future versions of this MIB module."
-- constrain on Encryption algorithms
OBJECT docsBpi2CmCryptoSuiteDataEncryptAlg
SYNTAX DocsBpkmDataEncryptAlg {
none(0),
des56CbcMode(1),
des40CbcMode(2)
}
DESCRIPTION
"It is compliant to only support des56CbcMode(1)
and des40CbcMode(2) for data encryption algorithms."
-- constrain on Integrity algorithms
OBJECT docsBpi2CmCryptoSuiteDataAuthentAlg
SYNTAX DocsBpkmDataAuthentAlg {
none(0)
}
DESCRIPTION
"It is compliant to not support data message
authentication algorithms."
::= { docsBpi2Compliances 1 }
docsBpi2CmtsCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"This is the compliance statement for CMTSs that
implement the DOCSIS Baseline Privacy Interface Plus."
MODULE -- docsBpi2MIB
-- unconditionally mandatory group
MANDATORY-GROUPS {
docsBpi2CmtsGroup
}
-- unconditionally optional group
GROUP docsBpi2CodeDownloadGroup
DESCRIPTION
"This group is optional for CMTSes. The implementation
decision of this group is left to the vendor"
-- constrain on mandatory range
OBJECT docsBpi2CmtsDefaultAuthLifetime
SYNTAX Integer32 (86400..6048000)
DESCRIPTION
"The refined range corresponds to the minimum and
maximum values in operational networks."
-- constrain on mandatory range
OBJECT docsBpi2CmtsDefaultTEKLifetime
SYNTAX Integer32 (1800..604800)
DESCRIPTION
"The refined range corresponds to the minimum and
maximum values in operational networks."
-- constrain on mandatory range
OBJECT docsBpi2CmtsAuthCmLifetime
SYNTAX Integer32 (86400..6048000)
DESCRIPTION
"The refined range corresponds to the minimum and
maximum values in operational networks."
-- constrain on Encryption algorithms
OBJECT docsBpi2CmtsTEKDataEncryptAlg
SYNTAX DocsBpkmDataEncryptAlg {
none(0),
des56CbcMode(1),
des40CbcMode(2)
}
DESCRIPTION
"It is compliant to only support des56CbcMode(1)
and des40CbcMode(2) for data encryption."
-- constrain on Integrity algorithms
OBJECT docsBpi2CmtsTEKDataAuthentAlg
SYNTAX DocsBpkmDataAuthentAlg {
none(0)
}
DESCRIPTION
"It is compliant to not support data message
authentication algorithms."
-- constrain on mandatory range
OBJECT docsBpi2CmtsTEKLifetime
SYNTAX Integer32 (1800..604800)
DESCRIPTION
"The refined range corresponds to the minimum and
maximum values in operational networks."
-- constrain on access
-- constrain on IP Addressing
OBJECT docsBpi2CmtsIpMulticastAddressType
SYNTAX InetAddressType { ipv4(1) }
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required.
An implementation is only required to support IPv4
addresses. Support for other address types may be defined
in future versions of this MIB module."
OBJECT docsBpi2CmtsIpMulticastAddress
SYNTAX InetAddress (SIZE(4))
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required.
An implementation is only required to support IPv4
addresses. Support for other address types may be defined
in future versions of this MIB module."
OBJECT docsBpi2CmtsIpMulticastMask
SYNTAX InetAddress (SIZE(4))
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required.
An implementation is only required to support IPv4
addresses. Support for other address types may be defined
in future versions of this MIB module."
-- constrain on access
OBJECT docsBpi2CmtsIpMulticastSAId
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
OBJECT docsBpi2CmtsIpMulticastSAType
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
-- constrain on access
-- constrain on Encryption algorithms
OBJECT docsBpi2CmtsIpMulticastDataEncryptAlg
SYNTAX DocsBpkmDataEncryptAlg {
none(0),
des56CbcMode(1),
des40CbcMode(2)
}
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required.
It is compliant to only support des56CbcMode(1)
and des40CbcMode(2) for data encryption"
-- constrain on access
-- constrain on Integrity algorithms
OBJECT docsBpi2CmtsIpMulticastDataAuthentAlg
SYNTAX DocsBpkmDataAuthentAlg {
none(0)
}
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required.
It is compliant to not support data message
authentication algorithms."
-- constrain on access
OBJECT docsBpi2CmtsMulticastAuthControl
MIN-ACCESS read-only
DESCRIPTION
"Write access is not required."
::= { docsBpi2Compliances 2 }
docsBpi2CmGroup OBJECT-GROUP
OBJECTS {
docsBpi2CmPrivacyEnable,
docsBpi2CmPublicKey,
docsBpi2CmAuthState,
docsBpi2CmAuthKeySequenceNumber,
docsBpi2CmAuthExpiresOld,
docsBpi2CmAuthExpiresNew,
docsBpi2CmAuthReset,
docsBpi2CmAuthGraceTime,
docsBpi2CmTEKGraceTime,
docsBpi2CmAuthWaitTimeout,
docsBpi2CmReauthWaitTimeout,
docsBpi2CmOpWaitTimeout,
docsBpi2CmRekeyWaitTimeout,
docsBpi2CmAuthRejectWaitTimeout,
docsBpi2CmSAMapWaitTimeout,
docsBpi2CmSAMapMaxRetries,
docsBpi2CmAuthentInfos,
docsBpi2CmAuthRequests,
docsBpi2CmAuthReplies,
docsBpi2CmAuthRejects,
docsBpi2CmAuthInvalids,
docsBpi2CmAuthRejectErrorCode,
docsBpi2CmAuthRejectErrorString,
docsBpi2CmAuthInvalidErrorCode,
docsBpi2CmAuthInvalidErrorString,
docsBpi2CmTEKSAType,
docsBpi2CmTEKDataEncryptAlg,
docsBpi2CmTEKDataAuthentAlg,
docsBpi2CmTEKState,
docsBpi2CmTEKKeySequenceNumber,
docsBpi2CmTEKExpiresOld,
docsBpi2CmTEKExpiresNew,
docsBpi2CmTEKKeyRequests,
docsBpi2CmTEKKeyReplies,
docsBpi2CmTEKKeyRejects,
docsBpi2CmTEKInvalids,
docsBpi2CmTEKAuthPends,
docsBpi2CmTEKKeyRejectErrorCode,
docsBpi2CmTEKKeyRejectErrorString,
docsBpi2CmTEKInvalidErrorCode,
docsBpi2CmTEKInvalidErrorString,
docsBpi2CmIpMulticastAddressType,
docsBpi2CmIpMulticastAddress,
docsBpi2CmIpMulticastSAId,
docsBpi2CmIpMulticastSAMapState,
docsBpi2CmIpMulticastSAMapRequests,
docsBpi2CmIpMulticastSAMapReplies,
docsBpi2CmIpMulticastSAMapRejects,
docsBpi2CmIpMulticastSAMapRejectErrorCode,
docsBpi2CmIpMulticastSAMapRejectErrorString,
docsBpi2CmDeviceCmCert,
docsBpi2CmDeviceManufCert,
docsBpi2CmCryptoSuiteDataEncryptAlg,
docsBpi2CmCryptoSuiteDataAuthentAlg
}
STATUS current
DESCRIPTION
"This collection of objects provides CM BPI+ status
and control."
::= { docsBpi2Groups 1 }
docsBpi2CmtsGroup OBJECT-GROUP
OBJECTS {
docsBpi2CmtsDefaultAuthLifetime,
docsBpi2CmtsDefaultTEKLifetime,
docsBpi2CmtsDefaultSelfSignedManufCertTrust,
docsBpi2CmtsCheckCertValidityPeriods,
docsBpi2CmtsAuthentInfos,
docsBpi2CmtsAuthRequests,
docsBpi2CmtsAuthReplies,
docsBpi2CmtsAuthRejects,
docsBpi2CmtsAuthInvalids,
docsBpi2CmtsSAMapRequests,
docsBpi2CmtsSAMapReplies,
docsBpi2CmtsSAMapRejects,
docsBpi2CmtsAuthCmBpiVersion,
docsBpi2CmtsAuthCmPublicKey,
docsBpi2CmtsAuthCmKeySequenceNumber,
docsBpi2CmtsAuthCmExpiresOld,
docsBpi2CmtsAuthCmExpiresNew,
docsBpi2CmtsAuthCmLifetime,
docsBpi2CmtsAuthCmReset,
docsBpi2CmtsAuthCmInfos,
docsBpi2CmtsAuthCmRequests,
docsBpi2CmtsAuthCmReplies,
docsBpi2CmtsAuthCmRejects,
docsBpi2CmtsAuthCmInvalids,
docsBpi2CmtsAuthRejectErrorCode,
docsBpi2CmtsAuthRejectErrorString,
docsBpi2CmtsAuthInvalidErrorCode,
docsBpi2CmtsAuthInvalidErrorString,
docsBpi2CmtsAuthPrimarySAId,
docsBpi2CmtsAuthBpkmCmCertValid,
docsBpi2CmtsAuthBpkmCmCert,
docsBpi2CmtsAuthCACertIndexPtr,
docsBpi2CmtsTEKSAType,
docsBpi2CmtsTEKDataEncryptAlg,
docsBpi2CmtsTEKDataAuthentAlg,
docsBpi2CmtsTEKLifetime,
docsBpi2CmtsTEKKeySequenceNumber,
docsBpi2CmtsTEKExpiresOld,
docsBpi2CmtsTEKExpiresNew,
docsBpi2CmtsTEKReset,
docsBpi2CmtsKeyRequests,
docsBpi2CmtsKeyReplies,
docsBpi2CmtsKeyRejects,
docsBpi2CmtsTEKInvalids,
docsBpi2CmtsKeyRejectErrorCode,
docsBpi2CmtsKeyRejectErrorString,
docsBpi2CmtsTEKInvalidErrorCode,
docsBpi2CmtsTEKInvalidErrorString,
docsBpi2CmtsIpMulticastAddressType,
docsBpi2CmtsIpMulticastAddress,
docsBpi2CmtsIpMulticastMask,
docsBpi2CmtsIpMulticastSAId,
docsBpi2CmtsIpMulticastSAType,
docsBpi2CmtsIpMulticastDataEncryptAlg,
docsBpi2CmtsIpMulticastDataAuthentAlg,
docsBpi2CmtsIpMulticastSAMapRequests,
docsBpi2CmtsIpMulticastSAMapReplies,
docsBpi2CmtsIpMulticastSAMapRejects,
docsBpi2CmtsIpMulticastSAMapRejectErrorCode,
docsBpi2CmtsIpMulticastSAMapRejectErrorString,
docsBpi2CmtsIpMulticastMapControl,
docsBpi2CmtsIpMulticastMapStorageType,
docsBpi2CmtsMulticastAuthControl,
docsBpi2CmtsProvisionedCmCertTrust,
docsBpi2CmtsProvisionedCmCertSource,
docsBpi2CmtsProvisionedCmCertStatus,
docsBpi2CmtsProvisionedCmCert,
docsBpi2CmtsCACertSubject,
docsBpi2CmtsCACertIssuer,
docsBpi2CmtsCACertSerialNumber,
docsBpi2CmtsCACertTrust,
docsBpi2CmtsCACertSource,
docsBpi2CmtsCACertStatus,
docsBpi2CmtsCACert,
docsBpi2CmtsCACertThumbprint
}
STATUS current
DESCRIPTION
"This collection of objects provides CMTS BPI+ status
and control."
::= { docsBpi2Groups 2 }
docsBpi2CodeDownloadGroup OBJECT-GROUP
OBJECTS {
docsBpi2CodeDownloadStatusCode,
docsBpi2CodeDownloadStatusString,
docsBpi2CodeMfgOrgName,
docsBpi2CodeMfgCodeAccessStart,
docsBpi2CodeMfgCvcAccessStart,
docsBpi2CodeCoSignerOrgName,
docsBpi2CodeCoSignerCodeAccessStart,
docsBpi2CodeCoSignerCvcAccessStart,
docsBpi2CodeCvcUpdate
}
STATUS current
DESCRIPTION
"This collection of objects provides authenticated
software download support."
::= { docsBpi2Groups 3 }
END
4. Acknowledgements
Kaz Ozawa: Authenticated Software Download objects and general
suggestions.
Rich Woundy: BPI MIB and general MIB expertise.
Mike St. Johns: BPI MIB and first version of BPI+ MIB.
Bert Wijnen: Extensive comments in MIB syntax and accuracy.
Thanks to Mike Sabin and Manson Wong for reviewing early BPI+ MIB
drafts and to Jean-Francois Mule for contributing to the last
versions.
5. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2578] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Structure of Management Information Version 2 (SMIv2)",
STD 58, RFC 2578, April 1999.
[RFC2579] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Textual Conventions for SMIv2", STD 58, RFC 2579, April
1999.
[RFC2580] McCloghrie, K., Perkins, D., and J. Schoenwaelder,
"Conformance Statements for SMIv2", STD 58, RFC 2580,
April 1999.
[RFC3411] Harrington, D., Presuhn, R., and B. Wijnen, "An
Architecture for Describing Simple Network Management
Protocol (SNMP) Management Frameworks", STD 62, RFC
3411, December 2002.
[RFC4001] Daniele, M., Haberman, B., Routhier, S., and J.
Schoenwaelder, "Textual Conventions for Internet Network
Addresses", RFC 4001, February 2005.
[RFC2863] McCloghrie, K. and F. Kastenholz, "The Interfaces Group
MIB", RFC 2863, June 2000.
[RFC2670] St. Johns, M., "Radio Frequency (RF) Interface
Management Information Base for MCNS/DOCSIS compliant RF
interfaces", RFC 2670, August 1999.
[DOCSIS] "Data-Over-Cable Service Interface Specifications:
Baseline Privacy Plus Interface Specification SP-BPI+-
I11-040407", DOCSIS, April 2004, available at
http://www.cablemodem.com.
http://www.cablelabs.com/specifications/archives.
6. Informative References
[RFC3083] Woundy, R., "Baseline Privacy Interface Management
Information Base for DOCSIS Compliant Cable Modems and
Cable Modem Termination Systems", RFC 3083, March 2001.
[RFC3410] Case, J., Mundy, R., Partain, D., and B. Stewart,
"Introduction and Applicability Statements for
Internet-Standard Management Framework", RFC 3410,
December 2002.
[RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6
(IPv6) Addressing Architecture", RFC 3513, April 2003.
[DOCSIS-1.0] "Data-Over-Cable Service Interface Specifications:
DOCSIS 1.0 Baseline Privacy Interface (BPI) ANSI/SCTE
22-2 2202, Available at http://www.scte.org.
[DOCSIS-1.1] "Data-Over-Cable Service Interface Specifications:
Operations Support System Interface Specification SP-
OSSIv1.1-I07-030730", DOCSIS 1.1 July 2003, available at
http://www.cablemodem.com.
http://www.cablelabs.com/specifications/archives.
[DOCSIS-2.0] "Data-Over-Cable Service Interface Specifications:
Operations Support System Interface Specification SP-
OSSIv2.0-I05-040407", DOCSIS 2.0 April 2004,
http://www.cablemodem.com.
http://www.cablelabs.com/specifications/archives.
[IANA] "Protocol Numbers and Assignment Services", IANA,
http://www.iana.org/assignments/ianaiftype-mib.
7. Security Considerations
There are a number of management objects defined in this MIB module
with a MAX-ACCESS clause of read-write and/or read-create. Such
objects may be considered sensitive or vulnerable in some network
environments. The support for SET operations in a non-secure
environment without proper protection can have a negative effect on
network operations. These are the tables and objects and their
sensitivity/vulnerability:
- The following objects, if SNMP SET maliciously, could constitute
denial of service or theft of service attacks or compromise the
intended data privacy of users:
Objects related to the Baseline Privacy Key Management (BPKM)
docsBpi2CmAuthReset,
docsBpi2CmtsAuthCmReset,
docsBpi2CmtsTEKReset:
These objects are used for initiating a re-key process. A
malicious massive SET attack may cause CMTS processing
overload and may compromise the service.
docsBpi2CmtsDefaultAuthLifetime,
docsBpi2CmtsDefaultTEKLifetime,
docsBpi2CmtsAuthCmLifetime,
docsBpi2CmtsTEKLifetime:
To minimize the risk of malicious or unintended short periods
of time when key updates may lead to degradation or denial of
service, implementers are encouraged to follow these objects’
range constraints, as defined in the docsBpi2CmtsCompliance
MODULE-COMPLIANCE clause for operational deployments.
docsBpi2CmtsDefaultSelfSignedManufCertTrust:
A malicious SET in a self-signed certificate as reject
message, which may constitute denial of service. This object