Table of Contents
1Scope
2References
2.1Normative
2.2Informative
3Termsanddefinitions
4Abbreviations
5Baselineprivacyplusbackgroundandoverview
5.1Architecturaloverview
5.2Operationaloverview
6DOCSISMACframeformats
6.1Variable-lengthpacketdataPDUMACframeformat
6.2FragmentationMACframeformat
6.3RequirementsonusageofBPextendedheaderelement
inMACheader
7BaselinePrivacyKeyManagement(BPKM)protocol
7.1Statemodels
7.2Keymanagementmessageformats
8DynamicSAmapping
8.1Introduction
8.2Theoryofoperation
8.3SAMappingstatemodel
8.4IPmulticasttrafficanddynamicSAs
9Keyusage
9.1CMTS
9.2Cablemodem
9.3AuthenticationofDOCSISv1.1/2.0dynamicservice
requests
10Cryptographicmethods
10.1Packetdataencryption
10.2EncryptionofTEK
10.3HMAC-Digestalgorithm
10.4DerivationofTEKs,KEKsandmessageauthenticationkeys
10.5Public-keyencryptionofauthorizationkey
10.6Digitalsignatures
10.7Supportingalternativealgorithms
11PhysicalprotectionofkeysintheCMandCMTS
12BPI+X.509certificateprofileandmanagement
12.1BPI+certificatemanagementarchitectureoverview
12.2Certificateformat
12.3CablemodemcertificatestorageandmanagementintheCM
12.4CertificateprocessingandmanagementintheCMTS
AnnexA-TFTPconfigurationfileextensions
A.1Encodings
A.2Parameterguidelines
AnnexB-Verifyingdownloadedoperationalsoftware
B.1Introduction
B.2Overview
B.3Codeupgraderequirements
B.4Securityconsiderations(Informative)
AnnexC-BPI/BPI+interoperability
C.1DOCSISv1.0/v1.1/v2.0interoperability
C.2DOCSISBPI/BPI+interoperabilityrequirements
C.3BPI40-bitDESexportmodeconsiderations
C.4Systemoperation
AnnexD-UpgradingfromBPItoBPI+
D.1HybridcablemodemwithBPI+
D.2UpgradingProcedure
AppendixI-Examplemessages,certificatesandPDUs
I.1Notation
I.2AuthenticationInfo
I.3AuthorizationRequest
I.4AuthorizationReply
I.5KeyRequest
I.6KeyReply
I.7PacketPDUencryption
I.8EncryptionofpacketPDUwithpayloadheader
suppression
I.9Fragmentedpacketencryption
Bibliography Abstract
Provides cable modem users with data privacy across the cable network and provide cable operators with service protection; i.e., prevent unauthorized users from gaining access to the network's RF MAC services.
