DOCSIS BPI Plus MIB November 2002 IPCDN Working Group Internet Draft S. Green Document: draft-ietf-ipcdn-bpiplus-mib-07 ARRIS Group Inc. A. Katsnelson CableLabs (Editor) Expires: May 2003 November 2002 Management Information Base for DOCSIS Cable Modems and Cable Modem Termination Systems for Baseline Privacy Plus Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026 [22]. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Abstract This memo defines a portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it defines a set of managed objects for SNMP-based management of the Baseline Privacy Plus features [17] of DOCSIS1.1- compliant[16] Cable Modems and Cable Modem Termination Systems. This memo specifies a MIB module in a manner that is compliant to the SNMP SMIv2 [5][6][7]. The set of objects are consistent with the SNMP framework and existing SNMP standards. This memo is a product of the IPCDN working group within the Internet Engineering Task Force. Comments are solicited and should be Green/Katsnelson Expires - May 2003 [Page 1]
DOCSIS BPI Plus MIB November 2002 addressed to the working group's mailing list at ipcdn@ietf.org and/or the authors. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC-2119 [23]. Table of Contents 1. The SNMP Network Management Framework..........................2 2. Overview.......................................................3 2.1 Structure of the MIB.......................................3 3. Definitions....................................................5 4. Acknowledgments...............................................69 5. References....................................................69 6. Security Considerations.......................................71 7. Authors' Addresses............................................72 8. Intellectual Property.........................................72 9. Full Copyright Statement......................................73 1. The SNMP Network Management Framework The SNMP Management Framework presently consists of five major components: o An overall architecture, described in RFC 2571 [1]. o Mechanisms for describing and naming objects and events for the purpose of management. The first version of this Structure of Management Information (SMI) is called SMIv1 and described in STD 16, RFC 1155 [2], STD 16, RFC 1212 [3] and RFC 1215 [4]. The second version, called SMIv2, is described in STD 58, RFC 2578 [5], STD 58, RFC 2579 [6] and STD 58, RFC 2580 [7]. o Message protocols for transferring management information. The first version of the SNMP message protocol is called SNMPv1 and described in RFC 1157 [8]. A second version of the SNMP message protocol, which is not an Internet standards track protocol, is called SNMPv2c and described in RFC 1901 [9] and RFC 1906 [10]. The third version of the message protocol is called SNMPv3 and described in RFC 1906 [10], RFC 2572 [11] and RFC 2574 [12]. o Protocol operations for accessing management information. The first set of protocol operations and associated PDU formats is described in STD 15, RFC 1157 [8]. A second set of protocol operations and associated PDU formats is described in RFC 1905 [13]. Green/Katsnelson Expires - May 2003 [Page 2]
DOCSIS BPI Plus MIB November 2002 o A set of fundamental applications described in RFC 2573 [14] and the view-based access control mechanism described in RFC 2575 [15]. A more detailed introduction to the current SNMP Management Framework can be found in RFC 2570 [21]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. Objects in the MIB are defined using the mechanisms defined in the SMI. This memo specifies a MIB module that is compliant to the SMIv2. A MIB conforming to the SMIv1 can be produced through the appropriate translations. The resulting translated MIB MUST be semantically equivalent, except where objects or events are omitted because no translation is possible (use of Counter64). Some machine readable information in SMIv2 will be converted into textual descriptions in SMIv1 during the translation process. However, this loss of machine readable information is not considered to change the semantics of the MIB. 2. Overview This MIB provides a set of objects required for the management of the Baseline Privacy Plus features of DOCSIS Cable Modem (CM) and Cable Modem Termination Systems (CMTS). The specification is derived from the operational model described in the DOCSIS Baseline Privacy Plus Specification [17]. DOCSIS Baseline Privacy Plus is composed of four distinct functional and manageable areas: o Key Exchange and Data Encryption o Cable Modem Authentication o Multicast Encryption o Authentication of Downloaded Software Images This MIB is an extension of the DOCSIS 1.0 Baseline Privacy MIB [19] which is derived from the operational model described in the DOCSIS Baseline Privacy Specification [18]. The original Baseline Privacy MIB structure has been mostly preserved in the Baseline Privacy Plus MIB. 2.1 Structure of the MIB This MIB is structured into several tables and objects: Green/Katsnelson Expires - May 2003 [Page 3]
DOCSIS BPI Plus MIB November 2002 2.1.1. Cable Modem o The docsBpi2CmBaseTable contains authorization key exchange information for one CM MAC interface. o The docsBpi2CmTEKTable contains traffic key exchange and data encryption information for a particular security association ID of the cable modem. o Multicast Encryption information is maintained under Docsbpi2CmMulticastObjects. There is currently one multicast table object which manages IP multicast encryption, docsBpi2CmIpMulticastMapTable. o Digital certificates used for cable modem authentication are accessible via docsBpi2CmDeviceCertTable. o Cryptographic suite capabilities for a CM MAC are maintained in the docsBpi2CmCryptoSuiteTable. 2.1.2. Cable Modem Termination System o The docsBpi2CmtsBaseTable contains default settings and summary counters for the cable modem termination system. o The DocsBpi2CmtsAuthTable contains Authorization Key Exchange information for each CM MAC interface, as well as data from CM certificates used in cable modem authentication. o The docsBpi2CmtsTEKTable contains traffic key exchange and data encryption information for a particular security association ID. o Multicast Encryption information is maintained under Docsbpi2CmtsMulticastObjects. There are currently two multicast table objects. DocsBpi2CmtsIpMulticastMapTable is specifically designed for IP multicast encryption, whereas docsBpi2CmtsMulticastAuthTable is meant to manage all multicast security associations. o DocsBpi2CmtsCertObjects contains 2 manageable tables: one for provisioned cable modem certificates and one for certification authority certificates. 2.1.3. Common o The docsBpi2CodeDownloadControl objects manage the authenticated software download process for a given device. Green/Katsnelson Expires - May 2003 [Page 4]
DOCSIS BPI Plus MIB November 2002 o The docsBpi2CRLObject contains the docsBpi2CRLTable for storing certificate revocation list entries. If desired, the table may be used in conjunction with future objects designed to automate the acquisition of CRLs from network nodes. 3. Definitions DOCS-BPI2-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Counter32, Integer32 FROM SNMPv2-SMI SnmpAdminString FROM SNMP-FRAMEWORK-MIB TEXTUAL-CONVENTION, MacAddress, RowStatus, TruthValue, DateAndTime FROM SNMPv2-TC OBJECT-GROUP, MODULE-COMPLIANCE FROM SNMPv2-CONF ifIndex FROM IF-MIB docsIfMib FROM DOCS-IF-MIB InetAddressType, InetAddress FROM INET-ADDRESS-MIB ; docsBpi2MIB MODULE-IDENTITY LAST-UPDATED "200211010000Z" ORGANIZATION "IETF IPCDN Working Group" CONTACT-INFO "--------------------------------------- Stuart M. Green Postal: ARRIS Group Inc. 6 Riverside Drive Andover, MA 01810 U.S.A. Tel: +1 978 946 4664 Fax: +1 978 946 4800 Green/Katsnelson Expires - May 2003 [Page 5]
DOCSIS BPI Plus MIB November 2002 E-mail: stu.green@arrisi.com --------------------------------------- Kaz Ozawa Postal: Cable Television Laboratories 400 Centennial Parkway Louisville, CO 80027 U.S.A. Tel: +1 303 661 3860 Fax: +1 303 661 9199 E-mail: k.ozawa@cablelabs.com --------------------------------------- Alexander Katsnelson Postal: Cable Television Laboratories, Inc. 400 Centennial Parkway Louisville, CO 80027-1266 U.S.A. Tel: +1 303 661 9100 Fax: +1 303 661 9199 E-mail: a.katsnelson@cablelabs.com --------------------------------------- IETF IPCDN Working Group General Discussion: ipcdn@ietf.org Subscribe: http://www.ietf.org/mailman/listinfo/ipcdn Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn Co-chairs: Richard Woundy, rwoundy@cisco.com Jean-Francois Mule, jfm@cablelabs.com" DESCRIPTION "This is the MIB Module for the DOCSIS Baseline Privacy Plus Interface (BPI+) at cable modems (CMs) and cable modem termination systems (CMTSs)." REVISION "200211010000Z" DESCRIPTION "Added encodings for docsBpi2CmtsAuthBpkmCmCertValid, added CRL object, table, & group, and made minor modifications to many object descriptions." REVISION "200104170000Z" DESCRIPTION "Modified CM and CMTS IP Multicast table indexing in preparation for IPV6. Obsoleted grace time objects from the CMTS portion of the MIB." REVISION "200011171930Z" DESCRIPTION Green/Katsnelson Expires - May 2003 [Page 6]
DOCSIS BPI Plus MIB November 2002 "Replaced DisplayString type with SnmpAdminString type. Several object descriptions were also changed." ::= { docsIfMib 6 } -- Textual conventions X509Certificate ::= TEXTUAL-CONVENTION STATUS current DESCRIPTION "An X509 digital certificate encoded as an ASN.1 DER object." SYNTAX OCTET STRING (SIZE (0..1400)) docsBpi2MIBObjects OBJECT IDENTIFIER ::= { docsBpi2MIB 1 } -- Cable Modem Group docsBpi2CmObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 1 } -- -- The BPI+ base and authorization table for CMs, indexed by -- ifIndex -- docsBpi2CmBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic and authorization related Baseline Privacy Plus attributes of each CM MAC interface." ::= { docsBpi2CmObjects 1 } docsBpi2CmBaseEntry OBJECT-TYPE SYNTAX DocsBpi2CmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpi2CmBaseTable 1 } DocsBpi2CmBaseEntry ::= SEQUENCE { Green/Katsnelson Expires - May 2003 [Page 7]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmPrivacyEnable TruthValue, docsBpi2CmPublicKey OCTET STRING, docsBpi2CmAuthState INTEGER, docsBpi2CmAuthKeySequenceNumber Integer32, docsBpi2CmAuthExpiresOld DateAndTime, docsBpi2CmAuthExpiresNew DateAndTime, docsBpi2CmAuthReset TruthValue, docsBpi2CmAuthGraceTime Integer32, docsBpi2CmTEKGraceTime Integer32, docsBpi2CmAuthWaitTimeout Integer32, docsBpi2CmReauthWaitTimeout Integer32, docsBpi2CmOpWaitTimeout Integer32, docsBpi2CmRekeyWaitTimeout Integer32, docsBpi2CmAuthRejectWaitTimeout Integer32, docsBpi2CmSAMapWaitTimeout Integer32, docsBpi2CmSAMapMaxRetries Integer32, docsBpi2CmAuthentInfos Counter32, docsBpi2CmAuthRequests Counter32, docsBpi2CmAuthReplies Counter32, docsBpi2CmAuthRejects Counter32, docsBpi2CmAuthInvalids Counter32, docsBpi2CmAuthRejectErrorCode INTEGER, docsBpi2CmAuthRejectErrorString SnmpAdminString, docsBpi2CmAuthInvalidErrorCode INTEGER, docsBpi2CmAuthInvalidErrorString SnmpAdminString } docsBpi2CmPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this CM is provisioned to run Baseline Privacy Plus." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1." ::= { docsBpi2CmBaseEntry 1 } docsBpi2CmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (74|106|140|204|270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [20], corresponding to the public key of the CM. The 74, 106, 140, 204, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, Green/Katsnelson Expires - May 2003 [Page 8]
DOCSIS BPI Plus MIB November 2002 1536 bit, and 2048 public moduli respectively." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.4." ::= { docsBpi2CmBaseEntry 2 } docsBpi2CmAuthState OBJECT-TYPE SYNTAX INTEGER { start(1), authWait(2), authorized(3), reauthWait(4), authRejectWait(5), silent(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the CM authorization FSM. The start state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.2.1." ::= { docsBpi2CmBaseEntry 3 } docsBpi2CmAuthKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the most recent authorization key sequence number for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpi2CmBaseEntry 4 } docsBpi2CmAuthExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent authorization key for this FSM. If this FSM has only one authorization key, then the value is the time of activation of this FSM." Green/Katsnelson Expires - May 2003 [Page 9]
DOCSIS BPI Plus MIB November 2002 REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmBaseEntry 5 } docsBpi2CmAuthExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent authorization key for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmBaseEntry 6 } docsBpi2CmAuthReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE generates a Reauthorize event in the authorization FSM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.2.3.4." ::= { docsBpi2CmBaseEntry 7 } docsBpi2CmAuthGraceTime OBJECT-TYPE SYNTAX Integer32 (1..6047999) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for an authorization key in seconds. A CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the most recent authorization key actually expires." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.3." ::= { docsBpi2CmBaseEntry 8 } docsBpi2CmTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..302399) Green/Katsnelson Expires - May 2003 [Page 10]
DOCSIS BPI Plus MIB November 2002 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the TEK in seconds. The CM is expected to start trying to acquire a new TEK beginning TEK GraceTime seconds before the expiration of the most recent TEK." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.6." ::= { docsBpi2CmBaseEntry 9 } docsBpi2CmAuthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorize Wait Timeout in second." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.1." ::= { docsBpi2CmBaseEntry 10 } docsBpi2CmReauthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Reauthorize Wait Timeout in seconds." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.2." ::= { docsBpi2CmBaseEntry 11 } docsBpi2CmOpWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Operational Wait Timeout in seconds." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Green/Katsnelson Expires - May 2003 [Page 11]
DOCSIS BPI Plus MIB November 2002 Appendix A.1.1.1.4." ::= { docsBpi2CmBaseEntry 12 } docsBpi2CmRekeyWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Rekey Wait Timeout in seconds." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.5." ::= { docsBpi2CmBaseEntry 13 } docsBpi2CmAuthRejectWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..600) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorization Reject Wait Timeout in seconds." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.7." ::= { docsBpi2CmBaseEntry 14 } docsBpi2CmSAMapWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the retransmission interval, in seconds, of SA Map Requests from the MAP Wait state." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.8." ::= { docsBpi2CmBaseEntry 15 } docsBpi2CmSAMapMaxRetries OBJECT-TYPE SYNTAX Integer32 (0..10) UNITS "count" MAX-ACCESS read-only STATUS current DESCRIPTION Green/Katsnelson Expires - May 2003 [Page 12]
DOCSIS BPI Plus MIB November 2002 "The value of this object is the maximum number of Map Request retries allowed." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.9." ::= { docsBpi2CmBaseEntry 16 } docsBpi2CmAuthentInfos OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an Authentication Information message, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.9." ::= { docsBpi2CmBaseEntry 17 } docsBpi2CmAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an Authorization Request message, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.1." ::= { docsBpi2CmBaseEntry 18 } docsBpi2CmAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reply message, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2." ::= { docsBpi2CmBaseEntry 19 } docsBpi2CmAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current Green/Katsnelson Expires - May 2003 [Page 13]
DOCSIS BPI Plus MIB November 2002 DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reject message, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.3." ::= { docsBpi2CmBaseEntry 20 } docsBpi2CmAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Invalid message, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.7." ::= { docsBpi2CmBaseEntry 21 } docsBpi2CmAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSaid(4), permanentAuthorizationFailure(8), timeOfDayNotAcquired(11) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.15." ::= { docsBpi2CmBaseEntry 22 } docsBpi2CmAuthRejectErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message received by the CM. Green/Katsnelson Expires - May 2003 [Page 14]
DOCSIS BPI Plus MIB November 2002 This is a zero length string if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpi2CmBaseEntry 23 } docsBpi2CmAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.15." ::= { docsBpi2CmBaseEntry 24 } docsBpi2CmAuthInvalidErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message received by the CM. This is a zero length string if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpi2CmBaseEntry 25 } -- Green/Katsnelson Expires - May 2003 [Page 15]
DOCSIS BPI Plus MIB November 2002 -- The CM TEK Table, indexed by ifIndex and SAID -- docsBpi2CmTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key (TEK) association. The CM maintains (no more than) one TEK association per SAID per CM MAC interface." ::= { docsBpi2CmObjects 2 } docsBpi2CmTEKEntry OBJECT-TYPE SYNTAX DocsBpi2CmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the TEK association attributes of one SAID. The CM MUST create one entry per SAID, regardless of whether the SAID was obtained from a Registration Response message, from an Authorization Reply message, or from any dynamic SAID establishment mechanisms." INDEX { ifIndex, docsBpi2CmTEKSAId } ::= { docsBpi2CmTEKTable 1 } DocsBpi2CmTEKEntry ::= SEQUENCE { docsBpi2CmTEKSAId Integer32, docsBpi2CmTEKSAType INTEGER, docsBpi2CmTEKDataEncryptAlg INTEGER, docsBpi2CmTEKDataAuthentAlg INTEGER, docsBpi2CmTEKState INTEGER, docsBpi2CmTEKKeySequenceNumber Integer32, docsBpi2CmTEKExpiresOld DateAndTime, docsBpi2CmTEKExpiresNew DateAndTime, docsBpi2CmTEKKeyRequests Counter32, docsBpi2CmTEKKeyReplies Counter32, docsBpi2CmTEKKeyRejects Counter32, docsBpi2CmTEKInvalids Counter32, docsBpi2CmTEKAuthPends Counter32, docsBpi2CmTEKKeyRejectErrorCode INTEGER, docsBpi2CmTEKKeyRejectErrorString SnmpAdminString, docsBpi2CmTEKInvalidErrorCode INTEGER, docsBpi2CmTEKInvalidErrorString SnmpAdminString } Green/Katsnelson Expires - May 2003 [Page 16]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmTEKSAId OBJECT-TYPE SYNTAX Integer32 (1..16383) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the DOCSIS Security Association ID (SAID)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.12." ::= { docsBpi2CmTEKEntry 1 } docsBpi2CmTEKSAType OBJECT-TYPE SYNTAX INTEGER { none(0), primary(1), static(2), dynamic(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the type of security association. The none(0) encoding must only be used if the SA type has yet to be determined." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 2.1.3." ::= { docsBpi2CmTEKEntry 2 } docsBpi2CmTEKDataEncryptAlg OBJECT-TYPE SYNTAX INTEGER { none(0), des56CbcMode(1), des40CbcMode(2) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data encryption algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmTEKEntry 3 } docsBpi2CmTEKDataAuthentAlg OBJECT-TYPE SYNTAX INTEGER { none(0) Green/Katsnelson Expires - May 2003 [Page 17]
DOCSIS BPI Plus MIB November 2002 } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data authentication algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmTEKEntry 4 } docsBpi2CmTEKState OBJECT-TYPE SYNTAX INTEGER { start(1), opWait(2), opReauthWait(3), operational(4), rekeyWait(5), rekeyReauthWait(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the indicated TEK FSM. The start(1) state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.3.1." ::= { docsBpi2CmTEKEntry 5 } docsBpi2CmTEKKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the most recent TEK key sequence number for this TEK FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.2.10 and 4.2.2.13." ::= { docsBpi2CmTEKEntry 6 } docsBpi2CmTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for Green/Katsnelson Expires - May 2003 [Page 18]
DOCSIS BPI Plus MIB November 2002 expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmTEKEntry 7 } docsBpi2CmTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmTEKEntry 8 } docsBpi2CmTEKKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted a Key Request message, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.4." ::= { docsBpi2CmTEKEntry 9 } docsBpi2CmTEKKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reply message, including a message whose authentication failed, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.5." ::= { docsBpi2CmTEKEntry 10 } docsBpi2CmTEKKeyRejects OBJECT-TYPE SYNTAX Counter32 Green/Katsnelson Expires - May 2003 [Page 19]
DOCSIS BPI Plus MIB November 2002 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reject message, including a message whose authentication failed, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.6." ::= { docsBpi2CmTEKEntry 11 } docsBpi2CmTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a TEK Invalid message, including a message whose authentication failed, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.8." ::= { docsBpi2CmTEKEntry 12 } docsBpi2CmTEKAuthPends OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times an Authorization Pending (Auth Pend) event occurred in this FSM, since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.3.3.3." ::= { docsBpi2CmTEKEntry 13 } docsBpi2CmTEKKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSaid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Key Reject message received by the CM. This has value unknown(2) if the Green/Katsnelson Expires - May 2003 [Page 20]
DOCSIS BPI Plus MIB November 2002 last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.6 and 4.2.2.15." ::= { docsBpi2CmTEKEntry 14 } docsBpi2CmTEKKeyRejectErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Key Reject message received by the CM. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.6 and 4.2.2.6." ::= { docsBpi2CmTEKEntry 15 } docsBpi2CmTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent TEK Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.8 and 4.2.2.15." ::= { docsBpi2CmTEKEntry 16 } docsBpi2CmTEKInvalidErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent TEK Invalid message received by the CM. This is a zero length string if no TEK Invalid message has been received Green/Katsnelson Expires - May 2003 [Page 21]
DOCSIS BPI Plus MIB November 2002 since reboot." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.8 and 4.2.2.6." ::= { docsBpi2CmTEKEntry 17 } -- -- The CM Multicast Objects Group -- docsBpi2CmMulticastObjects OBJECT IDENTIFIER ::= { docsBpi2CmObjects 3 } -- -- The CM Dynamic IP Multicast Mapping Table, indexed by -- docsBpi2CmIpMulticastIndex and by ifindex -- docsBpi2CmIpMulticastMapTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table maps multicast IP addresses to SAIDs. It is intended to map multicast IP addresses associated with SA MAP Request messages. An entry may be removed from this table upon the reception of an SA Map Reject." ::= { docsBpi2CmMulticastObjects 1 } docsBpi2CmIpMulticastMapEntry OBJECT-TYPE SYNTAX DocsBpi2CmIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the mapping of one multicast IP address to one SAID, as well as associated state, message counters, and error information." INDEX { ifIndex, docsBpi2CmIpMulticastIndex } ::= { docsBpi2CmIpMulticastMapTable 1 } DocsBpi2CmIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmIpMulticastIndex Integer32, docsBpi2CmIpMulticastAddressType InetAddressType, docsBpi2CmIpMulticastAddress InetAddress, docsBpi2CmIpMulticastSAId Integer32, docsBpi2CmIpMulticastSAMapState INTEGER, docsBpi2CmIpMulticastSAMapRequests Counter32, docsBpi2CmIpMulticastSAMapReplies Counter32, Green/Katsnelson Expires - May 2003 [Page 22]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmIpMulticastSAMapRejects Counter32, docsBpi2CmIpMulticastSAMapRejectErrorCode INTEGER, docsBpi2CmIpMulticastSAMapRejectErrorString SnmpAdminString } docsBpi2CmIpMulticastIndex OBJECT-TYPE SYNTAX Integer32 (1..1000) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of this row." ::= { docsBpi2CmIpMulticastMapEntry 1 } docsBpi2CmIpMulticastAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-only STATUS current DESCRIPTION "The type of internet address for docsBpi2CmIpMulticastAddress." ::= { docsBpi2CmIpMulticastMapEntry 2 } docsBpi2CmIpMulticastAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-only STATUS current DESCRIPTION "This object represents the IP multicast address to be mapped." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 5.4." ::= { docsBpi2CmIpMulticastMapEntry 3 } docsBpi2CmIpMulticastSAId OBJECT-TYPE SYNTAX Integer32 (0..16383) MAX-ACCESS read-only STATUS current DESCRIPTION "This object represents the SAID to which the IP multicast address has been mapped. If no SA Map Reply has been received for the IP address, this object should have the value 0." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.12." ::= { docsBpi2CmIpMulticastMapEntry 4 } docsBpi2CmIpMulticastSAMapState OBJECT-TYPE Green/Katsnelson Expires - May 2003 [Page 23]
DOCSIS BPI Plus MIB November 2002 SYNTAX INTEGER { start(1), mapWait(2), mapped(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the SA Mapping FSM for this IP." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 5.3.1." ::= { docsBpi2CmIpMulticastMapEntry 5 } docsBpi2CmIpMulticastSAMapRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an SA Map Request message for this IP, since entry creation" REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.10." ::= { docsBpi2CmIpMulticastMapEntry 6 } docsBpi2CmIpMulticastSAMapReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an SA Map Reply message for this IP, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.11." ::= { docsBpi2CmIpMulticastMapEntry 7 } docsBpi2CmIpMulticastSAMapRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an SA MAP Reject message for this IP, since entry creation." Green/Katsnelson Expires - May 2003 [Page 24]
DOCSIS BPI Plus MIB November 2002 REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.12." ::= { docsBpi2CmIpMulticastMapEntry 8 } docsBpi2CmIpMulticastSAMapRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), noAuthForRequestedDSFlow(9), dsFlowNotMappedToSA(10) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent SA Map Reject message sent in response to an SA Map Request for this IP. It has the value none(1) if no SA MAP Reject message has been received since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.15." ::= { docsBpi2CmIpMulticastMapEntry 9 } docsBpi2CmIpMulticastSAMapRejectErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent SA Map Reject message sent in response to an SA Map Request for this IP. It is a zero length string if no SA Map Reject message has been received since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.6." ::= { docsBpi2CmIpMulticastMapEntry 10 } -- -- CM Cert Objects -- docsBpi2CmCertObjects OBJECT IDENTIFIER ::= { docsBpi2CmObjects 4 } -- Green/Katsnelson Expires - May 2003 [Page 25]
DOCSIS BPI Plus MIB November 2002 -- CM Device Cert Table -- docsBpi2CmDeviceCertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmDeviceCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the Baseline Privacy Plus device certificates for each CM MAC interface." ::= { docsBpi2CmCertObjects 1 } docsBpi2CmDeviceCertEntry OBJECT-TYPE SYNTAX DocsBpi2CmDeviceCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains the device certificates of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpi2CmDeviceCertTable 1 } DocsBpi2CmDeviceCertEntry ::= SEQUENCE { docsBpi2CmDeviceCmCert X509Certificate, docsBpi2CmDeviceManufCert X509Certificate } docsBpi2CmDeviceCmCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-write STATUS current DESCRIPTION "The X509 DER-encoded cable modem certificate. Note: This object can be set only when the value is the null string. Once the object contains the certificate, its access MUST be read-only." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.1." ::= { docsBpi2CmDeviceCertEntry 1 } docsBpi2CmDeviceManufCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-only STATUS current DESCRIPTION "The X509 DER-encoded manufacturer certificate which Green/Katsnelson Expires - May 2003 [Page 26]
DOCSIS BPI Plus MIB November 2002 signed the cable modem certificate." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.1." ::= { docsBpi2CmDeviceCertEntry 2 } -- -- CM Crypto Suite Table -- docsBpi2CmCryptoSuiteTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmCryptoSuiteEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the Baseline Privacy Plus cryptographic suite capabilites for each CM MAC interface." ::= { docsBpi2CmObjects 5 } docsBpi2CmCryptoSuiteEntry OBJECT-TYPE SYNTAX DocsBpi2CmCryptoSuiteEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains a cryptographic suite pair which this CM MAC supports." INDEX { ifIndex, docsBpi2CmCryptoSuiteIndex } ::= { docsBpi2CmCryptoSuiteTable 1 } DocsBpi2CmCryptoSuiteEntry ::= SEQUENCE { docsBpi2CmCryptoSuiteIndex Integer32, docsBpi2CmCryptoSuiteDataEncryptAlg INTEGER, docsBpi2CmCryptoSuiteDataAuthentAlg INTEGER } docsBpi2CmCryptoSuiteIndex OBJECT-TYPE SYNTAX Integer32 (1..1000) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index for a cryptographic suite row." ::= { docsBpi2CmCryptoSuiteEntry 1 } docsBpi2CmCryptoSuiteDataEncryptAlg OBJECT-TYPE SYNTAX INTEGER { none(0), des56CbcMode(1), des40CbcMode(2) Green/Katsnelson Expires - May 2003 [Page 27]
DOCSIS BPI Plus MIB November 2002 } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data encryption algorithm for this cryptographic suite capability." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmCryptoSuiteEntry 2 } docsBpi2CmCryptoSuiteDataAuthentAlg OBJECT-TYPE SYNTAX INTEGER { none(0) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data authentication algorithm for this cryptographic suite capability." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmCryptoSuiteEntry 3 } -- Cable Modem Termination System Group docsBpi2CmtsObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 2 } -- -- SPECIAL NOTE: For the following CMTS tables, when a CM is -- running -- in BPI mode, replace SAID (Security Association ID) -- with SID (Service ID). The CMTS is required to map SAIDs and -- SIDs -- to one contiguous space. -- -- -- The BPI+ base table for CMTSs, indexed by ifIndex -- Green/Katsnelson Expires - May 2003 [Page 28]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic Baseline Privacy attributes of each CMTS MAC interface." ::= { docsBpi2CmtsObjects 1 } docsBpi2CmtsBaseEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CMTS MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpi2CmtsBaseTable 1 } DocsBpi2CmtsBaseEntry ::= SEQUENCE { docsBpi2CmtsDefaultAuthLifetime Integer32, docsBpi2CmtsDefaultTEKLifetime Integer32, docsBpi2CmtsDefaultSelfSignedManufCertTrust INTEGER, docsBpi2CmtsCheckCertValidityPeriods TruthValue, docsBpi2CmtsAuthentInfos Counter32, docsBpi2CmtsAuthRequests Counter32, docsBpi2CmtsAuthReplies Counter32, docsBpi2CmtsAuthRejects Counter32, docsBpi2CmtsAuthInvalids Counter32, docsBpi2CmtsSAMapRequests Counter32, docsBpi2CmtsSAMapReplies Counter32, docsBpi2CmtsSAMapRejects Counter32 } docsBpi2CmtsDefaultAuthLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new authorization key." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.2." ::= { docsBpi2CmtsBaseEntry 1 } docsBpi2CmtsDefaultTEKLifetime OBJECT-TYPE Green/Katsnelson Expires - May 2003 [Page 29]
DOCSIS BPI Plus MIB November 2002 SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new Traffic Encryption Key (TEK)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.2." ::= { docsBpi2CmtsBaseEntry 2 } docsBpi2CmtsDefaultSelfSignedManufCertTrust OBJECT-TYPE SYNTAX INTEGER { trusted (1), untrusted (2) } MAX-ACCESS read-write STATUS current DESCRIPTION "This object determines the default trust of self-signed manufacturer certificate entries, contained in docsBpi2CmtsCACertTable, created after setting the object." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1" ::= { docsBpi2CmtsBaseEntry 3 } docsBpi2CmtsCheckCertValidityPeriods OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE causes all chained and root certificates in the chain to have their validity periods checked against the current time of day, when the CMTS receives an Authorization Request from the CM. A FALSE setting causes all certificates in the chain not to have their validity periods checked against the current time of day." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.2" ::= { docsBpi2CmtsBaseEntry 4 } docsBpi2CmtsAuthentInfos OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current Green/Katsnelson Expires - May 2003 [Page 30]
DOCSIS BPI Plus MIB November 2002 DESCRIPTION "The value of this object is the count of times the CMTS has received an Authentication Information message from any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.9." ::= { docsBpi2CmtsBaseEntry 5 } docsBpi2CmtsAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.1." ::= { docsBpi2CmtsBaseEntry 6 } docsBpi2CmtsAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2." ::= { docsBpi2CmtsBaseEntry 7 } docsBpi2CmtsAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.3." ::= { docsBpi2CmtsBaseEntry 8 } docsBpi2CmtsAuthInvalids OBJECT-TYPE Green/Katsnelson Expires - May 2003 [Page 31]
DOCSIS BPI Plus MIB November 2002 SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.7." ::= { docsBpi2CmtsBaseEntry 9 } docsBpi2CmtsSAMapRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an SA Map Request message from any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.10." ::= { docsBpi2CmtsBaseEntry 10 } docsBpi2CmtsSAMapReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an SA Map Reply message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.11." ::= { docsBpi2CmtsBaseEntry 11 } docsBpi2CmtsSAMapRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an SA Map Reject message to any CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.12." ::= { docsBpi2CmtsBaseEntry 12 } -- Green/Katsnelson Expires - May 2003 [Page 32]
DOCSIS BPI Plus MIB November 2002 -- The CMTS Authorization Table, indexed by ifIndex and CM MAC -- address -- docsBpi2CmtsAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM authorization association. The CMTS maintains one authorization association with each Baseline Privacy-enabled CM, registered on each CMTS MAC interface, regardless of whether the CM is authorized or rejected." ::= { docsBpi2CmtsObjects 2 } docsBpi2CmtsAuthEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one authorization association. The CMTS MUST create one entry per CM per MAC interface, based on the receipt of an Authorization Request message, and MUST not delete the entry until the CM loses registration." INDEX { ifIndex, docsBpi2CmtsAuthCmMacAddress } ::= { docsBpi2CmtsAuthTable 1 } DocsBpi2CmtsAuthEntry ::= SEQUENCE { docsBpi2CmtsAuthCmMacAddress MacAddress, docsBpi2CmtsAuthCmBpiVersion INTEGER, docsBpi2CmtsAuthCmPublicKey OCTET STRING, docsBpi2CmtsAuthCmKeySequenceNumber Integer32, docsBpi2CmtsAuthCmExpiresOld DateAndTime, docsBpi2CmtsAuthCmExpiresNew DateAndTime, docsBpi2CmtsAuthCmLifetime Integer32, docsBpi2CmtsAuthCmGraceTime Integer32, docsBpi2CmtsAuthCmReset INTEGER, docsBpi2CmtsAuthCmInfos Counter32, docsBpi2CmtsAuthCmRequests Counter32, docsBpi2CmtsAuthCmReplies Counter32, docsBpi2CmtsAuthCmRejects Counter32, docsBpi2CmtsAuthCmInvalids Counter32, docsBpi2CmtsAuthRejectErrorCode INTEGER, docsBpi2CmtsAuthRejectErrorString SnmpAdminString, docsBpi2CmtsAuthInvalidErrorCode INTEGER, docsBpi2CmtsAuthInvalidErrorString SnmpAdminString, docsBpi2CmtsAuthPrimarySAId Integer32, Green/Katsnelson Expires - May 2003 [Page 33]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsAuthBpkmCmCertValid INTEGER, docsBpi2CmtsAuthBpkmCmCert X509Certificate } docsBpi2CmtsAuthCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the physical address of the CM to which the authorization association applies." ::= { docsBpi2CmtsAuthEntry 1 } docsBpi2CmtsAuthCmBpiVersion OBJECT-TYPE SYNTAX INTEGER { bpi (0), bpiPlus (1) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the version of Baseline Privacy for which this CM has registered." ::= { docsBpi2CmtsAuthEntry 2 } docsBpi2CmtsAuthCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0|74|106|140|204|270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [10], corresponding to the public key of the CM. The 74, 106, 140, 204, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, 1536 bit, and 2048 public moduli respectively. This is a zero-length string if the CMTS does not retain the public key." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.4." ::= { docsBpi2CmtsAuthEntry 3 } docsBpi2CmtsAuthCmKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the most recent Green/Katsnelson Expires - May 2003 [Page 34]
DOCSIS BPI Plus MIB November 2002 authorization key sequence number for this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpi2CmtsAuthEntry 4 } docsBpi2CmtsAuthCmExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent authorization key for this FSM. If this FSM has only one authorization key, then the value is the time of activation of this FSM. Note: For CMs running in BPI mode, implementation of this object is optional and MAY vary." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmtsAuthEntry 5 } docsBpi2CmtsAuthCmExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent authorization key for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpi2CmtsAuthEntry 6 } docsBpi2CmtsAuthCmLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to an authorization key for this CM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2 and Appendix A.2." ::= { docsBpi2CmtsAuthEntry 7 } Green/Katsnelson Expires - May 2003 [Page 35]
DOCSIS BPI Plus MIB November 2002 -- Note: the following object has been obsoleted docsBpi2CmtsAuthCmGraceTime OBJECT-TYPE SYNTAX Integer32 (1..6047999) UNITS "seconds" MAX-ACCESS read-only STATUS obsolete DESCRIPTION "The value of this object is the grace time for the most recent authorization key in seconds. The CM is expected to start trying to get a new authorization key beginning docsBpi2CmtsAuthCmGraceTime seconds before the authorization key actually expires. Note: Tracking this value is optional on certain CMTS implementations." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.3." ::= { docsBpi2CmtsAuthEntry 8 } docsBpi2CmtsAuthCmReset OBJECT-TYPE SYNTAX INTEGER { noResetRequested(1), invalidateAuth(2), sendAuthInvalid(3), invalidateTeks(4) } MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to invalidateAuth(2) causes the CMTS to invalidate the current CM authorization key(s), but not to transmit an Authorization Invalid message nor to invalidate the primary SAID's TEKs. Setting this object to sendAuthInvalid(3) causes the CMTS to invalidate the current CM authorization key(s), and to transmit an Authorization Invalid message to the CM, but not to invalidate the primary SAID's TEKs. Setting this object to invalidateTeks(4) causes the CMTS to invalidate the current CM authorization key(s), to transmit an Authorization Invalid message to the CM, and to invalidate the TEKs associated with this CM's primary SAID. For BPI mode, substitute all of the CM's unicast TEK(s) for the primary SAID's TEKs in the previous paragraph. Reading this object returns the most-recently-set value of this object, or returns noResetRequested(1) if the object has not been set since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5." Green/Katsnelson Expires - May 2003 [Page 36]
DOCSIS BPI Plus MIB November 2002 ::= { docsBpi2CmtsAuthEntry 9 } docsBpi2CmtsAuthCmInfos OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authentication Information message from this CM, since entry creatiion." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.9." ::= { docsBpi2CmtsAuthEntry 10 } docsBpi2CmtsAuthCmRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from this CM, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.1." ::= { docsBpi2CmtsAuthEntry 11 } docsBpi2CmtsAuthCmReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to this CM, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.2." ::= { docsBpi2CmtsAuthEntry 12 } docsBpi2CmtsAuthCmRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to this CM, since entry creation." Green/Katsnelson Expires - May 2003 [Page 37]
DOCSIS BPI Plus MIB November 2002 REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.3." ::= { docsBpi2CmtsAuthEntry 13 } docsBpi2CmtsAuthCmInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to this CM, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.7." ::= { docsBpi2CmtsAuthEntry 14 } docsBpi2CmtsAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSaid(4), permanentAuthorizationFailure(8), timeOfDayNotAcquired(11) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been transmitted to the CM, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.15." ::= { docsBpi2CmtsAuthEntry 15 } docsBpi2CmtsAuthRejectErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message transmitted to the CM. This is a zero length string if no Authorization Reject Green/Katsnelson Expires - May 2003 [Page 38]
DOCSIS BPI Plus MIB November 2002 message has been transmitted to the CM, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpi2CmtsAuthEntry 16 } docsBpi2CmtsAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been transmitted to the CM since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.15." ::= { docsBpi2CmtsAuthEntry 17 } docsBpi2CmtsAuthInvalidErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message transmitted to the CM. This is a zero length string if no Authorization Invalid message has been transmitted to the CM since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpi2CmtsAuthEntry 18 } docsBpi2CmtsAuthPrimarySAId OBJECT-TYPE SYNTAX Integer32 (0..16383) MAX-ACCESS read-only STATUS current DESCRIPTION Green/Katsnelson Expires - May 2003 [Page 39]
DOCSIS BPI Plus MIB November 2002 "The value of this object is the Primary Security Association identifier. For BPI mode, the value must be any unicast SID." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 2.1.3." ::= { docsBpi2CmtsAuthEntry 19 } docsBpi2CmtsAuthBpkmCmCertValid OBJECT-TYPE SYNTAX INTEGER { unknown (0), validCmChained (1), validCmTrusted (2), invalidCmUntrusted (3), invalidCAUntrusted (4), invalidCmOther (5), invalidCAOther (6), validCATrusted (7) } MAX-ACCESS read-only STATUS current DESCRIPTION "Contains the reason why a CM's certificate is deemed valid or invalid. Return unknown(0) if the CM is running BPI mode. ValidCmChained(1) means the certificate is valid because it chains to a valid certificate. ValidCmTrusted(2) means the certificate is valid because it has been provisioned (in the docsBpi2CmtsProvisionedCmCert table) to be trusted. InvalidCmUntrusted(3) means the certificate is invalid because it has been provisioned (in the docsBpi2CmtsProvisionedCmCert table) to be untrusted. InvalidCAUntrusted(4) means the certificate is invalid because it chains to an untrusted certificate. InvalidCmOther(5) and InvalidCAOther(6) refer to errors in parsing, validity periods, etc, which are attributable to the CM certificate or its chain respectively; additional information may be found in docsBpi2AuthRejectErrorString for these types of errors. ValidCATrusted(7) is appropriate when the modem's CM certificate chains to a trusted manufacturer's certificate." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.2." ::= { docsBpi2CmtsAuthEntry 20 } Green/Katsnelson Expires - May 2003 [Page 40]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsAuthBpkmCmCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-only STATUS current DESCRIPTION "The X509 CM Certificate sent as part of a BPKM Authorization Request. Note: The NULL string must be returned if the entire certificate is not retained in the CMTS." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2." ::= { docsBpi2CmtsAuthEntry 21 } -- -- The CMTS TEK Table, indexed by ifIndex and SAID -- docsBpi2CmtsTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each Traffic Encryption Key (TEK) association. The CMTS maintains one TEK association per SAID on each CMTS MAC interface." ::= { docsBpi2CmtsObjects 3 } docsBpi2CmtsTEKEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one TEK association on a particular CMTS MAC interface. The CMTS MUST create one entry per SAID per MAC interface, based on the receipt of a Key Request message, and MUST not delete the entry before the CM authorization for the SAID permanently expires." INDEX { ifIndex, docsBpi2CmtsTEKSAId } ::= { docsBpi2CmtsTEKTable 1 } DocsBpi2CmtsTEKEntry ::= SEQUENCE { docsBpi2CmtsTEKSAId Integer32, docsBpi2CmtsTEKSAType INTEGER, docsBpi2CmtsTEKDataEncryptAlg INTEGER, docsBpi2CmtsTEKDataAuthentAlg INTEGER, docsBpi2CmtsTEKLifetime Integer32, docsBpi2CmtsTEKGraceTime Integer32, Green/Katsnelson Expires - May 2003 [Page 41]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsTEKKeySequenceNumber Integer32, docsBpi2CmtsTEKExpiresOld DateAndTime, docsBpi2CmtsTEKExpiresNew DateAndTime, docsBpi2CmtsTEKReset TruthValue, docsBpi2CmtsKeyRequests Counter32, docsBpi2CmtsKeyReplies Counter32, docsBpi2CmtsKeyRejects Counter32, docsBpi2CmtsTEKInvalids Counter32, docsBpi2CmtsKeyRejectErrorCode INTEGER, docsBpi2CmtsKeyRejectErrorString SnmpAdminString, docsBpi2CmtsTEKInvalidErrorCode INTEGER, docsBpi2CmtsTEKInvalidErrorString SnmpAdminString } docsBpi2CmtsTEKSAId OBJECT-TYPE SYNTAX Integer32 (1..16383) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the DOCSIS Security Association ID (SAID)." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.12." ::= { docsBpi2CmtsTEKEntry 1 } docsBpi2CmtsTEKSAType OBJECT-TYPE SYNTAX INTEGER { none(0), primary(1), static(2), dynamic(3) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the type of security association. Dynamic(3) does not apply to CMs running in BPI mode. Unicast BPI TEKs must utilize the primary(1) encoding and multicast BPI TEKs must utilize the static(2) encoding. The none(0) encoding must only be used if the SA type has yet to be determined." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 2.1.3." ::= { docsBpi2CmtsTEKEntry 2 } docsBpi2CmtsTEKDataEncryptAlg OBJECT-TYPE SYNTAX INTEGER { Green/Katsnelson Expires - May 2003 [Page 42]
DOCSIS BPI Plus MIB November 2002 none(0), des56CbcMode(1), des40CbcMode(2) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data encryption algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmtsTEKEntry 3 } docsBpi2CmtsTEKDataAuthentAlg OBJECT-TYPE SYNTAX INTEGER { none(0) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the data authentication algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." ::= { docsBpi2CmtsTEKEntry 4 } docsBpi2CmtsTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to keys for this TEK association." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.5 and Appendix A.2." ::= { docsBpi2CmtsTEKEntry 5 } -- Note: the following object has been obsoleted docsBpi2CmtsTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..302399) UNITS "seconds" MAX-ACCESS read-only STATUS obsolete DESCRIPTION Green/Katsnelson Expires - May 2003 [Page 43]
DOCSIS BPI Plus MIB November 2002 "The value of this object is the grace time for the TEK in seconds. The CM is expected to start trying to acquire a new TEK beginning TEK GraceTime seconds before the TEK actually expires. Note: The value of this object is vendor specific for multicast TEKs." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Appendix A.1.1.1.6." ::= { docsBpi2CmtsTEKEntry 6 } docsBpi2CmtsTEKKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the most recent TEK key sequence number for this SAID." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.2.10 and 4.2.2.13." ::= { docsBpi2CmtsTEKEntry 7 } docsBpi2CmtsTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmtsTEKEntry 8 } docsBpi2CmtsTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpi2CmtsTEKEntry 9 } Green/Katsnelson Expires - May 2003 [Page 44]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsTEKReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE causes the CMTS to invalidate all currently active TEK(s) and to generate new TEK(s) for the associated SAID; the CMTS MAY also generate unsolicited TEK Invalid message(s), to optimize the TEK synchronizationbetween the CMTS and the CM(s). Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.1.3.3.5." ::= { docsBpi2CmtsTEKEntry 10 } docsBpi2CmtsKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received a Key Request message, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.4." ::= { docsBpi2CmtsTEKEntry 11 } docsBpi2CmtsKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reply message, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.5." ::= { docsBpi2CmtsTEKEntry 12 } docsBpi2CmtsKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reject message, since entry Green/Katsnelson Expires - May 2003 [Page 45]
DOCSIS BPI Plus MIB November 2002 creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.6." ::= { docsBpi2CmtsTEKEntry 13 } docsBpi2CmtsTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a TEK Invalid message, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.8." ::= { docsBpi2CmtsTEKEntry 14 } docsBpi2CmtsKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSaid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent Key Reject message sent in response to a Key Request for this SAID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.6 and 4.2.2.15." ::= { docsBpi2CmtsTEKEntry 15 } docsBpi2CmtsKeyRejectErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent Key Reject message sent in response to a Key Request for this SAID. This is a zero length string if no Key Reject message has been received since entry creation." REFERENCE Green/Katsnelson Expires - May 2003 [Page 46]
DOCSIS BPI Plus MIB November 2002 "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.6 and 4.2.2.6." ::= { docsBpi2CmtsTEKEntry 16 } docsBpi2CmtsTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent TEK Invalid message sent in association with this SAID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.8 and 4.2.2.15." ::= { docsBpi2CmtsTEKEntry 17 } docsBpi2CmtsTEKInvalidErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent TEK Invalid message sent in association with this SAID. This is a zero length string if no TEK Invalid message has been received since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.8 and 4.2.2.6." ::= { docsBpi2CmtsTEKEntry 18 } -- -- The CMTS Multicast Objects Group -- docsBpi2CmtsMulticastObjects OBJECT IDENTIFIER ::= { docsBpi2CmtsObjects 4 } -- -- The CMTS IP Multicast Mapping Table, indexed by Green/Katsnelson Expires - May 2003 [Page 47]
DOCSIS BPI Plus MIB November 2002 -- docsBpi2CmtsIpMulticastIndex, and by ifindex -- docsBpi2CmtsIpMulticastMapTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table maps multicast IP addresses to SAIDs. If a multicast IP address is mapped by multiple rows in the table, the row with the lowest docsBpi2CmtsIpMulticastIndex must be utilized for the mapping." ::= { docsBpi2CmtsMulticastObjects 1 } docsBpi2CmtsIpMulticastMapEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the mapping of a set of multicast IP address and mask to one SAID, as well as associated message counters and error information." INDEX { ifIndex, docsBpi2CmtsIpMulticastIndex } ::= { docsBpi2CmtsIpMulticastMapTable 1 } DocsBpi2CmtsIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmtsIpMulticastIndex Integer32, docsBpi2CmtsIpMulticastAddressType InetAddressType, docsBpi2CmtsIpMulticastAddress InetAddress, docsBpi2CmtsIpMulticastMaskType InetAddressType, docsBpi2CmtsIpMulticastMask InetAddress, docsBpi2CmtsIpMulticastSAId Integer32, docsBpi2CmtsIpMulticastSAType INTEGER, docsBpi2CmtsIpMulticastDataEncryptAlg INTEGER, docsBpi2CmtsIpMulticastDataAuthentAlg INTEGER, docsBpi2CmtsIpMulticastSAMapRequests Counter32, docsBpi2CmtsIpMulticastSAMapReplies Counter32, docsBpi2CmtsIpMulticastSAMapRejects Counter32, docsBpi2CmtsIpMulticastSAMapRejectErrorCode INTEGER, docsBpi2CmtsIpMulticastSAMapRejectErrorString SnmpAdminString, docsBpi2CmtsIpMulticastMapControl RowStatus } Green/Katsnelson Expires - May 2003 [Page 48]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsIpMulticastIndex OBJECT-TYPE SYNTAX Integer32 (1..10000) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of this row." ::= { docsBpi2CmtsIpMulticastMapEntry 1 } docsBpi2CmtsIpMulticastAddressType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-create STATUS current DESCRIPTION "The type of internet address for docsBpi2CmtsIpMulticastAddress." DEFVAL { ipv4 } ::= { docsBpi2CmtsIpMulticastMapEntry 2 } docsBpi2CmtsIpMulticastAddress OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION "This object represents the IP multicast address to be mapped, in conjunction with docsBpi2CmtsIpMulticastMask." ::= { docsBpi2CmtsIpMulticastMapEntry 3 } docsBpi2CmtsIpMulticastMaskType OBJECT-TYPE SYNTAX InetAddressType MAX-ACCESS read-create STATUS current DESCRIPTION "The type of internet address for docsBpi2CmtsIpMulticastMask." DEFVAL { ipv4 } ::= { docsBpi2CmtsIpMulticastMapEntry 4 } docsBpi2CmtsIpMulticastMask OBJECT-TYPE SYNTAX InetAddress MAX-ACCESS read-create STATUS current DESCRIPTION "This object represents the IP multicast address mask for this row. An IP multicast address matches this row if the logical AND of the address with docsBpi2CmtsIpMulticastMask is identical to the logical AND of Green/Katsnelson Expires - May 2003 [Page 49]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsIpMulticastAddr with docsBpi2CmtsIpMulticastMask." ::= { docsBpi2CmtsIpMulticastMapEntry 5 } docsBpi2CmtsIpMulticastSAId OBJECT-TYPE SYNTAX Integer32 (0..16383) MAX-ACCESS read-create STATUS current DESCRIPTION "This object represents the multicast SAID to be used in this IP multicast address mapping entry." ::= { docsBpi2CmtsIpMulticastMapEntry 6 } docsBpi2CmtsIpMulticastSAType OBJECT-TYPE SYNTAX INTEGER { none(0), primary(1), static(2), dynamic(3) } MAX-ACCESS read-create STATUS current DESCRIPTION "The value of this object is the type of security association. Dynamic(3) does not apply to CMs running in BPI mode. Unicast BPI TEKs must utilize the primary(1) encoding and multicast BPI TEKs must utilize the static(2) encoding. The none(0) encoding must only be used if the SA type has yet to be determined." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 2.1.3." ::= { docsBpi2CmtsIpMulticastMapEntry 7 } docsBpi2CmtsIpMulticastDataEncryptAlg OBJECT-TYPE SYNTAX INTEGER { none(0), des56CbcMode(1), des40CbcMode(2) } MAX-ACCESS read-create STATUS current DESCRIPTION "The value of this object is the data encryption algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." DEFVAL { des56CbcMode } Green/Katsnelson Expires - May 2003 [Page 50]
DOCSIS BPI Plus MIB November 2002 ::= { docsBpi2CmtsIpMulticastMapEntry 8 } docsBpi2CmtsIpMulticastDataAuthentAlg OBJECT-TYPE SYNTAX INTEGER { none(0) } MAX-ACCESS read-create STATUS current DESCRIPTION "The value of this object is the data authentication algorithm being utilized." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.2.20." DEFVAL { none } ::= { docsBpi2CmtsIpMulticastMapEntry 9 } docsBpi2CmtsIpMulticastSAMapRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an SA Map Request message for this IP, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.10." ::= { docsBpi2CmtsIpMulticastMapEntry 10 } docsBpi2CmtsIpMulticastSAMapReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an SA Map Reply message for this IP, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.11." ::= { docsBpi2CmtsIpMulticastMapEntry 11 } docsBpi2CmtsIpMulticastSAMapRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the Green/Katsnelson Expires - May 2003 [Page 51]
DOCSIS BPI Plus MIB November 2002 CMTS has transmitted an SA Map Reject message for this IP, since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 4.2.1.12." ::= { docsBpi2CmtsIpMulticastMapEntry 12 } docsBpi2CmtsIpMulticastSAMapRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), noAuthForRequestedDSFlow(9), dsFlowNotMappedToSA(10) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent SA Map Reject message sent in response to a SA Map Request for this IP. It has value unknown(2) if the last Error-Code value was 0, and none(1) if no SA MAP Reject message has been received since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.15." ::= { docsBpi2CmtsIpMulticastMapEntry 13 } docsBpi2CmtsIpMulticastSAMapRejectErrorString OBJECT-TYPE SYNTAX SnmpAdminString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent SA Map Reject message sent in response to an SA Map Request for this IP. It is a zero length string if no SA Map Reject message has been received since entry creation." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Sections 4.2.1.12 and 4.2.2.6." ::= { docsBpi2CmtsIpMulticastMapEntry 14 } docsBpi2CmtsIpMulticastMapControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the IP multicast Green/Katsnelson Expires - May 2003 [Page 52]
DOCSIS BPI Plus MIB November 2002 address mapping entry. There is no restriction on the ability to change values in this row while the row is active. Inactive rows need not be timed out." ::= { docsBpi2CmtsIpMulticastMapEntry 15 } -- -- The CMTS Multicast SAID Authorization Table, indexed by ifIndex -- by multicast SAID by CM MAC address -- docsBpi2CmtsMulticastAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the multicast SAID authorization for each CM on each CMTS MAC interface." ::= { docsBpi2CmtsMulticastObjects 2 } docsBpi2CmtsMulticastAuthEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the key authorization of one cable modem for one multicast SAID for one CMTS MAC interface." INDEX { ifIndex, docsBpi2CmtsMulticastAuthSAId, docsBpi2CmtsMulticastAuthCmMacAddress } ::= { docsBpi2CmtsMulticastAuthTable 1 } DocsBpi2CmtsMulticastAuthEntry ::= SEQUENCE { docsBpi2CmtsMulticastAuthSAId Integer32, docsBpi2CmtsMulticastAuthCmMacAddress MacAddress, docsBpi2CmtsMulticastAuthControl RowStatus } docsBpi2CmtsMulticastAuthSAId OBJECT-TYPE SYNTAX Integer32 (1..16383) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the multicast SAID for authorization." ::= { docsBpi2CmtsMulticastAuthEntry 1 } Green/Katsnelson Expires - May 2003 [Page 53]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsMulticastAuthCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the MAC address of the CM to which the multicast SAID authorization applies." ::= { docsBpi2CmtsMulticastAuthEntry 2 } docsBpi2CmtsMulticastAuthControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the CM authorization for each multicast SAID. There is no restriction on the ability to change values in this row while the row is active. Inactive rows need not be timed out." ::= { docsBpi2CmtsMulticastAuthEntry 3 } -- -- CMTS Cert Objects -- docsBpi2CmtsCertObjects OBJECT IDENTIFIER ::= { docsBpi2CmtsObjects 5 } -- -- CMTS Provisioned CM Cert Table -- docsBpi2CmtsProvisionedCmCertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsProvisionedCmCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table of CM certificate trust entries provisioned to the CMTS. The trust object for a certificate in this table has an overriding effect on the validity object of a certificate in the authorization table, as long as the entire contents of the two certificates are identical." ::= { docsBpi2CmtsCertObjects 1 } docsBpi2CmtsProvisionedCmCertEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsProvisionedCmCertEntry Green/Katsnelson Expires - May 2003 [Page 54]
DOCSIS BPI Plus MIB November 2002 MAX-ACCESS not-accessible STATUS current DESCRIPTION "An entry in the CMTS's provisioned CM certificate table." INDEX { docsBpi2CmtsProvisionedCmCertMacAddress } ::= { docsBpi2CmtsProvisionedCmCertTable 1 } DocsBpi2CmtsProvisionedCmCertEntry ::= SEQUENCE { docsBpi2CmtsProvisionedCmCertMacAddress MacAddress, docsBpi2CmtsProvisionedCmCertTrust INTEGER, docsBpi2CmtsProvisionedCmCertSource INTEGER, docsBpi2CmtsProvisionedCmCertStatus RowStatus, docsBpi2CmtsProvisionedCmCert X509Certificate } docsBpi2CmtsProvisionedCmCertMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index of this row." ::= { docsBpi2CmtsProvisionedCmCertEntry 1 } docsBpi2CmtsProvisionedCmCertTrust OBJECT-TYPE SYNTAX INTEGER { trusted (1), untrusted (2) } MAX-ACCESS read-create STATUS current DESCRIPTION "Trust state for the provisioned CM certificate entry. Note: Setting this object need only override the validity of CM certificates sent in future authorization requests; instantaneous effect need not occur." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1." DEFVAL { untrusted } ::= { docsBpi2CmtsProvisionedCmCertEntry 2 } docsBpi2CmtsProvisionedCmCertSource OBJECT-TYPE SYNTAX INTEGER { snmp (1), configurationFile (2), externalDatabase (3), other (4) Green/Katsnelson Expires - May 2003 [Page 55]
DOCSIS BPI Plus MIB November 2002 } MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates how the certificate reached the CMTS. Other(4) means it originated from a source not identified above." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1." ::= { docsBpi2CmtsProvisionedCmCertEntry 3 } docsBpi2CmtsProvisionedCmCertStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION " Standard RowStatus object except: a) if a row has ever been activated, a set to docsBpi2CmtsProvisionedCmCert need not succeed, b) inactive rows need not be timed out." ::= { docsBpi2CmtsProvisionedCmCertEntry 4 } docsBpi2CmtsProvisionedCmCert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-create STATUS current DESCRIPTION "An X509 DER-encoded certificate authority certificate. Note: The NULL string must be returned, on reads, if the entire certificate is not retained in the CMTS." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2." ::= { docsBpi2CmtsProvisionedCmCertEntry 5 } -- -- CMTS CA Cert Table -- docsBpi2CmtsCACertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsCACertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The table of known certificate authority certificates acquired by this device." Green/Katsnelson Expires - May 2003 [Page 56]
DOCSIS BPI Plus MIB November 2002 ::= { docsBpi2CmtsCertObjects 2 } docsBpi2CmtsCACertEntry OBJECT-TYPE SYNTAX DocsBpi2CmtsCACertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A row in the Certificate Authority certificate table." INDEX { docsBpi2CmtsCACertIndex } ::= {docsBpi2CmtsCACertTable 1 } DocsBpi2CmtsCACertEntry ::= SEQUENCE { docsBpi2CmtsCACertIndex Integer32, docsBpi2CmtsCACertSubject SnmpAdminString, docsBpi2CmtsCACertIssuer SnmpAdminString, docsBpi2CmtsCACertSerialNumber OCTET STRING, docsBpi2CmtsCACertTrust INTEGER, docsBpi2CmtsCACertSource INTEGER, docsBpi2CmtsCACertStatus RowStatus, docsBpi2CmtsCACert X509Certificate, docsBpi2CmtsCACertThumbprint OCTET STRING } docsBpi2CmtsCACertIndex OBJECT-TYPE SYNTAX Integer32 (1..10000) MAX-ACCESS not-accessible STATUS current DESCRIPTION "The index for this row." ::= { docsBpi2CmtsCACertEntry 1 } docsBpi2CmtsCACertSubject OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The subject name exactly as it is encoded in the X509 certificate. The organizationName portion of the certificate's subject name must be present. All other fields are optional. Any optional field present must be prepended with <CR> (carriage return) <LF> (line feed) ASCII characters. Ordering of fields present must conform to: organizationName <CR> <LF> countryName <CR> <LF> stateOrProvinceName <CR> <LF> localityName <CR> <LF> Green/Katsnelson Expires - May 2003 [Page 57]
DOCSIS BPI Plus MIB November 2002 organizationalUnitName <CR> <LF> organizationalUnitName=<Manufacturing Location> <CR> <LF> commonName" REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2.4" ::= { docsBpi2CmtsCACertEntry 2 } docsBpi2CmtsCACertIssuer OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The issuer name exactly as it is encoded in the X509 certificate. The commonName portion of the certificate's issuer name must be present. All other fields are optional. Any optional field present must be prepended with <CR> (carriage return) <LF> (line feed) ASCII characters. Ordering of fields present must conform to: commonName <CR> <LF> countryName <CR> <LF> stateOrProvinceName <CR> <LF> localityName <CR> <LF> organizationName <CR> <LF> organizationalUnitName <CR> <LF> organizationalUnitName=<Manufacturing Location>" REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2.4" ::= { docsBpi2CmtsCACertEntry 3 } docsBpi2CmtsCACertSerialNumber OBJECT-TYPE SYNTAX OCTET STRING (SIZE (1..32)) MAX-ACCESS read-only STATUS current DESCRIPTION "This CA certificate's serial number represented as an octet string." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2.2" ::= { docsBpi2CmtsCACertEntry 4 } docsBpi2CmtsCACertTrust OBJECT-TYPE SYNTAX INTEGER { trusted (1), untrusted (2), Green/Katsnelson Expires - May 2003 [Page 58]
DOCSIS BPI Plus MIB November 2002 chained (3), root (4) } MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls the trust status of this certificate. Root certificates must be given root(4) trust; manufacturer certificates must not be given root(4) trust. Trust on root certificates must not change. Note: Setting this object need only affect the validity of CM certificates sent in future authorization requests; instantaneous effect need not occur." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1" DEFVAL { chained } ::= { docsBpi2CmtsCACertEntry 5 } docsBpi2CmtsCACertSource OBJECT-TYPE SYNTAX INTEGER { snmp (1), configurationFile (2), externalDatabase (3), other (4), authentInfo (5), compiledIntoCode (6) } MAX-ACCESS read-only STATUS current DESCRIPTION "This object indicates how the certificate reached the CMTS. Other(4) means it originated from a source not identified above." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1" ::= { docsBpi2CmtsCACertEntry 6 } docsBpi2CmtsCACertStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION " Standard RowStatus objects except: a) if a row has ever been activated, a set to docsBpi2CmtsCACert need not succeed, b) inactive rows need not be timed out, c) if a row has ever been activated, a destroy setting need Green/Katsnelson Expires - May 2003 [Page 59]
DOCSIS BPI Plus MIB November 2002 not succeed." ::= { docsBpi2CmtsCACertEntry 7 } docsBpi2CmtsCACert OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-create STATUS current DESCRIPTION "An X509 DER-encoded certificate authority certificate. To help identify certificates, either this object or docsBpi2CmtsCACertThumbprint must be returned by a CMTS for self-signed CA certificates. Note: The NULL string must be returned, on reads, if the entire certificate is not retained in the CMTS." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.2." ::= { docsBpi2CmtsCACertEntry 8 } docsBpi2CmtsCACertThumbprint OBJECT-TYPE SYNTAX OCTET STRING (SIZE (20)) MAX-ACCESS read-only STATUS current DESCRIPTION "The SHA-1 hash of a CA certificate. To help identify certificates, either this object or docsBpi2CmtsCACert must be returned by a CMTS for self-signed CA certificates. Note: The NULL string must be returned if this object is not supported by the CMTS." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.3" ::= { docsBpi2CmtsCACertEntry 9 } -- -- Authenticated Software Download Objects -- -- -- Note: the authenticated software download objects are a -- CM requirement only. -- docsBpi2CodeDownloadControl OBJECT IDENTIFIER Green/Katsnelson Expires - May 2003 [Page 60]
DOCSIS BPI Plus MIB November 2002 ::= { docsBpi2MIBObjects 4 } docsBpi2CodeDownloadStatusCode OBJECT-TYPE SYNTAX INTEGER { configFileCvcVerified (1), configFileCvcRejected (2), snmpCvcVerified (3), snmpCvcRejected (4), codeFileVerified (5), codeFileRejected (6), other (7), configFileCvcVerifiedAfterCodeFileVerified(8), configFileCvcRejectedAfterCodeFileVerified(9) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value indicates the result of the latest config file CVC verification, SNMP CVC verification, or code file verification. Values configFileCvcVerifiedAfterCodeFileVerified(8) and configFileCvcRejectedAfterCodeFileVerified(9) designate the previous status of the MIB" REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.3.2 & D.3.5.1." ::= { docsBpi2CodeDownloadControl 1 } docsBpi2CodeDownloadStatusString OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object indicates the additional information to the status code. The value will include the error code and error description which will be defined separately." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section TBD (see D.3.7)" ::= { docsBpi2CodeDownloadControl 2 } docsBpi2CodeMfgOrgName OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the device manufacturer's organizationName." Green/Katsnelson Expires - May 2003 [Page 61]
DOCSIS BPI Plus MIB November 2002 REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 3 } docsBpi2CodeMfgCodeAccessStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the device manufacturer's current codeAccessStart value." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 4 } docsBpi2CodeMfgCvcAccessStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the device manufacturer's current cvcAccessStart value." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 5 } docsBpi2CodeCoSignerOrgName OBJECT-TYPE SYNTAX SnmpAdminString MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Co-Signer's organizationName. The value is a zero length string if the co-signer is not specified." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 6 } docsBpi2CodeCoSignerCodeAccessStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Co-Signer's current codeAccessStart value. Green/Katsnelson Expires - May 2003 [Page 62]
DOCSIS BPI Plus MIB November 2002 If docsBpi2CodeCoSignerOrgName is a zero length string, the value of this object is meaningless." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 7 } docsBpi2CodeCoSignerCvcAccessStart OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Co-Signer's current cvcAccessStart value. If docsBpi2CodeCoSignerOrgName is a zero length string, the value of this object is meaningless." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.2.2." ::= { docsBpi2CodeDownloadControl 8 } docsBpi2CodeCvcUpdate OBJECT-TYPE SYNTAX X509Certificate MAX-ACCESS read-write STATUS current DESCRIPTION "Setting a CVC to this object triggers the device to verify the CVC and update the cvcAccessStart value. If the device is not enabled to upgrade codefiles, or the CVC verification fails, the CVC will be rejected. Reading this object always returns the null string." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section D.3.3.2.2." ::= { docsBpi2CodeDownloadControl 9 } -- -- The BPI+ MIB Conformance Statements (with a placeholder for -- notifications) -- docsBpi2Notification OBJECT IDENTIFIER ::= { docsBpi2MIB 2 } docsBpi2Conformance OBJECT IDENTIFIER ::= { docsBpi2MIB 3 } docsBpi2Compliances OBJECT IDENTIFIER ::= { docsBpi2Conformance 1 } Green/Katsnelson Expires - May 2003 [Page 63]
DOCSIS BPI Plus MIB November 2002 docsBpi2Groups OBJECT IDENTIFIER ::= { docsBpi2Conformance 2 } docsBpi2BasicCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "This is the compliance statement for devices which implement the DOCSIS Baseline Privacy Interface." MODULE -- docsBpi2MIB -- conditionally mandatory group GROUP docsBpi2CmGroup DESCRIPTION "This group is implemented only in CMs, not in CMTSs." -- conditionally mandatory group GROUP docsBpi2CmtsGroup DESCRIPTION "This group is implemented only in CMTSs, not in CMs." -- conditionally mandatory group GROUP docsBpi2CodeDownloadGroup DESCRIPTION "This group is required in CMs and is optional in CMTSs." -- relaxation on mandatory range OBJECT docsBpi2CmtsDefaultAuthLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpi2CmtsDefaultTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpi2CmtsAuthCmLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." Green/Katsnelson Expires - May 2003 [Page 64]
DOCSIS BPI Plus MIB November 2002 -- relaxation on mandatory range OBJECT docsBpi2CmtsTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on IP addressing OBJECT docsBpi2CmIpMulticastAddressType -- SYNTAX InetAddressType { ipv4(1) } DESCRIPTION "An implementation is only required to support IPv4 addresses." -- relaxation on IP addressing OBJECT docsBpi2CmIpMulticastAddress SYNTAX InetAddress (SIZE(4)) DESCRIPTION "An implementation is only required to support IPv4 addresses." -- relaxation on IP addressing OBJECT docsBpi2CmtsIpMulticastAddressType -- SYNTAX InetAddressType { ipv4(1) } DESCRIPTION "An implementation is only required to support IPv4 addresses." -- relaxation on IP addressing OBJECT docsBpi2CmtsIpMulticastAddress SYNTAX InetAddress (SIZE(4)) DESCRIPTION "An implementation is only required to support IPv4 addresses." -- relaxation on IP addressing OBJECT docsBpi2CmtsIpMulticastMaskType -- SYNTAX InetAddressType { ipv4(1) } DESCRIPTION "An implementation is only required to support IPv4 addresses." -- relaxation on IP addressing OBJECT docsBpi2CmtsIpMulticastMask SYNTAX InetAddress (SIZE(4)) DESCRIPTION "An implementation is only required to support IPv4 Green/Katsnelson Expires - May 2003 [Page 65]
DOCSIS BPI Plus MIB November 2002 addresses." ::= { docsBpi2Compliances 1 } docsBpi2CmGroup OBJECT-GROUP OBJECTS { docsBpi2CmPrivacyEnable, docsBpi2CmPublicKey, docsBpi2CmAuthState, docsBpi2CmAuthKeySequenceNumber, docsBpi2CmAuthExpiresOld, docsBpi2CmAuthExpiresNew, docsBpi2CmAuthReset, docsBpi2CmAuthGraceTime, docsBpi2CmTEKGraceTime, docsBpi2CmAuthWaitTimeout, docsBpi2CmReauthWaitTimeout, docsBpi2CmOpWaitTimeout, docsBpi2CmRekeyWaitTimeout, docsBpi2CmAuthRejectWaitTimeout, docsBpi2CmSAMapWaitTimeout, docsBpi2CmSAMapMaxRetries, docsBpi2CmAuthentInfos, docsBpi2CmAuthRequests, docsBpi2CmAuthReplies, docsBpi2CmAuthRejects, docsBpi2CmAuthInvalids, docsBpi2CmAuthRejectErrorCode, docsBpi2CmAuthRejectErrorString, docsBpi2CmAuthInvalidErrorCode, docsBpi2CmAuthInvalidErrorString, docsBpi2CmTEKSAType, docsBpi2CmTEKDataEncryptAlg, docsBpi2CmTEKDataAuthentAlg, docsBpi2CmTEKState, docsBpi2CmTEKKeySequenceNumber, docsBpi2CmTEKExpiresOld, docsBpi2CmTEKExpiresNew, docsBpi2CmTEKKeyRequests, docsBpi2CmTEKKeyReplies, docsBpi2CmTEKKeyRejects, docsBpi2CmTEKInvalids, docsBpi2CmTEKAuthPends, docsBpi2CmTEKKeyRejectErrorCode, docsBpi2CmTEKKeyRejectErrorString, docsBpi2CmTEKInvalidErrorCode, docsBpi2CmTEKInvalidErrorString, docsBpi2CmIpMulticastAddressType, docsBpi2CmIpMulticastAddress, Green/Katsnelson Expires - May 2003 [Page 66]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmIpMulticastSAId, docsBpi2CmIpMulticastSAMapState, docsBpi2CmIpMulticastSAMapRequests, docsBpi2CmIpMulticastSAMapReplies, docsBpi2CmIpMulticastSAMapRejects, docsBpi2CmIpMulticastSAMapRejectErrorCode, docsBpi2CmIpMulticastSAMapRejectErrorString, docsBpi2CmDeviceCmCert, docsBpi2CmDeviceManufCert, docsBpi2CmCryptoSuiteDataEncryptAlg, docsBpi2CmCryptoSuiteDataAuthentAlg } STATUS current DESCRIPTION "This collection of objects provides CM BPI+ status and control." ::= { docsBpi2Groups 1 } docsBpi2CmtsGroup OBJECT-GROUP OBJECTS { docsBpi2CmtsDefaultAuthLifetime, docsBpi2CmtsDefaultTEKLifetime, docsBpi2CmtsDefaultSelfSignedManufCertTrust, docsBpi2CmtsCheckCertValidityPeriods, docsBpi2CmtsAuthentInfos, docsBpi2CmtsAuthRequests, docsBpi2CmtsAuthReplies, docsBpi2CmtsAuthRejects, docsBpi2CmtsAuthInvalids, docsBpi2CmtsSAMapRequests, docsBpi2CmtsSAMapReplies, docsBpi2CmtsSAMapRejects, docsBpi2CmtsAuthCmBpiVersion, docsBpi2CmtsAuthCmPublicKey, docsBpi2CmtsAuthCmKeySequenceNumber, docsBpi2CmtsAuthCmExpiresOld, docsBpi2CmtsAuthCmExpiresNew, docsBpi2CmtsAuthCmLifetime, docsBpi2CmtsAuthCmReset, docsBpi2CmtsAuthCmInfos, docsBpi2CmtsAuthCmRequests, docsBpi2CmtsAuthCmReplies, docsBpi2CmtsAuthCmRejects, docsBpi2CmtsAuthCmInvalids, docsBpi2CmtsAuthRejectErrorCode, docsBpi2CmtsAuthRejectErrorString, docsBpi2CmtsAuthInvalidErrorCode, docsBpi2CmtsAuthInvalidErrorString, docsBpi2CmtsAuthPrimarySAId, Green/Katsnelson Expires - May 2003 [Page 67]
DOCSIS BPI Plus MIB November 2002 docsBpi2CmtsAuthBpkmCmCertValid, docsBpi2CmtsAuthBpkmCmCert, docsBpi2CmtsTEKSAType, docsBpi2CmtsTEKDataEncryptAlg, docsBpi2CmtsTEKDataAuthentAlg, docsBpi2CmtsTEKLifetime, docsBpi2CmtsTEKKeySequenceNumber, docsBpi2CmtsTEKExpiresOld, docsBpi2CmtsTEKExpiresNew, docsBpi2CmtsTEKReset, docsBpi2CmtsKeyRequests, docsBpi2CmtsKeyReplies, docsBpi2CmtsKeyRejects, docsBpi2CmtsTEKInvalids, docsBpi2CmtsKeyRejectErrorCode, docsBpi2CmtsKeyRejectErrorString, docsBpi2CmtsTEKInvalidErrorCode, docsBpi2CmtsTEKInvalidErrorString, docsBpi2CmtsIpMulticastAddressType, docsBpi2CmtsIpMulticastAddress, docsBpi2CmtsIpMulticastMaskType, docsBpi2CmtsIpMulticastMask, docsBpi2CmtsIpMulticastSAId, docsBpi2CmtsIpMulticastSAType, docsBpi2CmtsIpMulticastDataEncryptAlg, docsBpi2CmtsIpMulticastDataAuthentAlg, docsBpi2CmtsIpMulticastSAMapRequests, docsBpi2CmtsIpMulticastSAMapReplies, docsBpi2CmtsIpMulticastSAMapRejects, docsBpi2CmtsIpMulticastSAMapRejectErrorCode, docsBpi2CmtsIpMulticastSAMapRejectErrorString, docsBpi2CmtsIpMulticastMapControl, docsBpi2CmtsMulticastAuthControl, docsBpi2CmtsProvisionedCmCertTrust, docsBpi2CmtsProvisionedCmCertSource, docsBpi2CmtsProvisionedCmCertStatus, docsBpi2CmtsProvisionedCmCert, docsBpi2CmtsCACertSubject, docsBpi2CmtsCACertIssuer, docsBpi2CmtsCACertSerialNumber, docsBpi2CmtsCACertTrust, docsBpi2CmtsCACertSource, docsBpi2CmtsCACertStatus, docsBpi2CmtsCACert, docsBpi2CmtsCACertThumbprint } STATUS current DESCRIPTION "This collection of objects provides CMTS BPI+ status and Green/Katsnelson Expires - May 2003 [Page 68]
DOCSIS BPI Plus MIB November 2002 control." ::= { docsBpi2Groups 2 } docsBpi2CodeDownloadGroup OBJECT-GROUP OBJECTS { docsBpi2CodeDownloadStatusCode, docsBpi2CodeDownloadStatusString, docsBpi2CodeMfgOrgName, docsBpi2CodeMfgCodeAccessStart, docsBpi2CodeMfgCvcAccessStart, docsBpi2CodeCoSignerOrgName, docsBpi2CodeCoSignerCodeAccessStart, docsBpi2CodeCoSignerCvcAccessStart, docsBpi2CodeCvcUpdate } STATUS current DESCRIPTION "This collection of objects provide authenticated software download support." ::= { docsBpi2Groups 3 } docsBpi2ObsoleteObjectsGroup OBJECT-GROUP OBJECTS { docsBpi2CmtsAuthCmGraceTime, docsBpi2CmtsTEKGraceTime } STATUS obsolete DESCRIPTION "This is a collection of obsolete BPI+ objects." ::= { docsBpi2Groups 4 } END 4. Acknowledgments Kaz Ozawa - Authenticated Software Download objects and general suggestions Rich Woundy - BPI MIB and general MIB expertise Mike St Johns - BPI MIB and 1st draft of BPI+ MIB Thanks to Mike Sabin and Manson Wong for reviewing early BPI+ MIB Drafts and to Jean-Francois Mule for reviewing the last version. 5. References [1] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture for Describing SNMP Management Frameworks", RFC 2571, April Green/Katsnelson Expires - May 2003 [Page 69]
DOCSIS BPI Plus MIB November 2002 1999. [2] Rose, M. and K. McCloghrie, "Structure and Identification of Management Information for TCP/IP-based Internets", STD 16, RFC 1155, May 1990. [3] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16, RFC 1212, March 1991. [4] Rose, M., "A Convention for Defining Traps for use with the SNMP", RFC 1215, March 1991. [5] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of Management Information for Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [6] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [7] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [8] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Management Protocol", STD 15, RFC 1157, May 1990. [9] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Introduction to Community-based SNMPv2", RFC 1901, January 1996. [10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport Mappings for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1906, January 1996. [11] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2572, April 1999. [12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", RFC 2574, April 1999. [13] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1905, January 1996. [14] Levi, D., Meyer, P. and B. Stewart, "SNMP Applications", RFC 2573, April 1999. [15] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Green/Katsnelson Expires - May 2003 [Page 70]
DOCSIS BPI Plus MIB November 2002 Control Model (VACM) for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999. [16] "Data-Over-Cable Service Interface Specifications: Cable Modem Radio Frequency Interface Specification SP-RFIv1.1-I07-010829", DOCSIS, August 2001, available at http://www.cablemodem.com/. [17] "Data-Over-Cable Service Interface Specifications: Baseline Privacy Plus Interface Specification SP-BPI+-I07-010829", DOCSIS, August 2001, available at http://www.cablemodem.com/. [18] "Data-Over-Cable Service Interface Specifications: Baseline Privacy Interface Specification SP-BPI-I03-010829", DOCSIS, August 2001, available at http://www.cablemodem.com/. [19] "Data-Over-Cable Service Interface Specifications: OSSI Baseline Privacy Interface MIB SP-OSSI-BPI-I02-010829", DOCSIS, August 2001, available at http://www.cablemodem.com/. [20] RSA Laboratories, "The Public-Key Cryptography Standards", RSA Data Security Inc., Redwood City, CA. [21] Case, J., Mundy, R., Partain, D., and B. Stewart, "Introduction to Version 3 of the Internet-standard Network Management Framework", RFC2570, April 1999. [22] Bradner, S., "The Internet Standards Process -- Revision 3", BCP 9, RFC 2026, October 1996. [23] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997 6. Security Considerations This MIB is intended to limit certain kinds of network behavior by subscriber hosts attached to cable modems, including, for example, IP spoofing. These limitations may be compromised, however, if the cable modem's identity or registration process is spoofed. The DOCSIS RFI and privacy specifications [16], [18], and [17] define a number of mechanisms for assuring modem identity. There are a number of management objects defined in this MIB that have a MAX-ACCESS clause of read-write and/or read-create. Such Green/Katsnelson Expires - May 2003 [Page 71]
DOCSIS BPI Plus MIB November 2002 objects may be considered sensitive or vulnerable in some network environments. The support for SET operations in a non-secure environment without proper protection can have a negative effect on network operations. SNMPv1 by itself is not a secure environment. Even if the network itself is secure (for example by using IPSec), even then, there is no control as to who on the secure network is allowed to access and GET/SET (read/change/create/delete) the objects in this MIB. It is recommended that the implementers consider the security features as provided by the SNMPv3 framework. Specifically, the use of the User-based Security Model RFC 2574 [12] and the View- based Access Control Model RFC 2575 [15] is recommended. It is then a customer/user responsibility to ensure that the SNMP entity giving access to an instance of this MIB, is properly configured to give access to the objects only to those principals (users) that have legitimate rights to indeed GET or SET (change/create/delete) them. 7. Authors' Addresses Stuart M. Green ARRIS Group Inc. 6 Riverside Drive Andover, MA 01810 USA Phone: +1 978 946 4664 Email: stu.green@arrisi.com Alexander Katsnelson Cable Television Laboratories, Inc. 400 Centennial Parkway Louisville, CO 80027-1266 USA Phone: +1 303 661 9100 E-mail: a.katsnelson@cablelabs.com 8. Intellectual Property The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of Green/Katsnelson Expires - May 2003 [Page 72]
DOCSIS BPI Plus MIB November 2002 licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director. 9. Full Copyright Statement Copyright (C) The Internet Society (2002). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Funding for the RFC Editor function is currently provided by the Internet Society. Green/Katsnelson Expires - May 2003 [Page 73]
