Chapter 29: Security
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
872
request to the C4/c CMTS, the system uses the shared secret, which only it and the configuration server know, to calculate
the MIC value. If this value is the same as the one sent by the registering modem, then the modem is allowed to register.
If the MIC value sent by the modem is not generated with the proper shared secret string, it will not match the MIC value
that the C4/c CMTS has calculated. Then the modem will not be allowed to register and the
show cable modem
command
will list the modem as having failed MIC authentication (Denied).
The cable shared-secondary-secret command allows a cable operator to specify a secondary DOCSIS shared secret string to
be used to authenticate a CM configuration file. If a CM has a MIC authentication failure during registration while using the
primary shared secret string, the CMTS then checks the MIC value using the secondary shared secret. If a match is found,
the CM is allowed online. If the CM also fails the MIC authentication using the secondary shared secret value, the C4/c
CMTS refuses to allow the CM to come online and instead logs a MIC authentication failure.
The use of the cable shared-secondary-secret command allows the MSO to gradually phase in changes to the shared secret
key with minimal disruption of service. If a shared secret has been compromised, or if the MSO decides to change the
shared secret periodically, the MSO can immediately change the primary shared secret on the CMTS. The previous key can
then be made a secondary shared secret, so that CMs can continue to register until the MSO can change all of the DOCSIS
configuration files to use the new shared secret.
Operational Considerations
MSOs and operators considering using the Dual Shared Secret feature should be aware of the following:
The Advanced CM Configuration File Verification feature provides a dynamic shared secret. It is the norm for CM
configuration file verification and is what ARRIS recommends for most customers. Dual Shared Secret is meant to be
used by certain customers with specific requirements.
This feature involves changes to CLI syntax that are not backwards compatible. MSOs using this feature should create
and save a running-configuration file that can be used to fall back to a previous load if desired.
If no primary shared secret is provisioned, a secondary shared secret may be provisioned but will not be used by the
C4/c CMTS.
If the primary shared secret is provisioned, the C4/c CMTS looks for the secondary shared secret only if the primary
fails authentication.
CLI Commands
The following table lists the commands that are pertinent to this feature:
