Request for Comments: 4131 Consultant
Category: Standards Track K. Ozawa
Toshiba
E. Cardona, Ed.
CableLabs
A. Katsnelson
September 2005
Management Information Base for
Data Over Cable Service Interface Specification (DOCSIS) Cable Modems
and Cable Modem Termination Systems for Baseline Privacy Plus
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
This memo defines a portion of the Management Information Base (MIB)
for use with network management protocols in the Internet community.
In particular, it defines a set of managed objects for Simple Network
Management Protocol (SNMP) based management of the Baseline Privacy
Plus features of DOCSIS 1.1 and DOCSIS 2.0 (Data-over-Cable Service
Interface Specification) compliant Cable Modems and Cable Modem
Termination Systems.
Table of Contents
1. The Internet-Standard Management Framework..................... 2
2. Overview....................................................... 2
2.1. Structure of the MIB...................................... 3
2.2. Relationship of BPI+ and BPI MIB Modules.................. 4
2.3. BPI+ MIB Module Relationship with The Interfaces Group MIB 5
3. Definitions.................................................... 5
4. Acknowledgements............................................... 77
5. Normative References........................................... 77
6. Informative References......................................... 78
7. Security Considerations........................................ 79
8. IANA Considerations............................................ 83
1. The Internet-Standard Management Framework
For a detailed overview of the documents that describe the current
Internet-Standard Management Framework, please refer to section 7 of
RFC 3410 [RFC3410].
Managed objects are accessed via a virtual information store, termed
the Management Information Base or MIB. MIB objects are generally
accessed through the Simple Network Management Protocol (SNMP).
Objects in the MIB are defined using the mechanisms defined in the
Structure of Management Information (SMI). This memo specifies a MIB
module that is compliant to the SMIv2, which is described in STD 58,
RFC 2578 [RFC2578], STD 58, RFC 2579 [RFC2579] and STD 58, RFC 2580
[RFC2580].
2. Overview
This MIB module (BPI+ MIB) provides a set of objects required for the
management of the Baseline Privacy Interface Plus features of DOCSIS
1.1 and DOCSIS 2.0 Cable Modem (CM) and Cable Modem Termination
System (CMTS). The specification is derived from the operational
model described in the DOCSIS Baseline Privacy Interface Plus
Specification [DOCSIS].
DOCSIS Baseline Privacy Plus is composed of four distinct functional
and manageable areas:
o Key exchange and data encryption
o Cable modem authentication
o Multicast encryption
o Authentication of downloaded software images
This MIB module is an extension of the DOCSIS 1.0 Baseline Privacy
MIB module [RFC3083] (BPI MIB), which is derived from the Operational
model described in the DOCSIS Baseline Privacy Interface
Specification [DOCSIS-1.0]. The original Baseline Privacy MIB
structure has mostly been preserved in the Baseline Privacy Plus MIB.
Please note that the referenced DOCSIS specifications only require
that Cable Modems process IPv4 customer traffic. Design choices in
this MIB module reflect those requirements. Future versions of the
DOCSIS specifications are expected to require support for IPv6 as
well.
Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT","SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL"
in this document are to be interpreted as described in BCP 14, RFC
2119 [RFC2119].
2.1. Structure of the MIB
This MIB module is structured into several tables and objects.
2.1.1. Cable Modem
o The docsBpi2CmBaseTable contains authorization key exchange
information for one CM MAC interface.
o The docsBpi2CmTEKTable contains traffic key exchange and data
encryption information for a particular security association ID of
the cable modem.
o Multicast Encryption information is maintained under
Docsbpi2CmMulticastObjects. There is currently one multicast
table object that manages IP multicast encryption,
docsBpi2CmIpMulticastMapTable.
o Digital certificates used for cable modem authentication are
accessible via docsBpi2CmDeviceCertTable.
o Cryptographic suite capabilities for a CM MAC are maintained in
the docsBpi2CmCryptoSuiteTable.
2.1.2. Cable Modem Termination System
o The docsBpi2CmtsBaseTable contains default settings and summary
counters for the cable modem termination system.
o The DocsBpi2CmtsAuthTable contains Authorization Key Exchange
information for each CM MAC interface, as well as data from CM
certificates used in cable modem authentication.
o The docsBpi2CmtsTEKTable contains traffic key exchange and data
encryption information for a particular security association ID.
o Multicast Encryption information is maintained under
Docsbpi2CmtsMulticastObjects. There are currently two multicast
table objects. The Table docsBpi2CmtsIpMulticastMapTable is
specifically designed for IP multicast encryption, whereas
docsBpi2CmtsMulticastAuthTable is meant to manage all multicast
security associations.
In particular, the table docsBpi2CmtsIpMulticastMapTable
defines the object docsBpi2CmtsIpMulticastMask, which could be
a non-contiguous netmask; this is why the object syntax is
based on the INET-ADDRESS-MIB MIB Module [RFC4001] Textual
Convention InetAddress instead of InetAddressPrefixLength.
This is to facilitate the assignment of same DOCSIS Security
Association ID (SAID) to one or more IPv6 multicast group IDs
matching one or more IPv6 multicast scope types within an entry
in this table. For example, multicast scopes labeled
"unassigned" [RFC3513] may be allocated by administrators to a
particular SAID, regardless of their multicast scope; such
mapping transient multicast group ’Y’ to SAID ’z’ for ANY
multicast scope. The non-contiguous netmask will be FF10:Y.
See [RFC3513] for details on IPv6 multicast addressing.
o DocsBpi2CmtsCertObjects contains 2 manageable tables: one for
provisioned cable modem certificates and one for certification
authority certificates.
2.1.3. Common
o The docsBpi2CodeDownloadControl objects manage the authenticated
software download process for a given device.
2.2. Relationship of BPI+ and BPI MIB Modules
This section describes the relationship between the BPI+ MIB module
defined in this document and the BPI MIB module defined in RFC 3083
[RFC3083]. The BPI+ protocol interface is an enhancement to the BPI
protocol, and it is a distinct protocol from BPI. The associated
BPI+ managed objects should be considered separate from the BPI MIB
objects defined in RFC 3083.
DOCSIS 1.1 and 2.0 systems implement both the BPI+ and BPI protocols
to be backward compatible with 1.0 systems. For more information
regarding the interoperability between BPI and BPI+ compliant
systems, refer to appendix C of the DOCSIS BPI+ specification
[DOCSIS]. For MIB modules requirements, refer to section 4.6.1,
Figure 9, of the DOCSIS 1.1 OSSI specification [DOCSIS-1.1] and to
section 7.6.1, Tables 7-9, of the DOCSIS 2.0 OSSI specification
[DOCSIS-2.0].
2.3. BPI+ MIB Module Relationship with the Interfaces Group MIB
The BPI+ MIB module is the management framework of Baseline Privacy
Plus Interface Specification [DOCSIS], which provides the MAC layer
(Media Access Control) security services of DOCSIS through the
Baseline Privacy Key Management (BPKM) protocol. The BPI+ MIB module
objects are organized as extensions of the Radio Frequency (RF)
Interface Management [RFC2670].
The MIB table structures of this MIB Module are extensions of the
DOCSIS CATV (Community Antenna Television) MAC layer interface
(DocsCableMaclayer by [IANA]). In particular, the provisions of the
Interface Group MIB [RFC2863] for counter discontinuities and system
re-initialization apply to CM and CMTS to validate the difference
between two consecutive counter polls.
All BPI+ MIB module counters are 32 bits and are based on the minimum
time to wrap up considerations of [RFC2863] and their possible
frequency occurrence as BPI+ FSM (Finite State Machine) event
counters. See [DOCSIS] for BPI+ FSM parameter guidelines.
3. Definitions
DOCS-IETF-BPI2-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
Integer32,
Unsigned32,
Counter32,
mib-2
FROM SNMPv2-SMI -- [RFC2578]
SnmpAdminString
FROM SNMP-FRAMEWORK-MIB -- [RFC3411]
TEXTUAL-CONVENTION,
MacAddress,
RowStatus,
TruthValue,
DateAndTime,
StorageType
FROM SNMPv2-TC -- [RFC2579]
OBJECT-GROUP,
MODULE-COMPLIANCE
FROM SNMPv2-CONF -- [RFC2580]
ifIndex
FROM IF-MIB -- [RFC2863]
InetAddressType,
InetAddress
FROM INET-ADDRESS-MIB; -- [RFC4001]
docsBpi2MIB MODULE-IDENTITY
LAST-UPDATED "200507200000Z" -- July 20, 2005
ORGANIZATION "IETF IP over Cable Data Network (IPCDN)
Working Group"
CONTACT-INFO "---------------------------------------
Stuart M. Green
E-mail: rubbersoul3@yahoo.com
---------------------------------------
Kaz Ozawa
Automotive Systems Development Center
TOSHIBA CORPORATION
1-1, Shibaura 1-Chome
Minato-ku, Tokyo 105-8001
Japan
Phone: +81-3-3457-8569
Fax: +81-3-5444-9325
E-mail: Kazuyoshi.Ozawa@toshiba.co.jp
---------------------------------------
Alexander Katsnelson
Postal:
Tel: +1-303-680-3924
E-mail: katsnelson6@peoplepc.com
---------------------------------------
Eduardo Cardona
Postal:
Cable Television Laboratories, Inc.
858 Coal Creek Circle
Louisville, CO 80027- 9750
U.S.A.
Tel: +1 303 661 9100
Fax: +1 303 661 9199
E-mail: e.cardona@cablelabs.com
---------------------------------------
IETF IPCDN Working Group
General Discussion: ipcdn@ietf.org
Subscribe: http://www.ietf.org/mailman/listinfo/ipcdn.
Archive: ftp://ftp.ietf.org/ietf-mail-archive/ipcdn.
Co-chairs: Richard Woundy, rwoundy@cisco.com
Jean-Francois Mule, jfm@cablelabs.com"
DESCRIPTION
"This is the MIB module for the DOCSIS Baseline
Privacy Plus Interface (BPI+) at cable modems (CMs)
and cable modem termination systems (CMTSs).
Copyright (C) The Internet Society (2005). This
version of this MIB module is part of RFC 4131; see
the RFC itself for full legal notices."
REVISION "200507200000Z" -- July 20, 2005
DESCRIPTION
"Initial version of the IETF BPI+ MIB module.
This version published as RFC 4131."
::= { mib-2 126 }
-- Textual conventions
DocsX509ASN1DEREncodedCertificate ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"An X509 digital certificate encoded as an ASN.1 DER
object."
SYNTAX OCTET STRING (SIZE (0..4096))
DocsSAId ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"Security Association identifier (SAID)."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface
specification, Section 2.1.3, BPI+ Security
Associations"
SYNTAX Integer32 (1..16383)
DocsSAIdOrZero ::= TEXTUAL-CONVENTION
DISPLAY-HINT "d"
STATUS current
DESCRIPTION
"Security Association identifier (SAID). The value
zero indicates that the SAID is yet to be determined."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface
specification, Section 2.1.3, BPI+ Security
Associations"
SYNTAX Unsigned32 (0 | 1..16383)
DocsBpkmSAType ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"The type of security association (SA).
The values of the named-numbers are associated
with the BPKM SA-Type attributes:
’primary’ corresponds to code ’1’, ’static’ to code ’2’,
and ’dynamic’ to code ’3’.
The ’none’ value must only be used if the SA type has yet
to be determined."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface
specification, Section 4.2.2.24"
SYNTAX INTEGER {
none(0),
primary(1),
static(2),
dynamic(3)
}
DocsBpkmDataEncryptAlg ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"The list of data encryption algorithms defined for
the DOCSIS interface in the BPKM cryptographic-suite
parameter. The value ’none’ indicates that the SAID
being referenced has no data encryption."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
SYNTAX INTEGER {
none(0),
des56CbcMode(1),
des40CbcMode(2),
t3Des128CbcMode(3),
aes128CbcMode(4),
aes256CbcMode(5)
}
DocsBpkmDataAuthentAlg ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"The list of data integrity algorithms defined for the
DOCSIS interface in the BPKM cryptographic-suite parameter.
The value ’none’ indicates that no data integrity is used for
the SAID being referenced."
REFERENCE
"DOCSIS Baseline Privacy Plus Interface Specification,
Section 4.2.2.20."
SYNTAX INTEGER {
none(0),
hmacSha196(1)
}
docsBpi2MIBObjects OBJECT IDENTIFIER ::= { docsBpi2MIB 1 }
-- Cable Modem Group
docsBpi2CmObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 1 }
--
-- The BPI+ base and authorization table for CMs,
-- indexed by ifIndex
--
docsBpi2CmBaseTable OBJECT-TYPE
SYNTAX SEQUENCE OF DocsBpi2CmBaseEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"This table describes the basic and authorization-
related Baseline Privacy Plus attributes of each CM MAC
interface."
::= { docsBpi2CmObjects 1 }
docsBpi2CmBaseEntry OBJECT-TYPE
SYNTAX DocsBpi2CmBaseEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Each entry contains objects describing attributes of
one CM MAC interface. An entry in this table exists for
each ifEntry with an ifType of docsCableMaclayer(127)."
INDEX { ifIndex }
::= { docsBpi2CmBaseTable 1 }
DocsBpi2CmBaseEntry ::= SEQUENCE {
docsBpi2CmPrivacyEnable TruthValue,
docsBpi2CmPublicKey OCTET STRING,
docsBpi2CmAuthState INTEGER,
docsBpi2CmAuthKeySequenceNumber Integer32,
docsBpi2CmAuthExpiresOld DateAndTime,
docsBpi2CmAuthExpiresNew DateAndTime,
docsBpi2CmAuthReset TruthValue,
docsBpi2CmAuthGraceTime Integer32,
docsBpi2CmTEKGraceTime Integer32,
docsBpi2CmAuthWaitTimeout Integer32,
docsBpi2CmReauthWaitTimeout Integer32,
docsBpi2CmOpWaitTimeout Integer32,
docsBpi2CmRekeyWaitTimeout Integer32,
docsBpi2CmAuthRejectWaitTimeout Integer32,
docsBpi2CmSAMapWaitTimeout Integer32,
docsBpi2CmSAMapMaxRetries Integer32,
docsBpi2CmAuthentInfos Counter32,
docsBpi2CmAuthRequests Counter32,
docsBpi2CmAuthReplies Counter32,
docsBpi2CmAuthRejects Counter32,
docsBpi2CmAuthInvalids Counter32,
docsBpi2CmAuthRejectErrorCode INTEGER,
docsBpi2CmAuthRejectErrorString SnmpAdminString,
docsBpi2CmAuthInvalidErrorCode INTEGER,
docsBpi2CmAuthInvalidErrorString SnmpAdminString
}
docsBpi2CmPrivacyEnable OBJECT-TYPE
SYNTAX TruthValue
MAX-ACCESS read-only
STATUS current