[Docs] [txt|pdf] [Tracker] [WG] [Email] [Diff1] [Diff2] [Nits]

Versions: 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 RFC 4131

    Internet Draft
    IPCDN Working Group                                         S. Green
    Document: draft-ietf-ipcdn-bpiplus-mib-15    ADC Telecommunications,
                                                                     Inc
                                                               Kaz Ozawa
                                                                 Toshiba
                                                           A. Katsnelson
                                                               CableLabs
                                                              E. Cardona
                                                      CableLabs (Editor)
    Expires: June 2004                                     November 2004
 
                Management Information Base for DOCSIS
               Cable Modems and Cable Modem Termination
                  Systems for Baseline Privacy Plus
 
 
  Status of this Memo
 
    By submitting this Internet-Draft, we certify that any applicable
    patent or other IPR claims of which we are aware have been
    disclosed, or will be disclosed, and any of which we become aware
    will be disclosed, in accordance with RFC 3668.
 
 
    Internet-Drafts are working documents of the Internet Engineering
    Task Force (IETF), its areas, and its working groups.  Note that
    other groups may also distribute working documents as Internet-
    Drafts.
 
    Internet-Drafts are draft documents valid for a maximum of six
    months and may be updated, replaced, or obsoleted by other
    documents at any time.  It is inappropriate to use Internet-Drafts
    as reference material or to cite them other than as "work in
    progress."
 
    The list of current Internet-Drafts can be accessed at
         http://www.ietf.org/ietf/1id-abstracts.txt.
    The list of Internet-Draft Shadow Directories can be accessed at
         http://www.ietf.org/shadow.html.
 
  Abstract
 
    This memo defines a portion of the Management Information Base (MIB)
    for use with network management protocols in the Internet community.
    In particular, it defines a set of managed objects for SNMP based
    management of the Baseline Privacy Plus features of DOCSIS 1.1 and
    DOCSIS 2.0 (Data-over-Cable Service Interface Specification)
    compliant Cable Modems and Cable Modem Termination
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires - June 2005        [Page 1]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    Systems.
 
    Note to RFC Editor (Remove this paragraph prior to publication)
    This memo is a product of the IPCDN working group within the
    Internet Engineering Task Force.  Comments are solicited and
    should be Addressed to the working group's mailing list at
    ipcdn@ietf.org and/or the authors.
 
 
  Conventions used in this document
 
    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
    NOT","SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
    in this document are to be interpreted as described in BCP 14,
    RFC 2119 [RFC2119].
 
 
  Table of Contents
 
    1. The Internet-Standard Management Framework......................2
    2. Overview........................................................3
       2.1 Structure of the MIB........................................3
       2.2 Relationship of BPI+ and BPI MIB Modules....................5
       2.3 BPI+ MIB module relationship with The Interfaces Group MIB..5
    3. Definitions.....................................................6
    4. Acknowledgments................................................77
    5. Normative References...........................................77
    6. Informative References.........................................79
    7. Security Considerations........................................79
    8. IANA Considerations............................................83
    9. Authors' Addresses.............................................84
    10. Disclaimer of Validity........................................84
    11. Intellectual Property.........................................85
    12. Copyright Statement...........................................85
 
 
 1. The Internet-Standard Management Framework
 
    For a detailed overview of the documents that describe the current
    Internet-Standard Management Framework, please refer to section 7 of
    RFC 3410 [RFC3410].
 
    Managed objects are accessed via a virtual information store, termed
    the Management Information Base or MIB.  MIB objects are generally
    accessed through the Simple Network Management Protocol (SNMP).
    Objects in the MIB are defined using the mechanisms defined in the
    Structure of Management Information (SMI).  This memo specifies a
    MIB module that is compliant to the SMIv2, which is described in
    STD 58, RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 2]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    RFC 2580 [RFC2580].
 
 
 2. Overview
 
    This MIB module (BPI+ MIB) provides a set of objects required for
    the management of the Baseline Privacy Interface Plus features of
    DOCSIS 1.1 and DOCSIS 2.0 Cable Modem (CM) and Cable Modem
    Termination System (CMTS). The specification is derived from the
    operational model described in the DOCSIS Baseline Privacy Interface
    Plus Specification [1].
 
    DOCSIS Baseline Privacy Plus is composed of four distinct
    functional and manageable areas:
 
    o    Key Exchange and Data Encryption
 
    o    Cable Modem Authentication
 
    o    Multicast Encryption
 
    o    Authentication of Downloaded Software Images
 
    This MIB module is an extension of the DOCSIS 1.0 Baseline Privacy
    MIB module [RFC3083] (BPI MIB), which is derived from the
    Operational model described in the DOCSIS Baseline Privacy Interface
    Specification [2].  The original Baseline Privacy MIB structure
    has been mostly preserved in the Baseline Privacy Plus MIB.
    Please note that the referenced DOCSIS specifications only require
    Cable Modems to process IPv4 customer traffic. Design choices in
    this MIB module reflect those requirements. Future versions of the
    DOCSIS specifications are expected to require support for IPv6 as
    well.
 
 
 2.1 Structure of the MIB
 
    This MIB module is structured into several tables and objects:
 
 
 2.1.1. Cable Modem
 
    o    The docsBpi2CmBaseTable contains authorization key exchange
         information for one CM MAC interface.
 
    o    The docsBpi2CmTEKTable contains traffic key exchange and
         data encryption information for a particular security
         association ID of the cable modem.
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 3]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    o    Multicast Encryption information is maintained under
         Docsbpi2CmMulticastObjects.  There is currently one multicast
         table object which manages IP multicast encryption,
         docsBpi2CmIpMulticastMapTable.
 
    o    Digital certificates used for cable modem authentication are
         accessible via docsBpi2CmDeviceCertTable.
 
    o    Cryptographic suite capabilities for a CM MAC are maintained
         in the docsBpi2CmCryptoSuiteTable.
 
 
 2.1.2. Cable Modem Termination System
 
    o    The docsBpi2CmtsBaseTable contains default settings and
         summary counters for the cable modem termination system.
 
    o    The DocsBpi2CmtsAuthTable contains Authorization Key Exchange
         information for each CM MAC interface, as well as data
         from CM certificates used in cable modem authentication.
 
    o    The docsBpi2CmtsTEKTable contains traffic key exchange and
         data encryption information for a particular security
         association ID.
 
    o    Multicast Encryption information is maintained under
         Docsbpi2CmtsMulticastObjects.  There are currently two
         multicast table objects. The Table
         docsBpi2CmtsIpMulticastMapTable is specifically designed
         for IP multicast encryption, whereas
         docsBpi2CmtsMulticastAuthTable is meant to manage all
         multicast security associations.
 
           In particular, the table docsBpi2CmtsIpMulticastMapTable
           defines the object docsBpi2CmtsIpMulticastMask which could
           be a non-contiguous netmask; this is why the object syntax
           is based on the INET-ADDRESS-MIB MIB Module [RFC3291]
           Textual Convention InetAddress instead of
           InetAddressPrefixLength.
 
           This is to facilitate the assignment of same DOCSIS Security
           Association ID (SAID) to one or more IPv6  multicast group
           ID(s) matching one or more IPv6 multicast scope types within
           an entry in this table.
           For example, multicast scopes labeled "unassigned" [RFC3513]
           may be allocated by administrators to a particular SAID
           regardless of their multicast scope; such mapping
           transient multicast group 'Y' to SAID 'z' for ANY multicast
           scope. The non-contiguous netmask will be FF10:Y, see
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 4]
 

                          DOCSIS BPI Plus MIB            November 2004
 
           [RFC3513] for details on IPv6 multicast addressing.
 
 
    o    DocsBpi2CmtsCertObjects contains 2 manageable tables: one
         for provisioned cable modem certificates and one for
         certification authority certificates.
 
 
 2.1.3. Common
 
    o    The docsBpi2CodeDownloadControl objects manage the
         authenticated software download process for a given device.
 
 2.2 Relationship of BPI+ and BPI MIB Modules
 
    This section describes the relationship between the BPI+ MIB module
    defined in this document and the BPI MIB module defined in RFC 3083
    [RFC3083]. The BPI+ protocol interface is an enhancement to the BPI
    protocol and it is a distinct protocol from BPI. The associated BPI+
    managed objects should be considered separate from the BPI MIB
    objects defined in RFC 3083.
 
    DOCSIS 1.1 and 2.0 systems implement both the BPI+ and BPI protocols
    to be backward compatible with 1.0 systems. For more information
    regarding the interoperability between BPI and BPI+ compliant
    systems, refer to appendix C of the DOCSIS BPI+ specification
    [1] and for MIB modules requirements, refers to section 4.6.1,
    Figure 9 of the DOCSIS 1.1 OSSI specification [3] and section
     7.6.1, Table 7-9 of the DOCSIS 2.0 OSSI specification [4].
 
 
 2.3 BPI+ MIB module relationship with The Interfaces Group MIB
 
    The BPI+ MIB module is the management framework of Baseline Privacy
    Plus Interface Specification [1], which provides the MAC layer
    (Media Access Control) security Services of DOCSIS through the
    Baseline Privacy Key Management (BPKM) protocol.
    The BPI+ MIB module objects are organized as extensions of the Radio
    Frequency (RF) Interface Management [RFC2670].
 
    The MIB table structures of this MIB Module are extensions of the
    DOCSIS CATV (Community Antenna Television) MAC layer interface
    (DocsCableMaclayer by [IANA]). In particular the provisions of the
    Interface Group MIB[RFC2863] for counters discontinuities and
    system re-initialization apply to CM and CMTS to validate the
    difference between two consecutive counters polls.
 
    All BPI+ MIB module counters are 32 bits based on the minimum time
    to wrap-up considerations of [RFC2863] and their possible frequency
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 5]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    occurrence as BPI+ FSM (Finite State Machine) event counters. see
    [1] for BPI+ FSM parameter guidelines.
 
 
 
 3. Definitions
 
    DOCS-IETF-BPI2-MIB DEFINITIONS ::= BEGIN
 
    IMPORTS
            MODULE-IDENTITY, OBJECT-TYPE,
            Integer32,
            Unsigned32,
            Counter32,
            mib-2
                 FROM SNMPv2-SMI           -- [RFC2578]
            SnmpAdminString
                 FROM SNMP-FRAMEWORK-MIB   -- [RFC3411]
            TEXTUAL-CONVENTION,
            MacAddress,
            RowStatus,
            TruthValue,
            DateAndTime,
            StorageType
                 FROM SNMPv2-TC            -- [RFC2579]
            OBJECT-GROUP,
            MODULE-COMPLIANCE
                 FROM SNMPv2-CONF          -- [RFC2580]
            ifIndex
                 FROM IF-MIB               -- [RFC2863]
            InetAddressType,
            InetAddress
                 FROM INET-ADDRESS-MIB;     -- [RFC3291]
 
 
 
       docsBpi2MIB    MODULE-IDENTITY
            LAST-UPDATED "200409071700Z" -- September 7th, 2004
            ORGANIZATION "IETF IP over Cable Data Network (IPCDN)
                          Working Group"
            CONTACT-INFO "---------------------------------------
                       Stuart M. Green
                       Postal:
                       ADC Telecommunications, Inc.
                       Mailstop 1641
                       8 Technology Drive
                       Westborough, MA  01581
                       U.S.A.
                       Tel:    +1 508 870 2554
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 6]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                       E-mail: stuart.green@adc.com
                       ---------------------------------------
                       Kaz Ozawa
                       Cable Modem & Network Dept.
                       Server & Network Div.
                       TOSHIBA CORPORATION
                       Digital Media Network Company
                       1-1, Shibaura 1-Chome
                       Minato-ku, Tokyo 105-8001
                       Japan
                       Phone: +81-3-3457-2726
                       FAX: +81-3-5444-9359
                       Email: Kazuyoshi.Ozawa@toshiba.co.jp
                       ---------------------------------------
                       Alexander Katsnelson
                       Postal:
                       Cable Television Laboratories, Inc.
                       858 Coal Creek Circle
                       Louisville, CO 80027- 9750
                       U.S.A.
                       Tel:    +1 303 661 9100
                       Fax:    +1 303 661 9199
                       E-mail: a.katsnelson@cablelabs.com
                       ---------------------------------------
                       Eduardo Cardona
                       Postal:
                       Cable Television Laboratories, Inc.
                       858 Coal Creek Circle
                       Louisville, CO 80027- 9750
                       U.S.A.
                       Tel:    +1 303 661 9100
                       Fax:    +1 303 661 9199
                       E-mail: e.cardona@cablelabs.com
                       ---------------------------------------
 
               IETF IPCDN Working Group
               General Discussion: ipcdn@ietf.org
               Subscribe: http://www.ietf.org/mailman/listinfo/ipcdn.
               Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn.
               Co-chairs: Richard Woundy, rwoundy@cisco.com
                          Jean-Francois Mule, jfm@cablelabs.com"
            DESCRIPTION
                "This is the MIB module for the DOCSIS Baseline
                 Privacy Plus Interface (BPI+) at cable modems (CMs)
                 and cable modem termination systems (CMTSs).
 
                 Copyright (C) The Internet Society (2004). This
                 version of this MIB module is part of RFC XXXX; see
                 the RFC itself for full legal notices."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 7]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
            REVISION        "200409071700Z"
            DESCRIPTION
                "Initial version of the IETF BPI+ MIB module.
                 This version published as RFC XXXX."
 
 
 
            -- Note to RFC editor:
            -- RFC editor to assign yy
            -- Delete this note
 
               ::= { mib-2 yy }   -- yy to be assigned by IANA
 
 
       -- Textual conventions
 
    DocsX509ASN1DEREncodedCertificate ::= TEXTUAL-CONVENTION
            STATUS    current
            DESCRIPTION
                "An X509 digital certificate encoded as an ASN.1 DER
            object."
            SYNTAX    OCTET STRING (SIZE (0..4096))
 
    DocsSAId ::= TEXTUAL-CONVENTION
            DISPLAY-HINT "d"
            STATUS    current
            DESCRIPTION
                 "Security Association identifier (SAId)"
            REFERENCE
                  " DOCSIS Baseline Privacy Plus Interface
            specification, Section 2.1.3 BPI+ Security
            Associations"
            SYNTAX    Integer32 (1..16383)
 
    DocsSAIdOrZero ::= TEXTUAL-CONVENTION
            DISPLAY-HINT "d"
            STATUS    current
            DESCRIPTION
                 "Security Association identifier (SAId). The value
            zero indicates the SAId is yet to be determined"
            REFERENCE
                  " DOCSIS Baseline Privacy Plus Interface
            specification, Section 2.1.3 BPI+ Security
                  Associations"
            SYNTAX    Unsigned32 (0 | 1..16383)
 
    DocsBpkmSAType ::= TEXTUAL-CONVENTION
            STATUS    current
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 8]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            DESCRIPTION
                 "The type of security association (SA).
            The values of the named-numbers are associated
            with the BPKM SA-Type attributes:
            'primary' corresponds to code '1', 'static' to code '2'
            'dynamic' to code '3'.
            'none' value must only be used if the SA type has yet
            to be determined."
            REFERENCE
                  "DOCSIS Baseline Privacy Plus Interface
            specification, Section 4.2.2.24"
            SYNTAX    INTEGER {
                           none(0),
                           primary(1),
                           static(2),
                           dynamic(3)
                      }
 
    DocsBpkmDataEncryptAlg ::= TEXTUAL-CONVENTION
            STATUS    current
            DESCRIPTION
                "The list of data encryption algorithms defined for
            the DOCSIS interface in the BPKM cryptographic-suite
            parameter.  The Value 'none' is indicates that the SAID
            being referenced has no data encryption."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            SYNTAX    INTEGER {
                           none(0),
                           des56CbcMode(1),
                           des40CbcMode(2),
                           t3Des128CbcMode(3),
                           aes128CbcMode(4),
                           aes256CbcMode(5)
                      }
 
    DocsBpkmDataAuthentAlg ::= TEXTUAL-CONVENTION
            STATUS    current
            DESCRIPTION
                "The list of data integrity algorithms defined for the
            DOCSIS interface in the BPKM cryptographic-suite parameter.
            The value 'none' indicates no data integrity is used for
            the SAID being referenced."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            SYNTAX    INTEGER {
                           none(0),
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005       [Page 9]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                           hmacSha196(1)
                      }
 
       docsBpi2MIBObjects  OBJECT IDENTIFIER ::= { docsBpi2MIB 1 }
 
       -- Cable Modem Group
 
       docsBpi2CmObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 1 }
 
       --
       -- The BPI+ base and authorization table for CMs,
       -- indexed by ifIndex
       --
 
       docsBpi2CmBaseTable OBJECT-TYPE
            SYNTAX              SEQUENCE OF    DocsBpi2CmBaseEntry
            MAX-ACCESS          not-accessible
            STATUS              current
            DESCRIPTION
                 "This table describes the basic and authorization
            related Baseline Privacy Plus attributes of each CM MAC
            interface."
            ::= { docsBpi2CmObjects 1 }
 
       docsBpi2CmBaseEntry OBJECT-TYPE
            SYNTAX              DocsBpi2CmBaseEntry
            MAX-ACCESS          not-accessible
            STATUS              current
            DESCRIPTION
                 "Each entry contains objects describing attributes of
            one CM MAC interface. An entry in this table exists for
            each ifEntry with an ifType of docsCableMaclayer(127)."
            INDEX               { ifIndex }
            ::= { docsBpi2CmBaseTable 1 }
 
       DocsBpi2CmBaseEntry ::= SEQUENCE {
            docsBpi2CmPrivacyEnable             TruthValue,
            docsBpi2CmPublicKey                 OCTET STRING,
            docsBpi2CmAuthState                 INTEGER,
            docsBpi2CmAuthKeySequenceNumber     Integer32,
            docsBpi2CmAuthExpiresOld            DateAndTime,
            docsBpi2CmAuthExpiresNew            DateAndTime,
            docsBpi2CmAuthReset                 TruthValue,
            docsBpi2CmAuthGraceTime             Integer32,
            docsBpi2CmTEKGraceTime              Integer32,
            docsBpi2CmAuthWaitTimeout           Integer32,
            docsBpi2CmReauthWaitTimeout         Integer32,
            docsBpi2CmOpWaitTimeout             Integer32,
            docsBpi2CmRekeyWaitTimeout          Integer32,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 10]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            docsBpi2CmAuthRejectWaitTimeout     Integer32,
            docsBpi2CmSAMapWaitTimeout          Integer32,
            docsBpi2CmSAMapMaxRetries           Integer32,
            docsBpi2CmAuthentInfos              Counter32,
            docsBpi2CmAuthRequests              Counter32,
            docsBpi2CmAuthReplies               Counter32,
            docsBpi2CmAuthRejects               Counter32,
            docsBpi2CmAuthInvalids              Counter32,
            docsBpi2CmAuthRejectErrorCode       INTEGER,
            docsBpi2CmAuthRejectErrorString     SnmpAdminString,
            docsBpi2CmAuthInvalidErrorCode      INTEGER,
            docsBpi2CmAuthInvalidErrorString    SnmpAdminString
            }
 
       docsBpi2CmPrivacyEnable  OBJECT-TYPE
            SYNTAX              TruthValue
            MAX-ACCESS          read-only
            STATUS              current
            DESCRIPTION
                 "This object identifies whether this CM is
            provisioned to run Baseline Privacy Plus."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1."
            ::= { docsBpi2CmBaseEntry 1 }
 
       docsBpi2CmPublicKey     OBJECT-TYPE
            SYNTAX             OCTET STRING (SIZE (0..524))
            MAX-ACCESS         read-only
            STATUS             current
            DESCRIPTION
                 "The value of this object is a DER-encoded
            RSAPublicKey ASN.1 type string, as defined in the RSA
            Encryption Standard (PKCS #1), corresponding to the
            public key of the CM."
 
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.4."
            ::= { docsBpi2CmBaseEntry 2 }
 
       docsBpi2CmAuthState OBJECT-TYPE
            SYNTAX         INTEGER   {
                           start(1),
                           authWait(2),
                           authorized(3),
                           reauthWait(4),
                           authRejectWait(5),
                           silent(6)
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 11]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                      }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the state of the CM
            authorization FSM.  The start state indicates that FSM is
            in its initial state."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.1.2.1."
            ::= { docsBpi2CmBaseEntry 3 }
 
       docsBpi2CmAuthKeySequenceNumber    OBJECT-TYPE
            SYNTAX              Integer32 (0..15)
            MAX-ACCESS          read-only
            STATUS              current
            DESCRIPTION
                 "The value of this object is the most recent
            authorization key sequence number for this FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.2 and 4.2.2.10."
            ::= { docsBpi2CmBaseEntry 4 }
 
       docsBpi2CmAuthExpiresOld OBJECT-TYPE
            SYNTAX              DateAndTime
            MAX-ACCESS          read-only
            STATUS              current
            DESCRIPTION
                 "The value of this object is the actual clock time for
            expiration of the immediate predecessor of the most recent
            authorization key for this FSM.  If this FSM has only one
            authorization key, then the value is the time of activation
            of this FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.2 and 4.2.2.9."
            ::= { docsBpi2CmBaseEntry 5 }
 
       docsBpi2CmAuthExpiresNew OBJECT-TYPE
            SYNTAX              DateAndTime
            MAX-ACCESS          read-only
            STATUS              current
            DESCRIPTION
                 "The value of this object is the actual clock time for
            expiration of the most recent authorization key for this
            FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 12]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            Sections 4.2.1.2 and 4.2.2.9."
            ::= { docsBpi2CmBaseEntry 6 }
 
       docsBpi2CmAuthReset OBJECT-TYPE
            SYNTAX         TruthValue
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "Setting this object to 'true' generates a Reauthorize
            event in the authorization FSM. Reading this object always
            returns FALSE.
            This object is for testing purposes only and therefore it
            does not require to be associated with a last reset
            object."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.1.2.3.4."
            ::= { docsBpi2CmBaseEntry 7 }
 
       docsBpi2CmAuthGraceTime  OBJECT-TYPE
            SYNTAX         Integer32 (1..6047999)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the grace time for an
            authorization key in seconds.  A CM is expected to start
            trying to get a new authorization key beginning
            AuthGraceTime seconds before the most recent authorization
            key actually expires."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.3."
            ::= { docsBpi2CmBaseEntry 8 }
 
       docsBpi2CmTEKGraceTime   OBJECT-TYPE
            SYNTAX         Integer32 (1..302399)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the grace time for
            the TEK in seconds.  The CM is expected to start trying to
            acquire a new TEK beginning TEK GraceTime seconds before
            the expiration of the most recent TEK."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.6."
            ::= { docsBpi2CmBaseEntry 9 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 13]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CmAuthWaitTimeout     OBJECT-TYPE
            SYNTAX         Integer32 (1..30)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the Authorize Wait
            Timeout in second."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.1."
            ::= { docsBpi2CmBaseEntry 10 }
 
       docsBpi2CmReauthWaitTimeout   OBJECT-TYPE
            SYNTAX         Integer32 (1..30)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the Reauthorize Wait
            Timeout in seconds."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.2."
            ::= { docsBpi2CmBaseEntry 11 }
 
       docsBpi2CmOpWaitTimeout  OBJECT-TYPE
            SYNTAX         Integer32 (1..10)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the Operational Wait
            Timeout in seconds."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.4."
            ::= { docsBpi2CmBaseEntry 12 }
 
       docsBpi2CmRekeyWaitTimeout    OBJECT-TYPE
            SYNTAX         Integer32 (1..10)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the Rekey Wait Timeout
            in seconds."
            REFERENCE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 14]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.5."
            ::= { docsBpi2CmBaseEntry 13 }
 
       docsBpi2CmAuthRejectWaitTimeout    OBJECT-TYPE
            SYNTAX         Integer32 (1..600)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the Authorization Reject
            Wait Timeout in seconds."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.7."
            ::= { docsBpi2CmBaseEntry 14 }
 
       docsBpi2CmSAMapWaitTimeout    OBJECT-TYPE
            SYNTAX         Integer32 (1..10)
            UNITS          "seconds"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the retransmission
            interval, in seconds, of SA Map Requests from the MAP Wait
            state."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.8."
            ::= { docsBpi2CmBaseEntry 15 }
 
       docsBpi2CmSAMapMaxRetries     OBJECT-TYPE
            SYNTAX         Integer32 (0..10)
            UNITS          "count"
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the maximum number of
            Map Request retries allowed."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.1.1.1.9."
            ::= { docsBpi2CmBaseEntry 16 }
 
       docsBpi2CmAuthentInfos   OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 15]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "The value of this object is the count of times the CM
            has transmitted an Authentication Information message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.9."
            ::= { docsBpi2CmBaseEntry 17 }
 
       docsBpi2CmAuthRequests   OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the CM
            has transmitted an Authorization Request message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.1."
            ::= { docsBpi2CmBaseEntry 18 }
 
       docsBpi2CmAuthReplies    OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the CM
            has received an Authorization Reply message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
 
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.2."
            ::= { docsBpi2CmBaseEntry 19 }
 
       docsBpi2CmAuthRejects    OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 16]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "The value of this object is the count of times the CM
            has received an Authorization Reject message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.3."
            ::= { docsBpi2CmBaseEntry 20 }
 
       docsBpi2CmAuthInvalids   OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the CM
            has received an Authorization Invalid message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.7."
            ::= { docsBpi2CmBaseEntry 21 }
 
       docsBpi2CmAuthRejectErrorCode OBJECT-TYPE
            SYNTAX         INTEGER {
                                  none(1),
                                  unknown(2),
                                  unauthorizedCm(3),
                                  unauthorizedSaid(4),
                                  permanentAuthorizationFailure(8),
                                  timeOfDayNotAcquired(11)
                                  }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in most recent Authorization
            Reject message received by the CM.  This has value
            unknown(2) if the last Error-Code value was 0, and none(1)
            if no Authorization Reject message has been received since
            reboot."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.3 and 4.2.2.15."
            ::= { docsBpi2CmBaseEntry 22 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 17]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CmAuthRejectErrorString    OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            most recent Authorization Reject message received by the
            CM.  This is a zero length string if no Authorization
            Reject message has been received since reboot."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.3 and 4.2.2.6."
            ::= { docsBpi2CmBaseEntry 23 }
 
       docsBpi2CmAuthInvalidErrorCode     OBJECT-TYPE
            SYNTAX         INTEGER {
                                  none(1),
                                  unknown(2),
                                  unauthorizedCm(3),
                                  unsolicited(5),
                                  invalidKeySequence(6),
                                  keyRequestAuthenticationFailure(7)
                                  }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in most recent Authorization
            Invalid message received by the CM.  This has value
            unknown(2) if the last Error-Code value was 0, and none(1)
            if no Authorization Invalid message has been received since
            reboot."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.7 and 4.2.2.15."
            ::= { docsBpi2CmBaseEntry 24 }
 
       docsBpi2CmAuthInvalidErrorString   OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            most recent Authorization Invalid message received by the
            CM. This is a zero length string if no Authorization
            Invalid message has been received since reboot."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 18]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            Sections 4.2.1.7 and 4.2.2.6."
            ::= { docsBpi2CmBaseEntry 25 }
 
 
 
 
       --
       -- The CM TEK Table, indexed by ifIndex and SAID
       --
 
       docsBpi2CmTEKTable  OBJECT-TYPE
            SYNTAX         SEQUENCE OF    DocsBpi2CmTEKEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This table describes the attributes of each CM
            Traffic Encryption Key (TEK) association. The CM maintains
            (no more than) one TEK association per SAID per CM MAC
            interface."
            ::= { docsBpi2CmObjects 2 }
 
       docsBpi2CmTEKEntry  OBJECT-TYPE
            SYNTAX         DocsBpi2CmTEKEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "Each entry contains objects describing the TEK
            association attributes of one SAID. The CM MUST create one
            entry per SAID, regardless of whether the SAID was obtained
            from a Registration Response message, from an Authorization
            Reply message, or from any dynamic SAID establishment
            mechanisms."
            INDEX     { ifIndex, docsBpi2CmTEKSAId }
            ::= { docsBpi2CmTEKTable 1 }
 
       DocsBpi2CmTEKEntry ::= SEQUENCE {
            docsBpi2CmTEKSAId                  DocsSAId,
            docsBpi2CmTEKSAType                DocsBpkmSAType,
            docsBpi2CmTEKDataEncryptAlg        DocsBpkmDataEncryptAlg,
            docsBpi2CmTEKDataAuthentAlg        DocsBpkmDataAuthentAlg,
            docsBpi2CmTEKState                 INTEGER,
            docsBpi2CmTEKKeySequenceNumber     Integer32,
            docsBpi2CmTEKExpiresOld            DateAndTime,
            docsBpi2CmTEKExpiresNew            DateAndTime,
            docsBpi2CmTEKKeyRequests           Counter32,
            docsBpi2CmTEKKeyReplies            Counter32,
            docsBpi2CmTEKKeyRejects            Counter32,
            docsBpi2CmTEKInvalids              Counter32,
            docsBpi2CmTEKAuthPends             Counter32,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 19]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            docsBpi2CmTEKKeyRejectErrorCode    INTEGER,
            docsBpi2CmTEKKeyRejectErrorString  SnmpAdminString,
            docsBpi2CmTEKInvalidErrorCode      INTEGER,
            docsBpi2CmTEKInvalidErrorString    SnmpAdminString
            }
 
       docsBpi2CmTEKSAId   OBJECT-TYPE
            SYNTAX         DocsSAId
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The value of this object is the DOCSIS Security
            Association ID (SAID)."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.12."
            ::= { docsBpi2CmTEKEntry 1 }
 
       docsBpi2CmTEKSAType OBJECT-TYPE
            SYNTAX         DocsBpkmSAType
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the type of security
            association."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 2.1.3."
            ::= { docsBpi2CmTEKEntry 2 }
 
       docsBpi2CmTEKDataEncryptAlg   OBJECT-TYPE
            SYNTAX    DocsBpkmDataEncryptAlg
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data encryption
            algorithm for this SAID."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            ::= { docsBpi2CmTEKEntry 3 }
 
       docsBpi2CmTEKDataAuthentAlg   OBJECT-TYPE
            SYNTAX    DocsBpkmDataAuthentAlg
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data authentication
            algorithm for this SAID."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 20]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            ::= { docsBpi2CmTEKEntry 4 }
 
       docsBpi2CmTEKState  OBJECT-TYPE
            SYNTAX         INTEGER {
                                   start(1),
                                   opWait(2),
                                   opReauthWait(3),
                                   operational(4),
                                   rekeyWait(5),
                                   rekeyReauthWait(6)
                                   }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the state of the
            indicated TEK FSM.  The start(1) state indicates that FSM
            is in its initial state."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.1.3.1."
            ::= { docsBpi2CmTEKEntry 5 }
 
       docsBpi2CmTEKKeySequenceNumber     OBJECT-TYPE
            SYNTAX              Integer32 (0..15)
            MAX-ACCESS          read-only
            STATUS              current
            DESCRIPTION
                 "The value of this object is the most recent TEK
            key sequence number for this TEK FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.2.10 and 4.2.2.13."
            ::= { docsBpi2CmTEKEntry 6 }
 
       docsBpi2CmTEKExpiresOld  OBJECT-TYPE
            SYNTAX         DateAndTime
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the actual clock time for
            expiration of the immediate predecessor of the most recent
            TEK for this FSM.  If this FSM has only one TEK, then the
            value is the time of activation of this FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.5 and 4.2.2.9."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 21]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            ::= { docsBpi2CmTEKEntry 7 }
 
       docsBpi2CmTEKExpiresNew  OBJECT-TYPE
            SYNTAX         DateAndTime
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the actual clock time for
            expiration of the most recent TEK for this FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.5 and 4.2.2.9."
            ::= { docsBpi2CmTEKEntry 8 }
 
       docsBpi2CmTEKKeyRequests OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the CM
            has transmitted a Key Request message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
 
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.4."
            ::= { docsBpi2CmTEKEntry 9 }
 
       docsBpi2CmTEKKeyReplies  OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the CM
            has received a Key Reply message, including a message whose
            authentication failed.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.5."
            ::= { docsBpi2CmTEKEntry 10 }
 
       docsBpi2CmTEKKeyRejects  OBJECT-TYPE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 22]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the CM
            has received a Key Reject message, including a message
            whose authentication failed.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.6."
            ::= { docsBpi2CmTEKEntry 11 }
 
       docsBpi2CmTEKInvalids    OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the CM
            has received a TEK Invalid message, including a message
            whose authentication failed.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.8."
            ::= { docsBpi2CmTEKEntry 12 }
 
       docsBpi2CmTEKAuthPends   OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times an
            Authorization Pending (Auth Pend) event occurred in this
            FSM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.1.3.3.3."
            ::= { docsBpi2CmTEKEntry 13 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 23]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CmTEKKeyRejectErrorCode    OBJECT-TYPE
            SYNTAX         INTEGER {
                                   none(1),
                                   unknown(2),
                                   unauthorizedSaid(4)
                                   }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in most recent Key Reject
            message received by the CM. This has value unknown(2) if
            the last Error-Code value was 0, and none(1) if no Key
            Reject message has been received since registration."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.1.2.6 and 4.2.2.15."
            ::= { docsBpi2CmTEKEntry 14 }
 
       docsBpi2CmTEKKeyRejectErrorString  OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            most recent Key Reject message received by the CM. This is
            a zero length string if no Key Reject message has been
            received since registration."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.1.2.6 and 4.2.2.6."
            ::= { docsBpi2CmTEKEntry 15 }
 
       docsBpi2CmTEKInvalidErrorCode OBJECT-TYPE
            SYNTAX         INTEGER {
                                   none(1),
                                   unknown(2),
                                   invalidKeySequence(6)
                                   }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in most recent TEK Invalid
            message received by the CM.  This has value unknown(2) if
            the last Error-Code value was 0, and none(1) if no TEK
            Invalid message has been received since registration."
            REFERENCE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 24]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.1.2.8 and 4.2.2.15."
            ::= { docsBpi2CmTEKEntry 16 }
 
       docsBpi2CmTEKInvalidErrorString    OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            most recent TEK Invalid message received by the CM. This is
            a zero length string if no TEK Invalid message has been
            received since registration."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.1.2.8 and 4.2.2.6."
            ::= { docsBpi2CmTEKEntry 17 }
 
 
       --
       -- The CM Multicast Objects Group
       --
 
       docsBpi2CmMulticastObjects OBJECT IDENTIFIER
            ::= { docsBpi2CmObjects 3 }
 
       --
       -- The CM Dynamic IP Multicast Mapping Table, indexed by
       -- docsBpi2CmIpMulticastIndex and by ifIndex
       --
 
       docsBpi2CmIpMulticastMapTable OBJECT-TYPE
            SYNTAX         SEQUENCE OF DocsBpi2CmIpMulticastMapEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This table maps multicast IP addresses to SAIDs per
            CM MAC Interface.
            It is intended to map multicast IP addresses associated
            with SA MAP Request messages."
            ::= { docsBpi2CmMulticastObjects 1 }
 
       docsBpi2CmIpMulticastMapEntry OBJECT-TYPE
            SYNTAX         DocsBpi2CmIpMulticastMapEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "Each entry contains objects describing the mapping of
            one multicast IP address to one SAID, as well as
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 25]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            associated state, message counters, and error information.
 
            An entry may be removed from this table upon the reception
            of an SA Map Reject."
            INDEX     { ifIndex, docsBpi2CmIpMulticastIndex }
            ::= { docsBpi2CmIpMulticastMapTable 1 }
 
       DocsBpi2CmIpMulticastMapEntry ::= SEQUENCE {
            docsBpi2CmIpMulticastIndex               Unsigned32,
            docsBpi2CmIpMulticastAddressType         InetAddressType,
            docsBpi2CmIpMulticastAddress             InetAddress,
            docsBpi2CmIpMulticastSAId                DocsSAIdOrZero,
            docsBpi2CmIpMulticastSAMapState          INTEGER,
            docsBpi2CmIpMulticastSAMapRequests       Counter32,
            docsBpi2CmIpMulticastSAMapReplies        Counter32,
            docsBpi2CmIpMulticastSAMapRejects        Counter32,
            docsBpi2CmIpMulticastSAMapRejectErrorCode INTEGER,
            docsBpi2CmIpMulticastSAMapRejectErrorString SnmpAdminString
            }
 
       docsBpi2CmIpMulticastIndex         OBJECT-TYPE
            SYNTAX         Unsigned32 (1..4294967295)
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The index of this row."
            ::= { docsBpi2CmIpMulticastMapEntry 1 }
 
       docsBpi2CmIpMulticastAddressType   OBJECT-TYPE
            SYNTAX         InetAddressType
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The type of internet address for
            docsBpi2CmIpMulticastAddress."
            ::= { docsBpi2CmIpMulticastMapEntry 2 }
 
       docsBpi2CmIpMulticastAddress  OBJECT-TYPE
            SYNTAX         InetAddress
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "This object represents the IP multicast address
            to be mapped. The type of this address is determined by
            the value of the docsBpi2CmIpMulticastAddressType object."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 5.4."
            ::= { docsBpi2CmIpMulticastMapEntry 3 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 26]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CmIpMulticastSAId          OBJECT-TYPE
            SYNTAX         DocsSAIdOrZero
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "This object represents the SAID to which the IP
            multicast address has been mapped.  If no SA Map Reply has
            been received for the IP address, this object should have
            the value 0."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.12."
            ::= { docsBpi2CmIpMulticastMapEntry 4 }
 
       docsBpi2CmIpMulticastSAMapState         OBJECT-TYPE
            SYNTAX         INTEGER {
                                  start(1),
                                  mapWait(2),
                                  mapped(3)
 
                           }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the state of the SA
            Mapping FSM for this IP."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 5.3.1."
            ::= { docsBpi2CmIpMulticastMapEntry 5 }
 
       docsBpi2CmIpMulticastSAMapRequests OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CM has transmitted an SA Map Request message for this IP.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.10."
            ::= { docsBpi2CmIpMulticastMapEntry 6 }
 
       docsBpi2CmIpMulticastSAMapReplies  OBJECT-TYPE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 27]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CM has received an SA Map Reply message for this IP.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.11."
            ::= { docsBpi2CmIpMulticastMapEntry 7 }
 
       docsBpi2CmIpMulticastSAMapRejects  OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CM has received an SA MAP Reject message for this IP.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.12."
            ::= { docsBpi2CmIpMulticastMapEntry 8 }
 
       docsBpi2CmIpMulticastSAMapRejectErrorCode    OBJECT-TYPE
            SYNTAX         INTEGER {
                           none(1),
                           unknown(2),
                           noAuthForRequestedDSFlow(9),
                           dsFlowNotMappedToSA(10)
                           }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in the most recent SA Map
            Reject message sent in response to an SA Map Request for
            This IP.  It has the value none(1) if no SA MAP Reject
            message has been received since entry creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.12 and 4.2.2.15."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 28]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            ::= { docsBpi2CmIpMulticastMapEntry 9 }
 
       docsBpi2CmIpMulticastSAMapRejectErrorString  OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            the most recent SA Map Reject message sent in response to
            an SA Map Request for this IP.  It is a zero length string
            if no SA Map Reject message has been received since entry
            creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.12 and 4.2.2.6."
            ::= { docsBpi2CmIpMulticastMapEntry 10 }
 
 
       --
       -- CM Cert Objects
       --
 
       docsBpi2CmCertObjects OBJECT IDENTIFIER
            ::= { docsBpi2CmObjects 4 }
 
       --
       -- CM Device Cert Table
       --
 
       docsBpi2CmDeviceCertTable  OBJECT-TYPE
            SYNTAX                SEQUENCE OF DocsBpi2CmDeviceCertEntry
            MAX-ACCESS            not-accessible
            STATUS                current
            DESCRIPTION
                 "This table describes the Baseline Privacy Plus
            device certificates for each CM MAC interface."
            ::= { docsBpi2CmCertObjects 1 }
 
       docsBpi2CmDeviceCertEntry  OBJECT-TYPE
            SYNTAX              DocsBpi2CmDeviceCertEntry
            MAX-ACCESS          not-accessible
            STATUS              current
            DESCRIPTION
                 "Each entry contains the device certificates of
            one CM MAC interface.  An entry in this table exists for
            each ifEntry with an ifType of docsCableMaclayer(127)."
            INDEX               { ifIndex }
            ::= { docsBpi2CmDeviceCertTable 1 }
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 29]
 

                          DOCSIS BPI Plus MIB            November 2004
 
       DocsBpi2CmDeviceCertEntry ::= SEQUENCE {
            docsBpi2CmDeviceCmCert
                                  DocsX509ASN1DEREncodedCertificate,
            docsBpi2CmDeviceManufCert
                                  DocsX509ASN1DEREncodedCertificate
            }
 
       docsBpi2CmDeviceCmCert   OBJECT-TYPE
            SYNTAX        DocsX509ASN1DEREncodedCertificate
            MAX-ACCESS         read-write
            STATUS              current
            DESCRIPTION
                 "The X509 DER-encoded cable modem certificate.
            Note:  This object can be set only when the value is the
            zero-length OCTET STRING, otherwise an error
            'inconsistentValue' is returned.  Once the object
            contains  the certificate, its access MUST be read-only
            and persists after re-initialization of the
            managed system."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.1."
            ::= { docsBpi2CmDeviceCertEntry 1 }
 
       docsBpi2CmDeviceManufCert     OBJECT-TYPE
            SYNTAX         DocsX509ASN1DEREncodedCertificate
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The X509 DER-encoded manufacturer certificate which
            signed the cable modem certificate."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.1."
            ::= { docsBpi2CmDeviceCertEntry 2 }
 
 
       --
       -- CM Crypto Suite Table
       --
 
       docsBpi2CmCryptoSuiteTable    OBJECT-TYPE
            SYNTAX         SEQUENCE OF    DocsBpi2CmCryptoSuiteEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This table describes the Baseline Privacy Plus
            cryptographic suite capabilities for each CM MAC
            interface."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 30]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            ::= { docsBpi2CmObjects 5 }
 
       docsBpi2CmCryptoSuiteEntry    OBJECT-TYPE
            SYNTAX         DocsBpi2CmCryptoSuiteEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "Each entry contains a cryptographic suite pair
            which this CM MAC supports."
            INDEX     { ifIndex, docsBpi2CmCryptoSuiteIndex }
            ::= { docsBpi2CmCryptoSuiteTable 1 }
 
       DocsBpi2CmCryptoSuiteEntry ::= SEQUENCE {
            docsBpi2CmCryptoSuiteIndex              Unsigned32,
            docsBpi2CmCryptoSuiteDataEncryptAlg
                                        DocsBpkmDataEncryptAlg,
            docsBpi2CmCryptoSuiteDataAuthentAlg
                                        DocsBpkmDataAuthentAlg
            }
 
       docsBpi2CmCryptoSuiteIndex OBJECT-TYPE
            SYNTAX         Unsigned32 (1..1000)
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The index for a cryptographic suite row."
            ::= { docsBpi2CmCryptoSuiteEntry 1 }
 
       docsBpi2CmCryptoSuiteDataEncryptAlg     OBJECT-TYPE
            SYNTAX    DocsBpkmDataEncryptAlg
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data encryption
            algorithm for this cryptographic suite capability."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            ::= { docsBpi2CmCryptoSuiteEntry 2 }
 
       docsBpi2CmCryptoSuiteDataAuthentAlg     OBJECT-TYPE
            SYNTAX    DocsBpkmDataAuthentAlg
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data authentication
            algorithm for this cryptographic suite capability."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 31]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            Section 4.2.2.20."
            ::= { docsBpi2CmCryptoSuiteEntry 3 }
 
 
 
 
 
       -- Cable Modem Termination System Group
 
     docsBpi2CmtsObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 2 }
 
 
       --
       -- SPECIAL NOTE:  For the following CMTS tables, when a CM is
       -- running
       -- in BPI mode, replace SAID (Security Association ID)
       -- with SID (Service ID).  The CMTS is required to map SAIDs and
       -- SIDs to one contiguous space.
       --
 
 
       --
       -- The BPI+ base table for CMTSs, indexed by ifIndex
       --
 
       docsBpi2CmtsBaseTable    OBJECT-TYPE
            SYNTAX              SEQUENCE OF    DocsBpi2CmtsBaseEntry
            MAX-ACCESS          not-accessible
            STATUS              current
            DESCRIPTION
                 "This table describes the basic Baseline Privacy
            attributes of each CMTS MAC interface."
            ::= { docsBpi2CmtsObjects 1 }
 
       docsBpi2CmtsBaseEntry    OBJECT-TYPE
            SYNTAX              DocsBpi2CmtsBaseEntry
            MAX-ACCESS          not-accessible
            STATUS              current
            DESCRIPTION
                 "Each entry contains objects describing attributes of
            one CMTS MAC interface.  An entry in this table exists for
            each ifEntry with an ifType of docsCableMaclayer(127)."
            INDEX     { ifIndex }
            ::= { docsBpi2CmtsBaseTable 1 }
 
       DocsBpi2CmtsBaseEntry ::= SEQUENCE {
            docsBpi2CmtsDefaultAuthLifetime              Integer32,
            docsBpi2CmtsDefaultTEKLifetime               Integer32,
            docsBpi2CmtsDefaultSelfSignedManufCertTrust  INTEGER,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 32]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            docsBpi2CmtsCheckCertValidityPeriods         TruthValue,
            docsBpi2CmtsAuthentInfos                     Counter32,
            docsBpi2CmtsAuthRequests                     Counter32,
            docsBpi2CmtsAuthReplies                      Counter32,
            docsBpi2CmtsAuthRejects                      Counter32,
            docsBpi2CmtsAuthInvalids                     Counter32,
            docsBpi2CmtsSAMapRequests                    Counter32,
            docsBpi2CmtsSAMapReplies                     Counter32,
            docsBpi2CmtsSAMapRejects                     Counter32
            }
 
       docsBpi2CmtsDefaultAuthLifetime    OBJECT-TYPE
            SYNTAX         Integer32 (1..6048000)
            UNITS          "seconds"
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "The value of this object is the default lifetime, in
            seconds, the CMTS assigns to a new authorization key.
            This object value persist after re-initialization of the
            managed system."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.2."
            DEFVAL { 604800 }
            ::= { docsBpi2CmtsBaseEntry 1 }
 
       docsBpi2CmtsDefaultTEKLifetime     OBJECT-TYPE
            SYNTAX         Integer32 (1..604800)
            UNITS          "seconds"
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "The value of this object is the default lifetime, in
            seconds, the CMTS assigns to a new Traffic Encryption Key
            (TEK).
            This object value persist after re-initialization of the
            managed system."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Appendix A.2."
            DEFVAL { 43200 }
            ::= { docsBpi2CmtsBaseEntry 2 }
 
       docsBpi2CmtsDefaultSelfSignedManufCertTrust  OBJECT-TYPE
            SYNTAX    INTEGER {
                      trusted (1),
                      untrusted (2)
                      }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 33]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "This object determines the default trust of
            self-signed  manufacturer certificate entries, contained
            in docsBpi2CmtsCACertTable, created after setting this
            object.
            This object needs not to persist after re-initialization
             of the managed system."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.1"
            ::= { docsBpi2CmtsBaseEntry 3 }
 
       docsBpi2CmtsCheckCertValidityPeriods    OBJECT-TYPE
            SYNTAX         TruthValue
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "Setting this object to 'true' causes all chained and
            root certificates in the chain to have their validity
            periods checked against the current time of day, when
            the CMTS receives an Authorization Request from the
            CM.
            A 'false' setting causes all certificates in the chain
            not to have their validity periods checked against the
            current time of day.
            This object needs not to persist after re-initialization
             of the managed system."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.2"
            ::= { docsBpi2CmtsBaseEntry 4 }
 
       docsBpi2CmtsAuthentInfos OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has received an Authentication Information message
            from any CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.9."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 34]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            ::= { docsBpi2CmtsBaseEntry 5 }
 
       docsBpi2CmtsAuthRequests OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                    "The value of this object is the count of times the
            CMTS has received an Authorization Request message from any
            CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.1."
            ::= { docsBpi2CmtsBaseEntry 6 }
 
       docsBpi2CmtsAuthReplies  OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                   "The value of this object is the count of times the
            CMTS has transmitted an Authorization Reply message to any
            CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.2."
            ::= { docsBpi2CmtsBaseEntry 7 }
 
       docsBpi2CmtsAuthRejects  OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                    "The value of this object is the count of times the
            CMTS has transmitted an Authorization Reject message to any
            CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 35]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.3."
            ::= { docsBpi2CmtsBaseEntry 8 }
 
       docsBpi2CmtsAuthInvalids OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                     "The value of this object is the count of times
            the CMTS has transmitted an Authorization Invalid message
            to any CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.7."
            ::= { docsBpi2CmtsBaseEntry 9 }
 
       docsBpi2CmtsSAMapRequests     OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has received an SA Map Request message from any CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.10."
            ::= { docsBpi2CmtsBaseEntry 10 }
 
       docsBpi2CmtsSAMapReplies OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted an SA Map Reply message to any CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 36]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.11."
            ::= { docsBpi2CmtsBaseEntry 11 }
 
       docsBpi2CmtsSAMapRejects OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted an SA Map Reject message to any CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.12."
            ::= { docsBpi2CmtsBaseEntry 12 }
 
       --
       -- The CMTS Authorization Table, indexed by ifIndex and CM MAC
       -- address
       --
 
       docsBpi2CmtsAuthTable    OBJECT-TYPE
            SYNTAX         SEQUENCE OF    DocsBpi2CmtsAuthEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This table describes the attributes of each CM
            authorization association. The CMTS maintains one
            authorization association with each Baseline Privacy-
            enabled CM, registered on each CMTS MAC interface,
            regardless of whether the CM is authorized or rejected."
            ::= { docsBpi2CmtsObjects 2 }
 
       docsBpi2CmtsAuthEntry    OBJECT-TYPE
            SYNTAX              DocsBpi2CmtsAuthEntry
            MAX-ACCESS          not-accessible
            STATUS              current
            DESCRIPTION
                 "Each entry contains objects describing attributes of
            one authorization association. The CMTS MUST create one
            entry per CM per MAC interface, based on the receipt of an
            Authorization Request message, and MUST not delete the
            entry until the CM loses registration."
            INDEX     { ifIndex, docsBpi2CmtsAuthCmMacAddress }
            ::= { docsBpi2CmtsAuthTable 1 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 37]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       DocsBpi2CmtsAuthEntry ::= SEQUENCE {
            docsBpi2CmtsAuthCmMacAddress        MacAddress,
            docsBpi2CmtsAuthCmBpiVersion        INTEGER,
            docsBpi2CmtsAuthCmPublicKey         OCTET STRING,
            docsBpi2CmtsAuthCmKeySequenceNumber Integer32,
            docsBpi2CmtsAuthCmExpiresOld        DateAndTime,
            docsBpi2CmtsAuthCmExpiresNew        DateAndTime,
            docsBpi2CmtsAuthCmLifetime          Integer32,
            docsBpi2CmtsAuthCmReset             INTEGER,
            docsBpi2CmtsAuthCmInfos             Counter32,
            docsBpi2CmtsAuthCmRequests          Counter32,
            docsBpi2CmtsAuthCmReplies           Counter32,
            docsBpi2CmtsAuthCmRejects           Counter32,
            docsBpi2CmtsAuthCmInvalids          Counter32,
            docsBpi2CmtsAuthRejectErrorCode     INTEGER,
            docsBpi2CmtsAuthRejectErrorString   SnmpAdminString,
            docsBpi2CmtsAuthInvalidErrorCode    INTEGER,
            docsBpi2CmtsAuthInvalidErrorString  SnmpAdminString,
            docsBpi2CmtsAuthPrimarySAId         DocsSAIdOrZero,
            docsBpi2CmtsAuthBpkmCmCertValid     INTEGER,
            docsBpi2CmtsAuthBpkmCmCert
                                 DocsX509ASN1DEREncodedCertificate,
            docsBpi2CmtsAuthCACertIndexPtr      Unsigned32
            }
 
       docsBpi2CmtsAuthCmMacAddress  OBJECT-TYPE
            SYNTAX         MacAddress
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The value of this object is the physical address of
            the CM to which the authorization association applies."
            ::= { docsBpi2CmtsAuthEntry 1 }
 
       docsBpi2CmtsAuthCmBpiVersion  OBJECT-TYPE
            SYNTAX         INTEGER {
                             bpi (0),
                             bpiPlus (1)
                              }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the version of Baseline
            Privacy for which this CM has registered. The value
            'bpiplus' represents the value of BPI-Version Attribute of
            the Baseline Privacy Key Management BPKM attribute
            BPI-Version (1). The value 'bpi' is used to represent the
            CM registered using DOCSIS 1.0 Baseline Privacy."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 38]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification
            Section 4.2.2.22; ANSI/SCTE 22-2 2002(formerly DSS 02-03)
            Data-Over-Cable Service Interface Specification DOCSIS 1.0
            Baseline Privacy Interface (BPI)"
 
            ::= { docsBpi2CmtsAuthEntry 2 }
 
       docsBpi2CmtsAuthCmPublicKey   OBJECT-TYPE
            SYNTAX         OCTET STRING (SIZE (0..524))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is a DER-encoded
            RSAPublicKey ASN.1 type string, as defined in the RSA
            Encryption Standard (PKCS #1), corresponding to the
            public key of the CM.  This is the zero-length OCTET
            STRING if the CMTS does not retain the public key."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.4."
            ::= { docsBpi2CmtsAuthEntry 3 }
 
       docsBpi2CmtsAuthCmKeySequenceNumber     OBJECT-TYPE
            SYNTAX         Integer32 (0..15)
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the most recent
            authorization key sequence number for this CM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.2 and 4.2.2.10."
            ::= { docsBpi2CmtsAuthEntry 4 }
 
       docsBpi2CmtsAuthCmExpiresOld  OBJECT-TYPE
            SYNTAX         DateAndTime
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the actual clock time
            for expiration of the immediate predecessor of the most
            recent authorization key for this FSM. If this FSM has only
            one authorization key, then the value is the time of
            activation of this FSM.
            Note: This object has no meaning for CMs running in BPI
            mode, therefore this object is not instantiated for entries
            associated to those CMs."
            REFERENCE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 39]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.2 and 4.2.2.9."
            ::= { docsBpi2CmtsAuthEntry 5 }
 
       docsBpi2CmtsAuthCmExpiresNew  OBJECT-TYPE
            SYNTAX         DateAndTime
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                      "The value of this object is the actual clock
            time for expiration of the most recent authorization key
            for this FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.2 and 4.2.2.9."
            ::= { docsBpi2CmtsAuthEntry 6 }
 
       docsBpi2CmtsAuthCmLifetime    OBJECT-TYPE
            SYNTAX         Integer32 (1..6048000)
            UNITS          "seconds"
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "The value of this object is the lifetime, in seconds,
            the CMTS assigns to an authorization key for this CM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.2 and Appendix A.2."
            ::= { docsBpi2CmtsAuthEntry 7 }
 
       docsBpi2CmtsAuthCmReset  OBJECT-TYPE
            SYNTAX    INTEGER   {
                                noResetRequested(1),
                                invalidateAuth(2),
                                sendAuthInvalid(3),
                                invalidateTeks(4)
                                }
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "Setting this object to invalidateAuth(2) causes the
            CMTS to invalidate the current CM authorization key(s), but
            not to transmit an Authorization Invalid message nor to
            invalidate the primary SAID's TEKs.  Setting this object to
            sendAuthInvalid(3) causes the CMTS to invalidate the
            current CM authorization key(s), and to transmit an
            Authorization Invalid message to the CM, but not to
            invalidate the primary SAID's TEKs.  Setting this object to
            invalidateTeks(4) causes the CMTS to invalidate the current
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 40]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            CM authorization key(s), to transmit an Authorization
            Invalid message to the CM, and to invalidate the TEKs
            associated with this CM's primary SAID.
            For BPI mode, substitute all of the CM's unicast
            TEK(s) for the primary SAID's TEKs in the previous
            paragraph.
            Reading this object returns the most recently set
            value of this object, or returns noResetRequested(1) if the
            object has not been set since entry creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5."
            ::= { docsBpi2CmtsAuthEntry 8 }
 
       docsBpi2CmtsAuthCmInfos       OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has received an Authentication Information message
            from this CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.9."
            ::= { docsBpi2CmtsAuthEntry 9 }
 
       docsBpi2CmtsAuthCmRequests    OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has received an Authorization Request message from
            this CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.1."
            ::= { docsBpi2CmtsAuthEntry 10 }
 
       docsBpi2CmtsAuthCmReplies     OBJECT-TYPE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 41]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted an Authorization Reply message to this
            CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.2."
            ::= { docsBpi2CmtsAuthEntry 11 }
 
       docsBpi2CmtsAuthCmRejects     OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted an Authorization Reject message to
            this CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.3."
            ::= { docsBpi2CmtsAuthEntry 12 }
 
       docsBpi2CmtsAuthCmInvalids    OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted an Authorization Invalid message to
            this CM.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.7."
            ::= { docsBpi2CmtsAuthEntry 13 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 42]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CmtsAuthRejectErrorCode    OBJECT-TYPE
            SYNTAX         INTEGER {
                                   none(1),
                                   unknown(2),
                                   unauthorizedCm(3),
                                   unauthorizedSaid(4),
                                   permanentAuthorizationFailure(8),
                                   timeOfDayNotAcquired(11)
                                   }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in most recent Authorization
            Reject message transmitted to the CM.  This has value
            unknown(2) if the last Error-Code value was 0, and none(1)
            if no Authorization Reject message has been transmitted to
            the CM, since entry creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.3 and 4.2.2.15."
            ::= { docsBpi2CmtsAuthEntry 14 }
 
       docsBpi2CmtsAuthRejectErrorString  OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            most recent Authorization Reject message transmitted to the
            CM.  This is a zero length string if no Authorization
            Reject message has been transmitted to the CM, since entry
            creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.3 and 4.2.2.6."
            ::= { docsBpi2CmtsAuthEntry 15 }
 
       docsBpi2CmtsAuthInvalidErrorCode   OBJECT-TYPE
            SYNTAX         INTEGER {
                                   none(1),
                                   unknown(2),
                                   unauthorizedCm(3),
                                   unsolicited(5),
                                   invalidKeySequence(6),
                                   keyRequestAuthenticationFailure(7)
                                   }
            MAX-ACCESS     read-only
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 43]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in most recent Authorization
            Invalid message transmitted to the CM.  This has value
            unknown(2) if the last Error-Code value was 0, and none(1)
            if no Authorization Invalid message has been transmitted to
            the CM since entry creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.7 and 4.2.2.15."
            ::= { docsBpi2CmtsAuthEntry 16 }
 
       docsBpi2CmtsAuthInvalidErrorString OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            most recent Authorization Invalid message transmitted to
            the CM.  This is a zero length string if no Authorization
            Invalid message has been transmitted to the CM since entry
            creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.7 and 4.2.2.6."
            ::= { docsBpi2CmtsAuthEntry 17 }
 
       docsBpi2CmtsAuthPrimarySAId   OBJECT-TYPE
            SYNTAX         DocsSAIdOrZero
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the Primary Security
            Association identifier.  For BPI mode, the value must be
            any unicast SID."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 2.1.3."
            ::= { docsBpi2CmtsAuthEntry 18 }
 
       docsBpi2CmtsAuthBpkmCmCertValid         OBJECT-TYPE
            SYNTAX    INTEGER {
                              unknown (0),
                              validCmChained (1),
                              validCmTrusted (2),
                              invalidCmUntrusted (3),
                              invalidCAUntrusted (4),
                              invalidCmOther (5),
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 44]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                              invalidCAOther (6)
                              }
            MAX-ACCESS     read-only
            STATUS    current
            DESCRIPTION
                 "Contains the reason why a CM's certificate is deemed
            valid or invalid.
            Return unknown(0) if the CM is running BPI mode.
            ValidCmChained(1) means the certificate is valid
               because it chains to a valid certificate.
            ValidCmTrusted(2) means the certificate is valid
               because it has been provisioned (in the
               docsBpi2CmtsProvisionedCmCert table) to be trusted.
            InvalidCmUntrusted(3) means the certificate is invalid
                 because it has been provisioned (in the
                 docsBpi2CmtsProvisionedCmCert table) to be untrusted.
            InvalidCAUntrusted(4) means the certificate is invalid
                 because it chains to an untrusted certificate.
            InvalidCmOther(5) and InvalidCAOther(6) refer to
                 errors in parsing, validity periods, etc, which are
                 attributable to the CM certificate or its chain
                 respectively; additional information may be found
                 in docsBpi2AuthRejectErrorString for these types
                 of errors."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.2."
            ::= { docsBpi2CmtsAuthEntry 19 }
 
       docsBpi2CmtsAuthBpkmCmCert    OBJECT-TYPE
            SYNTAX         DocsX509ASN1DEREncodedCertificate
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The X509 CM Certificate sent as part of a BPKM
            Authorization Request.
            Note: The zero-length OCTET STRING must be returned if the
            Entire certificate is not retained in the CMTS."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.2."
            ::= { docsBpi2CmtsAuthEntry 20 }
 
       docsBpi2CmtsAuthCACertIndexPtr    OBJECT-TYPE
            SYNTAX         Unsigned32 (0..4294967295)
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "A row index into docsBpi2CmtsCACertTable.
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 45]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                  Returns the index in docsBpi2CmtsCACertTable which
                  CA certificate this CM is chained to.  A value of
                  0 means it could not be found or not applicable."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.2."
            ::= { docsBpi2CmtsAuthEntry 21 }
 
 
       --
       -- The CMTS TEK Table, indexed by ifIndex and SAID
       --
 
       docsBpi2CmtsTEKTable     OBJECT-TYPE
            SYNTAX         SEQUENCE OF    DocsBpi2CmtsTEKEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This table describes the attributes of each
            Traffic Encryption Key (TEK) association. The CMTS
            Maintains one TEK association per SAID on each CMTS MAC
            interface."
            ::= { docsBpi2CmtsObjects 3 }
 
       docsBpi2CmtsTEKEntry     OBJECT-TYPE
            SYNTAX         DocsBpi2CmtsTEKEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "Each entry contains objects describing attributes of
            one TEK association on a particular CMTS MAC interface. The
            CMTS MUST create one entry per SAID per MAC interface,
            based on the receipt of a Key Request message, and MUST not
            delete the entry before the CM authorization for the SAID
            permanently expires."
            INDEX     { ifIndex, docsBpi2CmtsTEKSAId }
            ::= { docsBpi2CmtsTEKTable 1 }
 
       DocsBpi2CmtsTEKEntry ::= SEQUENCE {
            docsBpi2CmtsTEKSAId                DocsSAId,
            docsBpi2CmtsTEKSAType              DocsBpkmSAType,
            docsBpi2CmtsTEKDataEncryptAlg      DocsBpkmDataEncryptAlg,
            docsBpi2CmtsTEKDataAuthentAlg      DocsBpkmDataAuthentAlg,
            docsBpi2CmtsTEKLifetime            Integer32,
            docsBpi2CmtsTEKKeySequenceNumber   Integer32,
            docsBpi2CmtsTEKExpiresOld          DateAndTime,
            docsBpi2CmtsTEKExpiresNew          DateAndTime,
            docsBpi2CmtsTEKReset               TruthValue,
            docsBpi2CmtsKeyRequests            Counter32,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 46]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            docsBpi2CmtsKeyReplies             Counter32,
            docsBpi2CmtsKeyRejects             Counter32,
            docsBpi2CmtsTEKInvalids            Counter32,
            docsBpi2CmtsKeyRejectErrorCode     INTEGER,
            docsBpi2CmtsKeyRejectErrorString   SnmpAdminString,
            docsBpi2CmtsTEKInvalidErrorCode    INTEGER,
            docsBpi2CmtsTEKInvalidErrorString  SnmpAdminString
       }
 
       docsBpi2CmtsTEKSAId OBJECT-TYPE
            SYNTAX         DocsSAId
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The value of this object is the DOCSIS Security
            Association ID (SAID)."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.12."
            ::= { docsBpi2CmtsTEKEntry 1 }
 
       docsBpi2CmtsTEKSAType    OBJECT-TYPE
            SYNTAX         DocsBpkmSAType
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the type of security
            association.  'dynamic' does not apply to CMs running in
            BPI mode.  Unicast BPI TEKs must utilize the 'primary'
            encoding and multicast BPI TEKs must utilize the 'static'
            encoding."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 2.1.3."
            ::= { docsBpi2CmtsTEKEntry 2 }
 
       docsBpi2CmtsTEKDataEncryptAlg OBJECT-TYPE
            SYNTAX    DocsBpkmDataEncryptAlg
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data encryption
            algorithm for this SAID."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            ::= { docsBpi2CmtsTEKEntry 3 }
 
       docsBpi2CmtsTEKDataAuthentAlg OBJECT-TYPE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 47]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            SYNTAX    DocsBpkmDataAuthentAlg
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data authentication
            algorithm for this SAID."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            ::= { docsBpi2CmtsTEKEntry 4 }
 
       docsBpi2CmtsTEKLifetime  OBJECT-TYPE
            SYNTAX         Integer32 (1..604800)
            UNITS          "seconds"
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "The value of this object is the lifetime, in
            seconds, the CMTS assigns to keys for this TEK
            association."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.5 and Appendix A.2."
            ::= { docsBpi2CmtsTEKEntry 5 }
 
 
       docsBpi2CmtsTEKKeySequenceNumber   OBJECT-TYPE
            SYNTAX              Integer32 (0..15)
            MAX-ACCESS          read-only
            STATUS              current
            DESCRIPTION
                 "The value of this object is the most recent TEK
            key sequence number for this SAID."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.2.10 and 4.2.2.13."
            ::= { docsBpi2CmtsTEKEntry 6 }
 
       docsBpi2CmtsTEKExpiresOld     OBJECT-TYPE
            SYNTAX         DateAndTime
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the actual clock time
            for expiration of the immediate predecessor of the most
            recent TEK for this FSM. If this FSM has only one TEK, then
            the value is the time of activation of this FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 48]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            Sections 4.2.1.5 and 4.2.2.9."
            ::= { docsBpi2CmtsTEKEntry 7 }
 
       docsBpi2CmtsTEKExpiresNew     OBJECT-TYPE
            SYNTAX         DateAndTime
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the actual clock time
            for expiration of the most recent TEK for this FSM."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.5 and 4.2.2.9."
            ::= { docsBpi2CmtsTEKEntry 8 }
 
       docsBpi2CmtsTEKReset     OBJECT-TYPE
            SYNTAX         TruthValue
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                 "Setting this object to 'true' causes the CMTS to
            invalidate all currently active TEK(s) and to generate new
            TEK(s) for the associated SAID; the CMTS MAY also generate
            unsolicited TEK Invalid message(s), to optimize the TEK
            synchronization between the CMTS and the CM(s). Reading
            this object always returns FALSE."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.1.3.3.5."
            ::= { docsBpi2CmtsTEKEntry 9 }
 
       docsBpi2CmtsKeyRequests  OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has received a Key Request message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.4."
            ::= { docsBpi2CmtsTEKEntry 10 }
 
       docsBpi2CmtsKeyReplies   OBJECT-TYPE
            SYNTAX         Counter32
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 49]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted a Key Reply message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.5."
            ::= { docsBpi2CmtsTEKEntry 11 }
 
       docsBpi2CmtsKeyRejects   OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted a Key Reject message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.6."
            ::= { docsBpi2CmtsTEKEntry 12 }
 
       docsBpi2CmtsTEKInvalids  OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted a TEK Invalid message.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.8."
            ::= { docsBpi2CmtsTEKEntry 13 }
 
       docsBpi2CmtsKeyRejectErrorCode     OBJECT-TYPE
            SYNTAX         INTEGER {
                                   none(1),
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 50]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                                   unknown(2),
                                   unauthorizedSaid(4)
                                   }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in the most recent Key Reject
            message sent in response to a Key Request for this SAID.
            This has value unknown(2) if the last Error-Code value
            was 0, and none(1) if no Key Reject message has been
            received since registration."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.6 and 4.2.2.15."
            ::= { docsBpi2CmtsTEKEntry 14 }
 
       docsBpi2CmtsKeyRejectErrorString   OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            the most recent Key Reject message sent in response to a
            Key Request for this SAID. This is a zero length string if
            no Key Reject message has been received since
            registration."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.6 and 4.2.2.6."
            ::= { docsBpi2CmtsTEKEntry 15 }
 
       docsBpi2CmtsTEKInvalidErrorCode    OBJECT-TYPE
            SYNTAX         INTEGER {
                                   none(1),
                                   unknown(2),
                                   invalidKeySequence(6)
                                   }
            MAX-ACCESS          read-only
            STATUS              current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in the most recent TEK
            Invalid message sent in association with this SAID.  This
            has value unknown(2) if the last Error-Code value was 0,
            and none(1) if no TEK Invalid message has been received
            since registration."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 51]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            Sections 4.2.1.8 and 4.2.2.15."
            ::= { docsBpi2CmtsTEKEntry 16 }
 
       docsBpi2CmtsTEKInvalidErrorString  OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            the most recent TEK Invalid message sent in association
            with this SAID.  This is a zero length string if no TEK
            Invalid message has been received since registration."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.8 and 4.2.2.6."
            ::= { docsBpi2CmtsTEKEntry 17 }
 
 
 
       --
       -- The CMTS Multicast Objects Group
       --
 
       docsBpi2CmtsMulticastObjects OBJECT IDENTIFIER
            ::= { docsBpi2CmtsObjects 4 }
 
       --
       -- The CMTS IP Multicast Mapping Table, indexed by
       -- docsBpi2CmtsIpMulticastIndex, and by ifIndex
       --
 
       docsBpi2CmtsIpMulticastMapTable         OBJECT-TYPE
            SYNTAX         SEQUENCE OF DocsBpi2CmtsIpMulticastMapEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This table maps multicast IP addresses to SAIDs.
            If a multicast IP address is mapped by multiple rows
            in the table, the row with the lowest
            docsBpi2CmtsIpMulticastIndex must be utilized for the
            mapping."
            ::= { docsBpi2CmtsMulticastObjects 1 }
 
       docsBpi2CmtsIpMulticastMapEntry         OBJECT-TYPE
            SYNTAX         DocsBpi2CmtsIpMulticastMapEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "Each entry contains objects describing the mapping of
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 52]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            a set of multicast IP address and mask to one SAID
            associated to a CMTS MAC Interface, as well as associated
            message
            counters and error information."
            INDEX     { ifIndex, docsBpi2CmtsIpMulticastIndex }
            ::= { docsBpi2CmtsIpMulticastMapTable 1 }
 
       DocsBpi2CmtsIpMulticastMapEntry ::= SEQUENCE {
            docsBpi2CmtsIpMulticastIndex            Unsigned32,
            docsBpi2CmtsIpMulticastAddressType      InetAddressType,
            docsBpi2CmtsIpMulticastAddress          InetAddress,
            docsBpi2CmtsIpMulticastMask             InetAddress,
            docsBpi2CmtsIpMulticastSAId             DocsSAIdOrZero,
            docsBpi2CmtsIpMulticastSAType           DocsBpkmSAType,
            docsBpi2CmtsIpMulticastDataEncryptAlg
                                            DocsBpkmDataEncryptAlg,
            docsBpi2CmtsIpMulticastDataAuthentAlg
                                            DocsBpkmDataAuthentAlg,
            docsBpi2CmtsIpMulticastSAMapRequests    Counter32,
            docsBpi2CmtsIpMulticastSAMapReplies     Counter32,
            docsBpi2CmtsIpMulticastSAMapRejects     Counter32,
            docsBpi2CmtsIpMulticastSAMapRejectErrorCode
                                                       INTEGER,
            docsBpi2CmtsIpMulticastSAMapRejectErrorString
                                                       SnmpAdminString,
            docsBpi2CmtsIpMulticastMapControl          RowStatus,
            docsBpi2CmtsIpMulticastMapStorageType      StorageType
            }
 
       docsBpi2CmtsIpMulticastIndex       OBJECT-TYPE
            SYNTAX         Unsigned32 (1..4294967295)
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The index of this row.
            Conceptual rows having the value 'permanent' need not allow
            write-access to any columnar objects in the row."
            ::= { docsBpi2CmtsIpMulticastMapEntry 1 }
 
       docsBpi2CmtsIpMulticastAddressType OBJECT-TYPE
            SYNTAX         InetAddressType
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "The type of internet address for
            docsBpi2CmtsIpMulticastAddress
            and docsBpi2CmtsIpMulticastMask."
            DEFVAL { ipv4 }
            ::= { docsBpi2CmtsIpMulticastMapEntry 2 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 53]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CmtsIpMulticastAddress          OBJECT-TYPE
            SYNTAX         InetAddress
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "This object represents the IP multicast address
            to be mapped, in conjunction with
            docsBpi2CmtsIpMulticastMask. The type of this address is
            determined by the value of the object
            docsBpi2CmtsIpMulticastAddressType."
            ::= { docsBpi2CmtsIpMulticastMapEntry 3 }
 
 
       docsBpi2CmtsIpMulticastMask        OBJECT-TYPE
            SYNTAX         InetAddress
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "This object represents the IP multicast address mask
            for this row.
            An IP multicast address matches this row if the logical
            AND of the address with docsBpi2CmtsIpMulticastMask is
            identical to the logical AND of
            docsBpi2CmtsIpMulticastAddr with
            docsBpi2CmtsIpMulticastMask. The type of this address is
            determined by the value of the object
            docsBpi2CmtsIpMulticastAddressType.
             Note: For IPv6 this object needs not to represent a
             contiguous netmask, e.g. to associate an SAID to a
             multicast group matching 'any' multicast scope. The TC
             InetAddressPrefixLength is not used because it only
             represents contiguous netmask."
             ::= { docsBpi2CmtsIpMulticastMapEntry 4 }
 
 
       docsBpi2CmtsIpMulticastSAId        OBJECT-TYPE
            SYNTAX         DocsSAIdOrZero
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "This object represents the multicast SAID to be
            used in this IP multicast address mapping entry."
            ::= { docsBpi2CmtsIpMulticastMapEntry 5 }
 
       docsBpi2CmtsIpMulticastSAType OBJECT-TYPE
            SYNTAX         DocsBpkmSAType
            MAX-ACCESS     read-create
            STATUS         current
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 54]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            DESCRIPTION
                 "The value of this object is the type of security
            association.  'dynamic' does not apply to CMs running in
            BPI mode.  Unicast BPI TEKs must utilize the 'primary'
            encoding and multicast BPI TEKs must utilize the 'static'
            encoding.  SNMP created entries set this object by default
            to 'static' if not set at row creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 2.1.3."
            ::= { docsBpi2CmtsIpMulticastMapEntry 6 }
 
       docsBpi2CmtsIpMulticastDataEncryptAlg   OBJECT-TYPE
            SYNTAX    DocsBpkmDataEncryptAlg
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data encryption
            algorithm for this IP."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            DEFVAL { des56CbcMode }
            ::= { docsBpi2CmtsIpMulticastMapEntry 7 }
 
       docsBpi2CmtsIpMulticastDataAuthentAlg   OBJECT-TYPE
            SYNTAX    DocsBpkmDataAuthentAlg
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "The value of this object is the data authentication
            algorithm for this IP."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.2.20."
            DEFVAL { none }
            ::= { docsBpi2CmtsIpMulticastMapEntry 8 }
 
       docsBpi2CmtsIpMulticastSAMapRequests    OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has received an SA Map Request message for this IP.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 55]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.10."
            ::= { docsBpi2CmtsIpMulticastMapEntry 9 }
 
       docsBpi2CmtsIpMulticastSAMapReplies     OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted an SA Map Reply message for this IP.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.11."
            ::= { docsBpi2CmtsIpMulticastMapEntry 10 }
 
       docsBpi2CmtsIpMulticastSAMapRejects     OBJECT-TYPE
            SYNTAX         Counter32
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the count of times the
            CMTS has transmitted an SA Map Reject message for this IP.
            Discontinuities in the value of this counter can occur at
            re-initialization of the management system, and at other
            times as indicated by the value of
            ifCounterDiscontinuityTime."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 4.2.1.12."
            ::= { docsBpi2CmtsIpMulticastMapEntry 11 }
 
       docsBpi2CmtsIpMulticastSAMapRejectErrorCode  OBJECT-TYPE
            SYNTAX         INTEGER {
                                   none(1),
                                   unknown(2),
                                   noAuthForRequestedDSFlow(9),
                                   dsFlowNotMappedToSA(10)
                                   }
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the enumerated
            description of the Error-Code in the most recent SA Map
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 56]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            Reject message sent in response to a SA Map Request for
            This IP.  It has value unknown(2) if the last Error-Code
            Value was 0, and none(1) if no SA MAP Reject message has
            been received since entry creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.12 and 4.2.2.15."
            ::= { docsBpi2CmtsIpMulticastMapEntry 12 }
 
       docsBpi2CmtsIpMulticastSAMapRejectErrorString     OBJECT-TYPE
            SYNTAX         SnmpAdminString (SIZE (0..128))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The value of this object is the text string in
            the most recent SA Map Reject message sent in response to
            an SA Map Request for this IP.  It is a zero length string
            if no SA Map Reject message has been received since entry
            creation."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Sections 4.2.1.12 and 4.2.2.6."
            ::= { docsBpi2CmtsIpMulticastMapEntry 13 }
 
       docsBpi2CmtsIpMulticastMapControl  OBJECT-TYPE
            SYNTAX         RowStatus
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "This object controls and reflects the IP multicast
            address mapping entry.  There is no restriction on the
            ability to change values in this row while the row is
            active.
            A created row can be set to active only after the
            Corresponding instances of docsBpi2CmtsIpMulticastAddress,
            docsBpi2CmtsIpMulticastMask, docsBpi2CmtsIpMulticastSAId
            and docsBpi2CmtsIpMulticastSAType have all been set."
            ::= { docsBpi2CmtsIpMulticastMapEntry 14 }
 
       docsBpi2CmtsIpMulticastMapStorageType     OBJECT-TYPE
            SYNTAX         StorageType
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The storage type for this conceptual row.
            Conceptual rows having the value 'permanent' need not allow
            write-access to any columnar objects in the row."
            ::= { docsBpi2CmtsIpMulticastMapEntry 15 }
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 57]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       --
       -- The CMTS Multicast SAID Authorization Table,
       -- indexed by ifIndex by
       -- multicast SAID by CM MAC address
       --
 
       docsBpi2CmtsMulticastAuthTable          OBJECT-TYPE
            SYNTAX         SEQUENCE OF DocsBpi2CmtsMulticastAuthEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This table describes the multicast SAID
            authorization for each CM on each CMTS MAC interface."
            ::= { docsBpi2CmtsMulticastObjects 2 }
 
       docsBpi2CmtsMulticastAuthEntry          OBJECT-TYPE
            SYNTAX         DocsBpi2CmtsMulticastAuthEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "Each entry contains objects describing the key
            authorization of one cable modem for one multicast SAID
            for one CMTS MAC interface.
            Row entries persist after re-initialization of
            the managed system."
            INDEX     { ifIndex, docsBpi2CmtsMulticastAuthSAId,
                   docsBpi2CmtsMulticastAuthCmMacAddress }
            ::= { docsBpi2CmtsMulticastAuthTable 1 }
 
       DocsBpi2CmtsMulticastAuthEntry ::= SEQUENCE
            {
            docsBpi2CmtsMulticastAuthSAId                DocsSAId,
            docsBpi2CmtsMulticastAuthCmMacAddress        MacAddress,
            docsBpi2CmtsMulticastAuthControl             RowStatus
            }
 
       docsBpi2CmtsMulticastAuthSAId OBJECT-TYPE
            SYNTAX         DocsSAId
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "This object represents the multicast SAID for
            authorization."
            ::= { docsBpi2CmtsMulticastAuthEntry 1 }
 
       docsBpi2CmtsMulticastAuthCmMacAddress   OBJECT-TYPE
            SYNTAX         MacAddress
            MAX-ACCESS     not-accessible
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 58]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            STATUS         current
            DESCRIPTION
                 "This object represents the MAC address of the CM
            to which the multicast SAID authorization applies."
            ::= { docsBpi2CmtsMulticastAuthEntry 2 }
 
       docsBpi2CmtsMulticastAuthControl   OBJECT-TYPE
            SYNTAX         RowStatus
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "The status of this conceptual row for the
            authorization of  multicast SAIDs to CMs. "
            ::= { docsBpi2CmtsMulticastAuthEntry 3 }
 
 
       --
       -- CMTS Cert Objects
       --
 
       docsBpi2CmtsCertObjects OBJECT IDENTIFIER
            ::= { docsBpi2CmtsObjects 5 }
 
       --
       -- CMTS Provisioned CM Cert Table
       --
 
       docsBpi2CmtsProvisionedCmCertTable OBJECT-TYPE
            SYNTAX         SEQUENCE OF
                            DocsBpi2CmtsProvisionedCmCertEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "A table of CM certificate trust entries provisioned
            to the CMTS.  The trust object for a certificate in this
            table has an overriding effect on the validity object of a
            certificate in the authorization table, as long as the
            entire contents of the two certificates are identical."
            ::= { docsBpi2CmtsCertObjects 1 }
 
       docsBpi2CmtsProvisionedCmCertEntry OBJECT-TYPE
            SYNTAX         DocsBpi2CmtsProvisionedCmCertEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "An entry in the CMTS's provisioned CM certificate
            table.  Row entries persist after re-initialization of
            the managed system."
            REFERENCE
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 59]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "Data-Over-Cable Service Interface Specifications:
            Operations Support System Interface Specification
            SP-OSSIv2.0-I05-040407, Section 6.2.14"
            INDEX { docsBpi2CmtsProvisionedCmCertMacAddress }
            ::= { docsBpi2CmtsProvisionedCmCertTable 1 }
 
       DocsBpi2CmtsProvisionedCmCertEntry ::= SEQUENCE
            {
            docsBpi2CmtsProvisionedCmCertMacAddress MacAddress,
            docsBpi2CmtsProvisionedCmCertTrust      INTEGER,
            docsBpi2CmtsProvisionedCmCertSource     INTEGER,
            docsBpi2CmtsProvisionedCmCertStatus     RowStatus,
            docsBpi2CmtsProvisionedCmCert
                                      DocsX509ASN1DEREncodedCertificate
            }
 
       docsBpi2CmtsProvisionedCmCertMacAddress OBJECT-TYPE
            SYNTAX         MacAddress
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The index of this row."
            ::= { docsBpi2CmtsProvisionedCmCertEntry 1 }
 
       docsBpi2CmtsProvisionedCmCertTrust      OBJECT-TYPE
            SYNTAX    INTEGER {
                              trusted(1),
                              untrusted(2)
                              }
            MAX-ACCESS     read-create
            STATUS    current
            DESCRIPTION
                 "Trust state for the provisioned CM certificate entry.
            Note: Setting this object need only override the validity
            of CM certificates sent in future authorization requests;
            instantaneous effect need not occur."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.1."
            DEFVAL { untrusted }
            ::= { docsBpi2CmtsProvisionedCmCertEntry 2 }
 
       docsBpi2CmtsProvisionedCmCertSource     OBJECT-TYPE
            SYNTAX    INTEGER {
                              snmp(1),
                              configurationFile(2),
                              externalDatabase(3),
                              other(4)
                              }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 60]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            MAX-ACCESS read-only
            STATUS  current
            DESCRIPTION
                 "This object indicates how the certificate reached the
            CMTS.  Other(4) means is originated from a source not
            identified above."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.1."
            ::= { docsBpi2CmtsProvisionedCmCertEntry 3 }
 
       docsBpi2CmtsProvisionedCmCertStatus OBJECT-TYPE
            SYNTAX  RowStatus
            MAX-ACCESS read-create
            STATUS  current
            DESCRIPTION
                 "The status of this conceptual row. Values in this row
            cannot be changed while the row is 'active'."
            ::= { docsBpi2CmtsProvisionedCmCertEntry 4 }
 
       docsBpi2CmtsProvisionedCmCert OBJECT-TYPE
            SYNTAX         DocsX509ASN1DEREncodedCertificate
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "An X509 DER-encoded Certificate Authority
            certificate.
            Note: The zero-length OCTET STRING must be returned, on
            reads, if the entire certificate is not retained in the
            CMTS."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.2."
            ::= { docsBpi2CmtsProvisionedCmCertEntry 5 }
 
 
       --
       -- CMTS CA Cert Table
       --
 
       docsBpi2CmtsCACertTable OBJECT-TYPE
            SYNTAX         SEQUENCE OF DocsBpi2CmtsCACertEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The table of known Certificate Authority certificates
            acquired by this device."
            ::= { docsBpi2CmtsCertObjects 2 }
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 61]
 

                          DOCSIS BPI Plus MIB            November 2004
 
       docsBpi2CmtsCACertEntry OBJECT-TYPE
            SYNTAX         DocsBpi2CmtsCACertEntry
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "A row in the Certificate Authority certificate
            table.  Row entries with trust status 'trusted',
            'untrusted', or 'root' persist after re-initialization
             of the managed system."
            REFERENCE
                 "Data-Over-Cable Service Interface Specifications:
            Operations Support System Interface Specification
            SP-OSSIv2.0-I05-040407, Section 6.2.14"
            INDEX   { docsBpi2CmtsCACertIndex }
            ::= {docsBpi2CmtsCACertTable 1 }
 
       DocsBpi2CmtsCACertEntry ::= SEQUENCE {
            docsBpi2CmtsCACertIndex            Unsigned32,
            docsBpi2CmtsCACertSubject          SnmpAdminString,
            docsBpi2CmtsCACertIssuer           SnmpAdminString,
            docsBpi2CmtsCACertSerialNumber     OCTET STRING,
            docsBpi2CmtsCACertTrust            INTEGER,
            docsBpi2CmtsCACertSource           INTEGER,
            docsBpi2CmtsCACertStatus           RowStatus,
            docsBpi2CmtsCACert
                                  DocsX509ASN1DEREncodedCertificate,
            docsBpi2CmtsCACertThumbprint       OCTET STRING
       }
 
       docsBpi2CmtsCACertIndex OBJECT-TYPE
            SYNTAX         Unsigned32 (1.. 4294967295)
            MAX-ACCESS     not-accessible
            STATUS         current
            DESCRIPTION
                 "The index for this row."
            ::= { docsBpi2CmtsCACertEntry 1 }
 
       docsBpi2CmtsCACertSubject OBJECT-TYPE
            SYNTAX         SnmpAdminString
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The subject name exactly as it is encoded in the
            X509 certificate.
            The organizationName portion of the certificate's subject
            name must be present.  All other fields are optional.  Any
            optional field present must be pre pended with <CR>
            (carriage return, U+000D) <LF> (line feed, U+000A).
            Ordering of fields present must conform to:
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 62]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
            organizationName <CR> <LF>
            countryName <CR> <LF>
            stateOrProvinceName <CR> <LF>
            localityName <CR> <LF>
            organizationalUnitName <CR> <LF>
            organizationalUnitName=<Manufacturing Location> <CR> <LF>
            commonName"
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.2.4"
            ::= { docsBpi2CmtsCACertEntry 2 }
 
       docsBpi2CmtsCACertIssuer OBJECT-TYPE
            SYNTAX         SnmpAdminString
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The issuer name exactly as it is encoded in the
            X509 certificate.
            The commonName portion of the certificate's issuer
            name must be present.  All other fields are optional.  Any
            optional field present must be pre pended with <CR>
            (carriage return, U+000D) <LF> (line feed, U+000A).
            Ordering of fields present must conform to:
 
            CommonName <CR><LF>
            countryName <CR><LF>
            stateOrProvinceName <CR><LF>
            localityName <CR><LF>
            organizationName <CR><LF>
            organizationalUnitName <CR><LF>
            organizationalUnitName=<Manufacturing Location>"
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.2.4"
            ::= { docsBpi2CmtsCACertEntry 3 }
 
       docsBpi2CmtsCACertSerialNumber OBJECT-TYPE
            SYNTAX         OCTET STRING (SIZE (1..32))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "This CA certificate's serial number represented as
            an octet string."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.2.2"
            ::= { docsBpi2CmtsCACertEntry 4 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 63]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CmtsCACertTrust OBJECT-TYPE
            SYNTAX    INTEGER {
                              trusted (1),
                              untrusted (2),
                              chained (3),
                              root (4)
                              }
            MAX-ACCESS     read-create
            STATUS    current
            DESCRIPTION
                 "This object controls the trust status of this
            certificate.  Root certificates must be given root(4)
            trust; manufacturer certificates must not be given root(4)
            trust.  Trust on root certificates must not change.
            Note: Setting this object need only affect the validity of
            CM certificates sent in future authorization requests;
            instantaneous effect need not occur."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.1"
            DEFVAL { chained }
            ::= { docsBpi2CmtsCACertEntry 5 }
 
       docsBpi2CmtsCACertSource OBJECT-TYPE
            SYNTAX    INTEGER {
                      snmp (1),
                      configurationFile (2),
                      externalDatabase (3),
                      other (4),
                      authentInfo (5),
                      compiledIntoCode (6)
                      }
            MAX-ACCESS     read-only
            STATUS    current
            DESCRIPTION
                 "This object indicates how the certificate reached
            the CMTS.  Other(4) means it originated from a source not
            identified above."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.1"
            ::= { docsBpi2CmtsCACertEntry 6 }
 
       docsBpi2CmtsCACertStatus OBJECT-TYPE
            SYNTAX         RowStatus
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 64]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 "The status of this conceptual row. An attempt
            to set writable columnar values while this row is active
            behaves as follows:
            - Sets to the object docsBpi2CmtsCACertTrust are allowed.
            - Sets to the object docsBpi2CmtsCACert will return an
              error inconsistentValue'.
            A newly create entry cannot be set to active until the
            value of docsBpi2CmtsCACert is being set."
            ::= { docsBpi2CmtsCACertEntry 7 }
 
       docsBpi2CmtsCACert  OBJECT-TYPE
            SYNTAX         DocsX509ASN1DEREncodedCertificate
            MAX-ACCESS     read-create
            STATUS         current
            DESCRIPTION
                 "An X509 DER-encoded Certificate Authority
            certificate.
            To help identify certificates, either this object or
            docsBpi2CmtsCACertThumbprint must be returned by a CMTS for
            self-signed CA certificates.
 
            Note: The zero-length OCTET STRING must be returned, on
            reads, if the entire certificate is not retained in the
            CMTS."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.2."
            ::= { docsBpi2CmtsCACertEntry 8 }
 
       docsBpi2CmtsCACertThumbprint OBJECT-TYPE
            SYNTAX         OCTET STRING (SIZE (20))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                 "The SHA-1 hash of a CA certificate.
            To help identify certificates, either this object or
            docsBpi2CmtsCACert must be returned by a CMTS for
            self-signed CA certificates.
 
            Note: The zero-length OCTET STRING must be returned, on
            reads, if the CA certificate thumb print is not retained
            in the CMTS."
            REFERENCE
                 "DOCSIS Baseline Privacy Plus Interface Specification,
            Section 9.4.3"
            ::= { docsBpi2CmtsCACertEntry 9 }
 
 
       --
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 65]
 

                          DOCSIS BPI Plus MIB            November 2004
 
       -- Authenticated Software Download Objects
       --
 
       --
       -- Note: the authenticated software download objects are a
       -- CM requirement only.
       --
 
       docsBpi2CodeDownloadControl OBJECT IDENTIFIER
            ::= { docsBpi2MIBObjects 4 }
 
       docsBpi2CodeDownloadStatusCode     OBJECT-TYPE
            SYNTAX    INTEGER {
                              configFileCvcVerified (1),
                              configFileCvcRejected (2),
                              snmpCvcVerified (3),
                              snmpCvcRejected (4),
                              codeFileVerified (5),
                              codeFileRejected (6),
                              other (7)
                              }
            MAX-ACCESS     read-only
            STATUS    current
            DESCRIPTION
                "The value indicates the result of the latest config
            file CVC verification, SNMP CVC verification, or code file
            verification."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.3.2 & D.3.5.1."
            ::= { docsBpi2CodeDownloadControl 1 }
 
       docsBpi2CodeDownloadStatusString   OBJECT-TYPE
            SYNTAX         SnmpAdminString
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                "The value of this object indicates the additional
            information to the status code.  The value will include
            the error code and error description which will be defined
            separately."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section TBD (see D.3.7)"
            ::= { docsBpi2CodeDownloadControl 2 }
 
       docsBpi2CodeMfgOrgName   OBJECT-TYPE
            SYNTAX         SnmpAdminString
            MAX-ACCESS     read-only
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 66]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            STATUS         current
            DESCRIPTION
                "The value of this object is the device manufacturer's
            organizationName."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.2.2."
            ::= { docsBpi2CodeDownloadControl 3 }
 
       docsBpi2CodeMfgCodeAccessStart     OBJECT-TYPE
            SYNTAX         DateAndTime  (SIZE(11))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                "The value of this object is the device manufacturer's
            current codeAccessStart value. This value always be
            referenced to Greenwich Mean Time (GMT) and the value
            format must contain TimeZone information (fields 8-10)."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.2.2."
            ::= { docsBpi2CodeDownloadControl 4 }
 
       docsBpi2CodeMfgCvcAccessStart OBJECT-TYPE
            SYNTAX         DateAndTime (SIZE(11))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                "The value of this object is the device manufacturer's
            current cvcAccessStart value. This value always be
            referenced to Greenwich Mean Time (GMT) and the value
            format must contain TimeZone information (fields 8-10)."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.2.2."
            ::= { docsBpi2CodeDownloadControl 5 }
 
       docsBpi2CodeCoSignerOrgName   OBJECT-TYPE
            SYNTAX         SnmpAdminString
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                "The value of this object is the Co-Signer's
            organizationName.  The value is a zero length string if
            the co-signer is not specified."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.2.2."
            ::= { docsBpi2CodeDownloadControl 6 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 67]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
       docsBpi2CodeCoSignerCodeAccessStart     OBJECT-TYPE
            SYNTAX         DateAndTime (SIZE(11))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                "The value of this object is the Co-Signer's current
            codeAccessStart value. This value always be referenced to
            Greenwich Mean Time (GMT) and the value format must contain
            TimeZone information (fields 8-10).
            If docsBpi2CodeCoSignerOrgName is a zero
            length string, the value of this object is meaningless."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.2.2."
            ::= { docsBpi2CodeDownloadControl 7 }
 
       docsBpi2CodeCoSignerCvcAccessStart OBJECT-TYPE
            SYNTAX         DateAndTime (SIZE(11))
            MAX-ACCESS     read-only
            STATUS         current
            DESCRIPTION
                "The value of this object is the Co-Signer's current
            cvcAccessStart value. This value always be referenced to
            Greenwich Mean Time (GMT) and the value format must contain
            TimeZone information (fields 8-10).
            If docsBpi2CodeCoSignerOrgName is a zero
            length string, the value of this object is meaningless."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.2.2."
            ::= { docsBpi2CodeDownloadControl 8 }
 
       docsBpi2CodeCvcUpdate    OBJECT-TYPE
            SYNTAX         DocsX509ASN1DEREncodedCertificate
            MAX-ACCESS     read-write
            STATUS         current
            DESCRIPTION
                "Setting a CVC to this object triggers the device
            to verify the CVC and update the cvcAccessStart values,
            then the content of this object is discarded..
            If the device is not enabled to upgrade codefiles, or
            the CVC verification fails, the CVC will be rejected.
            Reading this object always returns the zero-length OCTET
            STRING."
            REFERENCE
                "DOCSIS Baseline Privacy Plus Interface Specification,
            Section D.3.3.2.2."
            ::= { docsBpi2CodeDownloadControl 9 }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 68]
 

                          DOCSIS BPI Plus MIB            November 2004
 
 
 
 
       --
       -- The BPI+ MIB Conformance Statements (with a placeholder for
       -- notifications)
       --
 
       docsBpi2Notification     OBJECT IDENTIFIER
            ::= { docsBpi2MIB 0 }
       docsBpi2Conformance OBJECT IDENTIFIER
            ::= { docsBpi2MIB 2 }
       docsBpi2Compliances OBJECT IDENTIFIER
            ::= { docsBpi2Conformance 1 }
       docsBpi2Groups      OBJECT IDENTIFIER
            ::= { docsBpi2Conformance 2 }
 
 
       docsBpi2CmCompliance MODULE-COMPLIANCE
            STATUS         current
            DESCRIPTION
                 "This is the compliance statement for CMs which
            implement the DOCSIS Baseline Privacy Interface Plus."
 
            MODULE  -- docsBpi2MIB
 
            -- unconditionally mandatory group
            MANDATORY-GROUPS {
                   docsBpi2CmGroup,
                   docsBpi2CodeDownloadGroup
            }
 
 
       -- constrain on Encryption algorithms
       OBJECT docsBpi2CmTEKDataEncryptAlg
            SYNTAX    DocsBpkmDataEncryptAlg {
                                   none(0),
                                   des56CbcMode(1),
                                   des40CbcMode(2)
                      }
            DESCRIPTION
                 "It is compliant to support des56CbcMode(1) and
            des40CbcMode(2) for data encryption algorithms."
 
       -- constrain on Integrity algorithms
       OBJECT docsBpi2CmTEKDataAuthentAlg
            SYNTAX    DocsBpkmDataAuthentAlg {
                                   none(0)
                      }
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 69]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            DESCRIPTION
                 "It is compliant to not support data message
            authentication algorithms."
 
       -- constrain on IP addressing
       OBJECT    docsBpi2CmIpMulticastAddressType
            SYNTAX InetAddressType { ipv4(1) }
            DESCRIPTION
                 "An implementation is only required to support IPv4
            addresses. Other address types support may be defined in
            future versions of this MIB module."
 
       -- constrain on IP addressing
       OBJECT    docsBpi2CmIpMulticastAddress
            SYNTAX  InetAddress (SIZE(4))
            DESCRIPTION
                 "An implementation is only required to support IPv4
            addresses Other address types support may be defined in
            future versions of this MIB module."
 
       -- constrain on Encryption algorithms
       OBJECT docsBpi2CmCryptoSuiteDataEncryptAlg
            SYNTAX    DocsBpkmDataEncryptAlg {
                                   none(0),
                                   des56CbcMode(1),
                                   des40CbcMode(2)
                      }
            DESCRIPTION
                 "It is compliant to only support des56CbcMode(1)
            and des40CbcMode(2) for data encryption algorithms."
 
       -- constrain on Integrity algorithms
       OBJECT docsBpi2CmCryptoSuiteDataAuthentAlg
            SYNTAX    DocsBpkmDataAuthentAlg {
                                   none(0)
                      }
            DESCRIPTION
                 "It is compliant to not support data message
            authentication algorithms."
 
       ::= { docsBpi2Compliances 1 }
 
 
       docsBpi2CmtsCompliance MODULE-COMPLIANCE
            STATUS         current
            DESCRIPTION
                 "This is the compliance statement for CMTSs which
            implement the DOCSIS Baseline Privacy Interface Plus."
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 70]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            MODULE  -- docsBpi2MIB
            -- unconditionally mandatory group
            MANDATORY-GROUPS {
                   docsBpi2CmtsGroup
            }
 
 
       -- unconditionally optional group
       GROUP     docsBpi2CodeDownloadGroup
            DESCRIPTION
                 "This group is optional for CMTSs. The implementation
            decision of this group is left to the vendor"
 
 
 
       -- constrain on mandatory range
       OBJECT    docsBpi2CmtsDefaultAuthLifetime
            SYNTAX    Integer32 (86400..6048000)
            DESCRIPTION
                 "The refined range corresponds to the minimum and
            maximum values in operational networks."
 
       -- constrain on mandatory range
       OBJECT    docsBpi2CmtsDefaultTEKLifetime
            SYNTAX    Integer32 (1800..604800)
            DESCRIPTION
                "The refined range corresponds to the minimum and
            maximum values in operational networks."
 
       -- constrain on mandatory range
       OBJECT    docsBpi2CmtsAuthCmLifetime
            SYNTAX    Integer32 (86400..6048000)
            DESCRIPTION
                "The refined range corresponds to the minimum and
            maximum values in operational networks."
 
 
       -- constrain on Encryption algorithms
    OBJECT   docsBpi2CmtsTEKDataEncryptAlg
            SYNTAX    DocsBpkmDataEncryptAlg {
                                   none(0),
                                   des56CbcMode(1),
                                   des40CbcMode(2)
                      }
            DESCRIPTION
                 "It is compliant to only support des56CbcMode(1)
            and des40CbcMode(2) for data encryption."
 
       -- constrain on Integrity algorithms
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 71]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    OBJECT docsBpi2CmtsTEKDataAuthentAlg
            SYNTAX    DocsBpkmDataAuthentAlg {
                                   none(0)
                      }
            DESCRIPTION
                 "It is compliant to not support data message
            authentication algorithms."
 
       -- constrain on mandatory range
       OBJECT    docsBpi2CmtsTEKLifetime
            SYNTAX    Integer32 (1800..604800)
            DESCRIPTION
                "The refined range corresponds to the minimum and
            maximum values in operational networks."
 
       -- constrain on access
       -- constrain on IP Addressing
 
       OBJECT    docsBpi2CmtsIpMulticastAddressType
            SYNTAX      InetAddressType { ipv4(1) }
            MIN-ACCESS  read-only
            DESCRIPTION
                "Write access is not required.
            An implementation is only required to support IPv4
            addresses. Other address types support may be defined in
            future versions of this MIB module."
 
       OBJECT    docsBpi2CmtsIpMulticastAddress
            SYNTAX  InetAddress (SIZE(4))
            MIN-ACCESS  read-only
            DESCRIPTION
                "Write access is not required.
            An implementation is only required to support IPv4
            addresses. Other address types support may be defined in
            future versions of this MIB module."
 
       OBJECT    docsBpi2CmtsIpMulticastMask
            SYNTAX  InetAddress (SIZE(4))
            MIN-ACCESS  read-only
            DESCRIPTION
                "Write access is not required.
            An implementation is only required to support  IPv4
            addresses. Other address types support may be defined in
            future versions of this MIB module."
 
       -- constrain on access
 
       OBJECT    docsBpi2CmtsIpMulticastSAId
            MIN-ACCESS  read-only
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 72]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            DESCRIPTION
                "Write access is not required."
 
       OBJECT    docsBpi2CmtsIpMulticastSAType
            MIN-ACCESS  read-only
            DESCRIPTION
                "Write access is not required."
 
       -- constrain on access
       -- constrain on Encryption algorithms
 
       OBJECT    docsBpi2CmtsIpMulticastDataEncryptAlg
            SYNTAX    DocsBpkmDataEncryptAlg {
                                   none(0),
                                   des56CbcMode(1),
                                   des40CbcMode(2)
                      }
            MIN-ACCESS  read-only
            DESCRIPTION
                "Write access is not required.
            It is compliant to only support des56CbcMode(1)
            and des40CbcMode(2) for data encryption"
 
 
       -- constrain on access
       -- constrain on Integrity algorithms
       OBJECT    docsBpi2CmtsIpMulticastDataAuthentAlg
            SYNTAX    DocsBpkmDataAuthentAlg {
                                   none(0)
                      }
            MIN-ACCESS  read-only
            DESCRIPTION
                "Write access is not required.
            It is compliant to not support data message
            authentication algorithms."
 
       -- constrain on access
       OBJECT    docsBpi2CmtsMulticastAuthControl
            MIN-ACCESS  read-only
            DESCRIPTION
           "Write access is not required."
 
            ::= { docsBpi2Compliances 2 }
 
 
       docsBpi2CmGroup     OBJECT-GROUP
            OBJECTS   {
                 docsBpi2CmPrivacyEnable,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 73]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 docsBpi2CmPublicKey,
                 docsBpi2CmAuthState,
                 docsBpi2CmAuthKeySequenceNumber,
                 docsBpi2CmAuthExpiresOld,
                 docsBpi2CmAuthExpiresNew,
                 docsBpi2CmAuthReset,
                 docsBpi2CmAuthGraceTime,
                 docsBpi2CmTEKGraceTime,
                 docsBpi2CmAuthWaitTimeout,
                 docsBpi2CmReauthWaitTimeout,
                 docsBpi2CmOpWaitTimeout,
                 docsBpi2CmRekeyWaitTimeout,
                 docsBpi2CmAuthRejectWaitTimeout,
                 docsBpi2CmSAMapWaitTimeout,
                 docsBpi2CmSAMapMaxRetries,
                 docsBpi2CmAuthentInfos,
                 docsBpi2CmAuthRequests,
                 docsBpi2CmAuthReplies,
                 docsBpi2CmAuthRejects,
                 docsBpi2CmAuthInvalids,
                 docsBpi2CmAuthRejectErrorCode,
                 docsBpi2CmAuthRejectErrorString,
                 docsBpi2CmAuthInvalidErrorCode,
                 docsBpi2CmAuthInvalidErrorString,
                 docsBpi2CmTEKSAType,
                 docsBpi2CmTEKDataEncryptAlg,
                 docsBpi2CmTEKDataAuthentAlg,
                 docsBpi2CmTEKState,
                 docsBpi2CmTEKKeySequenceNumber,
                 docsBpi2CmTEKExpiresOld,
                 docsBpi2CmTEKExpiresNew,
                 docsBpi2CmTEKKeyRequests,
                 docsBpi2CmTEKKeyReplies,
                 docsBpi2CmTEKKeyRejects,
                 docsBpi2CmTEKInvalids,
                 docsBpi2CmTEKAuthPends,
                 docsBpi2CmTEKKeyRejectErrorCode,
                 docsBpi2CmTEKKeyRejectErrorString,
                 docsBpi2CmTEKInvalidErrorCode,
                 docsBpi2CmTEKInvalidErrorString,
                 docsBpi2CmIpMulticastAddressType,
                 docsBpi2CmIpMulticastAddress,
                 docsBpi2CmIpMulticastSAId,
                 docsBpi2CmIpMulticastSAMapState,
                 docsBpi2CmIpMulticastSAMapRequests,
                 docsBpi2CmIpMulticastSAMapReplies,
                 docsBpi2CmIpMulticastSAMapRejects,
                 docsBpi2CmIpMulticastSAMapRejectErrorCode,
                 docsBpi2CmIpMulticastSAMapRejectErrorString,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 74]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 docsBpi2CmDeviceCmCert,
                 docsBpi2CmDeviceManufCert,
                 docsBpi2CmCryptoSuiteDataEncryptAlg,
                 docsBpi2CmCryptoSuiteDataAuthentAlg
                 }
            STATUS         current
            DESCRIPTION
                 "This collection of objects provides CM BPI+ status
            and control."
       ::= { docsBpi2Groups 1 }
 
       docsBpi2CmtsGroup   OBJECT-GROUP
            OBJECTS {
                 docsBpi2CmtsDefaultAuthLifetime,
                 docsBpi2CmtsDefaultTEKLifetime,
                 docsBpi2CmtsDefaultSelfSignedManufCertTrust,
                 docsBpi2CmtsCheckCertValidityPeriods,
                 docsBpi2CmtsAuthentInfos,
                 docsBpi2CmtsAuthRequests,
                 docsBpi2CmtsAuthReplies,
                 docsBpi2CmtsAuthRejects,
                 docsBpi2CmtsAuthInvalids,
                 docsBpi2CmtsSAMapRequests,
                 docsBpi2CmtsSAMapReplies,
                 docsBpi2CmtsSAMapRejects,
                 docsBpi2CmtsAuthCmBpiVersion,
                 docsBpi2CmtsAuthCmPublicKey,
                 docsBpi2CmtsAuthCmKeySequenceNumber,
                 docsBpi2CmtsAuthCmExpiresOld,
                 docsBpi2CmtsAuthCmExpiresNew,
                 docsBpi2CmtsAuthCmLifetime,
                 docsBpi2CmtsAuthCmReset,
                 docsBpi2CmtsAuthCmInfos,
                 docsBpi2CmtsAuthCmRequests,
                 docsBpi2CmtsAuthCmReplies,
                 docsBpi2CmtsAuthCmRejects,
                 docsBpi2CmtsAuthCmInvalids,
                 docsBpi2CmtsAuthRejectErrorCode,
                 docsBpi2CmtsAuthRejectErrorString,
                 docsBpi2CmtsAuthInvalidErrorCode,
                 docsBpi2CmtsAuthInvalidErrorString,
                 docsBpi2CmtsAuthPrimarySAId,
                 docsBpi2CmtsAuthBpkmCmCertValid,
                 docsBpi2CmtsAuthBpkmCmCert,
                 docsBpi2CmtsAuthCACertIndexPtr,
                 docsBpi2CmtsTEKSAType,
                 docsBpi2CmtsTEKDataEncryptAlg,
                 docsBpi2CmtsTEKDataAuthentAlg,
                 docsBpi2CmtsTEKLifetime,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 75]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 docsBpi2CmtsTEKKeySequenceNumber,
                 docsBpi2CmtsTEKExpiresOld,
                 docsBpi2CmtsTEKExpiresNew,
                 docsBpi2CmtsTEKReset,
                 docsBpi2CmtsKeyRequests,
                 docsBpi2CmtsKeyReplies,
                 docsBpi2CmtsKeyRejects,
                 docsBpi2CmtsTEKInvalids,
                 docsBpi2CmtsKeyRejectErrorCode,
                 docsBpi2CmtsKeyRejectErrorString,
                 docsBpi2CmtsTEKInvalidErrorCode,
                 docsBpi2CmtsTEKInvalidErrorString,
                 docsBpi2CmtsIpMulticastAddressType,
                 docsBpi2CmtsIpMulticastAddress,
                 docsBpi2CmtsIpMulticastMask,
                 docsBpi2CmtsIpMulticastSAId,
                 docsBpi2CmtsIpMulticastSAType,
                 docsBpi2CmtsIpMulticastDataEncryptAlg,
                 docsBpi2CmtsIpMulticastDataAuthentAlg,
                 docsBpi2CmtsIpMulticastSAMapRequests,
                 docsBpi2CmtsIpMulticastSAMapReplies,
                 docsBpi2CmtsIpMulticastSAMapRejects,
                 docsBpi2CmtsIpMulticastSAMapRejectErrorCode,
                 docsBpi2CmtsIpMulticastSAMapRejectErrorString,
                 docsBpi2CmtsIpMulticastMapControl,
                 docsBpi2CmtsIpMulticastMapStorageType,
                 docsBpi2CmtsMulticastAuthControl,
                 docsBpi2CmtsProvisionedCmCertTrust,
                 docsBpi2CmtsProvisionedCmCertSource,
                 docsBpi2CmtsProvisionedCmCertStatus,
                 docsBpi2CmtsProvisionedCmCert,
                 docsBpi2CmtsCACertSubject,
                 docsBpi2CmtsCACertIssuer,
                 docsBpi2CmtsCACertSerialNumber,
                 docsBpi2CmtsCACertTrust,
                 docsBpi2CmtsCACertSource,
                 docsBpi2CmtsCACertStatus,
                 docsBpi2CmtsCACert,
                 docsBpi2CmtsCACertThumbprint
                 }
            STATUS         current
            DESCRIPTION
                 "This collection of objects provides CMTS BPI+ status
            and control."
       ::= { docsBpi2Groups 2 }
 
       docsBpi2CodeDownloadGroup OBJECT-GROUP
               OBJECTS {
                 docsBpi2CodeDownloadStatusCode,
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 76]
 

                          DOCSIS BPI Plus MIB            November 2004
 
                 docsBpi2CodeDownloadStatusString,
                 docsBpi2CodeMfgOrgName,
                 docsBpi2CodeMfgCodeAccessStart,
                 docsBpi2CodeMfgCvcAccessStart,
                 docsBpi2CodeCoSignerOrgName,
                 docsBpi2CodeCoSignerCodeAccessStart,
                 docsBpi2CodeCoSignerCvcAccessStart,
                 docsBpi2CodeCvcUpdate
                 }
            STATUS         current
            DESCRIPTION
                 "This collection of objects provide authenticated
            software
            download support."
       ::= { docsBpi2Groups 3 }
 
 
       END
 
 
 
 4. Acknowledgments
 
       Kaz Ozawa - Authenticated Software Download objects and
                   general suggestions
       Rich Woundy - BPI MIB and general MIB expertise
       Mike St Johns - BPI MIB and 1st draft of BPI+ MIB
       Bert Wijnen - Extensive comments in MIB syntax and accuracy
       Thanks to Mike Sabin and Manson Wong for reviewing early BPI+
       MIB Drafts and to Jean-Francois Mule for contributing to the
       last versions.
 
 
 
 5. Normative References
 
 
    [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.
 
    [RFC2578] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M. and S. Waldbusser, "Structure of Management
              Information Version 2 (SMIv2)", STD 58, RFC 2578, April
              1999.
 
    [RFC2579] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M. and S. Waldbusser, "Textual Conventions for
              SMIv2", STD 58, RFC 2579, April 1999.
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 77]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    [RFC2580] McCloghrie, K., Perkins, D., Schoenwaelder, J., Case, J.,
              Rose, M. and S. Waldbusser, "Conformance Statements for
              SMIv2", RFC 2580, STD 58, April 1999.
 
    [RFC3411] Harrington, D., Presuhn, R. and B. Wijnen, "An
              Architecture for Describing Simple Network Management
              Protocol (SNMP) Management Frameworks", STD 62, RFC 3411,
              December 2002.
 
 
    [RFC2021] Waldbusser, S "Remote Network Monitoring Management
              Information Base Version 2 using SMIv2", RFC 2021,
              January 1997.
 
        ************************************************************
        * NOTES TO RFC Editor (to be removed prior to publication) *
        *                                                          *
        *     The I-D <draft-ietf-rmonmib-rmon2-v2-00.txt> (or a   *
        * successor) is expected to eventually replace RFC 2021    *
        * If that draft (or a successor) is published as a RFC     *
        * prior to or concurrently with this document, then the    *
        * normative reference [RFC2021] should be updated to       *
        * point to the replacement RFC.                            *
        *                                                          *
        ************************************************************
 
    [RFC3291] Daniele, M., Haberman, B., Routhier, S., Schoenwaelder,
              J., "Textual Conventions for Internet Network Addresses",
              RFC 3291, May 2002.
 
        ************************************************************
        * NOTES TO RFC Editor (to be removed prior to publication) *
        *                                                          *
        * 1.) The I-D <draft-ietf-ops-rfc3291bis-05.txt> (or a     *
        * successor) is expected to eventually replace RFC 3291.   *
        * If that draft (or a successor) is published as an RFC    *
        * prior to or concurrently with this document, then the    *
        * normative reference [RFC3291] should be updated to       *
        * point to the replacement RFC, and the reference tag      *
        * [RFC3291] should be updated to match.                    *
        *                                                          *
        ************************************************************
 
 
    [RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
              MIB", RFC 2863, June 2000.
 
    [RFC2670] St. Johns, M., "Radio Frequency (RF) Interface Management
              Information Base for MCNS/DOCSIS compliant RF
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 78]
 

                          DOCSIS BPI Plus MIB            November 2004
 
              interfaces", RFC 2670, August 1999.
 
     [1] "Data-Over-Cable Service Interface Specifications: Baseline
         Privacy Plus Interface Specification SP-BPI+-I11-040407",
         DOCSIS, April 2004, available at
         http://www.cablemodem.com.
         http://www.cablelabs.com/specifications/archives.
 
 
 6. Informative References
 
    [RFC3083]  Woundy, R., "Baseline Privacy Interface Management
               Information Base for DOCSIS Compliant Cable Modems and
               Cable Modem Termination Systems", RFC 3083, March 2001.
 
    [RFC3410]  Case, J., Mundy, R., Partain, D. and B. Stewart,
               "Introduction and Applicability Statements for
               Internet-Standard Management Framework", RFC 3410,
               December 2002.
 
    [RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6
              (IPv6) Addressing Architecture", RFC 3513, April 2003.
 
    [IANA]    "Protocol Numbers and Assignment Services", IANA,
              http://www.iana.org/assignments/ianaiftype-mib.
 
    [2] "Data-Over-Cable Service Interface Specifications: DOCSIS 1.0
         Baseline Privacy Interface (BPI) ANSI/SCTE 22-2 2202,
         Available at http://www.scte.org.
 
    [3] "Data-Over-Cable Service Interface Specifications: Operations
         Support System Interface Specification
         SP-OSSIv1.1-I07-030730", DOCSIS 1.1 July 2003, available at
          http://www.cablemodem.com.
         http://www.cablelabs.com/specifications/archives.
 
 
    [4] " Data-Over-Cable Service Interface Specifications: Operations
          Support System Interface Specification
          SP-OSSIv2.0-I05-040407", DOCSIS 2.0 April 2004,
          http://www.cablemodem.com.
          http://www.cablelabs.com/specifications/archives.
 
 
 
 7. Security Considerations
 
    There are a number of management objects defined in this MIB
    module with a MAX-ACCESS clause of read-write and/or read-create.
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 79]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    Such objects may be considered sensitive or vulnerable in some
    network environments.  The support for SET operations in a non-
    secure environment without proper protection can have a negative
    effect on network operations.  These are the tables and objects
    and their sensitivity/vulnerability:
 
    - The following objects, if SNMP SET maliciously could constitute
    a denial  of service, theft of service attacks or compromise the
    intended data privacy of users:
 
       Objects related to the Baseline Privacy Key Management (BPKM)
 
           docsBpi2CmAuthReset,
           docsBpi2CmtsAuthCmReset,
           docsBpi2CmtsTEKReset:
               These objects are used for initiating a re-key process.
               A malicious massive SET attack may cause CMTS
               processing overload and may compromise the service.
 
           docsBpi2CmtsDefaultAuthLifetime,
           docsBpi2CmtsDefaultTEKLifetime,
           docsBpi2CmtsAuthCmLifetime,
           docsBpi2CmtsTEKLifetime:
               Implementers are encouraged to follow these objects
               range constrains defined in docsBpi2CmtsCompliance
               MODULE-COMPLIANCE clause for operational deployments
               to minimize the risk of malicious or unintended short
               periods of time for keys updates that may lead into
               degradation or denial of service.
 
           docsBpi2CmtsDefaultSelfSignedManufCertTrust:
               A malicious SET in a self-signed certificate as
               'untrusted' may cause CM to receive an authorization
               reject message which may constitute denial of
               service. This object is designed for testing purposes,
               Therefore is not RECOMMENDED to be used for commercial
               Deployments [1].  Administrators can make usage of
               View-based Access Control (VACM) introduced in section
               7.9 of [RFC3410] to restrict write access to this object.
 
           docsBpi2CmtsCheckCertValidityPeriods:
               A malicious SET in this object enabling the period
               validity plus a wrong clock time in the CMTS, could
               cause denial of service as CM authorization requests
               will be rejected.
 
           For more details in the validation of CM certificates,
           refer to section 9 of [1].
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 80]
 

                          DOCSIS BPI Plus MIB            November 2004
 
       Objects related to the CM only:
 
           Objects in docsBpi2CmDeviceCertTable
           docsBpi2CmDeviceCmCert:
               This object is not harmful considering that a CM
               received a Certificate during the manufacturing process.
               Therefore the object access becomes read-only. See
               the object DESCRIPTION clause in section 3 for details.
 
         Objects for Secure Software Download in table
         docsBpi2CodeDownloadControl:
 
         docsBpi2CodeCvcUpdate:
               A malicious SET on this object may not constitute a risk
               since the CM holds the DOCSIS root key to verified the
               CVC authenticity. Operator if configured, could receive a
               notification for those events occurrences that may lead
               to detect the source of the attack.  Moreover, [1]
               recommends that CMs CVC are regularly updated to minimize
               the risk of potential code-signing keys being (e.g. by
               configuration file)
 
       Objects related to the CMTS only:
 
           Objects in docsBpi2CmtsProvisionedCmCertTable and
           docsBpi2CmtsCACertTable  containing CM Certificates and
           Certificate Authority information respectively:
 
           docsBpi2CmtsProvisionedCmCertTrust,
           docsBpi2CmtsProvisionedCmCertStatus,
           docsBpi2CmtsProvisionedCmCert,
           docsBpi2CmtsCACertStatus,
           docsBpi2CmtsCACert:
               Malicious SET on these objects may constitute a denial
               of service attack that will be experienced after the CMs
               perform authorization requests. It does not affect
               CMs in the authorized state.
 
           Objects in multicast tables docsBpi2CmtsIpMulticastMapTable
           and docsBpi2CmtsMulticastAuthTable:
 
           docsBpi2CmtsIpMulticastAddressType,
           docsBpi2CmtsIpMulticastAddress,
           docsBpi2CmtsIpMulticastMaskType,
           docsBpi2CmtsIpMulticastMask,
           docsBpi2CmtsIpMulticastSAId,
           docsBpi2CmtsIpMulticastSAType:
               Malicious SET on these objects may cause
               mis-configuration causing interruption of the users
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 81]
 

                          DOCSIS BPI Plus MIB            November 2004
 
               active multicast applications.
 
           docsBpi2CmtsIpMulticastDataEncryptAlg,
           docsBpi2CmtsIpMulticastDataAuthentAlg:
               Malicious SETs on these objects may create service mis-
               configuration causing service interruption or theft of
               service if encryption algorithms are removed for the
               multicast groups.
 
           docsBpi2CmtsIpMulticastMapControl,
           docsBpi2CmtsMulticastAuthControl:
               Malicious SETs on these objects may remove and/or
               disable customers and/or multicast groups causing
               service disruption. Also may constitute theft of service
               by authorizing non subscribed user to multicast groups
               or by adding other multicast groups in the forward path.
 
 
    Some of the readable objects in this MIB module (i.e., objects
    with a MAX-ACCESS other than not-accessible) may be considered
    sensitive or vulnerable in some network environments.  It is thus
    important to control even GET and/or NOTIFY access to these
    objects and possibly to even encrypt the values of these objects
    when sending them over the network via SNMP.  These are the tables
    and objects and their sensitivity/vulnerability:
 
         Objects in docsBpi2CmBaseTable, docsBpi2CmTEKTable,
         docsBpi2CmtsBaseTable, docsBpi2CmtsAuthTable,
         docsBpi2CmtsTEKTable, docsBpi2CmtsProvisionedCmCertTable and
         docsBpi2CmtsCACertTable
           If accessible, attackers may use this information to
           discriminate users configured to work without data
           encryption (e.g. docsBpi2CmPrivacyEnable) and to know
           current Baseline Privacy parameters in the network.
 
         Objects in docsBpi2CmIpMulticastMapTable and
         docsBpi2CmtsMulticastAuthTable
           In addition to the vulnerabilities around BPI plus
           multicast objects described in a previous apart, the
           read-only objects of this table may help attackers to
           monitor the status of the intrusion
 
         Objects in docsBpi2CodeDownloadControl
           In addition to the vulnerability of the read-write object
           docsBpi2CodeCvcUpdate, Attackers may be able to monitor the
           status of a denial of service using Secure Software
           Download.
 
    SNMP versions prior to SNMPv3 did not include adequate security.
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 82]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    Even if the network itself is secure (for example by using IPSec),
    even then, there is no control as to who on the secure network is
    allowed to access and GET/SET (read/change/create/delete) the
    objects in this MIB module.
 
    It is RECOMMENDED that implementers consider the security features
    as provided by the SNMPv3 framework (see [RFC3410], section 8),
    including full support for the SNMPv3 cryptographic mechanisms
    (for authentication and privacy).
 
    Further, deployment of SNMP versions prior to SNMPv3 is NOT
    RECOMMENDED.  Instead, it is RECOMMENDED to deploy SNMPv3 and to
    enable cryptographic security.  It is then a customer/operator
    responsibility to ensure that the SNMP entity giving access to an
    instance of this MIB module is properly configured to give access
    to the objects only to those principals (users) that have
    legitimate rights to indeed GET or SET (change/create/delete)
    them.
 
    BPI+ Encryption Algorithms:
    BPI+ Traffic Encryption Keys TEK (see [1]) uses DES
    (Data Encryption Standard) 56 or 40 bits encryption ciphers.
    Due DES cryptographic strength weakness, future revisions of BPI+
    specification [1] should introduce advanced encryption algorithms
    to overcome the progress in cheaper and faster decryption tools.
    Traffic Encryption Keys (TEK) are configured per CM and per BPI+
    multicast group which may reduce the threat of the DES weakness for
    the overall system. The time to crack DES could be additionally
    mitigated by a compromised value for the TEK lifetime and Grace Time
    (up to a minimum of 30 minutes for the TEK lifetime, see
    Appendix A [1]).
    Not exempt of the same recommendations as above, The CM BPI+
    Authorization protocol uses triple DES encryption,
    which offers improved robustness compared to DES for CM
    Authorization and TEK re-key management.
 
 
 
 8. IANA Considerations
    The MIB module in this document uses the following IANA-assigned
    OBJECT IDENTIFIER values recorded in the SMI Numbers registry:
 
    Descriptor     OBJECT IDENTIFIER Value
    ----------     -----------------------
    docsBpi2MIB    { mib-2 yy }
 
 
    Editor's Note (to be removed prior to publication): the IANA is
    requested to assign a value for yy under the mib-2 subtree and
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 83]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    to record the assignment in the SMI Numbers registry.  When the
    assignment has been made, the RFC Editor is asked to replace yy
    (here and in the MIB module) with the assigned value and to remove
    this note.
 
 
 
 9. Authors' Addresses
 
            Stuart M. Green
            ADC Telecommunications, Inc.
            Mailstop 1641
            8 Technology Drive
            Westborough, MA  01581
            U.S.A.
            Phone: +1 508 870 2554
            Email: stuart.green@adc.com
 
            Kaz Ozawa
            Cable Modem & Network Dept.
            Server & Network Div.
            TOSHIBA CORPORATION Digital Media Network Company
            1-1, Shibaura 1-Chome,
            Minato-ku, Tokyo 105-8001
            Japan
            Phone: +81-3-3457-2726
            Email: Kazuyoshi.Ozawa@toshiba.co.jp
 
            Alexander Katsnelson
            Cable Television Laboratories, Inc.
            858 Coal Creek Circle
            Louisville, CO 80027- 9750
            U.S.A.
            Phone: +1 303 661 9100
            E-mail: a.katsnelson@cablelabs.com
 
            Eduardo Cardona
            Cable Television Laboratories, Inc.
            858 Coal Creek Circle
            Louisville, CO 80027- 9750
            U.S.A.
            Phone: +1 303 661 9100
            E-mail: e.cardona@cablelabs.com
 
 10. Disclaimer of Validity
 
    This document and the information contained herein are provided
    on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
    REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 84]
 

                          DOCSIS BPI Plus MIB            November 2004
 
    THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES,
    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
    THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR
    ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A
    PARTICULAR PURPOSE.
 
 
 11. Intellectual Property
 
    The IETF takes no position regarding the validity or scope of
    Any Intellectual Property Rights or other rights that might be
    Claimed to pertain to the implementation or use of the technology
    described in this document or the extent to which any license
    under such rights might or might not be available; nor does it
    represent that it has made any independent effort to identify any
    such rights.  Information on the procedures with respect to rights
    in RFC documents can be found in BCP 78 and BCP 79.
 
    Copies of IPR disclosures made to the IETF Secretariat and any
    assurances of licenses to be made available, or the result of an
    attempt made to obtain a general license or permission for the use
    of such proprietary rights by implementers or users of this
    specification can be obtained from the IETF on-line IPR repository
    at http://www.ietf.org/ipr.
 
    The IETF invites any interested party to bring to its attention
    any copyrights, patents or patent applications, or other
    proprietary rights that may cover technology that may be required
    to implement this standard.  Please address the information to the
    IETF at ietf-ipr@ietf.org.
 
 
 
 12. Copyright Statement
 
    Copyright (C) The Internet Society (2004).  This document is
    subject to the rights, licenses and restrictions contained in BCP
    78, and except as set forth therein, the authors retain all their
    rights.
 
    Acknowledgment
    Funding for the RFC Editor function is currently provided by the
    Internet Society.
 
 
        -- Note to RFC editor:
            -- delete text below between the start delete and stop
            -- delete marks when publishing the RFC
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 85]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            -- [start delete]
 
 
                            drafts Revision History
            REVISION "200409070000Z"
            DESCRIPTION
            Reverted Counters to Counter32 instead of a mix of Counter32
            and ZeroBasedCounter32.
            Used generic MIB sentence for row entries with 'permanent'
            StorageType objects
            Updated text for non-contiguous netmask."
            REVISION "200408020000Z"
            DESCRIPTION
            "Details and explanation of selection of non-contiguous
            netmask instead of InetAddressPrefixLength syntax
            for docsBpi2CmtsIpMulticastMapTable: sections 2.1.2 and
            object docsBpi2CmtsIpMulticastMask
            Added section 2.3 'BPI+ MIB module relationship with The
            Interfaces Group MIB' to explain the ZeroBasedCounter32
            Usage. Updated discontinuity requirements in all counter
            objects
            Clarifications for the Zero-length OCTET STRING of
            docsBpi2CmtsCACertThumbprint, similar to docsBpi2CmtsCACert.
            Requirement of no instantiation of
            docsBpi2CmtsAuthCmExpiresOld for entries with associated CM
            in BPI mode.
            Added writable requirements for read-write and read-create
            objects within a row entry with StorageType 'permanent'
            status
            Small updates in objects docsBpi2CmtsIpMulticastMapControl
            entries docsBpi2CmtsIpMulticastMapStorageType
            REVISION "200407190000Z"
            DESCRIPTION
            "Comments received from Area Advisor incorporated and other
            Updates:
            Added persistent requirements for read-create and
            read-write objects.
            Added object docsBpi2CmtsIpMulticastMapStorageType with
            syntax read-only
            Correction in descriptions of objects of ZeroBasedCounter32
            And added discontinuity statements.
            Syntax for docsBpi2CmtsAuthCACertIndexPtr,
            docsBpi2CmtsCACertIndex, docsBpi2CmIpMulticastIndex and
            docsBpi2CmtsIpMulticastIndex refined as Unsigned32
            (1..4294967295).
            Clarified the use of Address Mask instead of prefixLength
            Deleted object docsBpi2CmtsIpMulticastMaskType, instead use
            docsBpi2CmtsIpMulticastAddressType for both
            docsBpi2CmtsIpMulticastAddress and
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 86]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            docsBpi2CmtsIpMulticastMask.
            Corrections and details for RowStatus objects considerations
            based on MIB review Guidelines
            draft-ietf-ops-mib-review-guidelines-03.txt.
            Changed OIDs for docsBpi2Notification and
            docsBpi2Conformance.
            Better handling of Unicode representation for <CR> <LF>
            Characters.
            Added return error message for invalid set of
            docsBpi2CmDeviceCmCert.
            Added note in security section for usage of DES considered
            Weak.
            Clarification in description of object
            docsBpi2CmtsDefaultSelfSignedManufCertTrust."
 
            REVISION "200310270000Z"
            DESCRIPTION
            "Added section 2.2 Relationship between BPI+ and BPI MIBs
            and added informative references
            Aligned Description and Syntax of TC DocsBpkmSAType
            Removed obsolete Group docsBpi2CmtsCompliance and its
            obsolete objects, OIDs sequence adjustments.
            Cleared used References and updated BPI 1.0 refs to SCTE
            Added TC DocsSAId and DocsSAIdOrZero
            Added Text to Ipv4 compliances
            Removed docsBpi2ObsoleteObjectsGroup OBJECT-GROUP and
            OBJECTS docsBpi2CmtsAuthCmGraceTime and
            docsBpi2CmtsTEKGraceTime"
 
            REVISION "200308010000Z"
            DESCRIPTION
            "Defined TEXTUAL-CONVENTION for SAType related objects:
            docsBpi2CmTEKSAType, docsBpi2CmtsTEKSAType and
            docsBpi2CmtsIpMulticastSAType
            Refined definition of docsBpi2CmtsAuthCmBpiVersion to
            clarify the usage of named-value bpi(0)
            Compliances statements for CM and CMTS in separated
            Modules and additional syntax corrections
            Updated SNMPv3 references
            More detail in section 7. Security Considerations for
            object or group of objects."
 
            REVISION "200306240000Z"
            DESCRIPTION
            "Modified security section and updated author's contact
            info"
 
            REVISION "200302090000Z"
            DESCRIPTION
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 87]
 

                          DOCSIS BPI Plus MIB            November 2004
 
            "Removed extraneous CRL references in text and MIB.
            Modified encodings for docsBpi2CodeDownloadStatusCode
            Modified encodings for docsBpi2CmtsAuthBpkmCmCertValid.
            Added a new object docsBpi2CmtsAuthCACertIndexPtr into
            the docsBpi2CmtsAuthTable.
            Made modifications to object descriptions for
            docsBpi2CodeMfgCodeAccessStart
            docsBpi2CodeMfgCvcAccessStart
            docsBpi2CodeCoSignerCodeAccessStart
            docsBpi2CodeCoSignerCvcAccessStart.
            Changed several object descriptions in docsBpi2CmTEKTable
            and docsBpi2CmtsTEKTable."
 
            REVISION "200211010000Z"
            DESCRIPTION
            "Added encodings for docsBpi2CodeDownloadStatusCode,
            removed CRL object, table, & group, and made minor
            modifications to some object descriptions."
 
            REVISION "200111210000Z"
            DESCRIPTION
            "Added encodings for docsBpi2CmtsAuthBpkmCmCertValid,
            added CRL object, table, & group, and made minor
            modifications to many object descriptions."
 
            REVISION "200104170000Z"
            DESCRIPTION
            "Modified CM and CMTS IP Multicast table indexing in
            preparation for IPV6.  Obsoleted grace time objects
            from the CMTS portion of the MIB."
 
            REVISION "200011171930Z"
            DESCRIPTION
            "Replaced DisplayString type with SnmpAdminString type.
            Several object descriptions were also changed."
 
 
            -- [stop delete]
 
 
 
 
 
 
 
 
 
 
 
 
 
 Green/Ozawa/Katsnelson/Cardona     Expires   March 2005      [Page 88]
 

Html markup produced by rfcmarkup 1.107, available from http://tools.ietf.org/tools/rfcmarkup/