From owner-ipcdn@terayon.com Tue Jan 4 22:14:25 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA13317 for ; Tue, 4 Jan 2000 22:14:20 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id TAA18721; Tue, 4 Jan 2000 19:11:14 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 5 Jan 2000 03:11:14 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id TAA25209; Tue, 4 Jan 2000 19:11:14 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id TAA13634 for ipcdn-outgoing; Tue, 4 Jan 2000 19:09:14 -0800 (PST) Message-Id: <200001050309.WAA21310@funnel.cisco.com> X-Sender: rwoundy@funnel X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.2 Date: Tue, 04 Jan 2000 22:12:38 -0500 To: ipcdn@terayon.com From: Rich Woundy Subject: Seeking comments on new BPI bare MIB for informational RFC Cc: docsis-oss@cablelabs.com Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=====================_38835562==_" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com --=====================_38835562==_ Content-Type: text/plain; charset="us-ascii" Folks, At the last IETF, I accepted the responsibility to get the BPI MIB (not the BPI+ MIB) published as an Informational RFC. I submitted my last BPI MIB proposal back in December 1998, which became quite controversial because it changed the indexes on two existing tables (docsBpiCmTEKTable and docsBpiCmtsTEKTable). There were also quite a few minor fixes which did not seem controversial. I propose to the working group that the minor fixes should be maintained in the MIB for the Informational RFC. I have incorporated the changes into a bare BPI MIB that I have attached to this message, which I have compiled successfully using SMICng. The minor fixes include: - corrections to object syntaxes (usually INTEGER to Integer32) - corrections in object value ranges (to match the BPI spec, and/or to meet CableLabs testing needs) - corrections to some textual descriptions - additions of REFERENCE clauses The specific implementation differences would be: - docsBpiCmPublicKey and docsBpiCmtsAuthCmPublicKey: correction in legal public key lengths - docsBpiCmAuthWaitTimeout, docsBpiCmReauthWaitTimeout, docsBpiCmAuthRejectWaitTimeout: correction in legal value ranges - docsBpiCmTEKPrivacyEnable: change to read-only - docsBpiCmtsDefaultAuthGraceTime and docsBpiCmtsDefaultTEKGraceTime: remove from MIB Does anyone object to this approach??? -- Richard Woundy, Cisco Systems --=====================_38835562==_ Content-Type: text/plain; charset="us-ascii" Content-Disposition: attachment; filename="bpimib-010700.txt" DOCS-BPI-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Integer32, Counter32, IpAddress FROM SNMPv2-SMI DisplayString, MacAddress, RowStatus, TruthValue, DateAndTime FROM SNMPv2-TC OBJECT-GROUP, MODULE-COMPLIANCE FROM SNMPv2-CONF ifIndex FROM IF-MIB docsIfMib, docsIfCmServiceId, docsIfCmtsServiceId FROM DOCS-IF-MIB ; docsBpiMIB MODULE-IDENTITY LAST-UPDATED "200001071930Z" ORGANIZATION "IETF IPCDN Working Group" CONTACT-INFO "Rich Woundy Postal: Cisco Systems 250 Apollo Drive Chelmsford, MA 01824 U.S.A. Tel: +1 978 244 8545 Fax: +1 978 244 8917 E-mail: rwoundy@cisco.com" DESCRIPTION "This is the MIB Module for the DOCSIS Baseline Privacy Interface (BPI) at cable modems (CMs) and cable modem termination systems (CMTSs)." ::= { docsIfMib 5 } docsBpiMIBObjects OBJECT IDENTIFIER ::= { docsBpiMIB 1 } -- Cable Modem Group docsBpiCmObjects OBJECT IDENTIFIER ::= { docsBpiMIBObjects 1 } -- -- The BPI base and authorization table for CMs, indexed by ifIndex -- docsBpiCmBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic and authorization-related Baseline Privacy attributes of each CM MAC interface." ::= { docsBpiCmObjects 1 } docsBpiCmBaseEntry OBJECT-TYPE SYNTAX DocsBpiCmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpiCmBaseTable 1 } DocsBpiCmBaseEntry ::= SEQUENCE { docsBpiCmPrivacyEnable TruthValue, docsBpiCmPublicKey OCTET STRING, docsBpiCmAuthState INTEGER, docsBpiCmAuthKeySequenceNumber Integer32, docsBpiCmAuthExpires DateAndTime, docsBpiCmAuthReset TruthValue, docsBpiCmAuthGraceTime Integer32, docsBpiCmTEKGraceTime Integer32, docsBpiCmAuthWaitTimeout Integer32, docsBpiCmReauthWaitTimeout Integer32, docsBpiCmOpWaitTimeout Integer32, docsBpiCmRekeyWaitTimeout Integer32, docsBpiCmAuthRejectWaitTimeout Integer32, docsBpiCmAuthRequests Counter32, docsBpiCmAuthReplies Counter32, docsBpiCmAuthRejects Counter32, docsBpiCmAuthInvalids Counter32, docsBpiCmAuthRejectErrorCode INTEGER, docsBpiCmAuthRejectErrorString DisplayString, docsBpiCmAuthInvalidErrorCode INTEGER, docsBpiCmAuthInvalidErrorString DisplayString } docsBpiCmPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this CM is provisioned to run Baseline Privacy. This is analogous to the presence (or absence) of the Baseline Privacy Configuration Setting option. The status of each individual SID with respect to Baseline Privacy is captured in the docsBpiCmTEKPrivacyEnable object. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1." ::= { docsBpiCmBaseEntry 1 } docsBpiCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (74 | 106 | 140 | 270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [10], corresponding to the public key of the CM. The 74, 106, 140, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and 2048 public moduli respectively." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.2.4." ::= { docsBpiCmBaseEntry 2 } docsBpiCmAuthState OBJECT-TYPE SYNTAX INTEGER { start(1), authWait(2), authorized(3), reauthWait(4), authRejectWait(5) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the CM authorization FSM. The start state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.2.1." ::= { docsBpiCmBaseEntry 3 } docsBpiCmAuthKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the authorization key sequence number for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpiCmBaseEntry 4 } docsBpiCmAuthExpires OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the current authorization for this FSM expires. If the CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpiCmBaseEntry 5 } docsBpiCmAuthReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE generates a Reauthorize event in the authorization FSM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.2.3.4." ::= { docsBpiCmBaseEntry 6 } docsBpiCmAuthGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for an authorization key. A CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.3." ::= { docsBpiCmBaseEntry 7 } docsBpiCmTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for a TEK. A CM is expected to start trying to get a new TEK beginning TEKGraceTime seconds before the TEK actually expires. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.6." ::= { docsBpiCmBaseEntry 8 } docsBpiCmAuthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorize Wait Timeout. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.1." ::= { docsBpiCmBaseEntry 9 } docsBpiCmReauthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Reauthorize Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.2." ::= { docsBpiCmBaseEntry 10 } docsBpiCmOpWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Operational Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.4." ::= { docsBpiCmBaseEntry 11 } docsBpiCmRekeyWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Rekey Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.5." ::= { docsBpiCmBaseEntry 12 } docsBpiCmAuthRejectWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..600) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorization Reject Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.7." ::= { docsBpiCmBaseEntry 13 } docsBpiCmAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an Authorization Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmBaseEntry 14 } docsBpiCmAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reply message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmBaseEntry 15 } docsBpiCmAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reject message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmBaseEntry 16 } docsBpiCmAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Invalid message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmBaseEntry 17 } docsBpiCmAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.16." ::= { docsBpiCmBaseEntry 18 } docsBpiCmAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message received by the CM. This is a zero length string if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpiCmBaseEntry 19 } docsBpiCmAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.16." ::= { docsBpiCmBaseEntry 20 } docsBpiCmAuthInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message received by the CM. This is a zero length string if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpiCmBaseEntry 21 } -- -- The CM TEK Table, indexed by ifIndex and SID -- docsBpiCmTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key (TEK) association. The CM maintains (no more than) one TEK association per SID per CM MAC interface." ::= { docsBpiCmObjects 2 } docsBpiCmTEKEntry OBJECT-TYPE SYNTAX DocsBpiCmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the TEK association attributes of one SID. The CM MUST create one entry per unicast or multicast SID, regardless of whether the SID was obtained from a Registration Response message, from an Authorization Reply message, or from any future dynamic SID establishment mechanisms. " INDEX { ifIndex, docsIfCmServiceId } ::= { docsBpiCmTEKTable 1 } DocsBpiCmTEKEntry ::= SEQUENCE { docsBpiCmTEKPrivacyEnable TruthValue, docsBpiCmTEKState INTEGER, docsBpiCmTEKExpiresOld DateAndTime, docsBpiCmTEKExpiresNew DateAndTime, docsBpiCmTEKKeyRequests Counter32, docsBpiCmTEKKeyReplies Counter32, docsBpiCmTEKKeyRejects Counter32, docsBpiCmTEKInvalids Counter32, docsBpiCmTEKAuthPends Counter32, docsBpiCmTEKKeyRejectErrorCode INTEGER, docsBpiCmTEKKeyRejectErrorString DisplayString, docsBpiCmTEKInvalidErrorCode INTEGER, docsBpiCmTEKInvalidErrorString DisplayString } docsBpiCmTEKPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this SID is provisioned to run Baseline Privacy. This is analogous to enabling Baseline Privacy on a provisioned SID using the Class-of-Service Privacy Enable option. Baseline Privacy is not effectively enabled for any SID unless Baseline Privacy is enabled for the CM, which is managed via the docsBpiCmPrivacyEnable object. Note: this object will be read-write accessible only after the CMTS has the capability to authorize the starting or stopping of a particular TEK state machine." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.2." ::= { docsBpiCmTEKEntry 1 } docsBpiCmTEKState OBJECT-TYPE SYNTAX INTEGER { start(1), opWait(2), opReauthWait(3), operational(4), rekeyWait(5), rekeyReauthWait(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the indicated TEK FSM. The start(1) state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.1." ::= { docsBpiCmTEKEntry 2 } docsBpiCmTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmTEKEntry 3 } docsBpiCmTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmTEKEntry 4 } docsBpiCmTEKKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted a Key Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.4." ::= { docsBpiCmTEKEntry 5 } docsBpiCmTEKKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reply message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5." ::= { docsBpiCmTEKEntry 6 } docsBpiCmTEKKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reject message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.6." ::= { docsBpiCmTEKEntry 7 } docsBpiCmTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a TEK Invalid message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.8." ::= { docsBpiCmTEKEntry 8 } docsBpiCmTEKAuthPends OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times an Authorization Pending (Auth Pend) event occurred in this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.3.3." ::= { docsBpiCmTEKEntry 9 } docsBpiCmTEKKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Key Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.6 and 4.2.2.16." ::= { docsBpiCmTEKEntry 10 } docsBpiCmTEKKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Key Reject message received by the CM. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.6 and 4.2.2.6." ::= { docsBpiCmTEKEntry 11 } docsBpiCmTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent TEK Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.8 and 4.2.2.16." ::= { docsBpiCmTEKEntry 12 } docsBpiCmTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent TEK Invalid message received by the CM. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.8 and 4.2.2.6." ::= { docsBpiCmTEKEntry 13 } -- Cable Modem Termination System Group docsBpiCmtsObjects OBJECT IDENTIFIER ::= { docsBpiMIBObjects 2 } -- -- The BPI base table for CMTSs, indexed by ifIndex -- docsBpiCmtsBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic Baseline Privacy attributes of each CMTS MAC interface." ::= { docsBpiCmtsObjects 1 } docsBpiCmtsBaseEntry OBJECT-TYPE SYNTAX DocsBpiCmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CMTS MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpiCmtsBaseTable 1 } DocsBpiCmtsBaseEntry ::= SEQUENCE { docsBpiCmtsDefaultAuthLifetime Integer32, docsBpiCmtsDefaultTEKLifetime Integer32, -- docsBpiCmtsDefaultAuthGraceTime INTEGER, -- docsBpiCmtsDefaultTEKGraceTime INTEGER, docsBpiCmtsAuthRequests Counter32, docsBpiCmtsAuthReplies Counter32, docsBpiCmtsAuthRejects Counter32, docsBpiCmtsAuthInvalids Counter32 } docsBpiCmtsDefaultAuthLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new authorization key." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.2." ::= { docsBpiCmtsBaseEntry 1 } docsBpiCmtsDefaultTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new Traffic Encryption Key (TEK)." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.2." ::= { docsBpiCmtsBaseEntry 2 } -- Note: the following two objects have been removed from this MIB. -- docsBpiCmtsDefaultAuthGraceTime OBJECT-TYPE -- SYNTAX INTEGER (1..1800) -- UNITS "seconds" -- MAX-ACCESS read-write -- STATUS current -- DESCRIPTION -- "Default grace time, in seconds, the CMTS uses for an authorization -- key. This controls how far in advance of authorization key expiration -- that the CMTS is expected to produce the next generation of keying -- material. This value is expected to agree with the Authorization Grace -- Time that the provisioning system provides to CMs." -- ::= { docsBpiCmtsBaseEntry 3 } -- docsBpiCmtsDefaultTEKGraceTime OBJECT-TYPE -- SYNTAX INTEGER (1..1800) -- UNITS "seconds" -- MAX-ACCESS read-write -- STATUS current -- DESCRIPTION -- "Default grace time, in seconds, the CMTS uses for a Traffic -- Encryption Key (TEK). This controls how far in advance of TEK -- expiration that the CMTS is expected to produce the next generation -- of keying material. This value is expected to agree with the TEK Grace -- Time that the provisioning system provides to CMs. Note that this -- object is particularly relevant for multicast SIDs, where multiple -- grace time values cannot be honored." -- ::= { docsBpiCmtsBaseEntry 4 } docsBpiCmtsAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmtsBaseEntry 5 } docsBpiCmtsAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmtsBaseEntry 6 } docsBpiCmtsAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmtsBaseEntry 7 } docsBpiCmtsAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmtsBaseEntry 8 } -- -- The CMTS Authorization Table, indexed by ifIndex and CM MAC address -- docsBpiCmtsAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM authorization association. The CMTS maintains one authorization association with each Baseline Privacy-enabled CM on each CMTS MAC interface." ::= { docsBpiCmtsObjects 2 } docsBpiCmtsAuthEntry OBJECT-TYPE SYNTAX DocsBpiCmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one authorization association. The CMTS MUST create one entry per CM per MAC interface, based on the receipt of an Authorization Request message, and MUST not delete the entry before the CM authorization permanently expires." INDEX { ifIndex, docsBpiCmtsAuthCmMacAddress } ::= { docsBpiCmtsAuthTable 1 } DocsBpiCmtsAuthEntry ::= SEQUENCE { docsBpiCmtsAuthCmMacAddress MacAddress, docsBpiCmtsAuthCmPublicKey OCTET STRING, docsBpiCmtsAuthCmKeySequenceNumber Integer32, docsBpiCmtsAuthCmExpires DateAndTime, docsBpiCmtsAuthCmLifetime Integer32, docsBpiCmtsAuthCmGraceTime Integer32, docsBpiCmtsAuthCmReset INTEGER, docsBpiCmtsAuthCmRequests Counter32, docsBpiCmtsAuthCmReplies Counter32, docsBpiCmtsAuthCmRejects Counter32, docsBpiCmtsAuthCmInvalids Counter32, docsBpiCmtsAuthRejectErrorCode INTEGER, docsBpiCmtsAuthRejectErrorString DisplayString, docsBpiCmtsAuthInvalidErrorCode INTEGER, docsBpiCmtsAuthInvalidErrorString DisplayString } docsBpiCmtsAuthCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the physical address of the CM to which the authorization association applies." ::= { docsBpiCmtsAuthEntry 1 } docsBpiCmtsAuthCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0 | 74 | 106 | 140 | 270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [10], corresponding to the public key of the CM. The 74, 106, 140, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and 2048 public moduli respectively. This is a zero-length string if the CMTS does not retain the public key." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.2.4." ::= { docsBpiCmtsAuthEntry 2 } docsBpiCmtsAuthCmKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the authorization key sequence number for this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpiCmtsAuthEntry 3 } docsBpiCmtsAuthCmExpires OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the current authorization for this CM expires. If this CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpiCmtsAuthEntry 4 } docsBpiCmtsAuthCmLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to an authorization key for this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2 and Appendix A.2." ::= { docsBpiCmtsAuthEntry 5 } docsBpiCmtsAuthCmGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the authorization key in seconds. The CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.3." ::= { docsBpiCmtsAuthEntry 6 } docsBpiCmtsAuthCmReset OBJECT-TYPE SYNTAX INTEGER { noResetRequested(1), invalidateAuth(2), sendAuthInvalid(3), invalidateTeks(4) } MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to invalidateAuth(2) causes the CMTS to invalidate the current CM authorization key, but not to transmit an Authorization Invalid message nor to invalidate unicast TEKs. Setting this object to sendAuthInvalid(3) causes the CMTS to invalidate the current CM authorization key, and to transmit an Authorization Invalid message to the CM, but not to invalidate unicast TEKs. Setting this object to invalidateTeks(4) causes the CMTS to invalidate the current CM authorization key, to transmit an Authorization Invalid message to the CM, and to invalidate all unicast TEKs associated with this CM authorization. Reading this object returns the most-recently-set value of this object, or returns noResetRequested(1) if the object has not been set since the last CMTS reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5." ::= { docsBpiCmtsAuthEntry 7 } docsBpiCmtsAuthCmRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmtsAuthEntry 8 } docsBpiCmtsAuthCmReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmtsAuthEntry 9 } docsBpiCmtsAuthCmRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmtsAuthEntry 10 } docsBpiCmtsAuthCmInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmtsAuthEntry 11 } docsBpiCmtsAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.16." ::= { docsBpiCmtsAuthEntry 12 } docsBpiCmtsAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message transmitted to the CM. This is a zero length string if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpiCmtsAuthEntry 13 } docsBpiCmtsAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.16." ::= { docsBpiCmtsAuthEntry 14 } docsBpiCmtsAuthInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message transmitted to the CM. This is a zero length string if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpiCmtsAuthEntry 15 } -- -- The CMTS TEK Table, indexed by ifIndex and SID -- docsBpiCmtsTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key (TEK) association. The CMTS maintains one TEK association per BPI SID on each CMTS MAC interface." ::= { docsBpiCmtsObjects 3 } docsBpiCmtsTEKEntry OBJECT-TYPE SYNTAX DocsBpiCmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one TEK association on a particular CMTS MAC interface. The CMTS MUST create one entry per SID per MAC interface, based on the receipt of an Key Request message, and MUST not delete the entry before the CM authorization for the SID permanently expires." INDEX { ifIndex, docsIfCmtsServiceId } ::= { docsBpiCmtsTEKTable 1 } DocsBpiCmtsTEKEntry ::= SEQUENCE { docsBpiCmtsTEKLifetime Integer32, docsBpiCmtsTEKGraceTime Integer32, docsBpiCmtsTEKExpiresOld DateAndTime, docsBpiCmtsTEKExpiresNew DateAndTime, docsBpiCmtsTEKReset TruthValue, docsBpiCmtsKeyRequests Counter32, docsBpiCmtsKeyReplies Counter32, docsBpiCmtsKeyRejects Counter32, docsBpiCmtsTEKInvalids Counter32, docsBpiCmtsKeyRejectErrorCode INTEGER, docsBpiCmtsKeyRejectErrorString DisplayString, docsBpiCmtsTEKInvalidErrorCode INTEGER, docsBpiCmtsTEKInvalidErrorString DisplayString } docsBpiCmtsTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to keys for this TEK association." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5 and Appendix A.2." ::= { docsBpiCmtsTEKEntry 1 } docsBpiCmtsTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the TEK in seconds. The CM is expected to start trying to get a new TEK beginning TEKGraceTime seconds before the TEK actually expires." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.6." ::= { docsBpiCmtsTEKEntry 2 } docsBpiCmtsTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmtsTEKEntry 3 } docsBpiCmtsTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmtsTEKEntry 4 } docsBpiCmtsTEKReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE causes the CMTS to invalidate the current active TEK(s) (plural due to key transition periods), and to generate a new TEK for the associated SID; the CMTS MAY also generate an unsolicited TEK Invalid message, to optimize the TEK synchronization between the CMTS and the CM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.3.5." ::= { docsBpiCmtsTEKEntry 5 } docsBpiCmtsKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received a Key Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.4." ::= { docsBpiCmtsTEKEntry 6 } docsBpiCmtsKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reply message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5." ::= { docsBpiCmtsTEKEntry 7 } docsBpiCmtsKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reject message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.6." ::= { docsBpiCmtsTEKEntry 8 } docsBpiCmtsTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a TEK Invalid message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.8." ::= { docsBpiCmtsTEKEntry 9 } docsBpiCmtsKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent Key Reject message sent in response to a Key Request for this BPI SID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.6 and 4.2.2.16." ::= { docsBpiCmtsTEKEntry 10 } docsBpiCmtsKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent Key Reject message sent in response to a Key Request for this BPI SID. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.6 and 4.2.2.6." ::= { docsBpiCmtsTEKEntry 11 } docsBpiCmtsTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent TEK Invalid message sent in association with this BPI SID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.8 and 4.2.2.16." ::= { docsBpiCmtsTEKEntry 12 } docsBpiCmtsTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent TEK Invalid message sent in association with this BPI SID. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.8 and 4.2.2.6." ::= { docsBpiCmtsTEKEntry 13 } -- -- The CMTS Multicast Control Group -- docsBpiMulticastControl OBJECT IDENTIFIER ::= { docsBpiCmtsObjects 4 } -- -- The CMTS IP Multicast Mapping Table, indexed by IP multicast -- address and prefix, and by ifindex -- docsBpiIpMulticastMapTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the mapping of IP multicast address prefixes to multicast SIDs on each CMTS MAC interface." ::= { docsBpiMulticastControl 1 } docsBpiIpMulticastMapEntry OBJECT-TYPE SYNTAX DocsBpiIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the mapping of one IP multicast address prefix to one multicast SID on one CMTS MAC interface. The CMTS uses the mapping when forwarding downstream IP multicast traffic." INDEX { ifIndex, docsBpiIpMulticastAddress, docsBpiIpMulticastPrefixLength } ::= { docsBpiIpMulticastMapTable 1 } DocsBpiIpMulticastMapEntry ::= SEQUENCE { docsBpiIpMulticastAddress IpAddress, docsBpiIpMulticastPrefixLength Integer32, docsBpiIpMulticastServiceId Integer32, docsBpiIpMulticastMapControl RowStatus } docsBpiIpMulticastAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address (prefix) to be mapped." ::= { docsBpiIpMulticastMapEntry 1 } docsBpiIpMulticastPrefixLength OBJECT-TYPE SYNTAX Integer32 (0..32) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address prefix length to be mapped." ::= { docsBpiIpMulticastMapEntry 2 } docsBpiIpMulticastServiceId OBJECT-TYPE SYNTAX Integer32 (8192..16368) MAX-ACCESS read-create STATUS current DESCRIPTION "This object represents the multicast SID to be used in this IP multicast address prefix mapping entry." -- DEFVAL is an unused multicast SID value chosen by CMTS. ::= { docsBpiIpMulticastMapEntry 3 } docsBpiIpMulticastMapControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the IP multicast address prefix mapping entry." ::= { docsBpiIpMulticastMapEntry 4 } -- -- The CMTS Multicast SID Authorization Table, indexed by ifIndex by -- multicast SID by CM MAC address -- docsBpiMulticastAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the multicast SID authorization for each CM on each CMTS MAC interface." ::= { docsBpiMulticastControl 2 } docsBpiMulticastAuthEntry OBJECT-TYPE SYNTAX DocsBpiMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the key authorization of one cable modem for one multicast SID for one CMTS MAC interface." INDEX { ifIndex, docsBpiMulticastServiceId, docsBpiMulticastCmMacAddress } ::= { docsBpiMulticastAuthTable 1 } DocsBpiMulticastAuthEntry ::= SEQUENCE { docsBpiMulticastServiceId Integer32, docsBpiMulticastCmMacAddress MacAddress, docsBpiMulticastAuthControl RowStatus } docsBpiMulticastServiceId OBJECT-TYPE SYNTAX Integer32 (8192..16368) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the multicast SID for authorization." ::= { docsBpiMulticastAuthEntry 1 } docsBpiMulticastCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the MAC address of the CM to which the multicast SID authorization applies." ::= { docsBpiMulticastAuthEntry 2 } docsBpiMulticastAuthControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the CM authorization for each multicast SID." ::= { docsBpiMulticastAuthEntry 3 } -- -- The BPI MIB Conformance Statements (with a placeholder for -- notifications) -- docsBpiNotification OBJECT IDENTIFIER ::= { docsBpiMIB 2 } docsBpiConformance OBJECT IDENTIFIER ::= { docsBpiMIB 3 } docsBpiCompliances OBJECT IDENTIFIER ::= { docsBpiConformance 1 } docsBpiGroups OBJECT IDENTIFIER ::= { docsBpiConformance 2 } docsBpiBasicCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "This is the compliance statement for devices which implement the DOCSIS Baseline Privacy Interface." MODULE -- docsBpiMIB -- conditionally mandatory group GROUP docsBpiCmGroup DESCRIPTION "This group is implemented only in CMs, not in CMTSs." -- conditionally mandatory group GROUP docsBpiCmtsGroup DESCRIPTION "This group is implemented only in CMTSs, not in CMs." -- relaxation on mandatory range OBJECT docsBpiCmAuthGraceTime SYNTAX Integer32 (300..1800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpiCmTEKGraceTime SYNTAX Integer32 (300..1800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpiCmtsDefaultAuthLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpiCmtsDefaultTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range -- OBJECT docsBpiCmtsDefaultAuthGraceTime -- SYNTAX INTEGER (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range -- OBJECT docsBpiCmtsDefaultTEKGraceTime -- SYNTAX INTEGER (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpiCmtsAuthCmLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpiCmtsAuthCmGraceTime SYNTAX Integer32 (300..1800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpiCmtsTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." -- relaxation on mandatory range OBJECT docsBpiCmtsTEKGraceTime SYNTAX Integer32 (300..1800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [7]." ::= { docsBpiCompliances 1 } docsBpiCmGroup OBJECT-GROUP OBJECTS { docsBpiCmPrivacyEnable, docsBpiCmPublicKey, docsBpiCmAuthState, docsBpiCmAuthKeySequenceNumber, docsBpiCmAuthExpires, docsBpiCmAuthReset, docsBpiCmAuthGraceTime, docsBpiCmTEKGraceTime, docsBpiCmAuthWaitTimeout, docsBpiCmReauthWaitTimeout, docsBpiCmOpWaitTimeout, docsBpiCmRekeyWaitTimeout, docsBpiCmAuthRejectWaitTimeout, docsBpiCmAuthRequests, docsBpiCmAuthReplies, docsBpiCmAuthRejects, docsBpiCmAuthInvalids, docsBpiCmAuthRejectErrorCode, docsBpiCmAuthRejectErrorString, docsBpiCmAuthInvalidErrorCode, docsBpiCmAuthInvalidErrorString, docsBpiCmTEKPrivacyEnable, docsBpiCmTEKState, docsBpiCmTEKExpiresOld, docsBpiCmTEKExpiresNew, docsBpiCmTEKKeyRequests, docsBpiCmTEKKeyReplies, docsBpiCmTEKKeyRejects, docsBpiCmTEKInvalids, docsBpiCmTEKAuthPends, docsBpiCmTEKKeyRejectErrorCode, docsBpiCmTEKKeyRejectErrorString, docsBpiCmTEKInvalidErrorCode, docsBpiCmTEKInvalidErrorString } STATUS current DESCRIPTION "This collection of objects provides CM BPI status and control." ::= { docsBpiGroups 1 } docsBpiCmtsGroup OBJECT-GROUP OBJECTS { docsBpiCmtsDefaultAuthLifetime, docsBpiCmtsDefaultTEKLifetime, -- docsBpiCmtsDefaultAuthGraceTime, -- docsBpiCmtsDefaultTEKGraceTime, docsBpiCmtsAuthRequests, docsBpiCmtsAuthReplies, docsBpiCmtsAuthRejects, docsBpiCmtsAuthInvalids, docsBpiCmtsAuthCmPublicKey, docsBpiCmtsAuthCmKeySequenceNumber, docsBpiCmtsAuthCmExpires, docsBpiCmtsAuthCmLifetime, docsBpiCmtsAuthCmGraceTime, docsBpiCmtsAuthCmReset, docsBpiCmtsAuthCmRequests, docsBpiCmtsAuthCmReplies, docsBpiCmtsAuthCmRejects, docsBpiCmtsAuthCmInvalids, docsBpiCmtsAuthRejectErrorCode, docsBpiCmtsAuthRejectErrorString, docsBpiCmtsAuthInvalidErrorCode, docsBpiCmtsAuthInvalidErrorString, docsBpiCmtsTEKLifetime, docsBpiCmtsTEKGraceTime, docsBpiCmtsTEKExpiresOld, docsBpiCmtsTEKExpiresNew, docsBpiCmtsTEKReset, docsBpiCmtsKeyRequests, docsBpiCmtsKeyReplies, docsBpiCmtsKeyRejects, docsBpiCmtsTEKInvalids, docsBpiCmtsKeyRejectErrorCode, docsBpiCmtsKeyRejectErrorString, docsBpiCmtsTEKInvalidErrorCode, docsBpiCmtsTEKInvalidErrorString, docsBpiIpMulticastServiceId, docsBpiIpMulticastMapControl, docsBpiMulticastAuthControl } STATUS current DESCRIPTION "This collection of objects provides CMTS BPI status and control." ::= { docsBpiGroups 2 } END --=====================_38835562==_ Content-Type: text/plain; charset="us-ascii" --=====================_38835562==_-- From owner-ipcdn@terayon.com Thu Jan 6 21:07:30 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA26739 for ; Thu, 6 Jan 2000 21:07:29 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id SAA06393; Thu, 6 Jan 2000 18:06:52 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 7 Jan 2000 02:06:52 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id SAA05330; Thu, 6 Jan 2000 18:06:51 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id SAA03501 for ipcdn-outgoing; Thu, 6 Jan 2000 18:04:54 -0800 (PST) Message-ID: <387549C2.184E4A1D@terayon.com> Date: Thu, 06 Jan 2000 18:04:50 -0800 From: Earl Mitchell Organization: Terayon Corp. X-Mailer: Mozilla 4.06 [en] (X11; I; SunOS 4.1.4 sun4m) MIME-Version: 1.0 To: ipcdn@terayon.com CC: DOCSIS OSS Majordomo List Subject: Re: bpiplus-mib-00.txt is now available References: <4DF5E8A771ECD21187020008C7B1C5AF398DEF@srvmail.cablelabs.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit On page 3, for Sec2.1.3 Common it implies that docsBpi2CodeDownloadControl is part of the CMTS MIB. But then on page 49 it has a "Note:" saying authenticated SW download objects are a CM requirement only. So shouldn't these objects be under Sec2.1.1 Cable Modems? -earl From owner-ipcdn@terayon.com Fri Jan 7 14:24:36 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA25518 for ; Fri, 7 Jan 2000 14:24:34 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id LAA11039; Fri, 7 Jan 2000 11:21:42 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 7 Jan 2000 19:21:42 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id LAA01433; Fri, 7 Jan 2000 11:21:41 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id LAA09406 for ipcdn-outgoing; Fri, 7 Jan 2000 11:19:12 -0800 (PST) Message-ID: <38763C2D.8908B9C6@terayon.com> Date: Fri, 07 Jan 2000 11:19:09 -0800 From: Earl Mitchell Organization: Terayon Corp. X-Mailer: Mozilla 4.06 [en] (X11; I; SunOS 4.1.4 sun4m) MIME-Version: 1.0 To: Stuart Green CC: ipcdn@terayon.com, DOCSIS OSS Majordomo List Subject: Re: bpiplus-mib-00.txt is now available References: <4DF5E8A771ECD21187020008C7B1C5AF398DEF@srvmail.cablelabs.com> <387549C2.184E4A1D@terayon.com> <387607CC.D9D89234@ne.arris-i.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit Stuart Green wrote: > > Earl, > Though the s/w download object is only required > on the CM, I wanted to make the object more general > purpose. A CMTS vendor could choose to implement > the s/w download feature and re-use the MIB object > in its entirety. > > Stu I see. Thanks for the explanation. -earl From owner-ipcdn@terayon.com Fri Jan 7 21:05:14 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA00110 for ; Fri, 7 Jan 2000 21:05:13 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id SAA14484; Fri, 7 Jan 2000 18:04:23 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 8 Jan 2000 02:04:23 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id SAA15631; Fri, 7 Jan 2000 18:04:22 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id SAA13301 for ipcdn-outgoing; Fri, 7 Jan 2000 18:03:01 -0800 (PST) Message-ID: <38769AD3.CBEED72@terayon.com> Date: Fri, 07 Jan 2000 18:02:59 -0800 From: Earl Mitchell Organization: Terayon Corp. X-Mailer: Mozilla 4.06 [en] (X11; I; SunOS 4.1.4 sun4m) MIME-Version: 1.0 To: ipcdn@terayon.com, DOCSIS OSS Majordomo List Subject: Re: bpiplus-mib-00.txt is now available References: <4DF5E8A771ECD21187020008C7B1C5AF398DEF@srvmail.cablelabs.com> <387549C2.184E4A1D@terayon.com> <387607CC.D9D89234@ne.arris-i.com> <38763C2D.8908B9C6@terayon.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit Is the object docsBpi2CmtsMulticastAuthTable used by CMTS to track which CM's are currently using a multicast SAID or which CM's are allowed to use (i.e. allowed to do MapRequest/KeyRequest) for that multicast SAID? -earl From owner-ipcdn@terayon.com Sat Jan 8 15:10:03 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA20721 for ; Sat, 8 Jan 2000 15:10:00 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id MAA16246; Sat, 8 Jan 2000 12:07:53 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 8 Jan 2000 20:07:53 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id MAA24513; Sat, 8 Jan 2000 12:07:52 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id MAA15743 for ipcdn-outgoing; Sat, 8 Jan 2000 12:06:28 -0800 (PST) Message-ID: <001301bf5a14$be24ed00$c2869cd1@prodigy.net> From: "Kaz Ozawa" To: Subject: bpiplus-mib-00.txt: Comments re: Dynamic SA Mapping & IP Multicasting Date: Sat, 8 Jan 2000 13:12:48 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit In the current draft, the table related to the dynamic SA mapping is completely linked with the IP multicasting. It's true that the BPI+ spec only defines the IP multicasting as the application which uses the dynamic SA mapping. But I understand that the BPI+ spec does not restrict the usage of the dynamic SA mapping to the IP multicasting application. That is, the BPI+ spec might be updated to allow a future application to use it. The followings are my proposing changes to the tables/objects related to the dynamic SA mapping and the IP multicasting. All of the object names are my draft and I welcome the modification of the names if you have a good idea. DocsBpi2CmIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmIpMulticastAddress IpAddress, ------index docsBpi2CmIpMulticastPrefixLength Integer32, ------index docsBpi2CmIpMulticastSAId Integer32 } ---- I know there was a discussion related to "PrefixLengh" but I leave as is. DocsBpi2CmSAMappingEntry ::= SEQUENCE { docsBpi2CmSAMappingIndex Integer32, ------index docsBpi2CmSAMapingState INTEGER, docsBpi2CmSAMapRequests Counter32, docsBpi2CmSAMapReplies Counter32, docsBpi2CmSAMapRejects Counter32, docsBpi2CmSAMapRequestQueryType Integer32, docsBpi2CmSAMapReplySAId Integer32, docsBpi2CmSAMapRejectErrorCode INTEGER, docsBpi2CmSAMapRejectErrorString DisplayString } ---- This entry is generated everytime the CM generates and starts a SA Mapping State Machine defined by BPI+ spec section 5.3. That is, a CM may have multiple entryies. Once I thought the SAID can be the index. However, I told that the FSM does not have a SAID if the CMTS respond to the SA MAP Request message with the SA MAP Reject message. DocsBpi2CmtsIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmtsIpMulticastAddress IpAddress, ----index docsBpi2CmtsIpMulticastPrefixLength Integer32, ----index docsBpi2CmtsIpMulticastSAId Integer32, docsBpi2CmtsIpMulticastMapControl RowStatus } DocsBpi2CmtsSAEntry ::= SEQUENCE { docsBpi2CmtsCmMacAddress MacAddress ----index docsBpi2CmtsSAId Ingeger32, ----index docsBpi2CmtsSAControl RowStatus } ---- The entries may be for either Primary, Static or Dynamic SAIDs. DocsBpi2CmtsSAMappingCmEntry ::= SEQUENCE { docsBpi2CmtsSAMappingCmMacAddressx MacAddress ------index docsBpi2CmtsSAMapingState INTEGER, docsBpi2CmtsSAMapRequests Counter32, docsBpi2CmtsSAMapReplies Counter32, docsBpi2CmtsSAMapRejects Counter32, docsBpi2CmtsSAMapRequestQueryType Integer32, ---- Query Type contained in the latest SA MAP Request message. docsBpi2CmtsSAMapReplySAId Integer32, ---- SAID contained in the latest SA MAP Request message. docsBpi2CmtsSAMapRejectErrorCode INTEGER, docsBpi2CmtsSAMapRejectErrorString DisplayString } ---- I propose to change from the table per SAID to the table per CM in order to count the SA MAP Reject messages and also the SA MAP Request messages responded with the SA MAP Reject messages. This table will contain the information related to multiple SA Mapping FSM of a single CM. Any comments ? Thanks, kaz From owner-ipcdn@terayon.com Sat Jan 8 17:02:09 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04160 for ; Sat, 8 Jan 2000 17:02:08 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id MAA16434; Sat, 8 Jan 2000 12:21:54 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 8 Jan 2000 20:21:54 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id MAA24852; Sat, 8 Jan 2000 12:21:53 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id MAA15859 for ipcdn-outgoing; Sat, 8 Jan 2000 12:21:10 -0800 (PST) Message-ID: <002b01bf5a16$cbf3dc00$c2869cd1@prodigy.net> From: "Kaz Ozawa" To: Subject: bpiplus-mib-00.txt: Comments re: Dynamic SA Mapping & IP Multicasting Date: Sat, 8 Jan 2000 13:27:31 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit In the current draft, the table related to the dynamic SA mapping is completely linked with the IP multicasting. It's true that the BPI+ spec only defines the IP multicasting as the application which uses the dynamic SA mapping. But I understand that the BPI+ spec does not restrict the usage of the dynamic SA mapping to the IP multicasting application. That is, the BPI+ spec might be updated to allow a future application to use it. The followings are my proposing changes to the tables/objects related to the dynamic SA mapping and the IP multicasting. All of the object names are my draft and I welcome the modification of the names if you have a good idea. DocsBpi2CmIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmIpMulticastAddress IpAddress, ------index docsBpi2CmIpMulticastPrefixLength Integer32, ------index docsBpi2CmIpMulticastSAId Integer32 } ---- I know there was a discussion related to "PrefixLengh" but I leave as is. DocsBpi2CmSAMappingEntry ::= SEQUENCE { docsBpi2CmSAMappingIndex Integer32, ------index docsBpi2CmSAMapingState INTEGER, docsBpi2CmSAMapRequests Counter32, docsBpi2CmSAMapReplies Counter32, docsBpi2CmSAMapRejects Counter32, docsBpi2CmSAMapRequestQueryType Integer32, docsBpi2CmSAMapReplySAId Integer32, docsBpi2CmSAMapRejectErrorCode INTEGER, docsBpi2CmSAMapRejectErrorString DisplayString } ---- This entry is generated everytime the CM generates and starts a SA Mapping State Machine defined by BPI+ spec section 5.3. That is, a CM may have multiple entryies. Once I thought the SAID can be the index. However, I told that the FSM does not have a SAID if the CMTS respond to the SA MAP Request message with the SA MAP Reject message. DocsBpi2CmtsIpMulticastMapEntry ::= SEQUENCE { docsBpi2CmtsIpMulticastAddress IpAddress, ----index docsBpi2CmtsIpMulticastPrefixLength Integer32, ----index docsBpi2CmtsIpMulticastSAId Integer32, docsBpi2CmtsIpMulticastMapControl RowStatus } DocsBpi2CmtsSAEntry ::= SEQUENCE { docsBpi2CmtsCmMacAddress MacAddress ----index docsBpi2CmtsSAId Ingeger32, ----index docsBpi2CmtsSAControl RowStatus } ---- The entries may be for either Primary, Static or Dynamic SAIDs. DocsBpi2CmtsSAMappingCmEntry ::= SEQUENCE { docsBpi2CmtsSAMappingCmMacAddressx MacAddress ------index docsBpi2CmtsSAMapingState INTEGER, docsBpi2CmtsSAMapRequests Counter32, docsBpi2CmtsSAMapReplies Counter32, docsBpi2CmtsSAMapRejects Counter32, docsBpi2CmtsSAMapRequestQueryType Integer32, ---- Query Type contained in the latest SA MAP Request message. docsBpi2CmtsSAMapReplySAId Integer32, ---- SAID contained in the latest SA MAP Request message. docsBpi2CmtsSAMapRejectErrorCode INTEGER, docsBpi2CmtsSAMapRejectErrorString DisplayString } ---- I propose to change from the table per SAID to the table per CM in order to count the SA MAP Reject messages and also the SA MAP Request messages responded with the SA MAP Reject messages. This table will contain the information related to multiple SA Mapping FSM of a single CM. Any comments ? Thanks, kaz Kaz Ozawa, Toshiba Visiting Engineer at CableLabs Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) Email: k.ozawa@cablelabs.com / kaz@pobox.com From owner-ipcdn@terayon.com Mon Jan 10 17:35:41 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA14618 for ; Mon, 10 Jan 2000 17:35:38 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id OAA26020; Mon, 10 Jan 2000 14:30:32 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 10 Jan 2000 22:30:32 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id OAA03741; Mon, 10 Jan 2000 14:30:31 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id OAA26964 for ipcdn-outgoing; Mon, 10 Jan 2000 14:28:05 -0800 (PST) Message-ID: <387A5CF0.ABDDCB59@terayon.com> Date: Mon, 10 Jan 2000 14:28:00 -0800 From: Earl Mitchell Organization: Terayon Corp. X-Mailer: Mozilla 4.06 [en] (X11; I; SunOS 4.1.4 sun4m) MIME-Version: 1.0 To: Stuart Green CC: ipcdn@terayon.com, DOCSIS OSS Majordomo List Subject: Re: bpiplus-mib-00.txt is now available References: <4DF5E8A771ECD21187020008C7B1C5AF398DEF@srvmail.cablelabs.com> <387549C2.184E4A1D@terayon.com> <387607CC.D9D89234@ne.arris-i.com> <38763C2D.8908B9C6@terayon.com> <38769AD3.CBEED72@terayon.com> <387A0905.1842A77C@ne.arris-i.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit Stuart Green wrote: > > Earl, > The table tracks which CMs are allowed to use the SAID, > rather than which CMs are using the SAID. > For example, a static multicast SAID entry would need > to be created prior to its use. > > Stu > thanks -earl From owner-ipcdn@terayon.com Mon Jan 10 23:03:22 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA18793 for ; Mon, 10 Jan 2000 23:03:21 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id UAA29241; Mon, 10 Jan 2000 20:01:24 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 04:01:24 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id UAA16091; Mon, 10 Jan 2000 20:01:23 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id UAA00529 for ipcdn-outgoing; Mon, 10 Jan 2000 20:00:19 -0800 (PST) Message-ID: <4DF5E8A771ECD21187020008C7B1C5AF398E44@srvmail.cablelabs.com> From: Kazuyoshi Ozawa To: "Ipcdn (E-mail)" Subject: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime Date: Mon, 10 Jan 2000 20:59:57 -0700 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com I am now reviewing the new BPI MIB draft again but I cannot remember why we need to remove both docsBpiCmtsDefaultAuthGraceTime and docsBpiCmtsDefaultTEKGraceTime. I remember that, according to the BPI spec, the CMTS is not required to use the TEK/Auth Grace Time for their key management. However, at the same time, I think that there are some CMTSs which are actually using these values for their key management...... If it's ok for all the CMTS vendors to remove these 2 object, I'm fine. Therefore, I definitly welcome the review by the CMTS vendors. Thank you for your help. kaz Kaz Ozawa Toshiba Visiting Engineer at CableLabs Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) Email: k.ozawa@cablelabs.com / kaz@pobox.com From owner-ipcdn@terayon.com Tue Jan 11 00:17:41 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA19525 for ; Tue, 11 Jan 2000 00:17:40 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id VAA29676; Mon, 10 Jan 2000 21:16:55 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 05:16:55 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id VAA17392; Mon, 10 Jan 2000 21:16:55 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id VAA00921 for ipcdn-outgoing; Mon, 10 Jan 2000 21:14:19 -0800 (PST) Message-ID: <4DF5E8A771ECD21187020008C7B1C5AF398E46@srvmail.cablelabs.com> From: Kazuyoshi Ozawa To: "Ipcdn (E-mail)" Subject: New BPI MIB: Relaxation on MandatoryRange Date: Mon, 10 Jan 2000 22:13:30 -0700 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Do we really need the relaxation on mandatory renge for the following 4 read-only objects ? docsBpiCmAuthGraceTime docsBpiCmTEKGraceTime docsBpiCmtsAuthCmGraceTime docsBpiCmtsTEKGraceTime I understand that we need the relaxation for the read-write object. However, I'm not sure regarding the read-only objects. Thanks, kaz Kaz Ozawa Toshiba Visiting Engineer at CableLabs Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) Email: k.ozawa@cablelabs.com / kaz@pobox.com From owner-ipcdn@terayon.com Tue Jan 11 00:27:14 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA19636 for ; Tue, 11 Jan 2000 00:27:13 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id VAA29899; Mon, 10 Jan 2000 21:25:21 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 05:25:21 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id VAA17803; Mon, 10 Jan 2000 21:25:20 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id VAA01027 for ipcdn-outgoing; Mon, 10 Jan 2000 21:22:48 -0800 (PST) From: Man Wong Message-Id: <200001110522.VAA19190@frogger.cisco.com> Subject: Re: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime To: ipcdn@terayon.com Date: Mon, 10 Jan 2000 21:22:45 -0800 (PST) In-Reply-To: <4DF5E8A771ECD21187020008C7B1C5AF398E44@srvmail.cablelabs.com> from "Kazuyoshi Ozawa" at Jan 10, 2000 08:59:57 PM X-Mailer: ELM [version 2.5 PL1] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit > > I am now reviewing the new BPI MIB draft again but I cannot > remember why we need to remove both docsBpiCmtsDefaultAuthGraceTime > and docsBpiCmtsDefaultTEKGraceTime. Grace times are not CMTS parameters. There is no use for default values in the CMTS. All CMs running BPI will have their own grace periods which comes from config file. > > I remember that, according to the BPI spec, the CMTS is not > required to use the TEK/Auth Grace Time for their key management. > However, at the same time, I think that there are some CMTSs which > are actually using these values for their key management...... > > If it's ok for all the CMTS vendors to remove these 2 object, I'm > fine. Therefore, I definitly welcome the review by the CMTS vendors. > It is fine with Cisco CMTS to have them removed. - mansonw > Thank you for your help. > kaz > > Kaz Ozawa > Toshiba Visiting Engineer at CableLabs > Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) > Email: k.ozawa@cablelabs.com / kaz@pobox.com > > From owner-ipcdn@terayon.com Tue Jan 11 00:37:20 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA19744 for ; Tue, 11 Jan 2000 00:37:19 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id VAA00153; Mon, 10 Jan 2000 21:35:16 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 05:35:16 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id VAA18118; Mon, 10 Jan 2000 21:35:15 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id VAA01193 for ipcdn-outgoing; Mon, 10 Jan 2000 21:34:19 -0800 (PST) Message-ID: <4DF5E8A771ECD21187020008C7B1C5AF398E47@srvmail.cablelabs.com> From: Kazuyoshi Ozawa To: "'ipcdn@terayon.com'" Subject: RE: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime Date: Mon, 10 Jan 2000 22:33:27 -0700 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com If it's ok to remove these 2 objects, I think we also need to remove the following 2 objects because the CMTS does not know these values at all. docsBpiCmtsAuthCmGraceTime docsBpiCmtsTEKGraceTime Thanks, kaz > -----Original Message----- > From: Man Wong [mailto:mansonw@cisco.com] > Sent: Monday, January 10, 2000 10:23 PM > To: ipcdn@terayon.com > Subject: Re: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime > > > > > > I am now reviewing the new BPI MIB draft again but I cannot > > remember why we need to remove both docsBpiCmtsDefaultAuthGraceTime > > and docsBpiCmtsDefaultTEKGraceTime. > > Grace times are not CMTS parameters. There is no use for > default values > in the CMTS. All CMs running BPI will have their own grace > periods which > comes from config file. > > > > > I remember that, according to the BPI spec, the CMTS is not > > required to use the TEK/Auth Grace Time for their key management. > > However, at the same time, I think that there are some CMTSs which > > are actually using these values for their key management...... > > > > If it's ok for all the CMTS vendors to remove these 2 object, I'm > > fine. Therefore, I definitly welcome the review by the > CMTS vendors. > > > > It is fine with Cisco CMTS to have them removed. > > - mansonw > > > > Thank you for your help. > > kaz > > > > Kaz Ozawa > > Toshiba Visiting Engineer at CableLabs > > Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) > > Email: k.ozawa@cablelabs.com / kaz@pobox.com > > > > > From owner-ipcdn@terayon.com Tue Jan 11 00:52:01 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA19849 for ; Tue, 11 Jan 2000 00:52:00 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id VAA00374; Mon, 10 Jan 2000 21:50:07 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 05:50:07 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id VAA18551; Mon, 10 Jan 2000 21:50:05 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id VAA01330 for ipcdn-outgoing; Mon, 10 Jan 2000 21:49:15 -0800 (PST) From: Man Wong Message-Id: <200001110549.VAA20269@frogger.cisco.com> Subject: Re: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime To: ipcdn@terayon.com Date: Mon, 10 Jan 2000 21:49:12 -0800 (PST) In-Reply-To: <4DF5E8A771ECD21187020008C7B1C5AF398E47@srvmail.cablelabs.com> from "Kazuyoshi Ozawa" at Jan 10, 2000 10:33:27 PM X-Mailer: ELM [version 2.5 PL1] MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit CMTS can get the grace period associated with each CM during CM registration. They are TLVs in the registration message. CMTS may need to know the grace times in BPI CMTS and it depends on the CMTS implementation. I don't think we need to remove them. - mansonw > > If it's ok to remove these 2 objects, I think we also need to > remove the following 2 objects because the CMTS does not know > these values at all. > > docsBpiCmtsAuthCmGraceTime > docsBpiCmtsTEKGraceTime > > Thanks, > kaz > > > -----Original Message----- > > From: Man Wong [mailto:mansonw@cisco.com] > > Sent: Monday, January 10, 2000 10:23 PM > > To: ipcdn@terayon.com > > Subject: Re: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime > > > > > > > > > > I am now reviewing the new BPI MIB draft again but I cannot > > > remember why we need to remove both docsBpiCmtsDefaultAuthGraceTime > > > and docsBpiCmtsDefaultTEKGraceTime. > > > > Grace times are not CMTS parameters. There is no use for > > default values > > in the CMTS. All CMs running BPI will have their own grace > > periods which > > comes from config file. > > > > > > > > I remember that, according to the BPI spec, the CMTS is not > > > required to use the TEK/Auth Grace Time for their key management. > > > However, at the same time, I think that there are some CMTSs which > > > are actually using these values for their key management...... > > > > > > If it's ok for all the CMTS vendors to remove these 2 object, I'm > > > fine. Therefore, I definitly welcome the review by the > > CMTS vendors. > > > > > > > It is fine with Cisco CMTS to have them removed. > > > > - mansonw > > > > > > > Thank you for your help. > > > kaz > > > > > > Kaz Ozawa > > > Toshiba Visiting Engineer at CableLabs > > > Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) > > > Email: k.ozawa@cablelabs.com / kaz@pobox.com > > > > > > > > > > From owner-ipcdn@terayon.com Tue Jan 11 10:42:25 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA13242 for ; Tue, 11 Jan 2000 10:42:21 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id HAA02607; Tue, 11 Jan 2000 07:40:09 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 15:40:09 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id HAA26902; Tue, 11 Jan 2000 07:40:08 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id HAA03956 for ipcdn-outgoing; Tue, 11 Jan 2000 07:39:02 -0800 (PST) Message-ID: <4DF5E8A771ECD21187020008C7B1C5AF398E4B@srvmail.cablelabs.com> From: Kazuyoshi Ozawa To: "'ipcdn@terayon.com'" Subject: RE: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime Date: Tue, 11 Jan 2000 08:38:41 -0700 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Now I understand as follows. (1) The BPI Spec does not require the CMTS to use the Auth/TEK Grace Time for its key management. Therefore, there may be a CMTS which does not need any Auth/TEK Grace Time value at all. (2) There may be a CMTS which needs the Auth/TEK Grace Time for its key management. However, the CMTS can get the Grace Time for each CM from Reg Req message and write function of docsBpiCmtsDefaultAuth/TEKGraceTime is not essential. (3) From the operators' point of view, it may be better to eliminate the docsBpiCmtsDefaultAuth/TEKGraceTime because it eliminate one of the CMTS settings which requires the operator to set docsBpiCmtsDefaultAuth/TEKGraceTime to an appropriate value. A little bit complicated point for the operators is that the value of Auth/TEK Grace Time MUST always be set to the value less than half of the Auth/TEK Lifetime value and the vaiolation of this rule may break the system (depending the CMTSs' and the CMs' implementation). These three are (a part of) the reason to remove docsBpiCmtsDefaultAuth/TEKGraceTime. (4) When considering the CMTS which does not use these Grace Times at all, it may be better to change docsBpiCmtsAuthCmGraceTime and docsBpiCmtsTEKGraceTime to optional. For example, allow the CMTS to always return zero if the CM does not use the Grace Time for its key management. Because the operator can get the value for a specific CM from the CM's BPI MIB tables, I don't think we loose anything by this change. Thanks, kaz > -----Original Message----- > From: Man Wong [mailto:mansonw@cisco.com] > Sent: Monday, January 10, 2000 10:49 PM > To: ipcdn@terayon.com > Subject: Re: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime > > > CMTS can get the grace period associated with each CM during > CM registration. > They are TLVs in the registration message. CMTS may need to > know the grace > times in BPI CMTS and it depends on the CMTS implementation. > I don't think > we need to remove them. > > - mansonw > > > > > > If it's ok to remove these 2 objects, I think we also need to > > remove the following 2 objects because the CMTS does not know > > these values at all. > > > > docsBpiCmtsAuthCmGraceTime > > docsBpiCmtsTEKGraceTime > > > > Thanks, > > kaz > > > > > -----Original Message----- > > > From: Man Wong [mailto:mansonw@cisco.com] > > > Sent: Monday, January 10, 2000 10:23 PM > > > To: ipcdn@terayon.com > > > Subject: Re: New BPI MIB: docsBpiCmtsDefaultAuth/TEKGraceTime > > > > > > > > > > > > > > I am now reviewing the new BPI MIB draft again but I cannot > > > > remember why we need to remove both > docsBpiCmtsDefaultAuthGraceTime > > > > and docsBpiCmtsDefaultTEKGraceTime. > > > > > > Grace times are not CMTS parameters. There is no use for > > > default values > > > in the CMTS. All CMs running BPI will have their own grace > > > periods which > > > comes from config file. > > > > > > > > > > > I remember that, according to the BPI spec, the CMTS is not > > > > required to use the TEK/Auth Grace Time for their key > management. > > > > However, at the same time, I think that there are some > CMTSs which > > > > are actually using these values for their key management...... > > > > > > > > If it's ok for all the CMTS vendors to remove these 2 > object, I'm > > > > fine. Therefore, I definitly welcome the review by the > > > CMTS vendors. > > > > > > > > > > It is fine with Cisco CMTS to have them removed. > > > > > > - mansonw > > > > > > > > > > Thank you for your help. > > > > kaz > > > > > > > > Kaz Ozawa > > > > Toshiba Visiting Engineer at CableLabs > > > > Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) > > > > Email: k.ozawa@cablelabs.com / kaz@pobox.com > > > > > > > > > > > > > > > > From owner-ipcdn@terayon.com Tue Jan 11 16:37:19 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA21709 for ; Tue, 11 Jan 2000 16:37:18 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id NAA06916; Tue, 11 Jan 2000 13:36:02 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 21:36:02 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id NAA12555; Tue, 11 Jan 2000 13:36:01 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id NAA08117 for ipcdn-outgoing; Tue, 11 Jan 2000 13:34:04 -0800 (PST) From: "Bob Himlin" To: Subject: RE: New BPI MIB: Relaxation on MandatoryRange Date: Tue, 11 Jan 2000 12:54:36 -0800 Message-ID: <000501bf5c7b$920fe030$a702000a@btlaptop.turbonet-comm.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 In-Reply-To: <4DF5E8A771ECD21187020008C7B1C5AF398E46@srvmail.cablelabs.com> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit I don't think they are needed. I do note, however, as regards docsBpiCmTEKGraceTime, that the BPI+ spec has a range of 1-18006, and the MIB only has a range of 1-1800. Which one needs to be changed? -----Original Message----- From: owner-ipcdn@terayon.com [mailto:owner-ipcdn@terayon.com]On Behalf Of Kazuyoshi Ozawa Sent: Monday, January 10, 2000 9:14 PM To: Ipcdn (E-mail) Subject: New BPI MIB: Relaxation on MandatoryRange Do we really need the relaxation on mandatory renge for the following 4 read-only objects ? docsBpiCmAuthGraceTime docsBpiCmTEKGraceTime docsBpiCmtsAuthCmGraceTime docsBpiCmtsTEKGraceTime I understand that we need the relaxation for the read-write object. However, I'm not sure regarding the read-only objects. Thanks, kaz Kaz Ozawa Toshiba Visiting Engineer at CableLabs Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) Email: k.ozawa@cablelabs.com / kaz@pobox.com From owner-ipcdn@terayon.com Tue Jan 11 17:20:22 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA22553 for ; Tue, 11 Jan 2000 17:20:21 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id OAA07610; Tue, 11 Jan 2000 14:17:47 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 11 Jan 2000 22:17:47 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id OAA14932; Tue, 11 Jan 2000 14:17:46 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id OAA08835 for ipcdn-outgoing; Tue, 11 Jan 2000 14:16:26 -0800 (PST) Message-ID: <4DF5E8A771ECD21187020008C7B1C5AF9841DF@srvmail.cablelabs.com> From: Kazuyoshi Ozawa To: "'ipcdn@terayon.com'" Subject: RE: New BPI MIB: Relaxation on MandatoryRange Date: Tue, 11 Jan 2000 15:05:17 -0700 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com > -----Original Message----- > From: Bob Himlin [mailto:rhimlin@turbonet-comm.com] > Sent: Tuesday, January 11, 2000 1:55 PM > To: ipcdn@terayon.com > Subject: RE: New BPI MIB: Relaxation on MandatoryRange > > > I don't think they are needed. I do note, however, as regards > docsBpiCmTEKGraceTime, that the BPI+ spec has a range of > 1-18006, and the > MIB only has a range of 1-1800. Which one needs to be changed? Oh, you are now talking about BPI+ instead of BPI. Yes, there was a mistake in BPI+-I03 but it's already fixed by an ECN, bpi-n-99100. The maximum value is now 302399 and consistent with the BPI+ MIB draft, draft-ietf-ipcdn-bpiplus-mib-00.txt. Note that the TEK management requirement specified in the BPI+ spec section 6 is different from BPI and the max value of TEK Grace time is completely different.... Thanks, kaz From owner-ipcdn@terayon.com Fri Jan 14 12:03:52 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA20126 for ; Fri, 14 Jan 2000 12:03:50 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id IAA03619; Fri, 14 Jan 2000 08:59:34 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 14 Jan 2000 16:59:34 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id IAA29654; Fri, 14 Jan 2000 08:59:34 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id IAA09196 for ipcdn-outgoing; Fri, 14 Jan 2000 08:57:18 -0800 (PST) Posted-Date: Fri, 14 Jan 2000 11:57:15 -0500 (EST) Message-ID: <387F551F.E177A638@ne.arris-i.com> Date: Fri, 14 Jan 2000 11:55:59 -0500 From: Stuart Green Organization: Arris Interactive - A Nortel Networks / Antec Company X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.5.1 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: ipcdn@terayon.com Subject: Re: New BPI MIB: Relaxation on MandatoryRange References: <4DF5E8A771ECD21187020008C7B1C5AF398E46@srvmail.cablelabs.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit I'm not sure. But if we do not have a relaxation statement then the BPI+ MIB will not comply with the BPI+ spec. So I think it is a good idea. Kazuyoshi Ozawa wrote: > > Do we really need the relaxation on mandatory renge for the > following 4 read-only objects ? > > docsBpiCmAuthGraceTime > docsBpiCmTEKGraceTime > docsBpiCmtsAuthCmGraceTime > docsBpiCmtsTEKGraceTime > > I understand that we need the relaxation for the read-write > object. However, I'm not sure regarding the read-only objects. > > Thanks, > kaz > > Kaz Ozawa > Toshiba Visiting Engineer at CableLabs > Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) > Email: k.ozawa@cablelabs.com / kaz@pobox.com -- Stuart M. Green Arris Interactive - A Nortel Networks / Antec Venture 6 Riverside Drive Andover, MA 01810 (978) 946-4664 stu.green@ne.arris-i.com From owner-ipcdn@terayon.com Fri Jan 14 16:14:49 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA22432 for ; Fri, 14 Jan 2000 16:14:48 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id NAA06881; Fri, 14 Jan 2000 13:12:35 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 14 Jan 2000 21:12:35 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id NAA11761; Fri, 14 Jan 2000 13:12:34 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id NAA12874 for ipcdn-outgoing; Fri, 14 Jan 2000 13:11:20 -0800 (PST) Message-ID: <4DF5E8A771ECD21187020008C7B1C5AF9841FB@srvmail.cablelabs.com> From: Kazuyoshi Ozawa To: "'ipcdn@terayon.com'" Subject: RE: New BPI MIB: Relaxation on MandatoryRange Date: Fri, 14 Jan 2000 14:11:19 -0700 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com If we remove the "Relaxation on MandatoryRange" and if a CM or a CMTS responds with the value outside the range defined by the syntax field, it's violating the MIB spec. On the other hand, is a CM violating the MIB spec if the CM cannot respond with a certain value inside the range ? --- I supposed that the answer is no while I may be wrong. If we need the "Relaxation on MandatoryRange", the following objects need them, too. docsBpi2CmAuthWaitTimeout docsBpi2CmReauthWaitTimeout docsBpi2CmAuthRejectWaitTimeout Thanks, kaz > -----Original Message----- > From: Stuart Green [mailto:stu.green@ne.arris-i.com] > Sent: Friday, January 14, 2000 9:56 AM > To: ipcdn@terayon.com > Subject: Re: New BPI MIB: Relaxation on MandatoryRange > > > I'm not sure. But if we do not have a relaxation statement > then the BPI+ MIB will not comply with the BPI+ spec. So I > think it is a good idea. > > Kazuyoshi Ozawa wrote: > > > > Do we really need the relaxation on mandatory renge for the > > following 4 read-only objects ? > > > > docsBpiCmAuthGraceTime > > docsBpiCmTEKGraceTime > > docsBpiCmtsAuthCmGraceTime > > docsBpiCmtsTEKGraceTime > > > > I understand that we need the relaxation for the read-write > > object. However, I'm not sure regarding the read-only objects. > > > > Thanks, > > kaz > > > > Kaz Ozawa > > Toshiba Visiting Engineer at CableLabs > > Tel: 303-661-3860 (direct); 9199 (fax); 9100 (main) > > Email: k.ozawa@cablelabs.com / kaz@pobox.com > > -- > Stuart M. Green > Arris Interactive - A Nortel Networks / Antec Venture > 6 Riverside Drive > Andover, MA 01810 > (978) 946-4664 > stu.green@ne.arris-i.com > From owner-ipcdn@terayon.com Fri Jan 21 18:08:13 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA18557 for ; Fri, 21 Jan 2000 18:08:12 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id PAA26683; Fri, 21 Jan 2000 15:05:01 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 21 Jan 2000 23:05:01 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id PAA06437; Fri, 21 Jan 2000 15:05:00 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id PAA22522 for ipcdn-outgoing; Fri, 21 Jan 2000 15:03:18 -0800 (PST) Posted-Date: Fri, 21 Jan 2000 18:03:14 -0500 (EST) Message-ID: <3888E560.44F0F51E@ne.arris-i.com> Date: Fri, 21 Jan 2000 18:01:52 -0500 From: Stuart Green Organization: Arris Interactive - A Nortel Networks / Antec Company X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.5.1 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: Kishore Gummadidala CC: Earl Mitchell , ipcdn@terayon.com Subject: Re: X.509 Certificate Size References: <3888E1FB.8AC3DB07@terayon.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit Kishore, 4096 is just a maximum size used in the MIB. As you indicate, certificates will be less than 1522 bytes. Stuart Kishore Gummadidala wrote: > > Hello Stuart, > > The BPI+ MIB (draft-ietf-ipcdn-bpiplus-mib-00.txt) specifies that the > X.509 certificate is an octet string of size upto 4096. > > The RFI specification (SP-RFIv1.1-I03-991105) says that MAC management > messages cannot be longer than 1522 bytes. I do not see how the X.509 > certificates of the CA and the CM can be included in the Authentication > Information and the Authorization Request messages respectively, without > exceeding the maximum MAC management message size?? > > Can you please clarify if I have the X.509 certificate size right? And > if so then is there a plan to extend the size of MAC management > messages. > > Regards, > > Kishore. -- Stuart M. Green Arris Interactive - A Nortel Networks / Antec Venture 6 Riverside Drive Andover, MA 01810 (978) 946-4664 stu.green@ne.arris-i.com From owner-ipcdn@terayon.com Wed Jan 26 10:15:08 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA05301 for ; Wed, 26 Jan 2000 10:15:07 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id HAA29684; Wed, 26 Jan 2000 07:13:23 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 26 Jan 2000 15:13:23 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id HAA16675; Wed, 26 Jan 2000 07:13:22 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id HAA10304 for ipcdn-outgoing; Wed, 26 Jan 2000 07:11:33 -0800 (PST) Posted-Date: Wed, 26 Jan 2000 10:11:20 -0500 (EST) Message-ID: <388F0E44.CB37E3D8@ne.arris-i.com> Date: Wed, 26 Jan 2000 10:09:56 -0500 From: Stuart Green Organization: Arris Interactive - A Nortel Networks / Antec Company X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.5.1 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: ipcdn@terayon.com Subject: Additional BPI+ MIB Changes Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Content-Transfer-Encoding: 7bit Hi, I am considering making a couple of additional BPI+ MIB changes. The changes make CMTS implementations more flexible by removing some additional requirements brought about by the BPI+ MIB. The changes are below. Please provide any feedback by the end of this week if possible. Thanks. 1) Remove "Root certificates must be placed into this table prior to manufacturer certificates" and remove "Note" as well: docsBpi2CmtsCACertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsCACertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "The table of known certificate authority certificates at this device. Root certificates must be placed into this table prior to manufacturer certificates. Note: A cert that does not conform to the format specified in Section 9.2 of the BPI+ spec MUST be excluded from this table." ::= { docsBpi2CmtsCertObjects 2 } 2) Remove "Note": docsBpi2CmtsProvisionedCmCertTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpi2CmtsProvisionedCmCertEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "A table of CM certificate trust entries provisioned to the CMTS. This table overrides CM Certificate entries located in the CMTS' authorization table. Note: A cert that does not conform to the format specified in Section 9.2 of the BPI+ spec MUST be excluded from this table." ::= { docsBpi2CmtsCertObjects 1 } 3) Remove chained as a value. It is not necessary since non-provisioned cm certs are chained by default: docsBpi2CmtsProvisionedCmCertTrust OBJECT-TYPE SYNTAX INTEGER { trusted (1), untrusted (2), chained (3) } MAX-ACCESS read-create STATUS current DESCRIPTION "Trust state for the provisioned CM certificate entry. Note: Setting this object need only override the validity of CM certificates sent in future authorization requests." REFERENCE "DOCSIS Baseline Privacy Plus Interface Specification, Section 9.4.1." ::= { docsBpi2CmtsProvisionedCmCertEntry 2 } 4) Add a sentence which says that deleting rows for actively used CA certs MAY NOT succeed depending on CMTS implementation. docsBpi2CmtsCACertStatus OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "Standard RowStatus object for creating and deleting entries in this table. Of the objects in the row controlled by this object, only docsBpi2CmtsCACertTrust may be modified while the row is active." ::= { docsBpi2CmtsCACertEntry 7 } -- Stuart M. Green Arris Interactive - A Nortel Networks / Antec Venture 6 Riverside Drive Andover, MA 01810 (978) 946-4664 stu.green@ne.arris-i.com From owner-ipcdn@terayon.com Mon Jan 31 12:38:59 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA10690 for ; Mon, 31 Jan 2000 12:38:51 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id JAA06713; Mon, 31 Jan 2000 09:33:14 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 31 Jan 2000 17:33:14 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id JAA09222; Mon, 31 Jan 2000 09:33:13 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id JAA21110 for ipcdn-outgoing; Mon, 31 Jan 2000 09:26:09 -0800 (PST) Message-Id: <200001311725.MAA23284@funnel.cisco.com> X-Sender: rwoundy@funnel X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.2 Date: Mon, 31 Jan 2000 12:29:44 -0500 To: ipcdn@terayon.com From: Rich Woundy Subject: "Final" BPI (not BPI+) MIB Cc: docsis-oss@cablelabs.com Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=====================_3100348==_" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com --=====================_3100348==_ Content-Type: text/plain; charset="us-ascii" Folks, I have attached what I hope to be the final DOCSIS Baseline Privacy MIB (for pre-BPI+ modems). Again, it has been verified using smicng. I will followup this note with the proposed Internet draft. The differences from the January 7, 2000 version are: 1. Commented out some "relaxations on mandatory ranges" in the compliances statements, since these relaxations are unnecessary for read-only MIB objects (each "relaxation" shrinks the legal value range of each object). This affects compliance statements for docsBpiCmAuthGraceTime, docsBpiCmTEKGraceTime, docsBpiCmtsAuthCmGraceTime, and docsBpiCmtsTEKGraceTime. 2. Updated numbering of external references (new bibliography) and other minor cleanup, to support the new internet draft. Please send comments by Friday morning. There should be no real surprises here. -- Rich --=====================_3100348==_ Content-Type: text/plain; charset="us-ascii" Content-Disposition: attachment; filename="bpimib-020100.txt" DOCS-BPI-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Integer32, Counter32, IpAddress FROM SNMPv2-SMI DisplayString, MacAddress, RowStatus, TruthValue, DateAndTime FROM SNMPv2-TC OBJECT-GROUP, MODULE-COMPLIANCE FROM SNMPv2-CONF ifIndex FROM IF-MIB docsIfMib, docsIfCmServiceId, docsIfCmtsServiceId FROM DOCS-IF-MIB ; docsBpiMIB MODULE-IDENTITY LAST-UPDATED "200002011930Z" ORGANIZATION "IETF IPCDN Working Group" CONTACT-INFO "Rich Woundy Postal: Cisco Systems 250 Apollo Drive Chelmsford, MA 01824 U.S.A. Tel: +1 978 244 8000 E-mail: rwoundy@cisco.com" DESCRIPTION "This is the MIB Module for the DOCSIS Baseline Privacy Interface (BPI) at cable modems (CMs) and cable modem termination systems (CMTSs)." ::= { docsIfMib 5 } docsBpiMIBObjects OBJECT IDENTIFIER ::= { docsBpiMIB 1 } -- Cable Modem Group docsBpiCmObjects OBJECT IDENTIFIER ::= { docsBpiMIBObjects 1 } -- -- The BPI base and authorization table for CMs, indexed by ifIndex -- docsBpiCmBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic and authorization-related Baseline Privacy attributes of each CM MAC interface." ::= { docsBpiCmObjects 1 } docsBpiCmBaseEntry OBJECT-TYPE SYNTAX DocsBpiCmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpiCmBaseTable 1 } DocsBpiCmBaseEntry ::= SEQUENCE { docsBpiCmPrivacyEnable TruthValue, docsBpiCmPublicKey OCTET STRING, docsBpiCmAuthState INTEGER, docsBpiCmAuthKeySequenceNumber Integer32, docsBpiCmAuthExpires DateAndTime, docsBpiCmAuthReset TruthValue, docsBpiCmAuthGraceTime Integer32, docsBpiCmTEKGraceTime Integer32, docsBpiCmAuthWaitTimeout Integer32, docsBpiCmReauthWaitTimeout Integer32, docsBpiCmOpWaitTimeout Integer32, docsBpiCmRekeyWaitTimeout Integer32, docsBpiCmAuthRejectWaitTimeout Integer32, docsBpiCmAuthRequests Counter32, docsBpiCmAuthReplies Counter32, docsBpiCmAuthRejects Counter32, docsBpiCmAuthInvalids Counter32, docsBpiCmAuthRejectErrorCode INTEGER, docsBpiCmAuthRejectErrorString DisplayString, docsBpiCmAuthInvalidErrorCode INTEGER, docsBpiCmAuthInvalidErrorString DisplayString } docsBpiCmPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this CM is provisioned to run Baseline Privacy. This is analogous to the presence (or absence) of the Baseline Privacy Configuration Setting option. The status of each individual SID with respect to Baseline Privacy is captured in the docsBpiCmTEKPrivacyEnable object. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1." ::= { docsBpiCmBaseEntry 1 } docsBpiCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (74 | 106 | 140 | 270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [22], corresponding to the public key of the CM. The 74, 106, 140, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and 2048 public moduli respectively." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.2.4." ::= { docsBpiCmBaseEntry 2 } docsBpiCmAuthState OBJECT-TYPE SYNTAX INTEGER { start(1), authWait(2), authorized(3), reauthWait(4), authRejectWait(5) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the CM authorization FSM. The start state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.2.1." ::= { docsBpiCmBaseEntry 3 } docsBpiCmAuthKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the authorization key sequence number for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpiCmBaseEntry 4 } docsBpiCmAuthExpires OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the current authorization for this FSM expires. If the CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpiCmBaseEntry 5 } docsBpiCmAuthReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE generates a Reauthorize event in the authorization FSM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.2.3.4." ::= { docsBpiCmBaseEntry 6 } docsBpiCmAuthGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for an authorization key. A CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.3." ::= { docsBpiCmBaseEntry 7 } docsBpiCmTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for a TEK. A CM is expected to start trying to get a new TEK beginning TEKGraceTime seconds before the TEK actually expires. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.6." ::= { docsBpiCmBaseEntry 8 } docsBpiCmAuthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorize Wait Timeout. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.1." ::= { docsBpiCmBaseEntry 9 } docsBpiCmReauthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Reauthorize Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.2." ::= { docsBpiCmBaseEntry 10 } docsBpiCmOpWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Operational Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.4." ::= { docsBpiCmBaseEntry 11 } docsBpiCmRekeyWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Rekey Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.5." ::= { docsBpiCmBaseEntry 12 } docsBpiCmAuthRejectWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..600) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorization Reject Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.7." ::= { docsBpiCmBaseEntry 13 } docsBpiCmAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an Authorization Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmBaseEntry 14 } docsBpiCmAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reply message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmBaseEntry 15 } docsBpiCmAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reject message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmBaseEntry 16 } docsBpiCmAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Invalid message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmBaseEntry 17 } docsBpiCmAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.16." ::= { docsBpiCmBaseEntry 18 } docsBpiCmAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message received by the CM. This is a zero length string if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpiCmBaseEntry 19 } docsBpiCmAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.16." ::= { docsBpiCmBaseEntry 20 } docsBpiCmAuthInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message received by the CM. This is a zero length string if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpiCmBaseEntry 21 } -- -- The CM TEK Table, indexed by ifIndex and SID -- docsBpiCmTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key (TEK) association. The CM maintains (no more than) one TEK association per SID per CM MAC interface." ::= { docsBpiCmObjects 2 } docsBpiCmTEKEntry OBJECT-TYPE SYNTAX DocsBpiCmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the TEK association attributes of one SID. The CM MUST create one entry per unicast or multicast SID, regardless of whether the SID was obtained from a Registration Response message, from an Authorization Reply message, or from any future dynamic SID establishment mechanisms. " INDEX { ifIndex, docsIfCmServiceId } ::= { docsBpiCmTEKTable 1 } DocsBpiCmTEKEntry ::= SEQUENCE { docsBpiCmTEKPrivacyEnable TruthValue, docsBpiCmTEKState INTEGER, docsBpiCmTEKExpiresOld DateAndTime, docsBpiCmTEKExpiresNew DateAndTime, docsBpiCmTEKKeyRequests Counter32, docsBpiCmTEKKeyReplies Counter32, docsBpiCmTEKKeyRejects Counter32, docsBpiCmTEKInvalids Counter32, docsBpiCmTEKAuthPends Counter32, docsBpiCmTEKKeyRejectErrorCode INTEGER, docsBpiCmTEKKeyRejectErrorString DisplayString, docsBpiCmTEKInvalidErrorCode INTEGER, docsBpiCmTEKInvalidErrorString DisplayString } docsBpiCmTEKPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this SID is provisioned to run Baseline Privacy. This is analogous to enabling Baseline Privacy on a provisioned SID using the Class-of-Service Privacy Enable option. Baseline Privacy is not effectively enabled for any SID unless Baseline Privacy is enabled for the CM, which is managed via the docsBpiCmPrivacyEnable object. Note: this object will be read-write accessible only after the CMTS has the capability to authorize the starting or stopping of a particular TEK state machine." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.2." ::= { docsBpiCmTEKEntry 1 } docsBpiCmTEKState OBJECT-TYPE SYNTAX INTEGER { start(1), opWait(2), opReauthWait(3), operational(4), rekeyWait(5), rekeyReauthWait(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the indicated TEK FSM. The start(1) state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.1." ::= { docsBpiCmTEKEntry 2 } docsBpiCmTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmTEKEntry 3 } docsBpiCmTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmTEKEntry 4 } docsBpiCmTEKKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted a Key Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.4." ::= { docsBpiCmTEKEntry 5 } docsBpiCmTEKKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reply message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5." ::= { docsBpiCmTEKEntry 6 } docsBpiCmTEKKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reject message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.6." ::= { docsBpiCmTEKEntry 7 } docsBpiCmTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a TEK Invalid message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.8." ::= { docsBpiCmTEKEntry 8 } docsBpiCmTEKAuthPends OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times an Authorization Pending (Auth Pend) event occurred in this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.3.3." ::= { docsBpiCmTEKEntry 9 } docsBpiCmTEKKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Key Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.6 and 4.2.2.16." ::= { docsBpiCmTEKEntry 10 } docsBpiCmTEKKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Key Reject message received by the CM. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.6 and 4.2.2.6." ::= { docsBpiCmTEKEntry 11 } docsBpiCmTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent TEK Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.8 and 4.2.2.16." ::= { docsBpiCmTEKEntry 12 } docsBpiCmTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent TEK Invalid message received by the CM. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.8 and 4.2.2.6." ::= { docsBpiCmTEKEntry 13 } -- Cable Modem Termination System Group docsBpiCmtsObjects OBJECT IDENTIFIER ::= { docsBpiMIBObjects 2 } -- -- The BPI base table for CMTSs, indexed by ifIndex -- docsBpiCmtsBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic Baseline Privacy attributes of each CMTS MAC interface." ::= { docsBpiCmtsObjects 1 } docsBpiCmtsBaseEntry OBJECT-TYPE SYNTAX DocsBpiCmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CMTS MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpiCmtsBaseTable 1 } DocsBpiCmtsBaseEntry ::= SEQUENCE { docsBpiCmtsDefaultAuthLifetime Integer32, docsBpiCmtsDefaultTEKLifetime Integer32, -- docsBpiCmtsDefaultAuthGraceTime Integer32, -- docsBpiCmtsDefaultTEKGraceTime Integer32, docsBpiCmtsAuthRequests Counter32, docsBpiCmtsAuthReplies Counter32, docsBpiCmtsAuthRejects Counter32, docsBpiCmtsAuthInvalids Counter32 } docsBpiCmtsDefaultAuthLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new authorization key." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.2." ::= { docsBpiCmtsBaseEntry 1 } docsBpiCmtsDefaultTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new Traffic Encryption Key (TEK)." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.2." ::= { docsBpiCmtsBaseEntry 2 } -- Note: the following two objects have been removed from this MIB. -- docsBpiCmtsDefaultAuthGraceTime OBJECT-TYPE -- SYNTAX Integer32 (1..1800) -- UNITS "seconds" -- MAX-ACCESS read-write -- STATUS current -- DESCRIPTION -- "Default grace time, in seconds, the CMTS uses for an authorization -- key. This controls how far in advance of authorization key expiration -- that the CMTS is expected to produce the next generation of keying -- material. This value is expected to agree with the Authorization Grace -- Time that the provisioning system provides to CMs." -- ::= { docsBpiCmtsBaseEntry 3 } -- docsBpiCmtsDefaultTEKGraceTime OBJECT-TYPE -- SYNTAX Integer32 (1..1800) -- UNITS "seconds" -- MAX-ACCESS read-write -- STATUS current -- DESCRIPTION -- "Default grace time, in seconds, the CMTS uses for a Traffic -- Encryption Key (TEK). This controls how far in advance of TEK -- expiration that the CMTS is expected to produce the next generation -- of keying material. This value is expected to agree with the TEK Grace -- Time that the provisioning system provides to CMs. Note that this -- object is particularly relevant for multicast SIDs, where multiple -- grace time values cannot be honored." -- ::= { docsBpiCmtsBaseEntry 4 } docsBpiCmtsAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmtsBaseEntry 5 } docsBpiCmtsAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmtsBaseEntry 6 } docsBpiCmtsAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmtsBaseEntry 7 } docsBpiCmtsAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmtsBaseEntry 8 } -- -- The CMTS Authorization Table, indexed by ifIndex and CM MAC address -- docsBpiCmtsAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM authorization association. The CMTS maintains one authorization association with each Baseline Privacy-enabled CM on each CMTS MAC interface." ::= { docsBpiCmtsObjects 2 } docsBpiCmtsAuthEntry OBJECT-TYPE SYNTAX DocsBpiCmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one authorization association. The CMTS MUST create one entry per CM per MAC interface, based on the receipt of an Authorization Request message, and MUST not delete the entry before the CM authorization permanently expires." INDEX { ifIndex, docsBpiCmtsAuthCmMacAddress } ::= { docsBpiCmtsAuthTable 1 } DocsBpiCmtsAuthEntry ::= SEQUENCE { docsBpiCmtsAuthCmMacAddress MacAddress, docsBpiCmtsAuthCmPublicKey OCTET STRING, docsBpiCmtsAuthCmKeySequenceNumber Integer32, docsBpiCmtsAuthCmExpires DateAndTime, docsBpiCmtsAuthCmLifetime Integer32, docsBpiCmtsAuthCmGraceTime Integer32, docsBpiCmtsAuthCmReset INTEGER, docsBpiCmtsAuthCmRequests Counter32, docsBpiCmtsAuthCmReplies Counter32, docsBpiCmtsAuthCmRejects Counter32, docsBpiCmtsAuthCmInvalids Counter32, docsBpiCmtsAuthRejectErrorCode INTEGER, docsBpiCmtsAuthRejectErrorString DisplayString, docsBpiCmtsAuthInvalidErrorCode INTEGER, docsBpiCmtsAuthInvalidErrorString DisplayString } docsBpiCmtsAuthCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the physical address of the CM to which the authorization association applies." ::= { docsBpiCmtsAuthEntry 1 } docsBpiCmtsAuthCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0 | 74 | 106 | 140 | 270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [22], corresponding to the public key of the CM. The 74, 106, 140, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and 2048 public moduli respectively. This is a zero-length string if the CMTS does not retain the public key." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.2.4." ::= { docsBpiCmtsAuthEntry 2 } docsBpiCmtsAuthCmKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the authorization key sequence number for this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpiCmtsAuthEntry 3 } docsBpiCmtsAuthCmExpires OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the current authorization for this CM expires. If this CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpiCmtsAuthEntry 4 } docsBpiCmtsAuthCmLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to an authorization key for this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2 and Appendix A.2." ::= { docsBpiCmtsAuthEntry 5 } docsBpiCmtsAuthCmGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the authorization key in seconds. The CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.3." ::= { docsBpiCmtsAuthEntry 6 } docsBpiCmtsAuthCmReset OBJECT-TYPE SYNTAX INTEGER { noResetRequested(1), invalidateAuth(2), sendAuthInvalid(3), invalidateTeks(4) } MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to invalidateAuth(2) causes the CMTS to invalidate the current CM authorization key, but not to transmit an Authorization Invalid message nor to invalidate unicast TEKs. Setting this object to sendAuthInvalid(3) causes the CMTS to invalidate the current CM authorization key, and to transmit an Authorization Invalid message to the CM, but not to invalidate unicast TEKs. Setting this object to invalidateTeks(4) causes the CMTS to invalidate the current CM authorization key, to transmit an Authorization Invalid message to the CM, and to invalidate all unicast TEKs associated with this CM authorization. Reading this object returns the most-recently-set value of this object, or returns noResetRequested(1) if the object has not been set since the last CMTS reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5." ::= { docsBpiCmtsAuthEntry 7 } docsBpiCmtsAuthCmRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmtsAuthEntry 8 } docsBpiCmtsAuthCmReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmtsAuthEntry 9 } docsBpiCmtsAuthCmRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reject message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmtsAuthEntry 10 } docsBpiCmtsAuthCmInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmtsAuthEntry 11 } docsBpiCmtsAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.16." ::= { docsBpiCmtsAuthEntry 12 } docsBpiCmtsAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message transmitted to the CM. This is a zero length string if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpiCmtsAuthEntry 13 } docsBpiCmtsAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.16." ::= { docsBpiCmtsAuthEntry 14 } docsBpiCmtsAuthInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message transmitted to the CM. This is a zero length string if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpiCmtsAuthEntry 15 } -- -- The CMTS TEK Table, indexed by ifIndex and SID -- docsBpiCmtsTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key (TEK) association. The CMTS maintains one TEK association per BPI SID on each CMTS MAC interface." ::= { docsBpiCmtsObjects 3 } docsBpiCmtsTEKEntry OBJECT-TYPE SYNTAX DocsBpiCmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one TEK association on a particular CMTS MAC interface. The CMTS MUST create one entry per SID per MAC interface, based on the receipt of an Key Request message, and MUST not delete the entry before the CM authorization for the SID permanently expires." INDEX { ifIndex, docsIfCmtsServiceId } ::= { docsBpiCmtsTEKTable 1 } DocsBpiCmtsTEKEntry ::= SEQUENCE { docsBpiCmtsTEKLifetime Integer32, docsBpiCmtsTEKGraceTime Integer32, docsBpiCmtsTEKExpiresOld DateAndTime, docsBpiCmtsTEKExpiresNew DateAndTime, docsBpiCmtsTEKReset TruthValue, docsBpiCmtsKeyRequests Counter32, docsBpiCmtsKeyReplies Counter32, docsBpiCmtsKeyRejects Counter32, docsBpiCmtsTEKInvalids Counter32, docsBpiCmtsKeyRejectErrorCode INTEGER, docsBpiCmtsKeyRejectErrorString DisplayString, docsBpiCmtsTEKInvalidErrorCode INTEGER, docsBpiCmtsTEKInvalidErrorString DisplayString } docsBpiCmtsTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to keys for this TEK association." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5 and Appendix A.2." ::= { docsBpiCmtsTEKEntry 1 } docsBpiCmtsTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the TEK in seconds. The CM is expected to start trying to get a new TEK beginning TEKGraceTime seconds before the TEK actually expires." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.6." ::= { docsBpiCmtsTEKEntry 2 } docsBpiCmtsTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmtsTEKEntry 3 } docsBpiCmtsTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmtsTEKEntry 4 } docsBpiCmtsTEKReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE causes the CMTS to invalidate the current active TEK(s) (plural due to key transition periods), and to generate a new TEK for the associated SID; the CMTS MAY also generate an unsolicited TEK Invalid message, to optimize the TEK synchronization between the CMTS and the CM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.3.5." ::= { docsBpiCmtsTEKEntry 5 } docsBpiCmtsKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received a Key Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.4." ::= { docsBpiCmtsTEKEntry 6 } docsBpiCmtsKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reply message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5." ::= { docsBpiCmtsTEKEntry 7 } docsBpiCmtsKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reject message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.6." ::= { docsBpiCmtsTEKEntry 8 } docsBpiCmtsTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a TEK Invalid message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.8." ::= { docsBpiCmtsTEKEntry 9 } docsBpiCmtsKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent Key Reject message sent in response to a Key Request for this BPI SID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.6 and 4.2.2.16." ::= { docsBpiCmtsTEKEntry 10 } docsBpiCmtsKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent Key Reject message sent in response to a Key Request for this BPI SID. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.6 and 4.2.2.6." ::= { docsBpiCmtsTEKEntry 11 } docsBpiCmtsTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent TEK Invalid message sent in association with this BPI SID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.8 and 4.2.2.16." ::= { docsBpiCmtsTEKEntry 12 } docsBpiCmtsTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent TEK Invalid message sent in association with this BPI SID. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.8 and 4.2.2.6." ::= { docsBpiCmtsTEKEntry 13 } -- -- The CMTS Multicast Control Group -- docsBpiMulticastControl OBJECT IDENTIFIER ::= { docsBpiCmtsObjects 4 } -- -- The CMTS IP Multicast Mapping Table, indexed by IP multicast -- address and prefix, and by ifindex -- docsBpiIpMulticastMapTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the mapping of IP multicast address prefixes to multicast SIDs on each CMTS MAC interface." ::= { docsBpiMulticastControl 1 } docsBpiIpMulticastMapEntry OBJECT-TYPE SYNTAX DocsBpiIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the mapping of one IP multicast address prefix to one multicast SID on one CMTS MAC interface. The CMTS uses the mapping when forwarding downstream IP multicast traffic." INDEX { ifIndex, docsBpiIpMulticastAddress, docsBpiIpMulticastPrefixLength } ::= { docsBpiIpMulticastMapTable 1 } DocsBpiIpMulticastMapEntry ::= SEQUENCE { docsBpiIpMulticastAddress IpAddress, docsBpiIpMulticastPrefixLength Integer32, docsBpiIpMulticastServiceId Integer32, docsBpiIpMulticastMapControl RowStatus } docsBpiIpMulticastAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address (prefix) to be mapped." ::= { docsBpiIpMulticastMapEntry 1 } docsBpiIpMulticastPrefixLength OBJECT-TYPE SYNTAX Integer32 (0..32) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address prefix length to be mapped." ::= { docsBpiIpMulticastMapEntry 2 } docsBpiIpMulticastServiceId OBJECT-TYPE SYNTAX Integer32 (8192..16368) MAX-ACCESS read-create STATUS current DESCRIPTION "This object represents the multicast SID to be used in this IP multicast address prefix mapping entry." -- DEFVAL is an unused multicast SID value chosen by CMTS. ::= { docsBpiIpMulticastMapEntry 3 } docsBpiIpMulticastMapControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the IP multicast address prefix mapping entry." ::= { docsBpiIpMulticastMapEntry 4 } -- -- The CMTS Multicast SID Authorization Table, indexed by ifIndex by -- multicast SID by CM MAC address -- docsBpiMulticastAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the multicast SID authorization for each CM on each CMTS MAC interface." ::= { docsBpiMulticastControl 2 } docsBpiMulticastAuthEntry OBJECT-TYPE SYNTAX DocsBpiMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the key authorization of one cable modem for one multicast SID for one CMTS MAC interface." INDEX { ifIndex, docsBpiMulticastServiceId, docsBpiMulticastCmMacAddress } ::= { docsBpiMulticastAuthTable 1 } DocsBpiMulticastAuthEntry ::= SEQUENCE { docsBpiMulticastServiceId Integer32, docsBpiMulticastCmMacAddress MacAddress, docsBpiMulticastAuthControl RowStatus } docsBpiMulticastServiceId OBJECT-TYPE SYNTAX Integer32 (8192..16368) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the multicast SID for authorization." ::= { docsBpiMulticastAuthEntry 1 } docsBpiMulticastCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the MAC address of the CM to which the multicast SID authorization applies." ::= { docsBpiMulticastAuthEntry 2 } docsBpiMulticastAuthControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the CM authorization for each multicast SID." ::= { docsBpiMulticastAuthEntry 3 } -- -- The BPI MIB Conformance Statements (with a placeholder for -- notifications) -- docsBpiNotification OBJECT IDENTIFIER ::= { docsBpiMIB 2 } docsBpiConformance OBJECT IDENTIFIER ::= { docsBpiMIB 3 } docsBpiCompliances OBJECT IDENTIFIER ::= { docsBpiConformance 1 } docsBpiGroups OBJECT IDENTIFIER ::= { docsBpiConformance 2 } docsBpiBasicCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "This is the compliance statement for devices which implement the DOCSIS Baseline Privacy Interface." MODULE -- docsBpiMIB -- conditionally mandatory group GROUP docsBpiCmGroup DESCRIPTION "This group is implemented only in CMs, not in CMTSs." -- conditionally mandatory group GROUP docsBpiCmtsGroup DESCRIPTION "This group is implemented only in CMTSs, not in CMs." -- relaxation on mandatory range (unnecessary since object is read-only) -- OBJECT docsBpiCmAuthGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (unnecessary since object is read-only) -- OBJECT docsBpiCmTEKGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsDefaultAuthLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsDefaultTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (object removed from MIB) -- OBJECT docsBpiCmtsDefaultAuthGraceTime -- SYNTAX INTEGER (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (object removed from MIB) -- OBJECT docsBpiCmtsDefaultTEKGraceTime -- SYNTAX INTEGER (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsAuthCmLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (unnecessary since object is read-only) -- OBJECT docsBpiCmtsAuthCmGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (unnecessary since object is read-only) -- OBJECT docsBpiCmtsTEKGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." ::= { docsBpiCompliances 1 } docsBpiCmGroup OBJECT-GROUP OBJECTS { docsBpiCmPrivacyEnable, docsBpiCmPublicKey, docsBpiCmAuthState, docsBpiCmAuthKeySequenceNumber, docsBpiCmAuthExpires, docsBpiCmAuthReset, docsBpiCmAuthGraceTime, docsBpiCmTEKGraceTime, docsBpiCmAuthWaitTimeout, docsBpiCmReauthWaitTimeout, docsBpiCmOpWaitTimeout, docsBpiCmRekeyWaitTimeout, docsBpiCmAuthRejectWaitTimeout, docsBpiCmAuthRequests, docsBpiCmAuthReplies, docsBpiCmAuthRejects, docsBpiCmAuthInvalids, docsBpiCmAuthRejectErrorCode, docsBpiCmAuthRejectErrorString, docsBpiCmAuthInvalidErrorCode, docsBpiCmAuthInvalidErrorString, docsBpiCmTEKPrivacyEnable, docsBpiCmTEKState, docsBpiCmTEKExpiresOld, docsBpiCmTEKExpiresNew, docsBpiCmTEKKeyRequests, docsBpiCmTEKKeyReplies, docsBpiCmTEKKeyRejects, docsBpiCmTEKInvalids, docsBpiCmTEKAuthPends, docsBpiCmTEKKeyRejectErrorCode, docsBpiCmTEKKeyRejectErrorString, docsBpiCmTEKInvalidErrorCode, docsBpiCmTEKInvalidErrorString } STATUS current DESCRIPTION "This collection of objects provides CM BPI status and control." ::= { docsBpiGroups 1 } docsBpiCmtsGroup OBJECT-GROUP OBJECTS { docsBpiCmtsDefaultAuthLifetime, docsBpiCmtsDefaultTEKLifetime, -- docsBpiCmtsDefaultAuthGraceTime, -- docsBpiCmtsDefaultTEKGraceTime, docsBpiCmtsAuthRequests, docsBpiCmtsAuthReplies, docsBpiCmtsAuthRejects, docsBpiCmtsAuthInvalids, docsBpiCmtsAuthCmPublicKey, docsBpiCmtsAuthCmKeySequenceNumber, docsBpiCmtsAuthCmExpires, docsBpiCmtsAuthCmLifetime, docsBpiCmtsAuthCmGraceTime, docsBpiCmtsAuthCmReset, docsBpiCmtsAuthCmRequests, docsBpiCmtsAuthCmReplies, docsBpiCmtsAuthCmRejects, docsBpiCmtsAuthCmInvalids, docsBpiCmtsAuthRejectErrorCode, docsBpiCmtsAuthRejectErrorString, docsBpiCmtsAuthInvalidErrorCode, docsBpiCmtsAuthInvalidErrorString, docsBpiCmtsTEKLifetime, docsBpiCmtsTEKGraceTime, docsBpiCmtsTEKExpiresOld, docsBpiCmtsTEKExpiresNew, docsBpiCmtsTEKReset, docsBpiCmtsKeyRequests, docsBpiCmtsKeyReplies, docsBpiCmtsKeyRejects, docsBpiCmtsTEKInvalids, docsBpiCmtsKeyRejectErrorCode, docsBpiCmtsKeyRejectErrorString, docsBpiCmtsTEKInvalidErrorCode, docsBpiCmtsTEKInvalidErrorString, docsBpiIpMulticastServiceId, docsBpiIpMulticastMapControl, docsBpiMulticastAuthControl } STATUS current DESCRIPTION "This collection of objects provides CMTS BPI status and control." ::= { docsBpiGroups 2 } END --=====================_3100348==_ Content-Type: text/plain; charset="us-ascii" --=====================_3100348==_-- From owner-ipcdn@terayon.com Mon Jan 31 12:55:13 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11070 for ; Mon, 31 Jan 2000 12:54:57 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id JAA07300; Mon, 31 Jan 2000 09:49:40 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 31 Jan 2000 17:49:40 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id JAA10527; Mon, 31 Jan 2000 09:49:39 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id JAA21687 for ipcdn-outgoing; Mon, 31 Jan 2000 09:47:08 -0800 (PST) Message-Id: <200001311746.MAA25173@funnel.cisco.com> X-Sender: rwoundy@funnel X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0.2 Date: Mon, 31 Jan 2000 12:50:47 -0500 To: ipcdn@terayon.com From: Rich Woundy Subject: BPI (not BPI+) MIB Internet Draft Cc: docsis-oss@cablelabs.com Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=====================_4363884==_" Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com --=====================_4363884==_ Content-Type: text/plain; charset="us-ascii" Folks, I have attached the latest DOCSIS Baseline Privacy MIB (for pre-BPI+ modems) Internet draft. It includes the February 1st version of the BPI MIB. Some of the non-MIB editorial changes include: 1. Adopted "SNMP Management Framework" section similar to RFCs 2669/2670. 2. Added "Table of Contents" and "Glossary". 3. Updated "References" and "Security Considerations" with some references/text stolen from RFCs 2669/2670. 4. Added "Intellectual Property" and "Copyright Statement". Please send comments by Friday morning. The intent is to publish this Internet draft as an Informational RFC. -- Rich --=====================_4363884==_ Content-Type: text/plain; charset="us-ascii" Content-Disposition: attachment; filename="bpi-id-020100.txt" Internet Draft R. Woundy IPCDN Working Group Cisco Systems draft-ietf-ipcdn-mcns-bpi-mib-01.txt Expires: 1 August 2000 Baseline Privacy Interface Management Information Base for DOCSIS Compliant Cable Modems and Cable Modem Termination Systems Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. Copyright Notice Copyright (C) The Internet Society (2000). All Rights Reserved. Abstract This memo defines an experimental portion of the Management Information Base (MIB) for use with network management protocols in the Internet community. In particular, it defines a basic set of managed objects for SNMP-based management of the Baseline Privacy Interface, which provides data privacy for DOCSIS 1.0 compliant Cable Modems and Cable Modem Termination Systems. This MIB is defined as an extension to the DOCSIS Radio Frequency Interface MIB, RFC 2670. This memo specifies a MIB module in a manner that is compliant to the SNMPv2 SMI. The set of objects is consistent with the SNMP framework and existing SNMP standards. This memo does not specify a standard for the Internet community. Expires August 2000 [Page 1] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 This memo is a product of the IPCDN working group within the Internet Engineering Task Force. Comments are solicited and should be addressed to the working group's mailing list at ipcdn@terayon.com and/or the author. Table of Contents 1 The SNMP Management Framework ................................... 2 2 Glossary ........................................................ 3 2.1 Authorization key ............................................. 3 2.2 BPI ........................................................... 3 2.3 BPI+ .......................................................... 4 2.4 CATV .......................................................... 4 2.5 CM ............................................................ 4 2.6 CMTS .......................................................... 4 2.7 DOCSIS ........................................................ 4 2.8 Downstream .................................................... 4 2.9 Head-end ...................................................... 4 2.10 MAC Packet ................................................... 4 2.11 MCNS ......................................................... 4 2.12 RF ........................................................... 5 2.13 SID .......................................................... 5 2.14 TEK .......................................................... 5 2.15 Upstream ..................................................... 5 3 Overview ........................................................ 5 3.1 Structure of the MIB .......................................... 5 3.2 Management requirements ....................................... 6 4 Definitions ..................................................... 7 5 Acknowledgments ................................................ 40 6 References ..................................................... 40 7 Security Considerations ........................................ 42 8 Intellectual Property .......................................... 42 9 Author's Address ............................................... 43 10 Full Copyright Statement ...................................... 43 1. The SNMP Management Framework The SNMP Management Framework presently consists of five major components: o An overall architecture, described in RFC 2571 [1]. o Mechanisms for describing and naming objects and events for the purpose of management. The first version of this Structure of Management Information (SMI) is called SMIv1 and described in STD 16, RFC 1155 [2], STD 16, RFC 1212 [3] and RFC 1215 [4]. The second version, called SMIv2, is described in STD 58, RFC 2578 [5], STD 58, RFC 2579 [6] and STD 58, RFC 2580 [7]. Expires August 2000 [Page 2] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 o Message protocols for transferring management information. The first version of the SNMP message protocol is called SNMPv1 and described in STD 15, RFC 1157 [8]. A second version of the SNMP message protocol, which is not an Internet standards track protocol, is called SNMPv2c and described in RFC 1901 [9] and RFC 1906 [10]. The third version of the message protocol is called SNMPv3 and described in RFC 1906 [10], RFC 2572 [11] and RFC 2574 [12]. o Protocol operations for accessing management information. The first set of protocol operations and associated PDU formats is described in STD 15, RFC 1157 [8]. A second set of protocol operations and associated PDU formats is described in RFC 1905 [13]. o A set of fundamental applications described in RFC 2573 [14] and the view-based access control mechanism described in RFC 2575 [15]. Managed objects are accessed via a virtual information store, termed the Management Information Base or MIB. Objects in the MIB are defined using the mechanisms defined in the SMI. This memo specifies a MIB module that is compliant to the SMIv2. A MIB conforming to the SMIv1 can be produced through the appropriate translations. The resulting translated MIB must be semantically equivalent, except where objects or events are omitted because no translation is possible (use of Counter64). Some machine readable information in SMIv2 will be converted into textual descriptions in SMIv1 during the translation process. However, this loss of machine readable information is not considered to change the semantics of the MIB. 2. Glossary The terms in this document are derived either from normal cable system usage, or from the documents associated with the Data Over Cable Service Interface Specification process. 2.1. Authorization key A key used to derive a key encryption key (used to encrypt TEKs), and to derive message authentication keys. When the CMTS communicates the authorization key to the CM, it encrypts the authorization key using the RSA public key of the CM [22]. 2.2. BPI - Baseline Privacy Interface Expires August 2000 [Page 3] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 A term referring to the DOCSIS specification [18] for enabling simple data privacy in the DOCSIS 1.0 system. Management of the BPI is the focus of this document. 2.3. BPI+ - Baseline Privacy Plus Interface A term referring to the DOCSIS specification [21] for enabling CM authentication and data privacy in the DOCSIS 1.1 system. Management of the BPI+ is not addressed in this document. 2.4. CATV Originally "Community Antenna Television", now used to refer to any cable or hybrid fiber and cable system used to deliver video signals to a community. 2.5. CM - Cable Modem A CM acts as a "slave" station in a DOCSIS compliant cable data system. 2.6. CMTS - Cable Modem Termination System A generic term covering a cable bridge or cable router in a head-end. A CMTS acts as the master station in a DOCSIS compliant cable data system. It is the only station that transmits downstream, and it controls the scheduling of upstream transmissions by its associated CMs. 2.7. DOCSIS "Data Over Cable Interface Specification". A term referring to the ITU-T J.112 Annex B standard for cable modem systems [19]. 2.8. Downstream The direction from the head-end towards the subscriber. 2.9. Head-end The origination point in most cable systems of the subscriber video signals. Generally also the location of the CMTS equipment. 2.10. MAC Packet A DOCSIS PDU. 2.11. MCNS Expires August 2000 [Page 4] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 "Multimedia Cable Network System". Generally replaced in usage by DOCSIS. 2.12. RF Radio Frequency. 2.13 SID Service ID. The SID identifies a particular upstream bandwidth allocation and class-of-service management for DOCSIS, and identifies a particular bidirectional security association for BPI. 2.14. TEK - Traffic Encryption Key Traffic Encryption Key, which is used for DES encryption of upstream and downstream traffic. When the CMTS communicates the TEK to the CM, it encrypts the TEK using the key encryption key derived from the authorization key. 2.15. Upstream The direction from the subscriber towards the head-end. 3. Overview This MIB provides a set of objects required for the management of the Baseline Privacy Interface for DOCSIS compliant Cable Modems (CMs) and Cable Modem Termination Systems (CMTSs). This MIB specification is derived from the DOCSIS Baseline Privacy Interface specification [18], which is an extension to the DOCSIS Radio Frequency Interface specification [19]. Please note that this MIB specification is not sufficient for the management of the DOCSIS Baseline Privacy Plus Interface specification [21]. The working group expects to issue a MIB for the management of BPI+ at a later time. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [23]. 3.1. Structure of the MIB This MIB consists of one group of CM-only objects (docsBpiCmGroup), and one group of CMTS-only objects (docsBpiCmtsGroup). The CM-only objects are organized into two tables: Expires August 2000 [Page 5] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 o The docsBpiCmBaseTable contains objects for managing basic Baseline Privacy parameters and counters, and for managing the Authorization finite state machine. o The docsBpiCmTEKTable contains objects for managing the Traffic Encryption Key (TEK) finite state machine per SID. The CMTS-only objects are organized into four sub-groups: o The docsBpiCmtsBaseTable contains objects for managing basic Baseline Privacy parameters and counters. o The docsBpiCmtsAuthTable contains objects for managing the Authorization association information per cable modem. o The docsBpiCmtsTEKTable contains objects for managing the TEK association information per SID. o The docsBpiMulticastControl consists of two tables. The docsBpiIpMulticastMapTable controls the mapping of downstream IP multicast data traffic to downstream multicast SID values. The docsBpiMulticastAuthTable controls which CMs are authorized to receive downstream traffic transmitted over particular multicast SIDs; a CM will receive TEKs corresponding to the multicast SIDs for which it is authorized. The combination of these two tables will limit the distribution of downstream IP multicast data traffic to authorized CMs. 3.2. Management requirements The Baseline Privacy Interface specification is documented in [18], and is an extension to the Radio Frequency Interface specification documented in [19]. In addition to the explicit requirements in this specification, the CM and CMTS enabled for Baseline Privacy MUST support all applicable DOCSIS and IETF requirements and MIB objects. Specifications that identify relevant requirements and MIB objects include the IETF Radio Frequency MIB [16], the IETF Cable Device MIB [17], and the DOCSIS OSSI Specification [20]. The explicit management requirements of the Baseline Privacy Interface, which motivate the development of the MIB in this document, are detailed below: o The CM and CMTS MUST support viewing relevant RSA public keys, for future subscriber authentication applications. o The Baseline Privacy management interface needs to support operator configuration of Authorization and TEK Finite State Expires August 2000 [Page 6] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 Machine (FSM) parameters, for performance tuning and security incident handling. The CMTS MUST support configuring and viewing all FSM-related parameters, including baseline privacy status (enabled or disabled), key lifetimes, key grace times, and state timeout values. The CM MUST support viewing these parameters where possible. o The management interface needs to support operator analysis and override of FSM behavior, for fault management, subscriber service de-provisioning, and security incident handling. The CM MUST support viewing the current FSM states. The CM and CMTS MUST support viewing message error codes and message error strings, and counters for invalid KEK and TEK events, for key expirations and renewals, and for duplicate messages. The CM and CMTS MUST support viewing current authorization key sequence numbers and key expiration times for failure diagnosis. o The management interface needs to support dynamic control of the distribution of IP multicast data traffic. This control includes forwarding IP multicast traffic to the correct multicast group (SID), and managing the membership lists of each multicast group (SID). The CMTS MUST support configuring and viewing all IP multicast forwarding state, and all multicast group memberships, within the MAC domains of the CMTS. 4. Definitions DOCS-BPI-MIB DEFINITIONS ::= BEGIN IMPORTS MODULE-IDENTITY, OBJECT-TYPE, Integer32, Counter32, IpAddress FROM SNMPv2-SMI DisplayString, MacAddress, RowStatus, TruthValue, DateAndTime FROM SNMPv2-TC OBJECT-GROUP, MODULE-COMPLIANCE FROM SNMPv2-CONF ifIndex FROM IF-MIB docsIfMib, docsIfCmServiceId, docsIfCmtsServiceId FROM DOCS-IF-MIB ; docsBpiMIB MODULE-IDENTITY LAST-UPDATED "200002011930Z" ORGANIZATION "IETF IPCDN Working Group" CONTACT-INFO "Rich Woundy Postal: Cisco Systems Expires August 2000 [Page 7] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 250 Apollo Drive Chelmsford, MA 01824 U.S.A. Tel: +1 978 244 8000 E-mail: rwoundy@cisco.com" DESCRIPTION "This is the MIB Module for the DOCSIS Baseline Privacy Interface (BPI) at cable modems (CMs) and cable modem termination systems (CMTSs)." ::= { docsIfMib 5 } docsBpiMIBObjects OBJECT IDENTIFIER ::= { docsBpiMIB 1 } -- Cable Modem Group docsBpiCmObjects OBJECT IDENTIFIER ::= { docsBpiMIBObjects 1 } -- -- The BPI base and authorization table for CMs, indexed by ifIndex -- docsBpiCmBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic and authorization-related Baseline Privacy attributes of each CM MAC interface." ::= { docsBpiCmObjects 1 } docsBpiCmBaseEntry OBJECT-TYPE SYNTAX DocsBpiCmBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." INDEX { ifIndex } ::= { docsBpiCmBaseTable 1 } DocsBpiCmBaseEntry ::= SEQUENCE { docsBpiCmPrivacyEnable TruthValue, docsBpiCmPublicKey OCTET STRING, docsBpiCmAuthState INTEGER, docsBpiCmAuthKeySequenceNumber Integer32, docsBpiCmAuthExpires DateAndTime, docsBpiCmAuthReset TruthValue, Expires August 2000 [Page 8] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 docsBpiCmAuthGraceTime Integer32, docsBpiCmTEKGraceTime Integer32, docsBpiCmAuthWaitTimeout Integer32, docsBpiCmReauthWaitTimeout Integer32, docsBpiCmOpWaitTimeout Integer32, docsBpiCmRekeyWaitTimeout Integer32, docsBpiCmAuthRejectWaitTimeout Integer32, docsBpiCmAuthRequests Counter32, docsBpiCmAuthReplies Counter32, docsBpiCmAuthRejects Counter32, docsBpiCmAuthInvalids Counter32, docsBpiCmAuthRejectErrorCode INTEGER, docsBpiCmAuthRejectErrorString DisplayString, docsBpiCmAuthInvalidErrorCode INTEGER, docsBpiCmAuthInvalidErrorString DisplayString } docsBpiCmPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this CM is provisioned to run Baseline Privacy. This is analogous to the presence (or absence) of the Baseline Privacy Configuration Setting option. The status of each individual SID with respect to Baseline Privacy is captured in the docsBpiCmTEKPrivacyEnable object. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1." ::= { docsBpiCmBaseEntry 1 } docsBpiCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (74 | 106 | 140 | 270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [22], corresponding to the public key of the CM. The 74, 106, 140, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and 2048 public moduli respectively." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.2.4." ::= { docsBpiCmBaseEntry 2 } Expires August 2000 [Page 9] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 docsBpiCmAuthState OBJECT-TYPE SYNTAX INTEGER { start(1), authWait(2), authorized(3), reauthWait(4), authRejectWait(5) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the CM authorization FSM. The start state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.2.1." ::= { docsBpiCmBaseEntry 3 } docsBpiCmAuthKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the authorization key sequence number for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpiCmBaseEntry 4 } docsBpiCmAuthExpires OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the current authorization for this FSM expires. If the CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpiCmBaseEntry 5 } docsBpiCmAuthReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION Expires August 2000 [Page 10] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 "Setting this object to TRUE generates a Reauthorize event in the authorization FSM. Reading this object always returns FALSE." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.2.3.4." ::= { docsBpiCmBaseEntry 6 } docsBpiCmAuthGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for an authorization key. A CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.3." ::= { docsBpiCmBaseEntry 7 } docsBpiCmTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for a TEK. A CM is expected to start trying to get a new TEK beginning TEKGraceTime seconds before the TEK actually expires. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.6." ::= { docsBpiCmBaseEntry 8 } docsBpiCmAuthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorize Wait Timeout. The value Expires August 2000 [Page 11] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.1." ::= { docsBpiCmBaseEntry 9 } docsBpiCmReauthWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..30) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Reauthorize Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.2." ::= { docsBpiCmBaseEntry 10 } docsBpiCmOpWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Operational Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.4." ::= { docsBpiCmBaseEntry 11 } docsBpiCmRekeyWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..10) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Rekey Wait Timeout in seconds. The value of this object cannot be changed while the authorization state Expires August 2000 [Page 12] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.5." ::= { docsBpiCmBaseEntry 12 } docsBpiCmAuthRejectWaitTimeout OBJECT-TYPE SYNTAX Integer32 (1..600) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Authorization Reject Wait Timeout in seconds. The value of this object cannot be changed while the authorization state machine is running. Note: this object will be read-write accessible only after the ability to start and stop the authorization state machine is understood." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.7." ::= { docsBpiCmBaseEntry 13 } docsBpiCmAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted an Authorization Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmBaseEntry 14 } docsBpiCmAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reply message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmBaseEntry 15 } docsBpiCmAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only Expires August 2000 [Page 13] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Reject message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmBaseEntry 16 } docsBpiCmAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received an Authorization Invalid message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmBaseEntry 17 } docsBpiCmAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.16." ::= { docsBpiCmBaseEntry 18 } docsBpiCmAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message received by the CM. This is a zero length string if no Authorization Reject message has been received since reboot." Expires August 2000 [Page 14] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.6." ::= { docsBpiCmBaseEntry 19 } docsBpiCmAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.16." ::= { docsBpiCmBaseEntry 20 } docsBpiCmAuthInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message received by the CM. This is a zero length string if no Authorization Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpiCmBaseEntry 21 } -- -- The CM TEK Table, indexed by ifIndex and SID -- docsBpiCmTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmTEKEntry MAX-ACCESS not-accessible Expires August 2000 [Page 15] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Key (TEK) association. The CM maintains (no more than) one TEK association per SID per CM MAC interface." ::= { docsBpiCmObjects 2 } docsBpiCmTEKEntry OBJECT-TYPE SYNTAX DocsBpiCmTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the TEK association attributes of one SID. The CM MUST create one entry per unicast or multicast SID, regardless of whether the SID was obtained from a Registration Response message, from an Authorization Reply message, or from any future dynamic SID establishment mechanisms. " INDEX { ifIndex, docsIfCmServiceId } ::= { docsBpiCmTEKTable 1 } DocsBpiCmTEKEntry ::= SEQUENCE { docsBpiCmTEKPrivacyEnable TruthValue, docsBpiCmTEKState INTEGER, docsBpiCmTEKExpiresOld DateAndTime, docsBpiCmTEKExpiresNew DateAndTime, docsBpiCmTEKKeyRequests Counter32, docsBpiCmTEKKeyReplies Counter32, docsBpiCmTEKKeyRejects Counter32, docsBpiCmTEKInvalids Counter32, docsBpiCmTEKAuthPends Counter32, docsBpiCmTEKKeyRejectErrorCode INTEGER, docsBpiCmTEKKeyRejectErrorString DisplayString, docsBpiCmTEKInvalidErrorCode INTEGER, docsBpiCmTEKInvalidErrorString DisplayString } docsBpiCmTEKPrivacyEnable OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-only STATUS current DESCRIPTION "This object identifies whether this SID is provisioned to run Baseline Privacy. This is analogous to enabling Baseline Privacy on a provisioned SID using the Class-of-Service Privacy Enable option. Baseline Privacy is not effectively enabled for any SID unless Baseline Privacy is enabled for the CM, which is managed via the docsBpiCmPrivacyEnable object. Note: this object will be read-write accessible only after the Expires August 2000 [Page 16] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 CMTS has the capability to authorize the starting or stopping of a particular TEK state machine." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.2." ::= { docsBpiCmTEKEntry 1 } docsBpiCmTEKState OBJECT-TYPE SYNTAX INTEGER { start(1), opWait(2), opReauthWait(3), operational(4), rekeyWait(5), rekeyReauthWait(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the state of the indicated TEK FSM. The start(1) state indicates that FSM is in its initial state." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.1." ::= { docsBpiCmTEKEntry 2 } docsBpiCmTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmTEKEntry 3 } docsBpiCmTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." Expires August 2000 [Page 17] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 ::= { docsBpiCmTEKEntry 4 } docsBpiCmTEKKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has transmitted a Key Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.4." ::= { docsBpiCmTEKEntry 5 } docsBpiCmTEKKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reply message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5." ::= { docsBpiCmTEKEntry 6 } docsBpiCmTEKKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a Key Reject message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.6." ::= { docsBpiCmTEKEntry 7 } docsBpiCmTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CM has received a TEK Invalid message, including a message whose authentication failed." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.8." ::= { docsBpiCmTEKEntry 8 } docsBpiCmTEKAuthPends OBJECT-TYPE SYNTAX Counter32 Expires August 2000 [Page 18] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times an Authorization Pending (Auth Pend) event occurred in this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.3.3." ::= { docsBpiCmTEKEntry 9 } docsBpiCmTEKKeyRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Key Reject message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.6 and 4.2.2.16." ::= { docsBpiCmTEKEntry 10 } docsBpiCmTEKKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Key Reject message received by the CM. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.6 and 4.2.2.6." ::= { docsBpiCmTEKEntry 11 } docsBpiCmTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current Expires August 2000 [Page 19] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent TEK Invalid message received by the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.8 and 4.2.2.16." ::= { docsBpiCmTEKEntry 12 } docsBpiCmTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent TEK Invalid message received by the CM. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.8 and 4.2.2.6." ::= { docsBpiCmTEKEntry 13 } -- Cable Modem Termination System Group docsBpiCmtsObjects OBJECT IDENTIFIER ::= { docsBpiMIBObjects 2 } -- -- The BPI base table for CMTSs, indexed by ifIndex -- docsBpiCmtsBaseTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the basic Baseline Privacy attributes of each CMTS MAC interface." ::= { docsBpiCmtsObjects 1 } docsBpiCmtsBaseEntry OBJECT-TYPE SYNTAX DocsBpiCmtsBaseEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one CMTS MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127)." Expires August 2000 [Page 20] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 INDEX { ifIndex } ::= { docsBpiCmtsBaseTable 1 } DocsBpiCmtsBaseEntry ::= SEQUENCE { docsBpiCmtsDefaultAuthLifetime Integer32, docsBpiCmtsDefaultTEKLifetime Integer32, -- docsBpiCmtsDefaultAuthGraceTime Integer32, -- docsBpiCmtsDefaultTEKGraceTime Integer32, docsBpiCmtsAuthRequests Counter32, docsBpiCmtsAuthReplies Counter32, docsBpiCmtsAuthRejects Counter32, docsBpiCmtsAuthInvalids Counter32 } docsBpiCmtsDefaultAuthLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new authorization key." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.2." ::= { docsBpiCmtsBaseEntry 1 } docsBpiCmtsDefaultTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the default lifetime, in seconds, the CMTS assigns to a new Traffic Encryption Key (TEK)." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.2." ::= { docsBpiCmtsBaseEntry 2 } -- Note: the following two objects have been removed from this MIB. -- docsBpiCmtsDefaultAuthGraceTime OBJECT-TYPE -- SYNTAX Integer32 (1..1800) -- UNITS "seconds" -- MAX-ACCESS read-write -- STATUS current -- DESCRIPTION -- "Default grace time, in seconds, the CMTS uses for an authorization -- key. This controls how far in advance of authorization key expiration Expires August 2000 [Page 21] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 -- that the CMTS is expected to produce the next generation of keying -- material. This value is expected to agree with the Authorization Grace -- Time that the provisioning system provides to CMs." -- ::= { docsBpiCmtsBaseEntry 3 } -- docsBpiCmtsDefaultTEKGraceTime OBJECT-TYPE -- SYNTAX Integer32 (1..1800) -- UNITS "seconds" -- MAX-ACCESS read-write -- STATUS current -- DESCRIPTION -- "Default grace time, in seconds, the CMTS uses for a Traffic -- Encryption Key (TEK). This controls how far in advance of TEK -- expiration that the CMTS is expected to produce the next generation -- of keying material. This value is expected to agree with the TEK Grace -- Time that the provisioning system provides to CMs. Note that this -- object is particularly relevant for multicast SIDs, where multiple -- grace time values cannot be honored." -- ::= { docsBpiCmtsBaseEntry 4 } docsBpiCmtsAuthRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmtsBaseEntry 5 } docsBpiCmtsAuthReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmtsBaseEntry 6 } docsBpiCmtsAuthRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has Expires August 2000 [Page 22] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 transmitted an Authorization Reject message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmtsBaseEntry 7 } docsBpiCmtsAuthInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to any CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmtsBaseEntry 8 } -- -- The CMTS Authorization Table, indexed by ifIndex and CM MAC address -- docsBpiCmtsAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM authorization association. The CMTS maintains one authorization association with each Baseline Privacy-enabled CM on each CMTS MAC interface." ::= { docsBpiCmtsObjects 2 } docsBpiCmtsAuthEntry OBJECT-TYPE SYNTAX DocsBpiCmtsAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one authorization association. The CMTS MUST create one entry per CM per MAC interface, based on the receipt of an Authorization Request message, and MUST not delete the entry before the CM authorization permanently expires." INDEX { ifIndex, docsBpiCmtsAuthCmMacAddress } ::= { docsBpiCmtsAuthTable 1 } DocsBpiCmtsAuthEntry ::= SEQUENCE { docsBpiCmtsAuthCmMacAddress MacAddress, docsBpiCmtsAuthCmPublicKey OCTET STRING, docsBpiCmtsAuthCmKeySequenceNumber Integer32, docsBpiCmtsAuthCmExpires DateAndTime, Expires August 2000 [Page 23] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 docsBpiCmtsAuthCmLifetime Integer32, docsBpiCmtsAuthCmGraceTime Integer32, docsBpiCmtsAuthCmReset INTEGER, docsBpiCmtsAuthCmRequests Counter32, docsBpiCmtsAuthCmReplies Counter32, docsBpiCmtsAuthCmRejects Counter32, docsBpiCmtsAuthCmInvalids Counter32, docsBpiCmtsAuthRejectErrorCode INTEGER, docsBpiCmtsAuthRejectErrorString DisplayString, docsBpiCmtsAuthInvalidErrorCode INTEGER, docsBpiCmtsAuthInvalidErrorString DisplayString } docsBpiCmtsAuthCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "The value of this object is the physical address of the CM to which the authorization association applies." ::= { docsBpiCmtsAuthEntry 1 } docsBpiCmtsAuthCmPublicKey OBJECT-TYPE SYNTAX OCTET STRING (SIZE (0 | 74 | 106 | 140 | 270)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is a DER-encoded RSAPublicKey ASN.1 type string, as defined in the RSA Encryption Standard (PKCS #1) [22], corresponding to the public key of the CM. The 74, 106, 140, and 270 byte key encoding lengths correspond to 512 bit, 768 bit, 1024 bit, and 2048 public moduli respectively. This is a zero-length string if the CMTS does not retain the public key." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.2.4." ::= { docsBpiCmtsAuthEntry 2 } docsBpiCmtsAuthCmKeySequenceNumber OBJECT-TYPE SYNTAX Integer32 (0..15) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the authorization key sequence number for this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.10." ::= { docsBpiCmtsAuthEntry 3 } Expires August 2000 [Page 24] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 docsBpiCmtsAuthCmExpires OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time when the current authorization for this CM expires. If this CM does not have an active authorization, then the value is of the expiration date and time of the last active authorization." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.2 and 4.2.2.9." ::= { docsBpiCmtsAuthEntry 4 } docsBpiCmtsAuthCmLifetime OBJECT-TYPE SYNTAX Integer32 (1..6048000) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to an authorization key for this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2 and Appendix A.2." ::= { docsBpiCmtsAuthEntry 5 } docsBpiCmtsAuthCmGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the authorization key in seconds. The CM is expected to start trying to get a new authorization key beginning AuthGraceTime seconds before the authorization key actually expires." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.3." ::= { docsBpiCmtsAuthEntry 6 } docsBpiCmtsAuthCmReset OBJECT-TYPE SYNTAX INTEGER { noResetRequested(1), invalidateAuth(2), sendAuthInvalid(3), invalidateTeks(4) } Expires August 2000 [Page 25] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to invalidateAuth(2) causes the CMTS to invalidate the current CM authorization key, but not to transmit an Authorization Invalid message nor to invalidate unicast TEKs. Setting this object to sendAuthInvalid(3) causes the CMTS to invalidate the current CM authorization key, and to transmit an Authorization Invalid message to the CM, but not to invalidate unicast TEKs. Setting this object to invalidateTeks(4) causes the CMTS to invalidate the current CM authorization key, to transmit an Authorization Invalid message to the CM, and to invalidate all unicast TEKs associated with this CM authorization. Reading this object returns the most-recently-set value of this object, or returns noResetRequested(1) if the object has not been set since the last CMTS reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5." ::= { docsBpiCmtsAuthEntry 7 } docsBpiCmtsAuthCmRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received an Authorization Request message from this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.1." ::= { docsBpiCmtsAuthEntry 8 } docsBpiCmtsAuthCmReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Reply message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.2." ::= { docsBpiCmtsAuthEntry 9 } docsBpiCmtsAuthCmRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has Expires August 2000 [Page 26] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 transmitted an Authorization Reject message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.3." ::= { docsBpiCmtsAuthEntry 10 } docsBpiCmtsAuthCmInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted an Authorization Invalid message to this CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.7." ::= { docsBpiCmtsAuthEntry 11 } docsBpiCmtsAuthRejectErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Reject message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.16." ::= { docsBpiCmtsAuthEntry 12 } docsBpiCmtsAuthRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Reject message transmitted to the CM. This is a zero length string if no Authorization Reject message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.3 and 4.2.2.6." Expires August 2000 [Page 27] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 ::= { docsBpiCmtsAuthEntry 13 } docsBpiCmtsAuthInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), unauthorizedCm(3), unsolicited(5), invalidKeySequence(6), keyRequestAuthenticationFailure(7) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in most recent Authorization Invalid message transmitted to the CM. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.16." ::= { docsBpiCmtsAuthEntry 14 } docsBpiCmtsAuthInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in most recent Authorization Invalid message transmitted to the CM. This is a zero length string if no Authorization Invalid message has been transmitted to the CM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.7 and 4.2.2.6." ::= { docsBpiCmtsAuthEntry 15 } -- -- The CMTS TEK Table, indexed by ifIndex and SID -- docsBpiCmtsTEKTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiCmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the attributes of each CM Traffic Encryption Expires August 2000 [Page 28] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 Key (TEK) association. The CMTS maintains one TEK association per BPI SID on each CMTS MAC interface." ::= { docsBpiCmtsObjects 3 } docsBpiCmtsTEKEntry OBJECT-TYPE SYNTAX DocsBpiCmtsTEKEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing attributes of one TEK association on a particular CMTS MAC interface. The CMTS MUST create one entry per SID per MAC interface, based on the receipt of an Key Request message, and MUST not delete the entry before the CM authorization for the SID permanently expires." INDEX { ifIndex, docsIfCmtsServiceId } ::= { docsBpiCmtsTEKTable 1 } DocsBpiCmtsTEKEntry ::= SEQUENCE { docsBpiCmtsTEKLifetime Integer32, docsBpiCmtsTEKGraceTime Integer32, docsBpiCmtsTEKExpiresOld DateAndTime, docsBpiCmtsTEKExpiresNew DateAndTime, docsBpiCmtsTEKReset TruthValue, docsBpiCmtsKeyRequests Counter32, docsBpiCmtsKeyReplies Counter32, docsBpiCmtsKeyRejects Counter32, docsBpiCmtsTEKInvalids Counter32, docsBpiCmtsKeyRejectErrorCode INTEGER, docsBpiCmtsKeyRejectErrorString DisplayString, docsBpiCmtsTEKInvalidErrorCode INTEGER, docsBpiCmtsTEKInvalidErrorString DisplayString } docsBpiCmtsTEKLifetime OBJECT-TYPE SYNTAX Integer32 (1..604800) UNITS "seconds" MAX-ACCESS read-write STATUS current DESCRIPTION "The value of this object is the lifetime, in seconds, the CMTS assigns to keys for this TEK association." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5 and Appendix A.2." ::= { docsBpiCmtsTEKEntry 1 } docsBpiCmtsTEKGraceTime OBJECT-TYPE SYNTAX Integer32 (1..1800) Expires August 2000 [Page 29] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 UNITS "seconds" MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the grace time for the TEK in seconds. The CM is expected to start trying to get a new TEK beginning TEKGraceTime seconds before the TEK actually expires." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Appendix A.1.1.1.6." ::= { docsBpiCmtsTEKEntry 2 } docsBpiCmtsTEKExpiresOld OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the immediate predecessor of the most recent TEK for this FSM. If this FSM has only one TEK, then the value is the time of activation of this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmtsTEKEntry 3 } docsBpiCmtsTEKExpiresNew OBJECT-TYPE SYNTAX DateAndTime MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the actual clock time for expiration of the most recent TEK for this FSM." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.5 and 4.2.2.9." ::= { docsBpiCmtsTEKEntry 4 } docsBpiCmtsTEKReset OBJECT-TYPE SYNTAX TruthValue MAX-ACCESS read-write STATUS current DESCRIPTION "Setting this object to TRUE causes the CMTS to invalidate the current active TEK(s) (plural due to key transition periods), and to generate a new TEK for the associated SID; the CMTS MAY also generate an unsolicited TEK Invalid message, to optimize the TEK synchronization between the CMTS and the CM. Reading this object always returns FALSE." REFERENCE Expires August 2000 [Page 30] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 "DOCSIS Baseline Privacy Interface Specification, Section 4.1.3.3.5." ::= { docsBpiCmtsTEKEntry 5 } docsBpiCmtsKeyRequests OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has received a Key Request message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.4." ::= { docsBpiCmtsTEKEntry 6 } docsBpiCmtsKeyReplies OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reply message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.5." ::= { docsBpiCmtsTEKEntry 7 } docsBpiCmtsKeyRejects OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a Key Reject message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.6." ::= { docsBpiCmtsTEKEntry 8 } docsBpiCmtsTEKInvalids OBJECT-TYPE SYNTAX Counter32 MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the count of times the CMTS has transmitted a TEK Invalid message." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Section 4.2.1.8." ::= { docsBpiCmtsTEKEntry 9 } docsBpiCmtsKeyRejectErrorCode OBJECT-TYPE Expires August 2000 [Page 31] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 SYNTAX INTEGER { none(1), unknown(2), unauthorizedSid(4) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent Key Reject message sent in response to a Key Request for this BPI SID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.6 and 4.2.2.16." ::= { docsBpiCmtsTEKEntry 10 } docsBpiCmtsKeyRejectErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent Key Reject message sent in response to a Key Request for this BPI SID. This is a zero length string if no Key Reject message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.6 and 4.2.2.6." ::= { docsBpiCmtsTEKEntry 11 } docsBpiCmtsTEKInvalidErrorCode OBJECT-TYPE SYNTAX INTEGER { none(1), unknown(2), invalidKeySequence(6) } MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the enumerated description of the Error-Code in the most recent TEK Invalid message sent in association with this BPI SID. This has value unknown(2) if the last Error-Code value was 0, and none(1) if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.8 Expires August 2000 [Page 32] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 and 4.2.2.16." ::= { docsBpiCmtsTEKEntry 12 } docsBpiCmtsTEKInvalidErrorString OBJECT-TYPE SYNTAX DisplayString (SIZE (0..128)) MAX-ACCESS read-only STATUS current DESCRIPTION "The value of this object is the Display-String in the most recent TEK Invalid message sent in association with this BPI SID. This is a zero length string if no TEK Invalid message has been received since reboot." REFERENCE "DOCSIS Baseline Privacy Interface Specification, Sections 4.2.1.8 and 4.2.2.6." ::= { docsBpiCmtsTEKEntry 13 } -- -- The CMTS Multicast Control Group -- docsBpiMulticastControl OBJECT IDENTIFIER ::= { docsBpiCmtsObjects 4 } -- -- The CMTS IP Multicast Mapping Table, indexed by IP multicast -- address and prefix, and by ifindex -- docsBpiIpMulticastMapTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the mapping of IP multicast address prefixes to multicast SIDs on each CMTS MAC interface." ::= { docsBpiMulticastControl 1 } docsBpiIpMulticastMapEntry OBJECT-TYPE SYNTAX DocsBpiIpMulticastMapEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the mapping of one IP multicast address prefix to one multicast SID on one CMTS MAC interface. The CMTS uses the mapping when forwarding downstream IP multicast traffic." INDEX { ifIndex, docsBpiIpMulticastAddress, docsBpiIpMulticastPrefixLength } ::= { docsBpiIpMulticastMapTable 1 } Expires August 2000 [Page 33] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 DocsBpiIpMulticastMapEntry ::= SEQUENCE { docsBpiIpMulticastAddress IpAddress, docsBpiIpMulticastPrefixLength Integer32, docsBpiIpMulticastServiceId Integer32, docsBpiIpMulticastMapControl RowStatus } docsBpiIpMulticastAddress OBJECT-TYPE SYNTAX IpAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address (prefix) to be mapped." ::= { docsBpiIpMulticastMapEntry 1 } docsBpiIpMulticastPrefixLength OBJECT-TYPE SYNTAX Integer32 (0..32) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the IP multicast address prefix length to be mapped." ::= { docsBpiIpMulticastMapEntry 2 } docsBpiIpMulticastServiceId OBJECT-TYPE SYNTAX Integer32 (8192..16368) MAX-ACCESS read-create STATUS current DESCRIPTION "This object represents the multicast SID to be used in this IP multicast address prefix mapping entry." -- DEFVAL is an unused multicast SID value chosen by CMTS. ::= { docsBpiIpMulticastMapEntry 3 } docsBpiIpMulticastMapControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION "This object controls and reflects the IP multicast address prefix mapping entry." ::= { docsBpiIpMulticastMapEntry 4 } -- -- The CMTS Multicast SID Authorization Table, indexed by ifIndex by -- multicast SID by CM MAC address -- Expires August 2000 [Page 34] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 docsBpiMulticastAuthTable OBJECT-TYPE SYNTAX SEQUENCE OF DocsBpiMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "This table describes the multicast SID authorization for each CM on each CMTS MAC interface." ::= { docsBpiMulticastControl 2 } docsBpiMulticastAuthEntry OBJECT-TYPE SYNTAX DocsBpiMulticastAuthEntry MAX-ACCESS not-accessible STATUS current DESCRIPTION "Each entry contains objects describing the key authorization of one cable modem for one multicast SID for one CMTS MAC interface." INDEX { ifIndex, docsBpiMulticastServiceId, docsBpiMulticastCmMacAddress } ::= { docsBpiMulticastAuthTable 1 } DocsBpiMulticastAuthEntry ::= SEQUENCE { docsBpiMulticastServiceId Integer32, docsBpiMulticastCmMacAddress MacAddress, docsBpiMulticastAuthControl RowStatus } docsBpiMulticastServiceId OBJECT-TYPE SYNTAX Integer32 (8192..16368) MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the multicast SID for authorization." ::= { docsBpiMulticastAuthEntry 1 } docsBpiMulticastCmMacAddress OBJECT-TYPE SYNTAX MacAddress MAX-ACCESS not-accessible STATUS current DESCRIPTION "This object represents the MAC address of the CM to which the multicast SID authorization applies." ::= { docsBpiMulticastAuthEntry 2 } docsBpiMulticastAuthControl OBJECT-TYPE SYNTAX RowStatus MAX-ACCESS read-create STATUS current DESCRIPTION Expires August 2000 [Page 35] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 "This object controls and reflects the CM authorization for each multicast SID." ::= { docsBpiMulticastAuthEntry 3 } -- -- The BPI MIB Conformance Statements (with a placeholder for -- notifications) -- docsBpiNotification OBJECT IDENTIFIER ::= { docsBpiMIB 2 } docsBpiConformance OBJECT IDENTIFIER ::= { docsBpiMIB 3 } docsBpiCompliances OBJECT IDENTIFIER ::= { docsBpiConformance 1 } docsBpiGroups OBJECT IDENTIFIER ::= { docsBpiConformance 2 } docsBpiBasicCompliance MODULE-COMPLIANCE STATUS current DESCRIPTION "This is the compliance statement for devices which implement the DOCSIS Baseline Privacy Interface." MODULE -- docsBpiMIB -- conditionally mandatory group GROUP docsBpiCmGroup DESCRIPTION "This group is implemented only in CMs, not in CMTSs." -- conditionally mandatory group GROUP docsBpiCmtsGroup DESCRIPTION "This group is implemented only in CMTSs, not in CMs." -- relaxation on mandatory range (unnecessary since object is read-only) -- OBJECT docsBpiCmAuthGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (unnecessary since object is read-only) -- OBJECT docsBpiCmTEKGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsDefaultAuthLifetime Expires August 2000 [Page 36] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsDefaultTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (object removed from MIB) -- OBJECT docsBpiCmtsDefaultAuthGraceTime -- SYNTAX INTEGER (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (object removed from MIB) -- OBJECT docsBpiCmtsDefaultTEKGraceTime -- SYNTAX INTEGER (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsAuthCmLifetime SYNTAX Integer32 (86400..6048000) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (unnecessary since object is read-only) -- OBJECT docsBpiCmtsAuthCmGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range OBJECT docsBpiCmtsTEKLifetime SYNTAX Integer32 (1800..604800) DESCRIPTION "The refined range corresponds to the minimum and maximum values in operational networks, according to Appendix A.2 in [18]." -- relaxation on mandatory range (unnecessary since object is read-only) Expires August 2000 [Page 37] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 -- OBJECT docsBpiCmtsTEKGraceTime -- SYNTAX Integer32 (300..1800) -- DESCRIPTION -- "The refined range corresponds to the minimum and maximum values in -- operational networks, according to Appendix A.2 in [18]." ::= { docsBpiCompliances 1 } docsBpiCmGroup OBJECT-GROUP OBJECTS { docsBpiCmPrivacyEnable, docsBpiCmPublicKey, docsBpiCmAuthState, docsBpiCmAuthKeySequenceNumber, docsBpiCmAuthExpires, docsBpiCmAuthReset, docsBpiCmAuthGraceTime, docsBpiCmTEKGraceTime, docsBpiCmAuthWaitTimeout, docsBpiCmReauthWaitTimeout, docsBpiCmOpWaitTimeout, docsBpiCmRekeyWaitTimeout, docsBpiCmAuthRejectWaitTimeout, docsBpiCmAuthRequests, docsBpiCmAuthReplies, docsBpiCmAuthRejects, docsBpiCmAuthInvalids, docsBpiCmAuthRejectErrorCode, docsBpiCmAuthRejectErrorString, docsBpiCmAuthInvalidErrorCode, docsBpiCmAuthInvalidErrorString, docsBpiCmTEKPrivacyEnable, docsBpiCmTEKState, docsBpiCmTEKExpiresOld, docsBpiCmTEKExpiresNew, docsBpiCmTEKKeyRequests, docsBpiCmTEKKeyReplies, docsBpiCmTEKKeyRejects, docsBpiCmTEKInvalids, docsBpiCmTEKAuthPends, docsBpiCmTEKKeyRejectErrorCode, docsBpiCmTEKKeyRejectErrorString, docsBpiCmTEKInvalidErrorCode, docsBpiCmTEKInvalidErrorString } STATUS current DESCRIPTION "This collection of objects provides CM BPI status and control." Expires August 2000 [Page 38] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 ::= { docsBpiGroups 1 } docsBpiCmtsGroup OBJECT-GROUP OBJECTS { docsBpiCmtsDefaultAuthLifetime, docsBpiCmtsDefaultTEKLifetime, -- docsBpiCmtsDefaultAuthGraceTime, -- docsBpiCmtsDefaultTEKGraceTime, docsBpiCmtsAuthRequests, docsBpiCmtsAuthReplies, docsBpiCmtsAuthRejects, docsBpiCmtsAuthInvalids, docsBpiCmtsAuthCmPublicKey, docsBpiCmtsAuthCmKeySequenceNumber, docsBpiCmtsAuthCmExpires, docsBpiCmtsAuthCmLifetime, docsBpiCmtsAuthCmGraceTime, docsBpiCmtsAuthCmReset, docsBpiCmtsAuthCmRequests, docsBpiCmtsAuthCmReplies, docsBpiCmtsAuthCmRejects, docsBpiCmtsAuthCmInvalids, docsBpiCmtsAuthRejectErrorCode, docsBpiCmtsAuthRejectErrorString, docsBpiCmtsAuthInvalidErrorCode, docsBpiCmtsAuthInvalidErrorString, docsBpiCmtsTEKLifetime, docsBpiCmtsTEKGraceTime, docsBpiCmtsTEKExpiresOld, docsBpiCmtsTEKExpiresNew, docsBpiCmtsTEKReset, docsBpiCmtsKeyRequests, docsBpiCmtsKeyReplies, docsBpiCmtsKeyRejects, docsBpiCmtsTEKInvalids, docsBpiCmtsKeyRejectErrorCode, docsBpiCmtsKeyRejectErrorString, docsBpiCmtsTEKInvalidErrorCode, docsBpiCmtsTEKInvalidErrorString, docsBpiIpMulticastServiceId, docsBpiIpMulticastMapControl, docsBpiMulticastAuthControl } STATUS current DESCRIPTION "This collection of objects provides CMTS BPI status and control." ::= { docsBpiGroups 2 } Expires August 2000 [Page 39] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 END 5. Acknowledgments This document was produced by the IPCDN Working Group. Much of the content of this MIB was conceived by Chet Birger and Mike StJohns. Kazuyoshi Ozawa and Bob Himlin provided many useful technical corrections. 6. References [1] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture for Describing SNMP Management Frameworks", RFC 2571, April 1999. [2] Rose, M. and K. McCloghrie, "Structure and Identification of Management Information for TCP/IP-based Internets", STD 16, RFC 1155, May 1990. [3] Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16, RFC 1212, March 1991. [4] Rose, M., "A Convention for Defining Traps for use with the SNMP", RFC 1215, March 1991. [5] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of Management Information for Version 2 (SMIv2)", STD 58, RFC 2578, April 1999. [6] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual Conventions for SMIv2", STD 58, RFC 2579, April 1999. [7] McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance Statements for SMIv2", STD 58, RFC 2580, April 1999. [8] Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple Network Management Protocol", STD 15, RFC 1157, May 1990. [9] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Introduction to Community-based SNMPv2", RFC 1901, January 1996. [10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport Mappings for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1906, January 1996. [11] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message Processing and Dispatching for the Simple Network Management Protocol (SNMP)", RFC 2572, April 1999. Expires August 2000 [Page 40] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 [12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3)", RFC 2574, April 1999. [13] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol Operations for Version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1905, January 1996. [14] Levi, D., Meyer, P. and B. Stewart, "SNMP Applications", RFC 2573, April 1999. [15] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999. [16] St. Johns, M., editor, "Radio Frequency (RF) Interface Management Information Base for MCNS/DOCSIS compliant RF interfaces", RFC 2670, August 1999. [17] St. Johns, M., editor, "DOCSIS Cable Device MIB, Cable Device Management Information Base for DOCSIS compliant Cable Modems and Cable Modem Termination Systems", RFC 2669, August 1999. [18] "Data-Over-Cable Service Interface Specifications: Baseline Privacy Interface Specification SP-BPI-I02-990319", DOCSIS, March 1999, http://www.cablemodem.com/public/pubtechspec/ss/SP-BPI-I02-990319.pdf. [19] "Data-Over-Cable Service Interface Specifications: Cable Modem Radio Frequency Interface Specification SP-RFI-I05-991105", DOCSIS, November 1999, http://www.cablemodem.com/public/pubtechspec/SP-RFI-I05-991105.pdf. [20] "Data-Over-Cable Service Interface Specifications: Operations Support System Interface Specification RF Interface SP-OSSI-RF- I02-980410", DOCSIS, April 1998, http://www.cablemodem.com/public/pubtechspec/ossi/sp-ossi.PDF. [21] "Data-Over-Cable Service Interface Specifications: Baseline Privacy Plus Interface Specification SP-BPI+-I03-991105", DOCSIS, November 1999, http://www.cablemodem.com/public/pubtechspec/ss/SP-BPI+-I03-991105.pdf. [22] RSA Laboratories, "The Public-Key Cryptography Standards", RSA Data Security Inc., Redwood City, CA. [23] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. Expires August 2000 [Page 41] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 7. Security Considerations The Baseline Privacy Interface provides data encryption for DOCSIS data-over-cable services. Baseline Privacy-capable cable modems have RSA private/public key pairs installed by manufacturers. The public key is used to encrypt an Authorization key, and the Authorization key is used to encrypt one or more Traffic Encryption Keys (TEKs). The TEKs are used to encrypt both upstream and downstream data traffic. Please refer to [18] to obtain further information on the Baseline Privacy specification. In particular, the Baseline Privacy Interface does not provide an authentication service. CMTS implementors are encouraged not to rely on the MAC address of the CM for service authorization -- in particular, for the docsBpiMulticastAuthTable in this MIB. The Baseline Privacy Plus Interface does provide a CM authentication service, and the working group expects to issue a MIB for the management of BPI+ at a later time. This MIB specification contains a number of read-write objects, that should be protected from unauthorized modification to prevent denial of service and theft of service attacks: in particular, objects that reset state machines (ex. docsBpiCmAuthReset), change key lifetimes (ex. docsBpiCmtsDefaultAuthLifetime), change rekeying grace times (ex. docsBpiCmtsDefaultAuthGraceTime), and control multicast traffic (ex. most objects in the docsBpiMulticastControl group). The desired means to protect these objects from unwarranted access is to implement the security features as provided by the SNMPv3 framework. Specifically, the use of the User-based Security Model [12] and the View-based Access Control Model [15] is recommended. Weaker methods to protect CMs from unauthorized access include using the docsDevNmAccessTable from the Cable Device MIB [17] to disallow configuration changes from unauthorized network management stations, and using the SNMP MIB Object and SNMP Write-Access Control configuration file options from the Radio Frequency Interface [19] to set MIB object values and disable SNMP SET operations at cable modem boot time. Note that these mechanisms may be vulnerable to an unauthorized network management station "spoofing" the source address of a legitimate network management station. 8. Intellectual Property The IETF takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights Expires August 2000 [Page 42] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on the IETF's procedures with respect to rights in standards-track and standards-related documentation can be found in BCP-11. Copies of claims of rights made available for publication and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users of this specification can be obtained from the IETF Secretariat. The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to practice this standard. Please address the information to the IETF Executive Director. 9. Author's Address Richard Woundy Cisco Systems 250 Apollo Drive Chelmsford, MA 01824 U.S.A. Phone: +1 978 244 8000 Email: rwoundy@cisco.com 10. Full Copyright Statement Copyright (C) The Internet Society (2000). All Rights Reserved. This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English. The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns. Expires August 2000 [Page 43] INTERNET-DRAFT DOCSIS Baseline Privacy MIB February 2000 This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Acknowledgement Funding for the RFC Editor function is currently provided by the Internet Society. Expires August 2000 [Page 44] --=====================_4363884==_ Content-Type: text/plain; charset="us-ascii" --=====================_4363884==_-- From owner-ipcdn@terayon.com Mon Jan 31 12:58:20 2000 Received: from www.terayon.com (terayon.com [157.22.250.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11136 for ; Mon, 31 Jan 2000 12:58:17 -0500 (EST) Received: from redpine.terayon.com (redpine [157.22.250.5]) by www.terayon.com (8.8.6 (PHNE_14041)/8.8.6) with SMTP id JAA07571; Mon, 31 Jan 2000 09:55:05 -0800 (PST) Received: from mail-serv.terayon.com by redpine.terayon.com via smtpd (for mails.terayon.com [157.22.250.1]) with SMTP; 31 Jan 2000 17:55:04 UT Received: from tamarind.terayon.com (tamarind.terayon.com [172.20.0.6]) by mail-serv.terayon.com (8.9.3+Sun/8.9.1) with ESMTP id JAA11005; Mon, 31 Jan 2000 09:55:03 -0800 (PST) Received: (from root@localhost) by tamarind.terayon.com (8.8.8+Sun/8.8.8) id JAA21842 for ipcdn-outgoing; Mon, 31 Jan 2000 09:52:51 -0800 (PST) Message-Id: <4.2.2.20000131094120.00dec5c0@poptart> X-Sender: stjohns@poptart X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Mon, 31 Jan 2000 09:43:24 -0800 To: ipcdn@terayon.com From: "Mike St. Johns" Subject: Call for agenda items - Adelaide IETF meeting Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-ipcdn@terayon.com Precedence: bulk Reply-To: ipcdn@terayon.com Please send me (and the list) items for discussion at the next IETF meeting in Adelaide. I need to start putting the schedule together. My cutoff for ensuring they get onto the agenda is 21 Feb 00. I'll try and accomodate items received after that date, but can't ensure that we'll have time. Mike