Subject: BPI+ MIB - Internet Draft 02

From: Stuart Green <[email-masked]>
Date: Mon, 20 Mar 2000 11:43:43 -0500

The attached BPI+ MIB (02) internet draft will be 
submitted on March 27th to the IETF.  The IETF
is not accepting internet drafts until that date.

This draft contains no changes from the raw MIB 
mailed on 0225.
-- 
Stuart M. Green
Nortel Networks - Arris Interactive Venture
6 Riverside Drive, Andover, MA 01810   tel:(978) 946-4664
email:[email-masked]  email: [email-masked]
http://www.nortelnetworks.com   http://www.arris-i.com

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

                      Management Information Base
      for DOCSIS Cable Modems and Cable Modem Termination Systems
                       for Baseline Privacy Plus
                  draft-ietf-ipcdn-bpiplus-mib-02.txt

                      Mon Mar 27 16:35:27 EST 2000

                            Stuart M. Green
                           Arris Interactive
                        [email-masked]

                          Status of this Memo

    This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.  Internet-Drafts are working
   documents of the Internet Engineering Task Force (IETF), its areas,
   and its working groups.  Note that other groups may also distribute
   working documents as Internet-Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at:
   http://www.ietf.org/ietf/1id-abstracts.txt

   The list of Internet-Draft Shadow Directories can be accessed at:
   http://www.ietf.org/shadow.html.

Abstract

   This memo defines a portion of the Management Information Base (MIB)
   for use with network management protocols in the Internet community.
   In particular, it defines a set of managed objects for SNMP-based
   management of the Baseline Privacy Plus features [17] of
   DOCSIS1.1-compliant[16] Cable Modems and Cable Modem Termination
   Systems.

   This memo specifies a MIB module in a manner that is compliant to the
   SNMP SMIv2 [5][6][7].  The set of objects are consistent with the
   SNMP framework and existing SNMP standards.

   This memo is a product of the IPCDN working group within the Internet
   Engineering Task Force.  Comments are solicited and should be
   addressed to the working group's mailing list at [email-masked]
   and/or the authors.

Table of Contents

1. The SNMP Network Management Framework..............................2
2. Overview...........................................................3

Expires September 2000                                         [Page 1]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

2.1. Structure of the MIB.............................................3
2.1.1. Cable Modem....................................................3
2.1.2. Cable Modem Termination System.................................4
2.1.3. Common.........................................................4
3. Definitions........................................................4
4. Acknowledgments...................................................58
5. References........................................................59
6. Security Considerations...........................................60
7. Author's Address..................................................61

1. The SNMP Network Management Framework

   The SNMP Management Framework presently consists of five major
   components:

   o   An overall architecture, described in RFC 2571 [1].

   o   Mechanisms for describing and naming objects and events for the
       purpose of management. The first version of this Structure of
       Management Information (SMI) is called SMIv1 and described in STD
       16, RFC 1155 [2], STD 16, RFC 1212 [3] and RFC 1215 [4]. The
       second version, called SMIv2, is described in STD 58, RFC 2578
       [5], STD 58, RFC 2579 [6] and STD 58, RFC 2580 [7].

   o   Message protocols for transferring management information. The
       first version of the SNMP message protocol is called SNMPv1 and
       described in RFC 1157 [8]. A second version of the SNMP message
       protocol, which is not an Internet standards track protocol, is
       called SNMPv2c and described in RFC 1901 [9] and RFC 1906 [10].
       The third version of the message protocol is called SNMPv3 and
       described in RFC 1906 [10], RFC 2572 [11] and RFC 2574 [12].

   o   Protocol operations for accessing management information. The
       first set of protocol operations and associated PDU formats is
       described in STD 15, RFC 1157 [8]. A second set of protocol
       operations and associated PDU formats is described in RFC 1905
       [13].

   o   A set of fundamental applications described in RFC 2573 [14] and
       the view-based access control mechanism described in RFC 2575
       [15].

   Managed objects are accessed via a virtual information store, termed
   the Management Information Base or MIB.  Objects in the MIB are
   defined using the mechanisms defined in the SMI.

   This memo specifies a MIB module that is compliant to the SMIv2. A
   MIB conforming to the SMIv1 can be produced through the appropriate
   translations. The resulting translated MIB MUST be semantically
   equivalent, except where objects or events are omitted because no
   translation is possible (use of Counter64). Some machine readable
   information in SMIv2 will be converted into textual descriptions in

Expires September 2000                                         [Page 2]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   SMIv1 during the translation process. However, this loss of machine
   readable information is not considered to change the semantics of the
   MIB.

2. Overview

   This MIB provides a set of objects required for the management of the
   Baseline Privacy Plus features of DOCSIS Cable Modem (CM) and Cable
   Modem Termination Systems (CMTS). The specification is derived from
   the operational model described in the DOCSIS Baseline Privacy Plus
   Specification [17].

   DOCSIS Baseline Privacy Plus is composed of four distinct functional
   and manageable areas:

   o    Key Exchange and Data Encryption

   o    Cable Modem Authentication

   o    Multicast Encryption

   o    Authentication of Downloaded Software Images

   This MIB is an extension of the DOCSIS 1.0 Baseline Privacy MIB [19]
   which is derived from the operational model described in the DOCSIS
   Baseline Privacy Specification [18].  The original Baseline Privacy
   MIB structure has been mostly preserved in the Baseline Privacy Plus
   MIB.

2.1. Structure of the MIB

   This MIB is structured into several tables and objects:

2.1.1. Cable Modem

   o    The docsBpi2CmBaseTable contains authorization key exchange
        information for one CM MAC interface.

   o    The docsBpi2CmTEKTable contains traffic key exchange and
        data encryption information for a particular security
        association ID of the cable modem.

   o    Multicast Encryption information is maintained under
        Docsbpi2CmMulticastObjects.  There is currently one multicast
        table object which manages IP multicast encryption,
        docsBpi2CmIpMulticastMapTable.

   o    Digital certificates used for cable modem authentication are
        accessible via docsBpi2CmDeviceCertTable.

   o    Cryptographic suite capabilities for a CM MAC are maintained
        in the docsBpi2CmCryptoSuiteTable.

Expires September 2000                                         [Page 3]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

2.1.2. Cable Modem Termination System

   o    The docsBpi2CmtsBaseTable contains default settings and
        summary counters for the cable modem termination system.

   o    The DocsBpi2CmtsAuthTable contains Authorization Key Exchange
        information for each CM MAC interface, as well as data
        from CM certificates used in cable modem authentication.

   o    The docsBpi2CmtsTEKTable contains traffic key exchange and
        data encryption information for a particular security
        association ID.

   o    Multicast Encryption information is maintained under
        Docsbpi2CmtsMulticastObjects.  There are currently two
        multicast table objects.  DocsBpi2CmtsIpMulticastMapTable
        is specifically designed for IP multicast encryption,
        whereas docsBpi2CmtsMulticastAuthTable is meant to manage
        all multicast security associations.

   o    DocsBpi2CmtsCertObjects contains 2 manageable tables: one
        for provisioned cable modem certificates, the other for
        certification authority certificates.

2.1.3. Common

   o    The docsBpi2CodeDownloadControl objects manage the
        authenticated software download process for a given device.

3. Definitions

   DOCS-BPI2-MIB DEFINITIONS ::= BEGIN

   IMPORTS
        MODULE-IDENTITY, OBJECT-TYPE,
        Counter32,
        IpAddress,
        Integer32
             FROM SNMPv2-SMI
        SnmpAdminString
             FROM SNMP-FRAMEWORK-MIB
        TEXTUAL-CONVENTION,
        DisplayString,
        MacAddress,
        RowStatus,
        TruthValue,
        DateAndTime
             FROM SNMPv2-TC
        OBJECT-GROUP,
        MODULE-COMPLIANCE
             FROM SNMPv2-CONF
        ifIndex

Expires September 2000                                         [Page 4]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

             FROM IF-MIB
        docsIfMib
             FROM DOCS-IF-MIB
   ;

   docsBpi2MIB    MODULE-IDENTITY
        LAST-UPDATED "0002251930Z"
        ORGANIZATION "IETF IPCDN Working Group"
        CONTACT-INFO "---------------------------------------
                   Stuart M. Green
                   Postal:
                   Arris Interactive / Nortel Networks
                   6 Riverside Drive
                   Andover, MA 01810
                   U.S.A.
                   Tel:    +1 978 946 4664
                   Fax:    +1 978 946 4800
                   E-mail: [email-masked]
                   ---------------------------------------
                   Kaz Ozawa
                   Postal:
                   Cable Television Laboratories
                   400 Centennial Parkway
                   Louisville, CO 80027
                   U.S.A.
                   Tel:    +1 303 661 3860
                   Fax:    +1 303 661 9199
                   E-mail: [email-masked]
                   ---------------------------------------
                   Mike St. Johns
                   Postal:
                   @Home Network
                   425 Broadway
                   Redwood City, CA 94063
                   U.S.A.
                   Tel:    +1 650 569 5368
                   E-mail: [email-masked]
                   ---------------------------------------
                   Rich Woundy (BPI MIB)
                   Postal:
                   Cisco Systems
                   300 Apollo Drive
                   Chelmsford, MA 01824
                   U.S.A.
                   Tel:    +1 978 244 8545
                   Fax:    +1 978 244 8917
                   E-mail: [email-masked]"
        DESCRIPTION
             "This is the MIB Module for the DOCSIS Baseline Privacy
        Plus Interface (BPI+) at cable modems (CMs) and cable modem
        termination systems (CMTSs)."
        ::= { docsIfMib 6 }

Expires September 2000                                         [Page 5]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   -- Textual conventions

   X509Certificate ::= TEXTUAL-CONVENTION
        STATUS    current
        DESCRIPTION
            "An X509 digital certificate encoded as an ASN.1 DER
        object."
        SYNTAX    OCTET STRING (SIZE (0..1487))

   docsBpi2MIBObjects  OBJECT IDENTIFIER ::= { docsBpi2MIB 1 }

   -- Cable Modem Group

   docsBpi2CmObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 1 }

   --
   -- The BPI+ base and authorization table for CMs, indexed by ifIndex
   --

   docsBpi2CmBaseTable OBJECT-TYPE
        SYNTAX              SEQUENCE OF    DocsBpi2CmBaseEntry
        MAX-ACCESS          not-accessible
        STATUS              current
        DESCRIPTION
             "This table describes the basic and authorization
        related   Baseline Privacy Plus attributes of each CM MAC
        interface."
        ::= { docsBpi2CmObjects 1 }

   docsBpi2CmBaseEntry OBJECT-TYPE
        SYNTAX              DocsBpi2CmBaseEntry
        MAX-ACCESS          not-accessible
        STATUS              current
        DESCRIPTION
             "Each entry contains objects describing attributes of
        one CM MAC interface. An entry in this table exists for each
        ifEntry with an ifType of docsCableMaclayer(127)."
        INDEX               { ifIndex }
        ::= { docsBpi2CmBaseTable 1 }

   DocsBpi2CmBaseEntry ::= SEQUENCE {
        docsBpi2CmPrivacyEnable            TruthValue,
        docsBpi2CmPublicKey           OCTET STRING,
        docsBpi2CmAuthState           INTEGER,
        docsBpi2CmAuthKeySequenceNumber         Integer32,
        docsBpi2CmAuthExpiresOld      DateAndTime,
        docsBpi2CmAuthExpiresNew      DateAndTime,
        docsBpi2CmAuthReset           TruthValue,
        docsBpi2CmAuthGraceTime            Integer32,
        docsBpi2CmTEKGraceTime             Integer32,
        docsBpi2CmAuthWaitTimeout          Integer32,
        docsBpi2CmReauthWaitTimeout        Integer32,

Expires September 2000                                         [Page 6]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        docsBpi2CmOpWaitTimeout            Integer32,
        docsBpi2CmRekeyWaitTimeout         Integer32,
        docsBpi2CmAuthRejectWaitTimeout         Integer32,
        docsBpi2CmSAMapWaitTimeout         Integer32,
        docsBpi2CmSAMapMaxRetries          Integer32,
        docsBpi2CmAuthentInfos             Counter32,
        docsBpi2CmAuthRequests             Counter32,
        docsBpi2CmAuthReplies              Counter32,
        docsBpi2CmAuthRejects              Counter32,
        docsBpi2CmAuthInvalids             Counter32,
        docsBpi2CmAuthRejectErrorCode      INTEGER,
        docsBpi2CmAuthRejectErrorString         DisplayString,
        docsBpi2CmAuthInvalidErrorCode          INTEGER,
        docsBpi2CmAuthInvalidErrorString   DisplayString
        }

   docsBpi2CmPrivacyEnable  OBJECT-TYPE
        SYNTAX         TruthValue
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "This object identifies whether this CM is
        provisioned to run Baseline Privacy Plus. This is analogous
        to the presence     (or absence) of the Baseline Privacy Plus
        Configuration Settings.  In addition, the Privacy Enable RFI
        encoding must be enabled for this object to be true."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1."
        ::= { docsBpi2CmBaseEntry 1 }

   docsBpi2CmPublicKey OBJECT-TYPE
        SYNTAX         OCTET STRING (SIZE (74|106|140|204|270))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is a DER-encoded
        RSAPublicKey ASN.1 type string, as defined in the RSA
        Encryption Standard (PKCS #1) [10], corresponding to the
        public key of the CM. The 74, 106, 140, 204, and 270 byte key
        encoding lengths correspond to 512 bit, 768 bit, 1024 bit,
        1536 bit, and 2048 public moduli respectively."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.4."
        ::= { docsBpi2CmBaseEntry 2 }

   docsBpi2CmAuthState OBJECT-TYPE
        SYNTAX         INTEGER   {
                       start(1),
                       authWait(2),
                       authorized(3),
                       reauthWait(4),

Expires September 2000                                         [Page 7]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

                       authRejectWait(5),
                       silent(6)
                  }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the state of the CM
        authorization FSM.  The start state indicates that FSM is in
        its initial state."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.1.2.1."
        ::= { docsBpi2CmBaseEntry 3 }

   docsBpi2CmAuthKeySequenceNumber    OBJECT-TYPE
        SYNTAX              Integer32 (0..15)
        MAX-ACCESS          read-only
        STATUS              current
        DESCRIPTION
             "The value of this object is the most recent
        authorization key sequence number for this FSM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.2 and 4.2.2.10."
        ::= { docsBpi2CmBaseEntry 4 }

   docsBpi2CmAuthExpiresOld OBJECT-TYPE
        SYNTAX              DateAndTime
        MAX-ACCESS          read-only
        STATUS              current
        DESCRIPTION
             "The value of this object is the actual clock time
        when the immediate predecessor of the most recent
        authorization for this FSM expires.  If the CM does not have
        an active authorization, then the value is of the expiration
        date and time of the last active authorization."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.2 and 4.2.2.9."
        ::= { docsBpi2CmBaseEntry 5 }

   docsBpi2CmAuthExpiresNew OBJECT-TYPE
        SYNTAX              DateAndTime
        MAX-ACCESS          read-only
        STATUS              current
        DESCRIPTION
             "The value of this object is the actual clock time
        when the most recent authorization for this FSM expires. If
        the CM does not have an active authorization, then the value
        is of the expiration date and time of the last active
        authorization."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,

Expires September 2000                                         [Page 8]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        Sections 4.2.1.2 and 4.2.2.9."
        ::= { docsBpi2CmBaseEntry 6 }

   docsBpi2CmAuthReset OBJECT-TYPE
        SYNTAX         TruthValue
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "Setting this object to TRUE generates a Reauthorize
        event in the authorization FSM. Reading this object always
        returns FALSE."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.1.2.3.4."
        ::= { docsBpi2CmBaseEntry 7 }

   docsBpi2CmAuthGraceTime  OBJECT-TYPE
        SYNTAX         Integer32 (1..6047999)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the grace time for an
        authorization key.  A CM is expected to start trying to get a
        new authorization key beginning AuthGraceTime seconds before
        the authorization key actually expires. The value of this
        object cannot be changed while the authorization state
        machine   is running."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.3."
        ::= { docsBpi2CmBaseEntry 8 }

   docsBpi2CmTEKGraceTime   OBJECT-TYPE
        SYNTAX         Integer32 (1..302399)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the grace time for
        the TEK in seconds.  The CM is expected to start trying to
        acquire a new TEK beginning TEK GraceTime seconds after
        the expiration of the immediate predecessor of the most
        recent TEK.  The value of this object cannot be changed
        while the authorization state machine is running."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.6."
        ::= { docsBpi2CmBaseEntry 9 }

   docsBpi2CmAuthWaitTimeout     OBJECT-TYPE
        SYNTAX         Integer32 (1..30)
        UNITS          "seconds"

Expires September 2000                                         [Page 9]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Authorize Wait
        Timeout. The value of this object cannot be changed while the
        authorization state machine is running."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.1."
        ::= { docsBpi2CmBaseEntry 10 }

   docsBpi2CmReauthWaitTimeout   OBJECT-TYPE
        SYNTAX         Integer32 (1..30)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Reauthorize Wait
        Timeout in seconds.  The value of this object cannot be
        changed while the authorization state machine is running."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.2."
        ::= { docsBpi2CmBaseEntry 11 }

   docsBpi2CmOpWaitTimeout  OBJECT-TYPE
        SYNTAX         Integer32 (1..10)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Operational Wait
        Timeout in seconds.  The value of this object cannot be
        changed while the authorization state machine is running."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.4."
        ::= { docsBpi2CmBaseEntry 12 }

   docsBpi2CmRekeyWaitTimeout    OBJECT-TYPE
        SYNTAX         Integer32 (1..10)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Rekey Wait Timeout
        in seconds. The value of this object cannot be changed while
        the authorization state machine is running."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.5."
        ::= { docsBpi2CmBaseEntry 13 }

Expires September 2000                                        [Page 10]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   docsBpi2CmAuthRejectWaitTimeout    OBJECT-TYPE
        SYNTAX         Integer32 (1..600)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Authorization Reject
        Wait Timeout in seconds. The value of this object cannot be
        changed while the authorization state machine is running."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.7."
        ::= { docsBpi2CmBaseEntry 14 }

   docsBpi2CmSAMapWaitTimeout    OBJECT-TYPE
        SYNTAX         Integer32 (1..10)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the retransmission
        interval, in seconds, of SA Map Requests from the MAP Wait
        state."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.8."
        ::= { docsBpi2CmBaseEntry 15 }

   docsBpi2CmSAMapMaxRetries     OBJECT-TYPE
        SYNTAX         Integer32 (0..10)
        UNITS          "count"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the maximum number of
        Map Request retries allowed."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.9."
        ::= { docsBpi2CmBaseEntry 16 }

   docsBpi2CmAuthentInfos   OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has transmitted an Authentication Information message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.9."
        ::= { docsBpi2CmBaseEntry 17 }

Expires September 2000                                        [Page 11]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   docsBpi2CmAuthRequests   OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has transmitted an Authorization Request message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.1."
        ::= { docsBpi2CmBaseEntry 18 }

   docsBpi2CmAuthReplies    OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has received an Authorization Reply message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.2."
        ::= { docsBpi2CmBaseEntry 19 }

   docsBpi2CmAuthRejects    OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has received an Authorization Reject message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.3."
        ::= { docsBpi2CmBaseEntry 20 }

   docsBpi2CmAuthInvalids   OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has received an Authorization Invalid message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.7."
        ::= { docsBpi2CmBaseEntry 21 }

   docsBpi2CmAuthRejectErrorCode OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       unauthorizedCm(3),

Expires September 2000                                        [Page 12]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

                       unauthorizedSaid(4),
                       permanentAuthorizationFailure(8)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in most recent Authorization
        Reject message received by the CM.  This has value unknown(2)
        if the last Error-Code value was 0, and none(1) if no
        Authorization Reject message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.3 and 4.2.2.15."
        ::= { docsBpi2CmBaseEntry 22 }

   docsBpi2CmAuthRejectErrorString    OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        most recent Authorization Reject message received by the CM.
        This is a zero length string if no Authorization Reject
        message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.3 and 4.2.2.6."
        ::= { docsBpi2CmBaseEntry 23 }

   docsBpi2CmAuthInvalidErrorCode     OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       unauthorizedCm(3),
                       unsolicited(5),
                       invalidKeySequence(6),
                       keyRequestAuthenticationFailure(7)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in most recent Authorization
        Invalid message received by the CM.  This has value unknown(2)
        if the last Error-Code value was 0, and none(1) if no
        Authorization Invalid message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.7 and 4.2.2.15."
        ::= { docsBpi2CmBaseEntry 24 }

   docsBpi2CmAuthInvalidErrorString   OBJECT-TYPE

Expires September 2000                                        [Page 13]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        most recent Authorization Invalid message received by the CM.
        This is a zero length string if no Authorization Invalid
        message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.7 and 4.2.2.6."
        ::= { docsBpi2CmBaseEntry 25 }

   --
   -- The CM TEK Table, indexed by ifIndex and SAID
   --

   docsBpi2CmTEKTable  OBJECT-TYPE
        SYNTAX         SEQUENCE OF    DocsBpi2CmTEKEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table describes the attributes of each CM
        Traffic Encryption Key(TEK) association. The CM maintains (no
        more than) one TEK association per SAID per CM MAC interface."
        ::= { docsBpi2CmObjects 2 }

   docsBpi2CmTEKEntry  OBJECT-TYPE
        SYNTAX         DocsBpi2CmTEKEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "Each entry contains objects describing the TEK
        association attributes of one SAID. The CM MUST create one
        entry per SAID, regardless of whether the SAID was obtained
        from a Registration Response message, from an Authorization
        Reply message, or from any future dynamic SAID establishment
        mechanisms."
        INDEX     { ifIndex, docsBpi2CmTEKSAId }
        ::= { docsBpi2CmTEKTable 1 }

   DocsBpi2CmTEKEntry ::= SEQUENCE {
        docsBpi2CmTEKSAId             Integer32,
        docsBpi2CmTEKSAType           INTEGER,
        docsBpi2CmTEKDataEncryptAlg        INTEGER,
        docsBpi2CmTEKDataAuthentAlg        INTEGER,
        docsBpi2CmTEKState            INTEGER,
        docsBpi2CmTEKKeySequenceNumber          Integer32,
        docsBpi2CmTEKExpiresOld            DateAndTime,
        docsBpi2CmTEKExpiresNew            DateAndTime,

Expires September 2000                                        [Page 14]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        docsBpi2CmTEKKeyRequests      Counter32,
        docsBpi2CmTEKKeyReplies            Counter32,
        docsBpi2CmTEKKeyRejects            Counter32,
        docsBpi2CmTEKInvalids              Counter32,
        docsBpi2CmTEKAuthPends             Counter32,
        docsBpi2CmTEKKeyRejectErrorCode         INTEGER,
        docsBpi2CmTEKKeyRejectErrorString  DisplayString,
        docsBpi2CmTEKInvalidErrorCode      INTEGER,
        docsBpi2CmTEKInvalidErrorString         DisplayString
        }

   docsBpi2CmTEKSAId   OBJECT-TYPE
        SYNTAX         Integer32 (1..16383)
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "The value of this object is the DOCSIS Security
        Association ID (SAID)."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.12."
        ::= { docsBpi2CmTEKEntry 1 }

   docsBpi2CmTEKSAType OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0),
                       primary(1),
                       static(2),
                       dynamic(3)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the type of security
        association."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 2.1.3."
        ::= { docsBpi2CmTEKEntry 2 }

   docsBpi2CmTEKDataEncryptAlg   OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0),
                       des56CbcMode(1),
                       des40CbcMode(2)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data encryption
        algorithm being utilized."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,

Expires September 2000                                        [Page 15]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        Section 4.2.2.20."
        ::= { docsBpi2CmTEKEntry 3 }

   docsBpi2CmTEKDataAuthentAlg   OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data authentication
        algorithm being utilized."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmTEKEntry 4 }

   docsBpi2CmTEKState  OBJECT-TYPE
        SYNTAX         INTEGER {
                       start(1),
                       opWait(2),
                       opReauthWait(3),
                       operational(4),
                       rekeyWait(5),
                       rekeyReauthWait(6)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the state of the
        indicated TEK FSM.  The start(1) state indicates that FSM is
        in its initial state."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.1.3.1."
        ::= { docsBpi2CmTEKEntry 5 }

   docsBpi2CmTEKKeySequenceNumber     OBJECT-TYPE
        SYNTAX              Integer32 (0..15)
        MAX-ACCESS          read-only
        STATUS              current
        DESCRIPTION
             "The value of this object is the most recent TEK
        key sequence number for this TEK FSM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.2.10 and 4.2.2.13."
        ::= { docsBpi2CmTEKEntry 6 }

   docsBpi2CmTEKExpiresOld  OBJECT-TYPE
        SYNTAX         DateAndTime
        MAX-ACCESS     read-only
        STATUS         current

Expires September 2000                                        [Page 16]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        DESCRIPTION
             "The value of this object is the actual clock time for
        expiration of the immediate predecessor of the most recent TEK
        for this FSM.  If this FSM has only one TEK, then the value is
        the time of activation of this FSM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.5 and 4.2.2.9."
        ::= { docsBpi2CmTEKEntry 7 }

   docsBpi2CmTEKExpiresNew  OBJECT-TYPE
        SYNTAX         DateAndTime
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the actual clock time for
        expiration of the most recent TEK for this FSM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.5 and 4.2.2.9."
        ::= { docsBpi2CmTEKEntry 8 }

   docsBpi2CmTEKKeyRequests OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has transmitted a Key Request message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.4."
        ::= { docsBpi2CmTEKEntry 9 }

   docsBpi2CmTEKKeyReplies  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has received a Key Reply message, including a message whose
        authentication failed."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.5."
        ::= { docsBpi2CmTEKEntry 10 }

   docsBpi2CmTEKKeyRejects  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM

Expires September 2000                                        [Page 17]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        has received a Key Reject message, including a message whose
        authentication failed."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.6."
        ::= { docsBpi2CmTEKEntry 11 }

        docsBpi2CmTEKInvalids    OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the CM
        has received a TEK Invalid message, including a message whose
        authentication failed."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.8."
        ::= { docsBpi2CmTEKEntry 12 }

   docsBpi2CmTEKAuthPends   OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times an
        Authorization Pending (Auth Pend) event occurred in this FSM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.1.3.3.3."
        ::= { docsBpi2CmTEKEntry 13 }

   docsBpi2CmTEKKeyRejectErrorCode    OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       unauthorizedSaid(4)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in most recent Key Reject
        message received by the CM. This has value unknown(2) if the
        last Error-Code value was 0, and none(1) if no Key Reject
        message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.1.2.6 and 4.2.2.15."
        ::= { docsBpi2CmTEKEntry 14 }

   docsBpi2CmTEKKeyRejectErrorString  OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))

Expires September 2000                                        [Page 18]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        most recent Key Reject message received by the CM. This is a
        zero length string if no Key Reject message has been received
        since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.1.2.6 and 4.2.2.6."
        ::= { docsBpi2CmTEKEntry 15 }

   docsBpi2CmTEKInvalidErrorCode OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       invalidKeySequence(6)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in most recent TEK Invalid
        message received by the CM.  This has value unknown(2) if the
        last Error-Code value was 0, and  none(1) if no TEK Invalid
        message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.1.2.8 and 4.2.2.15."
        ::= { docsBpi2CmTEKEntry 16 }

   docsBpi2CmTEKInvalidErrorString    OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        most recent TEK Invalid message received by the CM. This is a
        zero length string if no TEK Invalid message has been received
        since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.1.2.8 and 4.2.2.6."
        ::= { docsBpi2CmTEKEntry 17 }

   --
   -- The CM Multicast Objects Group
   --

   docsBpi2CmMulticastObjects OBJECT IDENTIFIER
        ::= { docsBpi2CmObjects 3 }

Expires September 2000                                        [Page 19]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   --
   -- The CM Dynamic IP Multicast Mapping Table, indexed by IP multicast
   -- address and by ifindex
   --

   docsBpi2CmIpMulticastMapTable OBJECT-TYPE
        SYNTAX         SEQUENCE OF DocsBpi2CmIpMulticastMapEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table maps multicast IP addresses to SAIDs.
        It is intended to map DYNAMIC multicast IP addresses only."
        ::= { docsBpi2CmMulticastObjects 1 }

   docsBpi2CmIpMulticastMapEntry OBJECT-TYPE
        SYNTAX         DocsBpi2CmIpMulticastMapEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "Each entry contains objects describing the mapping of
        one multicast IP address to one SAID, as well as
        associated state, message counters, and error information."
        INDEX     { ifIndex, docsBpi2CmIpMulticastAddress }
        ::= { docsBpi2CmIpMulticastMapTable 1 }

   DocsBpi2CmIpMulticastMapEntry ::= SEQUENCE {
        docsBpi2CmIpMulticastAddress            IpAddress,
        docsBpi2CmIpMulticastSAId               Integer32,
        docsBpi2CmIpMulticastSAMapState              INTEGER,
        docsBpi2CmIpMulticastSAMapRequests      Counter32,
        docsBpi2CmIpMulticastSAMapReplies       Counter32,
        docsBpi2CmIpMulticastSAMapRejects       Counter32,
        docsBpi2CmIpMulticastSAMapRejectErrorCode    INTEGER,
        docsBpi2CmIpMulticastSAMapRejectErrorString  DisplayString
        }

   docsBpi2CmIpMulticastAddress  OBJECT-TYPE
        SYNTAX         IpAddress
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This object represents the IP multicast address
        to be mapped."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 5.4."
        ::= { docsBpi2CmIpMulticastMapEntry 1 }

   docsBpi2CmIpMulticastSAId          OBJECT-TYPE
        SYNTAX         Integer32 (0..16383)
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION

Expires September 2000                                        [Page 20]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

             "This object represents the SAID to which the IP
        multicast address has been mapped.  If no SA Map Reply has
        been received for the IP address, this object should have the
        value 0."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.12."
        ::= { docsBpi2CmIpMulticastMapEntry 2 }

   docsBpi2CmIpMulticastSAMapState         OBJECT-TYPE
        SYNTAX         INTEGER {
                       start(1),
                       mapWait(2),
                       mapped(3)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the state of the SA
        Mapping   FSM for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 5.3.1."
        ::= { docsBpi2CmIpMulticastMapEntry 3 }

   docsBpi2CmIpMulticastSAMapRequests OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CM has transmitted an SA Map Request message for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.10."
        ::= { docsBpi2CmIpMulticastMapEntry 4 }

   docsBpi2CmIpMulticastSAMapReplies  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CM has received an SA Map Reply message for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.11."
        ::= { docsBpi2CmIpMulticastMapEntry 5 }

   docsBpi2CmIpMulticastSAMapRejects  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current

Expires September 2000                                        [Page 21]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        DESCRIPTION
             "The value of this object is the count of times the
        CM has received an SA MAP Reject message for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.12."
        ::= { docsBpi2CmIpMulticastMapEntry 6 }

   docsBpi2CmIpMulticastSAMapRejectErrorCode    OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       noAuthForRequestedDSFlow(9),
                       dsFlowNotMappedToSA(10)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in the most recent SA Map
        Reject message sent in response to an SA Map Request for this
        IP.  It has value unknown(2) if the last Error-Code value
        was 0, and none(1) if no SA MAP Reject message has been
        received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.12 and 4.2.2.15."
        ::= { docsBpi2CmIpMulticastMapEntry 7 }

   docsBpi2CmIpMulticastSAMapRejectErrorString  OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        the most recent SA Map Reject message sent in response to an
        SA Map Request for this IP.  It is a zero length string if
        no SA Map Reject message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.12 and 4.2.2.6."
        ::= { docsBpi2CmIpMulticastMapEntry 8 }

   --
   -- CM Cert Objects
   --

   docsBpi2CmCertObjects OBJECT IDENTIFIER
        ::= { docsBpi2CmObjects 4 }

   --
   -- CM Device Cert Table

Expires September 2000                                        [Page 22]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   --

   docsBpi2CmDeviceCertTable     OBJECT-TYPE
        SYNTAX              SEQUENCE OF    DocsBpi2CmDeviceCertEntry
        MAX-ACCESS          not-accessible
        STATUS              current
        DESCRIPTION
             "This table describes the Baseline Privacy Plus
        device certificates for each CM MAC interface."
        ::= { docsBpi2CmCertObjects 1 }

   docsBpi2CmDeviceCertEntry     OBJECT-TYPE
        SYNTAX              DocsBpi2CmDeviceCertEntry
        MAX-ACCESS          not-accessible
        STATUS              current
        DESCRIPTION
             "Each entry contains the device certificates of
        one CM MAC interface. An entry in this table exists for each
        ifEntry with an ifType of docsCableMaclayer(127)."
        INDEX               { ifIndex }
        ::= { docsBpi2CmDeviceCertTable 1 }

   DocsBpi2CmDeviceCertEntry ::= SEQUENCE {
        docsBpi2CmDeviceCmCert        X509Certificate,
        docsBpi2CmDeviceManufCert     X509Certificate
        }

   docsBpi2CmDeviceCmCert   OBJECT-TYPE
        SYNTAX    X509Certificate
        MAX-ACCESS     read-write
        STATUS    current
        DESCRIPTION
             "The X509 DER-encoded cable modem certificate.
        Note:  This object can be set only when the value is the null
        string.  Once the object contains the certificate, its access
        MUST be read-only."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.1."
        ::= { docsBpi2CmDeviceCertEntry 1 }

   docsBpi2CmDeviceManufCert     OBJECT-TYPE
        SYNTAX    X509Certificate
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
             "The X509 DER-encoded manufacturer certificate which
        signed the cable modem certificate."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.1."
        ::= { docsBpi2CmDeviceCertEntry 2 }

Expires September 2000                                        [Page 23]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   --
   -- CM Crypto Suite Table
   --

   docsBpi2CmCryptoSuiteTable    OBJECT-TYPE
        SYNTAX         SEQUENCE OF    DocsBpi2CmCryptoSuiteEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table describes the Baseline Privacy Plus
        cryptographic suite capabilites for each CM MAC interface."
        ::= { docsBpi2CmObjects 5 }

   docsBpi2CmCryptoSuiteEntry    OBJECT-TYPE
        SYNTAX         DocsBpi2CmCryptoSuiteEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "Each entry contains a cryptographic suite pair
        which this CM MAC supports."
        INDEX     { ifIndex, docsBpi2CmCryptoSuiteIndex }
        ::= { docsBpi2CmCryptoSuiteTable 1 }

   DocsBpi2CmCryptoSuiteEntry ::= SEQUENCE {
        docsBpi2CmCryptoSuiteIndex         Integer32,
        docsBpi2CmCryptoSuiteDataEncryptAlg     INTEGER,
        docsBpi2CmCryptoSuiteDataAuthentAlg     INTEGER
        }

   docsBpi2CmCryptoSuiteIndex OBJECT-TYPE
        SYNTAX    Integer32 (1..1000)
        MAX-ACCESS     not-accessible
        STATUS    current
        DESCRIPTION
             "The index for a cryptographic suite row."
        ::= { docsBpi2CmCryptoSuiteEntry 1 }

   docsBpi2CmCryptoSuiteDataEncryptAlg     OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0),
                       des56CbcMode(1),
                       des40CbcMode(2)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data encryption
        algorithm for this cryptographic suite capability."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmCryptoSuiteEntry 2 }

Expires September 2000                                        [Page 24]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   docsBpi2CmCryptoSuiteDataAuthentAlg     OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data authentication
        algorithm for this cryptographic suite capability."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmCryptoSuiteEntry 3 }

   -- Cable Modem Termination System Group

   docsBpi2CmtsObjects OBJECT IDENTIFIER ::= { docsBpi2MIBObjects 2 }

   --
   -- The BPI+ base table for CMTSs, indexed by ifIndex
   --

   docsBpi2CmtsBaseTable    OBJECT-TYPE
        SYNTAX         SEQUENCE OF    DocsBpi2CmtsBaseEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table describes the basic Baseline Privacy
        attributes of each CMTS MAC interface."
        ::= { docsBpi2CmtsObjects 1 }

   docsBpi2CmtsBaseEntry    OBJECT-TYPE
        SYNTAX         DocsBpi2CmtsBaseEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "Each entry contains objects describing attributes of
        one CMTS MAC interface.  An entry in this table exists for
        each ifEntry with an ifType of docsCableMaclayer(127)."
        INDEX     { ifIndex }
        ::= { docsBpi2CmtsBaseTable 1 }

   DocsBpi2CmtsBaseEntry ::= SEQUENCE {
        docsBpi2CmtsDefaultAuthLifetime              Integer32,
        docsBpi2CmtsDefaultTEKLifetime               Integer32,
        docsBpi2CmtsDefaultSelfSignedManufCertTrust  INTEGER,
        docsBpi2CmtsCheckCertValidityPeriods         TruthValue,
        docsBpi2CmtsAuthentInfos           Counter32,

Expires September 2000                                        [Page 25]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        docsBpi2CmtsAuthRequests           Counter32,
        docsBpi2CmtsAuthReplies                 Counter32,
        docsBpi2CmtsAuthRejects                 Counter32,
        docsBpi2CmtsAuthInvalids           Counter32,
        docsBpi2CmtsSAMapRequests               Counter32,
        docsBpi2CmtsSAMapReplies           Counter32,
        docsBpi2CmtsSAMapRejects           Counter32
        }

   docsBpi2CmtsDefaultAuthLifetime    OBJECT-TYPE
        SYNTAX         Integer32 (1..6048000)
        UNITS          "seconds"
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "The value of this object is the default lifetime, in
        seconds, the CMTS assigns to a new authorization key."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.2."
        ::= { docsBpi2CmtsBaseEntry 1 }

   docsBpi2CmtsDefaultTEKLifetime     OBJECT-TYPE
        SYNTAX         Integer32 (1..604800)
        UNITS          "seconds"
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "The value of this object is the default lifetime, in
        seconds, the CMTS assigns to a new Traffic Encryption Key
        (TEK)."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.2."
        ::= { docsBpi2CmtsBaseEntry 2 }

   docsBpi2CmtsDefaultSelfSignedManufCertTrust  OBJECT-TYPE
        SYNTAX    INTEGER {
                  trusted (1),
                  untrusted (2)
                  }
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "This object determines the default trust of all (new)
        self-signed manufacturer certificates obtained after setting
        the object."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.4.1"
        ::= { docsBpi2CmtsBaseEntry 3 }

   docsBpi2CmtsCheckCertValidityPeriods    OBJECT-TYPE

Expires September 2000                                        [Page 26]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        SYNTAX         TruthValue
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "Setting this object to TRUE causes all certificates
        obtained thereafter to have their validity periods (and their
        chain's validity periods) checked against the current time of
        day.  A FALSE setting will cause all certificates obtained
        thereafter to not have their validity periods (nor their
        chain's validity periods) checked against the current time of
        day."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.4.2"
        ::= { docsBpi2CmtsBaseEntry 4 }

   docsBpi2CmtsAuthentInfos OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has received an Authentication Information message from
        any CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.9."
        ::= { docsBpi2CmtsBaseEntry 5 }

   docsBpi2CmtsAuthRequests OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has received an Authorization Request message from any
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.1."
        ::= { docsBpi2CmtsBaseEntry 6 }

   docsBpi2CmtsAuthReplies  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an Authorization Reply message to any
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.2."

Expires September 2000                                        [Page 27]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        ::= { docsBpi2CmtsBaseEntry 7 }

   docsBpi2CmtsAuthRejects  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an Authorization Reject message to any
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.3."
        ::= { docsBpi2CmtsBaseEntry 8 }

   docsBpi2CmtsAuthInvalids OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an Authorization Invalid message to any
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.7."
        ::= { docsBpi2CmtsBaseEntry 9 }

   docsBpi2CmtsSAMapRequests     OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has received an SA Map Request message from any CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.10."
        ::= { docsBpi2CmtsBaseEntry 10 }

   docsBpi2CmtsSAMapReplies OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an SA Map Reply message to any CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.11."
        ::= { docsBpi2CmtsBaseEntry 11 }

   docsBpi2CmtsSAMapRejects OBJECT-TYPE

Expires September 2000                                        [Page 28]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an SA Map Reject message to any CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.12."
        ::= { docsBpi2CmtsBaseEntry 12 }

   --
   -- The CMTS Authorization Table, indexed by ifIndex and CM MAC
   -- address
   --

   docsBpi2CmtsAuthTable    OBJECT-TYPE
        SYNTAX         SEQUENCE OF    DocsBpi2CmtsAuthEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table describes the attributes of each CM
        authorization association. The CMTS maintains one
        authorization association with each Baseline Privacy-enabled
        CM on each CMTS MAC interface."
        ::= { docsBpi2CmtsObjects 2 }

   docsBpi2CmtsAuthEntry    OBJECT-TYPE
        SYNTAX         DocsBpi2CmtsAuthEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "Each entry contains objects describing attributes of
        one authorization association. The CMTS MUST create one entry
        per CM per MAC interface, based on the receipt of an
        Authorization Request message, and MUST not delete the entry
        before the CM authorization permanently expires."
        INDEX     { ifIndex, docsBpi2CmtsAuthCmMacAddress }
        ::= { docsBpi2CmtsAuthTable 1 }

   DocsBpi2CmtsAuthEntry ::= SEQUENCE {
        docsBpi2CmtsAuthCmMacAddress       MacAddress,
        docsBpi2CmtsAuthCmBpiVersion       INTEGER,
        docsBpi2CmtsAuthCmPublicKey        OCTET STRING,
        docsBpi2CmtsAuthCmKeySequenceNumber     Integer32,
        docsBpi2CmtsAuthCmExpiresOld       DateAndTime,
        docsBpi2CmtsAuthCmExpiresNew       DateAndTime,
        docsBpi2CmtsAuthCmLifetime         Integer32,
        docsBpi2CmtsAuthCmGraceTime        Integer32,
        docsBpi2CmtsAuthCmReset            INTEGER,
        docsBpi2CmtsAuthCmInfos            Counter32,
        docsBpi2CmtsAuthCmRequests         Counter32,
        docsBpi2CmtsAuthCmReplies          Counter32,

Expires September 2000                                        [Page 29]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        docsBpi2CmtsAuthCmRejects          Counter32,
        docsBpi2CmtsAuthCmInvalids         Counter32,
        docsBpi2CmtsAuthRejectErrorCode         INTEGER,
        docsBpi2CmtsAuthRejectErrorString  DisplayString,
        docsBpi2CmtsAuthInvalidErrorCode   INTEGER,
        docsBpi2CmtsAuthInvalidErrorString DisplayString,
        docsBpi2CmtsAuthPrimarySAId        Integer32,
        docsBpi2CmtsAuthBpkmCmCertValid         INTEGER,
        docsBpi2CmtsAuthBpkmCmCert         X509Certificate
        }

   docsBpi2CmtsAuthCmMacAddress  OBJECT-TYPE
        SYNTAX         MacAddress
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "The value of this object is the physical address of
        the CM to which the authorization association applies."
        ::= { docsBpi2CmtsAuthEntry 1 }

   docsBpi2CmtsAuthCmBpiVersion  OBJECT-TYPE
        SYNTAX         INTEGER {
                  bpi (0),
                  bpiPlus (1)
                  }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the version of Baseline
        Privacy   for which this CM has registered."
        ::= { docsBpi2CmtsAuthEntry 2 }

   docsBpi2CmtsAuthCmPublicKey   OBJECT-TYPE
        SYNTAX         OCTET STRING (SIZE (0|74|106|140|204|270))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is a DER-encoded
        RSAPublicKey ASN.1 type string, as defined in the RSA
        Encryption Standard (PKCS #1) [10], corresponding to the
        public key of the CM. The 74, 106, 140, 204, and 270 byte key
        encoding lengths correspond to 512 bit, 768 bit, 1024 bit,
        1536 bit, and 2048 public moduli respectively. This is a
        zero-length string if the CMTS does not retain the public
        key."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.4."
        ::= { docsBpi2CmtsAuthEntry 3 }

   docsBpi2CmtsAuthCmKeySequenceNumber     OBJECT-TYPE
        SYNTAX         Integer32 (0..15)
        MAX-ACCESS     read-only

Expires September 2000                                        [Page 30]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        STATUS         current
        DESCRIPTION
             "The value of this object is the most recent
        authorization key sequence number for this CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.2 and 4.2.2.10."
        ::= { docsBpi2CmtsAuthEntry 4 }

   docsBpi2CmtsAuthCmExpiresOld  OBJECT-TYPE
        SYNTAX         DateAndTime
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the actual clock time
        when the immediate predecessor of the most recent
        authorization for this CM expires. If this CM does not have
        an active authorization, then the value is of the expiration
        date and time of the last active authorization.
        Note: Implementation of this object is optional   and MAY vary
        for CMs running in BPI mode."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.2 and 4.2.2.9."
        ::= { docsBpi2CmtsAuthEntry 5 }

   docsBpi2CmtsAuthCmExpiresNew  OBJECT-TYPE
        SYNTAX         DateAndTime
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the actual clock time
        when the most recent authorization for this CM expires. If
        this CM   does not have an active authorization, then the value
        is of the expiration date and time of the last active
        authorization."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.2 and 4.2.2.9."
        ::= { docsBpi2CmtsAuthEntry 6 }

   docsBpi2CmtsAuthCmLifetime    OBJECT-TYPE
        SYNTAX         Integer32 (1..6048000)
        UNITS          "seconds"
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "The value of this object is the lifetime, in seconds,
        the CMTS assigns to an authorization key for this CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.2 and Appendix A.2."
        ::= { docsBpi2CmtsAuthEntry 7 }

Expires September 2000                                        [Page 31]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   docsBpi2CmtsAuthCmGraceTime   OBJECT-TYPE
        SYNTAX         Integer32 (1..6047999)
        UNITS          "seconds"
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the grace time for the
        authorization key in seconds.  The CM is expected to start
        trying to get a new authorization key beginning AuthGraceTime
        seconds before the authorization key actually expires.
        Note: Tracking this value is optional on certain CMTS
        implementations."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.3."
        ::= { docsBpi2CmtsAuthEntry 8 }

   docsBpi2CmtsAuthCmReset  OBJECT-TYPE
        SYNTAX    INTEGER   {
                  noResetRequested(1),
                  invalidateAuth(2),
                  sendAuthInvalid(3),
                  invalidateTeks(4)
                  }
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "Setting this object to invalidateAuth(2) causes the
        CMTS to invalidate the current CM authorization key(s), but
        not to transmit an Authorization Invalid message nor to
        invalidate unicast TEKs.  Setting this object to
        sendAuthInvalid(3) causes the CMTS to invalidate the current
        CM authorization key(s), and to transmit an Authorization
        Invalid message to the CM, but not to invalidate unicast TEKs.
        Setting this object to invalidateTeks(4) causes the CMTS to
        invalidate the current CM authorization key(s), to transmit an
        Authorization Invalid message to the CM, and to invalidate all
        unicast TEKs associated with this CM authorization. Reading
        this object returns the most-recently-set value of this
        object, or returns noResetRequested(1) if the object has not
        been set since the last CMTS reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.1.2.3.4, 4.1.2.3.5, and 4.1.3.3.5."
        ::= { docsBpi2CmtsAuthEntry 9 }

   docsBpi2CmtsAuthCmInfos       OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has received an Authentication Information message from

Expires September 2000                                        [Page 32]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        this CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.9."
        ::= { docsBpi2CmtsAuthEntry 10 }

   docsBpi2CmtsAuthCmRequests    OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has received an Authorization Request message from this
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.1."
        ::= { docsBpi2CmtsAuthEntry 11 }

   docsBpi2CmtsAuthCmReplies     OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an Authorization Reply message to this
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.2."
        ::= { docsBpi2CmtsAuthEntry 12 }

   docsBpi2CmtsAuthCmRejects     OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an Authorization Reject message to this
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.3."
        ::= { docsBpi2CmtsAuthEntry 13 }

   docsBpi2CmtsAuthCmInvalids    OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an Authorization Invalid message to this
        CM."

Expires September 2000                                        [Page 33]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.7."
        ::= { docsBpi2CmtsAuthEntry 14 }

   docsBpi2CmtsAuthRejectErrorCode    OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       unauthorizedCm(3),
                       unauthorizedSaid(4),
                       permanentAuthorizationFailure(8)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in most recent Authorization
        Reject message transmitted to the CM.  This has value
        unknown(2) if the last Error-Code value was 0, and none(1) if
        no Authorization Reject message has been transmitted to the
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.3 and 4.2.2.15."
        ::= { docsBpi2CmtsAuthEntry 15 }

   docsBpi2CmtsAuthRejectErrorString  OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        most recent Authorization Reject message transmitted to the
        CM.  This is a zero length string if no Authorization Reject
        message has been transmitted to the CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.3 and 4.2.2.6."
        ::= { docsBpi2CmtsAuthEntry 16 }

   docsBpi2CmtsAuthInvalidErrorCode   OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       unauthorizedCm(3),
                       unsolicited(5),
                       invalidKeySequence(6),
                       keyRequestAuthenticationFailure(7)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION

Expires September 2000                                        [Page 34]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

             "The value of this object is the enumerated
        description of the Error-Code in most recent Authorization
        Invalid message transmitted to the CM.  This has value
        unknown(2) if the last Error-Code value was 0, and none(1) if
        no Authorization Invalid message has been transmitted to the
        CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.7 and 4.2.2.15."
        ::= { docsBpi2CmtsAuthEntry 17 }

   docsBpi2CmtsAuthInvalidErrorString OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        most recent Authorization Invalid message transmitted to the
        CM.  This is a zero length string if no Authorization Invalid
        message has been transmitted to the CM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.7 and 4.2.2.6."
        ::= { docsBpi2CmtsAuthEntry 18 }

   docsBpi2CmtsAuthPrimarySAId   OBJECT-TYPE
        SYNTAX         Integer32 (0..16383)
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Primary Security
        Association identifier."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 2.1.3."
        ::= { docsBpi2CmtsAuthEntry 19 }

   docsBpi2CmtsAuthBpkmCmCertValid         OBJECT-TYPE
        SYNTAX    INTEGER {
                  unknown (0),
                  validCmChained (1),
                  validCmTrusted (2),
                  invalidCmUntrusted (3),
                  invalidCAUntrusted (4),
                  invalidCmOther (5),
                  invalidCAOther (6)
                  }
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
             "Contains the reason why a CM's certificate is deemed
        valid or invalid.
             Return unknown if the CM is running BPI mode.

Expires September 2000                                        [Page 35]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

             ValidCmChained means the certificate is valid because
        it chains to a valid certificate.
             ValidCmTrusted means the certificate is valid because
        it has been provisioned (in the docsBpi2CmtsProvisionedCmCert
        table) to be trusted.
             InvalidCmUntrusted means the certificate is invalid
        because it has been provisioned (in the
        docsBpi2CmtsProvisionedCmCert table) to be untrusted.
             InvalidCAUntrusted means the certificate is invalid
        because   it chains to an untrusted certificate.
             InvalidCmOther and InvalidCAOther refer to errors in
        parsing, validity periods, etc, which are attributable to the
        cm certificate or its chain respectively; additional
        information may be found in docsBpi2AuthRejectErrorString for
        these types of errors."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.4.2."
        ::= { docsBpi2CmtsAuthEntry 20 }

   docsBpi2CmtsAuthBpkmCmCert    OBJECT-TYPE
        SYNTAX    X509Certificate
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
             "The X509 CM Certificate sent as part of a BPKM
        Authorization Request.
        Note: The NULL string must be returned if the entire
        certificate is not retained in the CMTS."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.2."
        ::= { docsBpi2CmtsAuthEntry 21 }

   --
   -- The CMTS TEK Table, indexed by ifIndex and SAID
   --

   docsBpi2CmtsTEKTable     OBJECT-TYPE
        SYNTAX         SEQUENCE OF    DocsBpi2CmtsTEKEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table describes the attributes of each CM
        Traffic Encryption Key (TEK) association. The CMTS maintains
        one TEK association per SAID on each CMTS MAC interface."
        ::= { docsBpi2CmtsObjects 3 }

   docsBpi2CmtsTEKEntry     OBJECT-TYPE
        SYNTAX         DocsBpi2CmtsTEKEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION

Expires September 2000                                        [Page 36]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

             "Each entry contains objects describing attributes of
        one TEK association on a particular CMTS MAC interface. The
        CMTS MUST create one entry per SAID per MAC interface,
        based on the receipt of a Key Request message, and MUST not
        delete the entry before the CM authorization for the SAID
        permanently expires."
        INDEX     { ifIndex, docsBpi2CmtsTEKSAId }
        ::= { docsBpi2CmtsTEKTable 1 }

   DocsBpi2CmtsTEKEntry ::= SEQUENCE {
        docsBpi2CmtsTEKSAId           Integer32,
        docsBpi2CmtsTEKSAType              INTEGER,
        docsBpi2CmtsTEKDataEncryptAlg      INTEGER,
        docsBpi2CmtsTEKDataAuthentAlg      INTEGER,
        docsBpi2CmtsTEKLifetime            Integer32,
        docsBpi2CmtsTEKGraceTime      Integer32,
        docsBpi2CmtsTEKKeySequenceNumber   Integer32,
        docsBpi2CmtsTEKExpiresOld          DateAndTime,
        docsBpi2CmtsTEKExpiresNew          DateAndTime,
        docsBpi2CmtsTEKReset               TruthValue,
        docsBpi2CmtsKeyRequests            Counter32,
        docsBpi2CmtsKeyReplies             Counter32,
        docsBpi2CmtsKeyRejects             Counter32,
        docsBpi2CmtsTEKInvalids            Counter32,
        docsBpi2CmtsKeyRejectErrorCode          INTEGER,
        docsBpi2CmtsKeyRejectErrorString   DisplayString,
        docsBpi2CmtsTEKInvalidErrorCode         INTEGER,
        docsBpi2CmtsTEKInvalidErrorString  DisplayString
   }

   docsBpi2CmtsTEKSAId OBJECT-TYPE
        SYNTAX         Integer32 (1..16383)
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "The value of this object is the DOCSIS Security
        Association ID (SAID)."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.12."
        ::= { docsBpi2CmtsTEKEntry 1 }

   docsBpi2CmtsTEKSAType    OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0),
                       primary(1),
                       static(2),
                       dynamic(3)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the type of security

Expires September 2000                                        [Page 37]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        association.  Dynamic does not apply to CMs running in
        BPI mode."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 2.1.3."
        ::= { docsBpi2CmtsTEKEntry 2 }

   docsBpi2CmtsTEKDataEncryptAlg OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0),
                       des56CbcMode(1),
                       des40CbcMode(2)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data encryption
        algorithm being utilized."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmtsTEKEntry 3 }

   docsBpi2CmtsTEKDataAuthentAlg OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(0)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the data authentication
        algorithm being utilized."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.2.20."
        ::= { docsBpi2CmtsTEKEntry 4 }

   docsBpi2CmtsTEKLifetime  OBJECT-TYPE
        SYNTAX         Integer32 (1..604800)
        UNITS          "seconds"
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "The value of this object is the lifetime, in
        seconds, the CMTS assigns to keys for this TEK association."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.5 and Appendix A.2."
        ::= { docsBpi2CmtsTEKEntry 5 }

   docsBpi2CmtsTEKGraceTime OBJECT-TYPE
        SYNTAX         Integer32 (1..302399)
        UNITS          "seconds"

Expires September 2000                                        [Page 38]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the grace time for
        the TEK in seconds.  The CM is expected to start trying to
        acquire a new TEK beginning TEK GraceTime seconds after
        the expiration of the immediate predecessor of the most
        recent TEK.
        Note: A CM in BPI mode is expected to start trying to
        acquire a new TEK beginning TEK GraceTime seconds before
        the expiration of the most recent TEK.
        Note: Tracking this value is optional on certain CMTS
        implementations."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Appendix A.1.1.1.6."
        ::= { docsBpi2CmtsTEKEntry 6 }

   docsBpi2CmtsTEKKeySequenceNumber   OBJECT-TYPE
        SYNTAX              Integer32 (0..15)
        MAX-ACCESS          read-only
        STATUS              current
        DESCRIPTION
             "The value of this object is the most recent TEK
        key sequence number for this SAID."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.2.10 and 4.2.2.13."
        ::= { docsBpi2CmtsTEKEntry 7 }

   docsBpi2CmtsTEKExpiresOld     OBJECT-TYPE
        SYNTAX         DateAndTime
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the actual clock time
        for expiration of the immediate predecessor of the most
        recent TEK for this FSM. If this FSM has only one TEK, then
        the value is the time of activation of this FSM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.5 and 4.2.2.9."
        ::= { docsBpi2CmtsTEKEntry 8 }

   docsBpi2CmtsTEKExpiresNew     OBJECT-TYPE
        SYNTAX         DateAndTime
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the actual clock time
        for expiration of the most recent TEK for this FSM."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,

Expires September 2000                                        [Page 39]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        Sections 4.2.1.5 and 4.2.2.9."
        ::= { docsBpi2CmtsTEKEntry 9 }

   docsBpi2CmtsTEKReset     OBJECT-TYPE
        SYNTAX         TruthValue
        MAX-ACCESS     read-write
        STATUS         current
        DESCRIPTION
             "Setting this object to TRUE causes the CMTS to
        invalidate the current active TEK(s) (plural due to key
        transition periods), and to generate a new TEK for the
        associated SAID; the CMTS MAY also generate an unsolicited
        TEK Invalid message, to optimize the TEK synchronization
        between the CMTS and the CM. Reading this object always
        returns   FALSE."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.1.3.3.5."
        ::= { docsBpi2CmtsTEKEntry 10 }

   docsBpi2CmtsKeyRequests  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has received a Key Request message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.4."
        ::= { docsBpi2CmtsTEKEntry 11 }

   docsBpi2CmtsKeyReplies   OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted a Key Reply message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.5."
        ::= { docsBpi2CmtsTEKEntry 12 }

   docsBpi2CmtsKeyRejects   OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted a Key Reject message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,

Expires September 2000                                        [Page 40]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        Section 4.2.1.6."
        ::= { docsBpi2CmtsTEKEntry 13 }

   docsBpi2CmtsTEKInvalids  OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted a TEK Invalid message."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.8."
        ::= { docsBpi2CmtsTEKEntry 14 }

   docsBpi2CmtsKeyRejectErrorCode     OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       unauthorizedSaid(4)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in the most recent Key Reject
        message sent in response to a Key Request for this SAID.
        This has value unknown(2) if the last Error-Code value
        was 0, and none(1) if no Key Reject message has been received
        since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.6 and 4.2.2.15."
        ::= { docsBpi2CmtsTEKEntry 15 }

   docsBpi2CmtsKeyRejectErrorString   OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        the most recent Key Reject message sent in response to a Key
        Request for this SAID. This is a zero length string if no
        Key Reject message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.6 and 4.2.2.6."
        ::= { docsBpi2CmtsTEKEntry 16 }

   docsBpi2CmtsTEKInvalidErrorCode    OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),

Expires September 2000                                        [Page 41]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

                       invalidKeySequence(6)
                       }
        MAX-ACCESS          read-only
        STATUS              current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in the most recent TEK Invalid
        message sent in association with this SAID.  This has value
        unknown(2) if the last Error-Code value was 0, and none(1) if
        no TEK Invalid message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.8 and 4.2.2.15."
        ::= { docsBpi2CmtsTEKEntry 17 }

   docsBpi2CmtsTEKInvalidErrorString  OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        the most recent TEK Invalid message sent in association with
        this SAID.  This is a zero length string if no TEK Invalid
        message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.8 and 4.2.2.6."
        ::= { docsBpi2CmtsTEKEntry 18 }

   --
   -- The CMTS Multicast Objects Group
   --

   docsBpi2CmtsMulticastObjects OBJECT IDENTIFIER
        ::= { docsBpi2CmtsObjects 4 }

   --
   -- The CMTS IP Multicast Mapping Table, indexed by IP multicast
   -- address and prefix, and by ifindex
   --

   docsBpi2CmtsIpMulticastMapTable         OBJECT-TYPE
        SYNTAX         SEQUENCE OF DocsBpi2CmtsIpMulticastMapEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table maps multicast IP addresses to SAIDs.
        It is intended to map BOTH dynamic and static multicast IP
        addresses."
        ::= { docsBpi2CmtsMulticastObjects 1 }

Expires September 2000                                        [Page 42]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   docsBpi2CmtsIpMulticastMapEntry         OBJECT-TYPE
        SYNTAX         DocsBpi2CmtsIpMulticastMapEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "Each entry contains objects describing the mapping of
        one multicast IP address and prefix to one SAID, as well as
        associated message counters and error information.
           Note: For dynamic multicast IP addresses, create access
        does not apply."
        INDEX     { ifIndex, docsBpi2CmtsIpMulticastAddress,
               docsBpi2CmtsIpMulticastPrefixLength }
        ::= { docsBpi2CmtsIpMulticastMapTable 1 }

   DocsBpi2CmtsIpMulticastMapEntry ::= SEQUENCE {
        docsBpi2CmtsIpMulticastAddress               IpAddress,
        docsBpi2CmtsIpMulticastPrefixLength          Integer32,
        docsBpi2CmtsIpMulticastSAId             Integer32,
        docsBpi2CmtsIpMulticastSAMapRequests         Counter32,
        docsBpi2CmtsIpMulticastSAMapReplies          Counter32,
        docsBpi2CmtsIpMulticastSAMapRejects          Counter32,
        docsBpi2CmtsIpMulticastSAMapRejectErrorCode  INTEGER,
        docsBpi2CmtsIpMulticastSAMapRejectErrorString     DisplayString,
        docsBpi2CmtsIpMulticastMapControl       RowStatus
        }

   docsBpi2CmtsIpMulticastAddress          OBJECT-TYPE
        SYNTAX         IpAddress
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This object represents the IP multicast address
        to be mapped, in conjunction with
        docsBpi2CmtsIpMulticastPrefixLength."
        ::= { docsBpi2CmtsIpMulticastMapEntry 1 }

   docsBpi2CmtsIpMulticastPrefixLength     OBJECT-TYPE
        SYNTAX         Integer32 (0..32)
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
        "This object represents the IP multicast address prefix
        length for this row. The value of this object represents
        the length in bits of docsBpiIpMulticastAddress for
        multicast address comparisons, using big-endian ordering.
        An IP multicast address matches this row if the
        (docsBpi2CmtsIpMulticastPrefixLength) most significant bits
        of the IP multicast address and of the
        (docsBpi2CmtsIpMulticastAddress) are identical.
        This object is similar in usage to an IP address mask.
        The value 0 corresponds to IP address mask 0.0.0.0,
        the value 1 corresponds to IP address mask 128.0.0.0,
        the value 8 corresponds to IP address mask 255.0.0.0, and

Expires September 2000                                        [Page 43]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        the value 32 corresponds to IP address mask 255.255.255.255."
        ::= { docsBpi2CmtsIpMulticastMapEntry 2 }

   docsBpi2CmtsIpMulticastSAId        OBJECT-TYPE
        SYNTAX         Integer32 (1..16383)
        MAX-ACCESS     read-create
        STATUS         current
        DESCRIPTION
             "This object represents the multicast SAID to be
        used in this IP multicast address mapping entry."
        ::= { docsBpi2CmtsIpMulticastMapEntry 3 }

   docsBpi2CmtsIpMulticastSAMapRequests    OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has received an SA Map Request message for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.10."
        ::= { docsBpi2CmtsIpMulticastMapEntry 4 }

   docsBpi2CmtsIpMulticastSAMapReplies     OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an SA Map Reply message for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.11."
        ::= { docsBpi2CmtsIpMulticastMapEntry 5 }

   docsBpi2CmtsIpMulticastSAMapRejects     OBJECT-TYPE
        SYNTAX         Counter32
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the count of times the
        CMTS has transmitted an SA Map Reject message for this IP."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 4.2.1.12."
        ::= { docsBpi2CmtsIpMulticastMapEntry 6 }

   docsBpi2CmtsIpMulticastSAMapRejectErrorCode  OBJECT-TYPE
        SYNTAX         INTEGER {
                       none(1),
                       unknown(2),
                       noAuthForRequestedDSFlow(9),

Expires September 2000                                        [Page 44]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

                       dsFlowNotMappedToSA(10)
                       }
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the enumerated
        description of the Error-Code in the most recent SA Map
        Reject message sent in response to a SA Map Request for this
        IP.  It has value unknown(2) if the last Error-Code value
        was 0, and none(1) if no SA MAP Reject message has been
        received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.12 and 4.2.2.15."
        ::= { docsBpi2CmtsIpMulticastMapEntry 7 }

   docsBpi2CmtsIpMulticastSAMapRejectErrorString     OBJECT-TYPE
        SYNTAX         DisplayString (SIZE (0..128))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "The value of this object is the Display-String in
        the most recent SA Map Reject message sent in response to an
        SA Map Request for this IP.  It is a zero length string if
        no SA Map Reject message has been received since reboot."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Sections 4.2.1.12 and 4.2.2.6."
        ::= { docsBpi2CmtsIpMulticastMapEntry 8 }

   docsBpi2CmtsIpMulticastMapControl  OBJECT-TYPE
        SYNTAX         RowStatus
        MAX-ACCESS     read-create
        STATUS         current
        DESCRIPTION
             "This object controls and reflects the IP multicast
        address mapping entry."
        ::= { docsBpi2CmtsIpMulticastMapEntry 9 }

   --
   -- The CMTS Multicast SAID Authorization Table, indexed by ifIndex by
   -- multicast SAID by CM MAC address
   --

   docsBpi2CmtsMulticastAuthTable          OBJECT-TYPE
        SYNTAX         SEQUENCE OF DocsBpi2CmtsMulticastAuthEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This table describes the multicast SAID
        authorization for each CM on each CMTS MAC interface.
        Note: The CMTS need only track those CMs actively using

Expires September 2000                                        [Page 45]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        the SAID."
        ::= { docsBpi2CmtsMulticastObjects 2 }

   docsBpi2CmtsMulticastAuthEntry          OBJECT-TYPE
        SYNTAX         DocsBpi2CmtsMulticastAuthEntry
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "Each entry contains objects describing the key
        authorization of one cable modem for one multicast SAID
        for one CMTS MAC interface.
           Note: For dynamic multicast SAIDs, create access does not
        apply."
        INDEX     { ifIndex, docsBpi2CmtsMulticastAuthSAId,
               docsBpi2CmtsMulticastAuthCmMacAddress }
        ::= { docsBpi2CmtsMulticastAuthTable 1 }

   DocsBpi2CmtsMulticastAuthEntry ::= SEQUENCE
        {
        docsBpi2CmtsMulticastAuthSAId           Integer32,
        docsBpi2CmtsMulticastAuthCmMacAddress        MacAddress,
        docsBpi2CmtsMulticastAuthControl        RowStatus
        }

   docsBpi2CmtsMulticastAuthSAId OBJECT-TYPE
        SYNTAX         Integer32 (1..16383)
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This object represents the multicast SAID for
        authorization."
        ::= { docsBpi2CmtsMulticastAuthEntry 1 }

   docsBpi2CmtsMulticastAuthCmMacAddress   OBJECT-TYPE
        SYNTAX         MacAddress
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "This object represents the MAC address of the CM
        to which the multicast SAID authorization applies."
        ::= { docsBpi2CmtsMulticastAuthEntry 2 }

   docsBpi2CmtsMulticastAuthControl   OBJECT-TYPE
        SYNTAX         RowStatus
        MAX-ACCESS     read-create
        STATUS         current
        DESCRIPTION
             "This object controls and reflects the CM
        authorization for each multicast SAID."
        ::= { docsBpi2CmtsMulticastAuthEntry 3 }

   --

Expires September 2000                                        [Page 46]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   -- CMTS Cert Objects
   --

   docsBpi2CmtsCertObjects OBJECT IDENTIFIER
        ::= { docsBpi2CmtsObjects 5 }

   --
   -- CMTS Provisioned CM Cert Table
   --

   docsBpi2CmtsProvisionedCmCertTable OBJECT-TYPE
        SYNTAX         SEQUENCE OF DocsBpi2CmtsProvisionedCmCertEntry
        MAX-ACCESS     not-accessible
        STATUS    current
        DESCRIPTION
             "A table of CM certificate trust entries provisioned
        to the CMTS.  This table overrides CM Certificate entries
        located in the CMTS' authorization table."
        ::= { docsBpi2CmtsCertObjects 1 }

   docsBpi2CmtsProvisionedCmCertEntry OBJECT-TYPE
        SYNTAX    DocsBpi2CmtsProvisionedCmCertEntry
        MAX-ACCESS     not-accessible
        STATUS    current
        DESCRIPTION
             "An entry in the CMTS' provisioned CM certificate
        table."
        INDEX { docsBpi2CmtsProvisionedCmCertMacAddress }
        ::= { docsBpi2CmtsProvisionedCmCertTable 1 }

   DocsBpi2CmtsProvisionedCmCertEntry ::= SEQUENCE
        {
        docsBpi2CmtsProvisionedCmCertMacAddress MacAddress,
        docsBpi2CmtsProvisionedCmCertTrust INTEGER,
        docsBpi2CmtsProvisionedCmCertSource     INTEGER,
        docsBpi2CmtsProvisionedCmCertStatus     RowStatus,
        docsBpi2CmtsProvisionedCmCert      X509Certificate
        }

   docsBpi2CmtsProvisionedCmCertMacAddress OBJECT-TYPE
        SYNTAX         MacAddress
        MAX-ACCESS     not-accessible
        STATUS         current
        DESCRIPTION
             "The index of this row."
        ::= { docsBpi2CmtsProvisionedCmCertEntry 1 }

   docsBpi2CmtsProvisionedCmCertTrust      OBJECT-TYPE
        SYNTAX    INTEGER {
                  trusted (1),
                  untrusted (2)
                  }
        MAX-ACCESS     read-create

Expires September 2000                                        [Page 47]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        STATUS    current
        DESCRIPTION
             "Trust state for the provisioned CM certificate entry.
        Note: Setting this object need only override the validity of
        CM certificates sent in future authorization requests."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.4.1."
        ::= { docsBpi2CmtsProvisionedCmCertEntry 2 }

   docsBpi2CmtsProvisionedCmCertSource     OBJECT-TYPE
        SYNTAX    INTEGER {
                  snmp (1),
                  configurationFile (2),
                  externalDatabase (3),
                  other (4)
                  }
        MAX-ACCESS read-only
        STATUS  current
        DESCRIPTION
             "This object indicates how the certificate reached the
        CMTS.  Other means it originated from a source not identified
        above."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.4.1."
        ::= { docsBpi2CmtsProvisionedCmCertEntry 3 }

   docsBpi2CmtsProvisionedCmCertStatus OBJECT-TYPE
        SYNTAX  RowStatus
        MAX-ACCESS read-create
        STATUS  current
        DESCRIPTION
             "Standard RowStatus object for creating and deleting
        this row."
        ::= { docsBpi2CmtsProvisionedCmCertEntry 4 }

   docsBpi2CmtsProvisionedCmCert OBJECT-TYPE
        SYNTAX    X509Certificate
        MAX-ACCESS     read-create
        STATUS    current
        DESCRIPTION
             "An X509 DER-encoded certificate authority
        certificate.
        Note: The NULL string must be returned, on reads, if the
        entire certificate is not retained in the CMTS."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.2."
        ::= { docsBpi2CmtsProvisionedCmCertEntry 5 }

   --

Expires September 2000                                        [Page 48]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   -- CMTS CA Cert Table
   --

   docsBpi2CmtsCACertTable OBJECT-TYPE
        SYNTAX    SEQUENCE OF DocsBpi2CmtsCACertEntry
        MAX-ACCESS     not-accessible
        STATUS    current
        DESCRIPTION
             "The table of known certificate authority certificates
        acquired by this device."
        ::= { docsBpi2CmtsCertObjects 2 }

   docsBpi2CmtsCACertEntry OBJECT-TYPE
        SYNTAX    DocsBpi2CmtsCACertEntry
        MAX-ACCESS     not-accessible
        STATUS    current
        DESCRIPTION
             "A row in the Certificate Authority certificate
        table."
        INDEX   { docsBpi2CmtsCACertIndex }
        ::= {docsBpi2CmtsCACertTable 1 }

   DocsBpi2CmtsCACertEntry ::= SEQUENCE {
        docsBpi2CmtsCACertIndex       Integer32,
        docsBpi2CmtsCACertSubject     SnmpAdminString,
        docsBpi2CmtsCACertIssuer      SnmpAdminString,
        docsBpi2CmtsCACertSerialNumber     OCTET STRING,
        docsBpi2CmtsCACertTrust       INTEGER,
        docsBpi2CmtsCACertSource INTEGER,
        docsBpi2CmtsCACertStatus RowStatus,
        docsBpi2CmtsCACert       X509Certificate
   }

   docsBpi2CmtsCACertIndex OBJECT-TYPE
        SYNTAX    Integer32 (1..10000)
        MAX-ACCESS     not-accessible
        STATUS    current
        DESCRIPTION
             "The index for this row."
        ::= { docsBpi2CmtsCACertEntry 1 }

   docsBpi2CmtsCACertSubject OBJECT-TYPE
        SYNTAX         SnmpAdminString
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "Printable representation of (at least) the
        organizationName portion of the certificate's subject name.
        Additional fields MAY be present and SHOULD be separated by
        CR LF.  Ordering of fields is CMTS vendor specific."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.2.4"

Expires September 2000                                        [Page 49]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        ::= { docsBpi2CmtsCACertEntry 2 }

   docsBpi2CmtsCACertIssuer OBJECT-TYPE
        SYNTAX         SnmpAdminString
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "Printable representation of (at least) the
        commonName portion of the certificate's issuer name.
        Additional fields MAY be present and SHOULD be separated by
        CR LF.  Ordering of fields is CMTS vendor specific."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.2.4"
        ::= { docsBpi2CmtsCACertEntry 3 }

   docsBpi2CmtsCACertSerialNumber OBJECT-TYPE
        SYNTAX         OCTET STRING (SIZE (1..32))
        MAX-ACCESS     read-only
        STATUS         current
        DESCRIPTION
             "This CA certificate's serial number represented as
        an octet string."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.2.2"
        ::= { docsBpi2CmtsCACertEntry 4 }

   docsBpi2CmtsCACertTrust OBJECT-TYPE
        SYNTAX    INTEGER {
                  trusted (1),
                  untrusted (2),
                  chained (3),
                  root (4)
                  }
        MAX-ACCESS     read-create
        STATUS    current
        DESCRIPTION
             "This object controls the trust status of this
        certificate.  Root certificates must be given root trust;
        manufacturer certificates must not be given root trust.
        Trust on root certificates must not change.
        Note: Setting this object need only affect the validity of
        CM certificates sent in future authorization requests;
        instantaneous effect need not occur."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.4.1"
        ::= { docsBpi2CmtsCACertEntry 5 }

   docsBpi2CmtsCACertSource OBJECT-TYPE
        SYNTAX    INTEGER {
                  snmp (1),

Expires September 2000                                        [Page 50]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

                  configurationFile (2),
                  externalDatabase (3),
                  other (4),
                  authentInfo (5),
                  compiledIntoCode (6)
                  }
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
             "This object indicates how the certificate reached
        the CMTS.  Other means it originated from a source not
        identified above."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.4.1"
        ::= { docsBpi2CmtsCACertEntry 6 }

   docsBpi2CmtsCACertStatus OBJECT-TYPE
        SYNTAX    RowStatus
        MAX-ACCESS     read-create
        STATUS    current
        DESCRIPTION
             "Standard RowStatus object for creating and deleting
        entries   in this table.  Of the objects in the row controlled
        by this   object, only docsBpi2CmtsCACertTrust may be modified
        while the row is active.
        Note: Deleting rows for actively used CA certs MAY NOT succeed
        depending on CMTS implementation."
        ::= { docsBpi2CmtsCACertEntry 7 }

   docsBpi2CmtsCACert  OBJECT-TYPE
        SYNTAX    X509Certificate
        MAX-ACCESS     read-create
        STATUS    current
        DESCRIPTION
             "An X509 DER-encoded certificate authority
        certificate.
        Note: The NULL string must be returned, on reads, if the
        entire certificate is not retained in the CMTS."
        REFERENCE
             "DOCSIS Baseline Privacy Plus Interface Specification,
        Section 9.2."
        ::= { docsBpi2CmtsCACertEntry 8 }

   --
   -- Authenticated Software Download Objects
   --

   --
   -- Note: the authenticated software download objects are a
   -- CM requirement only.

Expires September 2000                                        [Page 51]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   --

   docsBpi2CodeDownloadControl OBJECT IDENTIFIER
        ::= { docsBpi2MIBObjects 4 }

   docsBpi2CodeDownloadStatusCode     OBJECT-TYPE
        SYNTAX    INTEGER {
             configFileCvcVerified (1),
             configFileCvcRejected (2),
             snmpCvcVerified (3),
             snmpCvcRejected (4),
             codeFileVerified (5),
             codeFileRejected (6),
             other (7)
        }
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
            "The value indicates the result of the latest config
        file CVC verification, SNMP CVC verification, or code file
        verification."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.3.2 & D.3.5.1."
        ::= { docsBpi2CodeDownloadControl 1 }

   docsBpi2CodeMfgCodeDownloadStatusString OBJECT-TYPE
        SYNTAX    DisplayString
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
            "The value of this object indicates the additional
        information to the status code.  The value will include
        the error code and error description which will be defined
        separately."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section TBD (see D.3.7)"
        ::= { docsBpi2CodeDownloadControl 2 }

   docsBpi2CodeMfgOrgName   OBJECT-TYPE
        SYNTAX    SnmpAdminString
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
            "The value of this object is the device manufacturer's
        organizationName."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.2.2."
        ::= { docsBpi2CodeDownloadControl 3 }

   docsBpi2CodeMfgCodeAccessStart     OBJECT-TYPE

Expires September 2000                                        [Page 52]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        SYNTAX    DateAndTime
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
            "The value of this object is the device manufacturer's
        current codeAccessStart value referenced to Greenwich Mean
        Time (GMT)."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.2.2."
        ::= { docsBpi2CodeDownloadControl 4 }

   docsBpi2CodeMfgCvcAccessStart OBJECT-TYPE
        SYNTAX    DateAndTime
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
            "The value of this object is the device manufacturer's
        current cvcAccessStart value referenced to Greenwich Mean
        Time (GMT)."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.2.2."
        ::= { docsBpi2CodeDownloadControl 5 }

   docsBpi2CodeCoSignerOrgName   OBJECT-TYPE
        SYNTAX    SnmpAdminString
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
            "The value of this object is the Co-Signer's
        organizationName."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.2.2."
        ::= { docsBpi2CodeDownloadControl 6 }

   docsBpi2CodeCoSignerCodeAccessStart     OBJECT-TYPE
        SYNTAX    DateAndTime
        MAX-ACCESS     read-only
        STATUS    current
        DESCRIPTION
            "The value of this object is the Co-Signer's current
        codeAccessStart value referenced to Greenwich Mean
        Time (GMT)."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.2.2."
        ::= { docsBpi2CodeDownloadControl 7 }

   docsBpi2CodeCoSignerCvcAccessStart OBJECT-TYPE
        SYNTAX    DateAndTime
        MAX-ACCESS     read-only

Expires September 2000                                        [Page 53]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

        STATUS    current
        DESCRIPTION
            "The value of this object is the Co-Signer's current
        cvcAccessStart value referenced to Greenwich Mean
        Time (GMT)."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.2.2."
        ::= { docsBpi2CodeDownloadControl 8 }

   docsBpi2CodeCvcUpdate    OBJECT-TYPE
        SYNTAX    X509Certificate
        MAX-ACCESS     read-write
        STATUS    current
        DESCRIPTION
            "Setting a CVC to this object triggers the device
        to verify the CVC and update the cvcAccessStart value.
        If the device is not enabled to upgrade codefiles, or
        the CVC verification fails, the CVC will be rejected.
        Reading this object always returns the null string."
        REFERENCE
            "DOCSIS Baseline Privacy Plus Interface Specification,
        Section D.3.3.2.2."
        ::= { docsBpi2CodeDownloadControl 9 }

   --
   -- The BPI+ MIB Conformance Statements (with a placeholder for
   -- notifications)
   --

   docsBpi2Notification     OBJECT IDENTIFIER
        ::= { docsBpi2MIB 2 }
   docsBpi2Conformance OBJECT IDENTIFIER
        ::= { docsBpi2MIB 3 }
   docsBpi2Compliances OBJECT IDENTIFIER
        ::= { docsBpi2Conformance 1 }
   docsBpi2Groups      OBJECT IDENTIFIER
        ::= { docsBpi2Conformance 2 }

   docsBpi2BasicCompliance MODULE-COMPLIANCE
        STATUS         current
        DESCRIPTION
             "This is the compliance statement for devices which
        implement the DOCSIS Baseline Privacy Interface."

        MODULE  -- docsBpi2MIB

   -- conditionally mandatory group
   GROUP     docsBpi2CmGroup
        DESCRIPTION
        "This group is implemented only in CMs, not in CMTSs."

Expires September 2000                                        [Page 54]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   -- conditionally mandatory group
   GROUP     docsBpi2CmtsGroup
        DESCRIPTION
        "This group is implemented only in CMTSs, not in CMs."

   -- conditionally mandatory group
   GROUP     docsBpi2CodeDownloadGroup
        DESCRIPTION
        "This group is required in CMs and is optional in CMTSs."

   -- relaxation on mandatory range
   OBJECT    docsBpi2CmtsDefaultAuthLifetime
        SYNTAX    Integer32 (86400..6048000)
        DESCRIPTION
        "The refined range corresponds to the minimum and maximum
        values in operational networks, according to Appendix A.2 in
        [7]."

   -- relaxation on mandatory range
   OBJECT    docsBpi2CmtsDefaultTEKLifetime
        SYNTAX    Integer32 (1800..604800)
        DESCRIPTION
        "The refined range corresponds to the minimum and maximum
        values in operational networks, according to Appendix A.2 in
        [7]."

   -- relaxation on mandatory range
   OBJECT    docsBpi2CmtsAuthCmLifetime
        SYNTAX    Integer32 (86400..6048000)
        DESCRIPTION
        "The refined range corresponds to the minimum and maximum
        values in operational networks, according to Appendix A.2 in
        [7]."

   -- relaxation on mandatory range
   OBJECT    docsBpi2CmtsTEKLifetime
        SYNTAX    Integer32 (1800..604800)
        DESCRIPTION
        "The refined range corresponds to the minimum and maximum
        values in operational networks, according to Appendix A.2 in
        [7]."

   ::= { docsBpi2Compliances 1 }

   docsBpi2CmGroup     OBJECT-GROUP
        OBJECTS   {
             docsBpi2CmPrivacyEnable,
             docsBpi2CmPublicKey,
             docsBpi2CmAuthState,
             docsBpi2CmAuthKeySequenceNumber,
             docsBpi2CmAuthExpiresOld,
             docsBpi2CmAuthExpiresNew,

Expires September 2000                                        [Page 55]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

             docsBpi2CmAuthReset,
             docsBpi2CmAuthGraceTime,
             docsBpi2CmTEKGraceTime,
             docsBpi2CmAuthWaitTimeout,
             docsBpi2CmReauthWaitTimeout,
             docsBpi2CmOpWaitTimeout,
             docsBpi2CmRekeyWaitTimeout,
             docsBpi2CmAuthRejectWaitTimeout,
             docsBpi2CmSAMapWaitTimeout,
             docsBpi2CmSAMapMaxRetries,
             docsBpi2CmAuthentInfos,
             docsBpi2CmAuthRequests,
             docsBpi2CmAuthReplies,
             docsBpi2CmAuthRejects,
             docsBpi2CmAuthInvalids,
             docsBpi2CmAuthRejectErrorCode,
             docsBpi2CmAuthRejectErrorString,
             docsBpi2CmAuthInvalidErrorCode,
             docsBpi2CmAuthInvalidErrorString,
             docsBpi2CmTEKSAType,
             docsBpi2CmTEKDataEncryptAlg,
             docsBpi2CmTEKDataAuthentAlg,
             docsBpi2CmTEKState,
             docsBpi2CmTEKKeySequenceNumber,
             docsBpi2CmTEKExpiresOld,
             docsBpi2CmTEKExpiresNew,
             docsBpi2CmTEKKeyRequests,
             docsBpi2CmTEKKeyReplies,
             docsBpi2CmTEKKeyRejects,
             docsBpi2CmTEKInvalids,
             docsBpi2CmTEKAuthPends,
             docsBpi2CmTEKKeyRejectErrorCode,
             docsBpi2CmTEKKeyRejectErrorString,
             docsBpi2CmTEKInvalidErrorCode,
             docsBpi2CmTEKInvalidErrorString,
             docsBpi2CmIpMulticastSAId,
             docsBpi2CmIpMulticastSAMapState,
             docsBpi2CmIpMulticastSAMapRequests,
             docsBpi2CmIpMulticastSAMapReplies,
             docsBpi2CmIpMulticastSAMapRejects,
             docsBpi2CmIpMulticastSAMapRejectErrorCode,
             docsBpi2CmIpMulticastSAMapRejectErrorString,
             docsBpi2CmDeviceCmCert,
             docsBpi2CmDeviceManufCert,
             docsBpi2CmCryptoSuiteDataEncryptAlg,
             docsBpi2CmCryptoSuiteDataAuthentAlg
             }
        STATUS         current
        DESCRIPTION
        "This collection of objects provides CM BPI+ status and
        control."
   ::= { docsBpi2Groups 1 }

Expires September 2000                                        [Page 56]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   docsBpi2CmtsGroup   OBJECT-GROUP
        OBJECTS {
             docsBpi2CmtsDefaultAuthLifetime,
             docsBpi2CmtsDefaultTEKLifetime,
             docsBpi2CmtsDefaultSelfSignedManufCertTrust,
             docsBpi2CmtsCheckCertValidityPeriods,
             docsBpi2CmtsAuthentInfos,
             docsBpi2CmtsAuthRequests,
             docsBpi2CmtsAuthReplies,
             docsBpi2CmtsAuthRejects,
             docsBpi2CmtsAuthInvalids,
             docsBpi2CmtsSAMapRequests,
             docsBpi2CmtsSAMapReplies,
             docsBpi2CmtsSAMapRejects,
             docsBpi2CmtsAuthCmBpiVersion,
             docsBpi2CmtsAuthCmPublicKey,
             docsBpi2CmtsAuthCmKeySequenceNumber,
             docsBpi2CmtsAuthCmExpiresOld,
             docsBpi2CmtsAuthCmExpiresNew,
             docsBpi2CmtsAuthCmLifetime,
             docsBpi2CmtsAuthCmGraceTime,
             docsBpi2CmtsAuthCmReset,
             docsBpi2CmtsAuthCmInfos,
             docsBpi2CmtsAuthCmRequests,
             docsBpi2CmtsAuthCmReplies,
             docsBpi2CmtsAuthCmRejects,
             docsBpi2CmtsAuthCmInvalids,
             docsBpi2CmtsAuthRejectErrorCode,
             docsBpi2CmtsAuthRejectErrorString,
             docsBpi2CmtsAuthInvalidErrorCode,
             docsBpi2CmtsAuthInvalidErrorString,
             docsBpi2CmtsAuthPrimarySAId,
             docsBpi2CmtsAuthBpkmCmCertValid,
             docsBpi2CmtsAuthBpkmCmCert,
             docsBpi2CmtsTEKSAType,
             docsBpi2CmtsTEKDataEncryptAlg,
             docsBpi2CmtsTEKDataAuthentAlg,
             docsBpi2CmtsTEKLifetime,
             docsBpi2CmtsTEKGraceTime,
             docsBpi2CmtsTEKKeySequenceNumber,
             docsBpi2CmtsTEKExpiresOld,
             docsBpi2CmtsTEKExpiresNew,
             docsBpi2CmtsTEKReset,
             docsBpi2CmtsKeyRequests,
             docsBpi2CmtsKeyReplies,
             docsBpi2CmtsKeyRejects,
             docsBpi2CmtsTEKInvalids,
             docsBpi2CmtsKeyRejectErrorCode,
             docsBpi2CmtsKeyRejectErrorString,
             docsBpi2CmtsTEKInvalidErrorCode,
             docsBpi2CmtsTEKInvalidErrorString,
             docsBpi2CmtsIpMulticastSAId,
             docsBpi2CmtsIpMulticastSAMapRequests,

Expires September 2000                                        [Page 57]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

             docsBpi2CmtsIpMulticastSAMapReplies,
             docsBpi2CmtsIpMulticastSAMapRejects,
             docsBpi2CmtsIpMulticastSAMapRejectErrorCode,
             docsBpi2CmtsIpMulticastSAMapRejectErrorString,
             docsBpi2CmtsIpMulticastMapControl,
             docsBpi2CmtsMulticastAuthControl,
             docsBpi2CmtsProvisionedCmCertTrust,
             docsBpi2CmtsProvisionedCmCertSource,
             docsBpi2CmtsProvisionedCmCertStatus,
             docsBpi2CmtsProvisionedCmCert,
             docsBpi2CmtsCACertSubject,
             docsBpi2CmtsCACertIssuer,
             docsBpi2CmtsCACertSerialNumber,
             docsBpi2CmtsCACertTrust,
             docsBpi2CmtsCACertSource,
             docsBpi2CmtsCACertStatus,
             docsBpi2CmtsCACert
             }
        STATUS         current
        DESCRIPTION
        "This collection of objects provides CMTS BPI+ status and
        control."
   ::= { docsBpi2Groups 2 }

   docsBpi2CodeDownloadGroup OBJECT-GROUP
           OBJECTS {
             docsBpi2CodeDownloadStatusCode,
             docsBpi2CodeMfgCodeDownloadStatusString,
             docsBpi2CodeMfgOrgName,
             docsBpi2CodeMfgCodeAccessStart,
             docsBpi2CodeMfgCvcAccessStart,
             docsBpi2CodeCoSignerOrgName,
             docsBpi2CodeCoSignerCodeAccessStart,
             docsBpi2CodeCoSignerCvcAccessStart,
             docsBpi2CodeCvcUpdate
             }
        STATUS         current
        DESCRIPTION
        "This collection of objects provide authenticated software
        download support."
   ::= { docsBpi2Groups 3 }

   END

4. Acknowledgments

   Kaz Ozawa (CableLabs/Toshiba) - Authenticated S/W Download Control
   Mike StJohns (@Home) - BPI MIB, 1st draft of BPI+ MIB 
   Rich Woundy (Cisco) - BPI MIB

   Thanks to Mike Sabin (Com21) and Manson Wong (Cisco) for reviewing
   the BPI+ MIB.

Expires September 2000                                        [Page 58]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

5. References

   [1]  Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture
        for Describing SNMP Management Frameworks", RFC 2571, April
        1999.

   [2]  Rose, M. and K. McCloghrie, "Structure and Identification of
        Management Information for TCP/IP-based Internets", STD 16, RFC
        1155, May 1990.

   [3]  Rose, M. and K. McCloghrie, "Concise MIB Definitions", STD 16,
        RFC 1212, March 1991.

   [4]  Rose, M., "A Convention for Defining Traps for use with the
        SNMP", RFC 1215, March 1991.

   [5]  McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Structure of
        Management Information for Version 2 (SMIv2)", STD 58, RFC 2578,
        April 1999.

   [6]  McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Textual
        Conventions for SMIv2", STD 58, RFC 2579, April 1999.

   [7]  McCloghrie, K., Perkins, D. and J. Schoenwaelder, "Conformance
        Statements for SMIv2", STD 58, RFC 2580, April 1999.

   [8]  Case, J., Fedor, M., Schoffstall, M. and J. Davin, "Simple
        Management Protocol", STD 15, RFC 1157, May 1990.

   [9]  Case, J., McCloghrie, K., Rose, M. and S. Waldbusser,
        "Introduction to Community-based SNMPv2", RFC 1901, January
        1996.

   [10] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Transport
        Mappings for Version 2 of the Simple Network Management Protocol
        (SNMPv2)", RFC 1906, January 1996.

   [11] Case, J., Harrington D., Presuhn R. and B. Wijnen, "Message
        Processing and Dispatching for the Simple Network Management
        Protocol (SNMP)", RFC 2572, April 1999.

   [12] Blumenthal, U. and B. Wijnen, "User-based Security Model (USM)
        for version 3 of the Simple Network Management Protocol
        (SNMPv3)", RFC 2574, April 1999.

   [13] Case, J., McCloghrie, K., Rose, M. and S. Waldbusser, "Protocol
        Operations for Version 2 of the Simple Network Management
        Protocol (SNMPv2)", RFC 1905, January 1996.

   [14] Levi, D., Meyer, P. and B. Stewart, "SNMP Applications", RFC
        2573, April 1999.

Expires September 2000                                        [Page 59]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   [15] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based Access
        Control Model (VACM) for the Simple Network Management Protocol
        (SNMP)", RFC 2575, April 1999.

   [16] "Data-Over-Cable Service Interface Specifications: Cable
        Modem Radio Frequency Interface Specification
        SP-RFIv1.1-I03-991105", DOCSIS, November 1999, available at
        http://www.cablemodem.com/.

   [17] "Data-Over-Cable Service Interface Specifications: Baseline
        Privacy Plus Interface Specification SP-BPI+-I03-991105",
        DOCSIS, November 1999, available at
        http://www.cablemodem.com/.

   [18] "Data-Over-Cable Service Interface Specifications: Baseline
        Privacy Interface Specification SP-BPI-I02-990319",
        DOCSIS, March 1999, available at
        http://www.cablemodem.com/.

   [19] "Data-Over-Cable Service Interface Specifications: OSSI
        Baseline Privacy Interface MIB SP-OSSI-BPI-I01-980331",
        DOCSIS, March 1999, available at
        http://www.cablemodem.com/.

6. Security Considerations

   This MIB is intended to limit certain kinds of network behavior by
   subscriber hosts attached to cable modems, including, for example, IP
   spoofing. These limitations may be compromised, however, if the cable
   modem's identity or registration process is spoofed. The DOCSIS RFI
   and privacy specifications [16], [18], and [17] define a number of
   mechanisms for assuring modem identity.

   There are a number of management objects defined in this MIB that
   have a MAX-ACCESS clause of read-write and/or read-create.  Such
   objects may be considered sensitive or vulnerable in some network
   environments.  The support for SET operations in a non-secure
   environment without proper protection can have a negative effect on
   network operations.

   SNMPv1 by itself is not a secure environment.  Even if the network
   itself is secure (for example by using IPSec), even then, there is no
   control as to who on the secure network is allowed to access and
   GET/SET (read/change/create/delete) the objects in this MIB.

   It is recommended that the implementers consider the security
   features as provided by the SNMPv3 framework.  Specifically, the use
   of the User-based Security Model RFC 2574 [12] and the View- based
   Access Control Model RFC 2575 [15] is recommended.

   It is then a customer/user responsibility to ensure that the SNMP
   entity giving access to an instance of this MIB, is properly

Expires September 2000                                        [Page 60]

INTERNET-DRAFT      DOCSIS Baseline Privacy Plus MIB          March 2000

   configured to give access to the objects only to those principals
   (users) that have legitimate rights to indeed GET or SET
   (change/create/delete) them.

7. Author's Address

        Stuart M. Green
        Arris Interactive
        6 Riverside Drive
        Andover, MA 01810
        USA

        Phone: +1 978 946 4664
        Email: [email-masked]

Expires September 2000                                        [Page 61]