ENGINEERING COMMITTEE Data Standards Subcommittee AMERICAN NATIONAL STANDARD ANSI/SCTE 23-2 2017 DOCSIS 1.1 Part 2: Baseline Privacy Plus Interface ANSI/SCTE 23-2 2017 NOTICE The Society of Cable Telecommunications Engineers (SCTE) Standards and Operational Practices (hereafter called “documents”) are intended to serve the public interest by providing specifications, test methods and procedures that promote uniformity of product, interchangeability, best practices and ultimately the long term reliability of broadband communications facilities. These documents shall not in any way preclude any member or non-member of SCTE from manufacturing or selling products not conforming to such documents, nor shall the existence of such standards preclude their voluntary use by those other than SCTE members. SCTE assumes no obligations or liability whatsoever to any party who may adopt the documents. Such adopting party assumes all risks associated with adoption of these documents, and accepts full responsibility for any damage and/or claims arising from the adoption of such documents. Attention is called to the possibility that implementation of this document may require the use of subject matter covered by patent rights. By publication of this document, no position is taken with respect to the existence or validity of any patent rights in connection therewith. SCTE shall not be responsible for identifying patents for which a license may be required or for conducting inquiries into the legal validity or scope of those patents that are brought to its attention. Patent holders who believe that they hold patents which are essential to the implementation of this document have been requested to provide information about those patents and any related licensing terms and conditions. Any such declarations made before or after publication of this document are available on the SCTE web site at http://www.scte.org. All Rights Reserved © Society of Cable Telecommunications Engineers, Inc. 2017 140 Philips Road Exton, PA 19341 SCTE STANDARD ©SCTE 2 ANSI/SCTE 23-2 2017 Table of Contents 1 SCOPE AND PURPOSE .............................................................................................................................. 1 1.1 SCOPE ...................................................................................................................................................................................................... 1 1.2 REQUIREMENTS ................................................................................................................................................................................... 1 1.3 BACKGROUND ...................................................................................................................................................................................... 2 1.3.1 Service Goals ...................................................................................................................................... 2 1.3.2 Reference Architecture ....................................................................................................................... 2 1.3.3 Categories of Interface Specification ................................................................................................. 2 1.3.4 Statement of Compatibility ................................................................................................................. 5 2 BASELINE PRIVACY PLUS OVERVIEW .............................................................................................. 7 2.1 ARCHITECTURAL OVERVIEW .......................................................................................................................................................... 7 2.1.1 Packet Data Encryption ..................................................................................................................... 7 2.1.2 Key Management Protocol ................................................................................................................. 8 2.1.3 BPI+ Security Associations ................................................................................................................ 9 2.1.4 QoS SIDs and BPI+ SAIDs. ............................................................................................................. 10 2.2 OPERATIONAL OVERVIEW ............................................................................................................................................................ 10 2.2.1 Cable Modem Initialization .............................................................................................................. 10 2.2.2 Cable Modem Key Update Mechanism ............................................................................................ 12 3 DOCSIS MAC FRAME FORMATS ......................................................................................................... 13 3.1 VARIABLE-LENGTH PACKET DATA PDU MAC FRAME FORMAT................................................................................. 13 3.2 FRAGMENTATION MAC FRAME FORMAT .............................................................................................................................. 15 3.3 REQUIREMENTS ON USAGE OF BP EXTENDED HEADER ELEMENT IN MAC HEADER ......................................... 17 4 BASELINE PRIVACY KEY MANAGEMENT (BPKM) PROTOCOL ................................................ 19 4.1 STATE MODELS ................................................................................................................................................................................. 19 4.1.1 Introduction ...................................................................................................................................... 19 4.1.2 Authorization State Machine ............................................................................................................ 23 4.1.3 TEK State Machine ........................................................................................................................... 32 4.2 KEY MANAGEMENT MESSAGE FORMATS ............................................................................................................................... 40 4.2.1 Packet Formats ................................................................................................................................ 40 4.2.2 BPKM Attributes ............................................................................................................................. 49 5 DYNAMIC SA MAPPING ......................................................................................................................... 71 5.1 INTRODUCTION.................................................................................................................................................................................. 71 5.2 THEORY OF OPERATION ................................................................................................................................................................ 72 5.3 SA MAPPING STATE MODEL ....................................................................................................................................................... 73 5.3.1 States ................................................................................................................................................ 74 5.3.2 Messages .......................................................................................................................................... 75 5.3.3 Events ............................................................................................................................................... 75 5.3.4 Parameters ....................................................................................................................................... 76 5.3.5 Actions .............................................................................................................................................. 77 ANSI/SCTE STANDARD ©SCTE 3 ANSI/SCTE 23-2 2017 5.4 IP MULTICAST TRAFFIC AND DYNAMIC SAS ........................................................................................................................ 78 6 KEY USAGE ................................................................................................................................................ 79 6.1 CMTS ......................................................................................................................................................... 79 6.2 CABLE MODEM ................................................................................................................................................................................. 81 6.3 AUTHENTICATION OF DOCSIS V1.1 DYNAMIC SERVICE REQUESTS ........................................................................... 84 7 CRYPTOGRAPHIC METHODS .............................................................................................................. 85 7.1 PACKET DATA ENCRYPTION ........................................................................................................................................................ 85 7.2 ENCRYPTION OF TEK .................................................................................................................................. 86 7.3 HMAC-DIGEST ALGORITHM ......................................................................................................................................................