean
Time (GMT)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.2.2."
::= { docsBpi2CodeDownloadControl 4 }
docsBpi2CodeMfgCvcAccessStart OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the device manufacturer's
current cvcAccessStart value referenced to Greenwich Mean
Time (GMT)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.2.2."
::= { docsBpi2CodeDownloadControl 5 }
docsBpi2CodeCoSignerOrgName OBJECT-TYPE
SYNTAX SnmpAdminString
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Co-Signer's
organizationName."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.2.2."
::= { docsBpi2CodeDownloadControl 6 }
docsBpi2CodeCoSignerCodeAccessStart OBJECT-TYPE
SYNTAX DateAndTime
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Co-Signer's current
codeAccessStart value referenced to Greenwich Mean
Time (GMT)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.2.2."
::= { docsBpi2CodeDownloadControl 7 }
docsBpi2CodeCoSignerCvcAccessStart OBJECT-TYPE
SYNTAX DateAndTime
Expires December 2000 [Page 53]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The value of this object is the Co-Signer's current
cvcAccessStart value referenced to Greenwich Mean
Time (GMT)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.2.2."
::= { docsBpi2CodeDownloadControl 8 }
docsBpi2CodeCvcUpdate OBJECT-TYPE
SYNTAX X509Certificate
MAX-ACCESS read-write
STATUS current
DESCRIPTION
"Setting a CVC to this object triggers the device
to verify the CVC and update the cvcAccessStart value.
If the device is not enabled to upgrade codefiles, or
the CVC verification fails, the CVC will be rejected.
Reading this object always returns the null string."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section D.3.3.2.2."
::= { docsBpi2CodeDownloadControl 9 }
--
-- The BPI+ MIB Conformance Statements (with a placeholder for
-- notifications)
--
docsBpi2Notification OBJECT IDENTIFIER
::= { docsBpi2MIB 2 }
docsBpi2Conformance OBJECT IDENTIFIER
::= { docsBpi2MIB 3 }
docsBpi2Compliances OBJECT IDENTIFIER
::= { docsBpi2Conformance 1 }
docsBpi2Groups OBJECT IDENTIFIER
::= { docsBpi2Conformance 2 }
docsBpi2BasicCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"This is the compliance statement for devices which
implement the DOCSIS Baseline Privacy Interface."
MODULE -- docsBpi2MIB
-- conditionally mandatory group
GROUP docsBpi2CmGroup
DESCRIPTION
Expires December 2000 [Page 54]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
"This group is implemented only in CMs, not in CMTSs."
-- conditionally mandatory group
GROUP docsBpi2CmtsGroup
DESCRIPTION
"This group is implemented only in CMTSs, not in CMs."
-- conditionally mandatory group
GROUP docsBpi2CodeDownloadGroup
DESCRIPTION
"This group is required in CMs and is optional in CMTSs."
-- relaxation on mandatory range
OBJECT docsBpi2CmtsDefaultAuthLifetime
SYNTAX Integer32 (86400..6048000)
DESCRIPTION
"The refined range corresponds to the minimum and maximum
values in operational networks, according to Appendix A.2 in
[7]."
-- relaxation on mandatory range
OBJECT docsBpi2CmtsDefaultTEKLifetime
SYNTAX Integer32 (1800..604800)
DESCRIPTION
"The refined range corresponds to the minimum and maximum
values in operational networks, according to Appendix A.2 in
[7]."
-- relaxation on mandatory range
OBJECT docsBpi2CmtsAuthCmLifetime
SYNTAX Integer32 (86400..6048000)
DESCRIPTION
"The refined range corresponds to the minimum and maximum
values in operational networks, according to Appendix A.2 in
[7]."
-- relaxation on mandatory range
OBJECT docsBpi2CmtsTEKLifetime
SYNTAX Integer32 (1800..604800)
DESCRIPTION
"The refined range corresponds to the minimum and maximum
values in operational networks, according to Appendix A.2 in
[7]."
::= { docsBpi2Compliances 1 }
docsBpi2CmGroup OBJECT-GROUP
OBJECTS {
docsBpi2CmPrivacyEnable,
docsBpi2CmPublicKey,
docsBpi2CmAuthState,
docsBpi2CmAuthKeySequenceNumber,
Expires December 2000 [Page 55]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmAuthExpiresOld,
docsBpi2CmAuthExpiresNew,
docsBpi2CmAuthReset,
docsBpi2CmAuthGraceTime,
docsBpi2CmTEKGraceTime,
docsBpi2CmAuthWaitTimeout,
docsBpi2CmReauthWaitTimeout,
docsBpi2CmOpWaitTimeout,
docsBpi2CmRekeyWaitTimeout,
docsBpi2CmAuthRejectWaitTimeout,
docsBpi2CmSAMapWaitTimeout,
docsBpi2CmSAMapMaxRetries,
docsBpi2CmAuthentInfos,
docsBpi2CmAuthRequests,
docsBpi2CmAuthReplies,
docsBpi2CmAuthRejects,
docsBpi2CmAuthInvalids,
docsBpi2CmAuthRejectErrorCode,
docsBpi2CmAuthRejectErrorString,
docsBpi2CmAuthInvalidErrorCode,
docsBpi2CmAuthInvalidErrorString,
docsBpi2CmTEKSAType,
docsBpi2CmTEKDataEncryptAlg,
docsBpi2CmTEKDataAuthentAlg,
docsBpi2CmTEKState,
docsBpi2CmTEKKeySequenceNumber,
docsBpi2CmTEKExpiresOld,
docsBpi2CmTEKExpiresNew,
docsBpi2CmTEKKeyRequests,
docsBpi2CmTEKKeyReplies,
docsBpi2CmTEKKeyRejects,
docsBpi2CmTEKInvalids,
docsBpi2CmTEKAuthPends,
docsBpi2CmTEKKeyRejectErrorCode,
docsBpi2CmTEKKeyRejectErrorString,
docsBpi2CmTEKInvalidErrorCode,
docsBpi2CmTEKInvalidErrorString,
docsBpi2CmIpMulticastSAId,
docsBpi2CmIpMulticastSAMapState,
docsBpi2CmIpMulticastSAMapRequests,
docsBpi2CmIpMulticastSAMapReplies,
docsBpi2CmIpMulticastSAMapRejects,
docsBpi2CmIpMulticastSAMapRejectErrorCode,
docsBpi2CmIpMulticastSAMapRejectErrorString,
docsBpi2CmDeviceCmCert,
docsBpi2CmDeviceManufCert,
docsBpi2CmCryptoSuiteDataEncryptAlg,
docsBpi2CmCryptoSuiteDataAuthentAlg
}
STATUS current
DESCRIPTION
"This collection of objects provides CM BPI+ status and
control."
Expires December 2000 [Page 56]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
::= { docsBpi2Groups 1 }
docsBpi2CmtsGroup OBJECT-GROUP
OBJECTS {
docsBpi2CmtsDefaultAuthLifetime,
docsBpi2CmtsDefaultTEKLifetime,
docsBpi2CmtsDefaultSelfSignedManufCertTrust,
docsBpi2CmtsCheckCertValidityPeriods,
docsBpi2CmtsAuthentInfos,
docsBpi2CmtsAuthRequests,
docsBpi2CmtsAuthReplies,
docsBpi2CmtsAuthRejects,
docsBpi2CmtsAuthInvalids,
docsBpi2CmtsSAMapRequests,
docsBpi2CmtsSAMapReplies,
docsBpi2CmtsSAMapRejects,
docsBpi2CmtsAuthCmBpiVersion,
docsBpi2CmtsAuthCmPublicKey,
docsBpi2CmtsAuthCmKeySequenceNumber,
docsBpi2CmtsAuthCmExpiresOld,
docsBpi2CmtsAuthCmExpiresNew,
docsBpi2CmtsAuthCmLifetime,
docsBpi2CmtsAuthCmGraceTime,
docsBpi2CmtsAuthCmReset,
docsBpi2CmtsAuthCmInfos,
docsBpi2CmtsAuthCmRequests,
docsBpi2CmtsAuthCmReplies,
docsBpi2CmtsAuthCmRejects,
docsBpi2CmtsAuthCmInvalids,
docsBpi2CmtsAuthRejectErrorCode,
docsBpi2CmtsAuthRejectErrorString,
docsBpi2CmtsAuthInvalidErrorCode,
docsBpi2CmtsAuthInvalidErrorString,
docsBpi2CmtsAuthPrimarySAId,
docsBpi2CmtsAuthBpkmCmCertValid,
docsBpi2CmtsAuthBpkmCmCert,
docsBpi2CmtsTEKSAType,
docsBpi2CmtsTEKDataEncryptAlg,
docsBpi2CmtsTEKDataAuthentAlg,
docsBpi2CmtsTEKLifetime,
docsBpi2CmtsTEKGraceTime,
docsBpi2CmtsTEKKeySequenceNumber,
docsBpi2CmtsTEKExpiresOld,
docsBpi2CmtsTEKExpiresNew,
docsBpi2CmtsTEKReset,
docsBpi2CmtsKeyRequests,
docsBpi2CmtsKeyReplies,
docsBpi2CmtsKeyRejects,
docsBpi2CmtsTEKInvalids,
docsBpi2CmtsKeyRejectErrorCode,
docsBpi2CmtsKeyRejectErrorString,
docsBpi2CmtsTEKInvalidErrorCode,
docsBpi2CmtsTEKInvalidErrorString,
Expires December 2000 [Page 57]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
docsBpi2CmtsIpMulticastSAId,
docsBpi2CmtsIpMulticastSAMapRequests,
docsBpi2CmtsIpMulticastSAMapReplies,
docsBpi2CmtsIpMulticastSAMapRejects,
docsBpi2CmtsIpMulticastSAMapRejectErrorCode,
docsBpi2CmtsIpMulticastSAMapRejectErrorString,
docsBpi2CmtsIpMulticastMapControl,
docsBpi2CmtsMulticastAuthControl,
docsBpi2CmtsProvisionedCmCertTrust,
docsBpi2CmtsProvisionedCmCertSource,
docsBpi2CmtsProvisionedCmCertStatus,
docsBpi2CmtsProvisionedCmCert,
docsBpi2CmtsCACertSubject,
docsBpi2CmtsCACertIssuer,
docsBpi2CmtsCACertSerialNumber,
docsBpi2CmtsCACertTrust,
docsBpi2CmtsCACertSource,
docsBpi2CmtsCACertStatus,
docsBpi2CmtsCACert
}
STATUS current
DESCRIPTION
"This collection of objects provides CMTS BPI+ status and
control."
::= { docsBpi2Groups 2 }
docsBpi2CodeDownloadGroup OBJECT-GROUP
OBJECTS {
docsBpi2CodeDownloadStatusCode,
docsBpi2CodeMfgCodeDownloadStatusString,
docsBpi2CodeMfgOrgName,
docsBpi2CodeMfgCodeAccessStart,
docsBpi2CodeMfgCvcAccessStart,
docsBpi2CodeCoSignerOrgName,
docsBpi2CodeCoSignerCodeAccessStart,
docsBpi2CodeCoSignerCvcAccessStart,
docsBpi2CodeCvcUpdate
}
STATUS current
DESCRIPTION
"This collection of objects provide authenticated software
download support."
::= { docsBpi2Groups 3 }
END
4. Acknowledgments
Kaz Ozawa (CableLabs/Toshiba) - Authenticated S/W Download Control
Mike StJohns (@Home) - BPI MIB, 1st draft of BPI+ MIB Rich Woundy
(Cisco) - BPI MIB
Thanks to Mike Sabin (Com21) and Manson Wong (Cisco) for reviewing
Expires December 2000 [Page 58]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
the BPI+ MIB.
5. References
[1] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture
for Describing SNMP Management Frameworks", RFC 2571, April
1999.
[2] Rose, M. and K. McCloghrie, "Structure and Identification of
Management Information for TCP/IP-based Internets", STD 16, RFC
1155, May 1990.
[3] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16,
RFC 1212, March 1991.
[4] Rose, M., "A Convention for Defining Traps for use with the
SNMP", RFC 1215, March 1991.
[5] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of
Management Information for Version 2 (SMIv2)", STD 58, RFC 2578,
April 1999.
[6] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual
Conventions for SMIv2", STD 58, RFC 2579, April 1999.
[7] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance
Statements for SMIv2", STD 58, RFC 2580, April 1999.
[8] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple
Management Protocol", STD 15, RFC 1157, May 1990.
[9] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
"Introduction to Community-based SNMPv2", RFC 1901, January
1996.
[10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport
Mappings for Version 2 of the Simple Network Management Protocol
(SNMPv2)", RFC 1906, January 1996.
[11] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message
Processing and Dispatching for the Simple Network Management
Protocol (SNMP)", RFC 2572, April 1999.
[12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM)
for version 3 of the Simple Network Management Protocol
(SNMPv3)", RFC 2574, April 1999.
[13] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol
Operations for Version 2 of the Simple Network Management
Protocol (SNMPv2)", RFC 1905, January 1996.
Expires December 2000 [Page 59]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
[14] Levi, D., Meyer, P. and B. Stewart, "SNMP Applications", RFC
2573, April 1999.
[15] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access
Control Model (VACM) for the Simple Network Management Protocol
(SNMP)", RFC 2575, April 1999.
[16] "Data-Over-Cable Service Interface Specifications: Cable
Modem Radio Frequency Interface Specification
SP-RFIv1.1-I03-991105", DOCSIS, November 1999, available at
http://www.cablemodem.com/.
[17] "Data-Over-Cable Service Interface Specifications: Baseline
Privacy Plus Interface Specification SP-BPI+-I03-991105",
DOCSIS, November 1999, available at
http://www.cablemodem.com/.
[18] "Data-Over-Cable Service Interface Specifications: Baseline
Privacy Interface Specification SP-BPI-I02-990319",
DOCSIS, March 1999, available at
http://www.cablemodem.com/.
[19] "Data-Over-Cable Service Interface Specifications: OSSI
Baseline Privacy Interface MIB SP-OSSI-BPI-I01-980331",
DOCSIS, March 1999, available at
http://www.cablemodem.com/.
6. Security Considerations
This MIB is intended to limit certain kinds of network behavior by
subscriber hosts attached to cable modems, including, for example, IP
spoofing. These limitations may be compromised, however, if the cable
modem's identity or registration process is spoofed. The DOCSIS RFI
and privacy specifications [16], [18], and [17] define a number of
mechanisms for assuring modem identity.
There are a number of management objects defined in this MIB that
have a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations.
SNMPv1 by itself is not a secure environment. Even if the network
itself is secure (for example by using IPSec), even then, there is no
control as to who on the secure network is allowed to access and
GET/SET (read/change/create/delete) the objects in this MIB.
It is recommended that the implementers consider the security
features as provided by the SNMPv3 framework. Specifically, the use
of the User-based Security Model RFC 2574 [12] and the View- based
Access Control Model RFC 2575 [15] is recommended.
Expires December 2000 [Page 60]
INTERNET-DRAFT DOCSIS Baseline Privacy Plus MIB June 2000
It is then a customer/user responsibility to ensure that the SNMP
entity giving access to an instance of this MIB, is properly
configured to give access to the objects only to those principals
(users) that have legitimate rights to indeed GET or SET
(change/create/delete) them.
7. Author's Address
Stuart M. Green
Arris Interactive
6 Riverside Drive
Andover, MA 01810
USA
Phone: +1 978 946 4664
Email: stu.green@ne.arris-i.com
Expires December 2000 [Page 61]
