This document is identical to SCTE 23-2 2012 except for informative components which may have been updated such as the title page, NOTICE text, headers and footers. No normative changes have been made to this document.

Note: The Telephony Return Interface mentioned in section 1.3.3 and in the [DOCSIS6] reference in Appendix F.2 is not used in modern architectures.

The intent of this BPI+ specification is to describe MAC layer security services for DOCSIS® CMTS - CM communications. BPI+ security goals aretwofold:
•provide cable modem users with data privacy across the cablenetwork
•provideMSOs with service protection; i.e., prevent unauthorized users fromgaining access to the network?s RF MACservices BPI+ provides a level of data privacy across the shared medium cable network equal to or better than that provided by dedicated line network access services (analog modems or digital subscriber lines).

The protected RF MAC data communications services fall into three categories:
•best-effort, high-speed, IP data services
•QoS (e.g., constant bit rate) data services
•IP multicast group services

The earlier BPI specification [SCTE 22-2] had "weak" service protection because the underlying key management protocol did not authenticate CMs. BPI+ strengthens this service protection by adding digital-certificate based CM authentication to its key exchange protocol.