DOCS-BPI2EXT-MIB

All MIBs › DOCS-BPI2EXT-MIB

Organization: Cable Television Laboratories, Inc.

Last Updated: 2017-04-13

Category: Domain: CATV/Cable, Domain: Security, Standard: DOCSIS

Description: Provides extended BPI2 security management objects for DOCSIS cable modem systems beyond the base BPI2 MIB.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is DOCS-BPI2EXT-MIB?

DOCS-BPI2EXT-MIB is a CableLabs DOCSIS MIB that extends the base BPI+ (Baseline Privacy Interface Plus) security objects defined in DOCS-IETF-BPI2-MIB (RFC 4131) to support DOCSIS 3.1 features, particularly certificate management for cable modems. It exposes objects for cable modem device certificates (CM and manufacturer certificates), code-file signing organization names, and access-start timestamps for code verification certificates (CVCs), along with the associated notifications, conformance, and compliance groups. Its monitoring relevance is chiefly around software/security status: tracking whether a cable modem's device certificates are valid and current, and whether code-signing CVC chains and access windows are properly configured, which affects the modem's ability to authenticate firmware updates. It explicitly builds on and requires DOCS-IETF-BPI2-MIB (RFC 4131) as its base, reusing legacy PKI certificate table concepts. It is deployed in DOCSIS 3.1 cable access networks, specifically on CMTS and cable modem management systems tracking modem security posture. Engineers can download the DOCS-BPI2EXT-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in DOCS-BPI2EXT-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

DOCSIS 3.1 cable modem
CMTS (cable modem termination system)

Monitoring Examples

An operator would poll docsBpi2Ext31CmDeviceCertTable/docsBpi2Ext31CmDeviceCertEntry for each modem's docsBpi2Ext31CmDeviceCmCert and docsBpi2Ext31CmDeviceManufCert to confirm valid device and manufacturer certificates are present, and check docsBpi2Ext31CodeUpdateCvcChain plus docsBpi2Ext31CodeMfgCodeAccessStart/docsBpi2Ext31CodeMfgCvcAccessStart to verify the code-signing certificate chain is within its valid access window. A modem missing a valid manufacturer certificate or with a CVC access window that has expired would fail firmware authentication, revealing a security provisioning problem. docsBpi2Ext31Notifications would alert operators to certificate-related events as they occur.

What Can Be Monitored

device certificate validity
manufacturer certificate status
code-signing CVC chain
certificate access-start windows

Imported Objects

From CLAB-DEF-MIB

clabProjDocsis

OBJECT-IDENTITY

From DOCS-IETF-BPI2-MIB

DocsX509ASN1DEREncodedCertificate

From IF-MIB

ifIndex

OBJECT-TYPE

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

MODULE-IDENTITY
OBJECT-TYPE

From SNMPv2-TC

DateAndTime
TEXTUAL-CONVENTION

OIDs

OID symbolic	OID numeric	Type	Access	Description
docsBpi2Ext31Mib	1.3.6.1.4.1.4491.2.1.29			This MIB module adds to the BPI management objects that are defined in the DOCS-IETF-BPI2-MIB (RFC 4131). These objects are in addition to and the DOCS-IETF-BPI2-MIB (RFC 4131). These objects are in addition to and separate from RFC 4131 and provide management support for new DOCSIS 3.1 features. The following MIBs from RFC 4131 are used to support legacy PKI CM certificate functions defined in the DOCSIS 3.0 security specification: docsBpi2CmDeviceCertTable, docsBpi2CodeMfgOrgName, docsBpi2CodeMfgCodeAccessStart, docsBpi2CodeMfgCvcAccessStart, docsBpi2CodeCoSignerOrgName, docsBpi2CodeCoSignerCodeAccessStart, docsBpi2CodeCoSignerCvcAccessStart, docsBpi2CodeCvcUpdate. The following MIBs defined in this MIB module are used to support new PKI CM certificate functions defined in the DOCSIS 3.1 security specification: docsBpi2Ext31CmDeviceCmCert, docsBpi2Ext31CodeUpdateCvcChain, docsBpi2Ext31CodeMfgOrgName, docsBpi2Ext31CodeMfgCodeAccessStart, docsBpi2Ext31CodeMfgCvcAccessStart, docsBpi2Ext31CodeCoSignerOrgName, docsBpi2Ext31CodeCoSignerCodeAccessStart, docsBpi2Ext31CodeCoSignerCvcAccessStart. Copyright 2015-2017 Cable Television Laboratories, Inc. All rights reserved.
docsBpi2Ext31Notifications	1.3.6.1.4.1.4491.2.1.29.0
docsBpi2Ext31MibObjects	1.3.6.1.4.1.4491.2.1.29.1
docsBpi2Ext31CmObjects	1.3.6.1.4.1.4491.2.1.29.1.1
docsBpi2Ext31CmCertObjects	1.3.6.1.4.1.4491.2.1.29.1.1.1
docsBpi2Ext31CmDeviceCertTable	1.3.6.1.4.1.4491.2.1.29.1.1.1.1		not-accessible	This table describes the Baseline Privacy Plus device certificates issued from the new PKI defined in DOCSIS 3.1 for each CM MAC interface.
docsBpi2Ext31CmDeviceCertEntry	1.3.6.1.4.1.4491.2.1.29.1.1.1.1.1		not-accessible	Each entry contains the device certificates of one CM MAC interface. An entry in this table exists for each ifEntry with an ifType of docsCableMaclayer(127).
DOC docsBpi2Ext31CmDeviceCmCert	1.3.6.1.4.1.4491.2.1.29.1.1.1.1.1.1	DocsX509ASN1DEREncodedCertificate	read-write	The X509 DER-encoded cable modem certificate. Note: This object can be set only when the value is the zero-length OCTET STRING; otherwise, an error of 'inconsistentValue' is returned. Once the object contains the certificate, its access MUST be read-only and persists after re-initialization of the managed system.
DOC docsBpi2Ext31CmDeviceManufCert	1.3.6.1.4.1.4491.2.1.29.1.1.1.1.1.2	DocsX509ASN1DEREncodedCertificate	read-only	The X509 DER-encoded manufacturer certificate that signed the cable modem certificate.
docsBpi2Ext31CodeDownloadControl	1.3.6.1.4.1.4491.2.1.29.1.2
DOC docsBpi2Ext31CodeUpdateCvcChain	1.3.6.1.4.1.4491.2.1.29.1.2.1	DocsCvcCaCertificateChain	read-write	The value of this object is a degenerate PKCS7 signedData structure that contains the CVC and the CVC CA certificate chain in the certificates field. Setting this object triggers the device to verify the CVC and update the cvcAccessStart values associated with the new PKI defined by DOCSIS 3.1. The content of this object is then discarded. If the device is not enabled to upgrade codefiles, or if the CVC verification fails, the CVC will be rejected. Reading this object always returns the zero-length OCTET STRING.
STR docsBpi2Ext31CodeMfgOrgName	1.3.6.1.4.1.4491.2.1.29.1.2.2	SnmpAdminString	read-only	The value of this object is the device manufacturer's organizationName used to validate the code verification certificate issued from the new PKI defined in DOCSIS 3.1.
DAT docsBpi2Ext31CodeMfgCodeAccessStart	1.3.6.1.4.1.4491.2.1.29.1.2.3	DateAndTime	read-only	The value of this object is the device manufacturer's current codeAccessStart value used with the new PKI defined in DOCSIS 3.1. This value will always refer to Greenwich Mean Time (GMT), and the value format must contain TimeZone information (fields 8-10).
DAT docsBpi2Ext31CodeMfgCvcAccessStart	1.3.6.1.4.1.4491.2.1.29.1.2.4	DateAndTime	read-only	The value of this object is the device manufacturer's current cvcAccessStart value used with the new PKI defined in DOCSIS 3.1. This value will always refer to Greenwich Mean Time (GMT), and the value format must contain TimeZone information (fields 8-10).
STR docsBpi2Ext31CodeCoSignerOrgName	1.3.6.1.4.1.4491.2.1.29.1.2.5	SnmpAdminString	read-only	The value of this object is the co-signer's organizationName used to validate the code verification certificate issued from the new PKI defined in DOCSIS 3.1. The value is a zero length string if the co-signer is not specified.
DAT docsBpi2Ext31CodeCoSignerCodeAccessStart	1.3.6.1.4.1.4491.2.1.29.1.2.6	DateAndTime	read-only	The value of this object is the co-signer's current codeAccessStart value used with the new PKI defined in DOCSIS 3.1. This value will always refer to Greenwich Mean Time (GMT), and the value format must contain TimeZone information (fields 8-10). If docsBpi2CodeCoSignerOrgName is a zero length string, the value of this object is meaningless.
DAT docsBpi2Ext31CodeCoSignerCvcAccessStart	1.3.6.1.4.1.4491.2.1.29.1.2.7	DateAndTime	read-only	The value of this object is the co-signer's current cvcAccessStart value used with the new PKI defined in DOCSIS 3.1. This value will always refer to Greenwich Mean Time (GMT), and the value format must contain TimeZone information (fields 8-10). If docsBpi2CodeCoSignerOrgName is a zero-length string, the value of this object is meaningless.
docsBpi2Ext31Conformance	1.3.6.1.4.1.4491.2.1.29.2
docsBpi2Ext31Compliances	1.3.6.1.4.1.4491.2.1.29.2.1
docsBpi2Ext31MIBCompliance	1.3.6.1.4.1.4491.2.1.29.2.1.1			The compliance statement for implementations of the DOC-BPI2EXT-MIB.
docsBpi2Ext31Groups	1.3.6.1.4.1.4491.2.1.29.2.2
docsBpi2Ext31CmGroup	1.3.6.1.4.1.4491.2.1.29.2.2.1			The group of objects implemented by the CM.
docsBpi2Ext31BaseGroup	1.3.6.1.4.1.4491.2.1.29.2.2.2			The group of objects implemented by the CM and open to implementation by other devices.

RFC description

DOCSIS 3.1 BPI (Baseline Privacy Interface) extension MIB for cable modem PKI certificate and device management.

Start monitoring DOCSIS 3.1 cable modem/CMTS (BPI+ certificate extensions, vendor-neutral CableLabs standard) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download DOCS-BPI2EXT-MIB

What Is DOCS-BPI2EXT-MIB?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description