The MIB module for managing an IEEE 802.1AR DevID (Secure Device
Identifier) Module. A DevID comprises: a DevID secret (a private
key) stored confidentially by the DevID module and accessible only
through operations provided by the module; a DevID certificate
containing the corresponding public key and a subject name that
identifies the device; and a (possibly null) certificate chain. Use
of the DevID module signing operations allows the device to prove
possession of the DevID secret, and thus assert its identity in
authentication protocols. An initial IDevID provided by the
device supplier can be used directly or can be used to provision
one or more locally significant LDevIDs that reflect authorization
decisions by the local network administrator with certificate fields
that record those decisions.
An SNMP agent can manage a network element comprising one or
many devices. They can include component (such as individual line
cards in a chassis) or aggregate devices (such as the chassis and
its current complement of cards). In each case a DevID module binds
DevIDs secrets and certificates to the device whose identity they can be
used to assert: they remain attached to a component device if it is
removed from the network element, and are not retained by the SNMP
agent. The entPhysicalIndex defined by the ENTITY-MIB identifies each
device managed by the agent and is used to index tables of managed
objects for each device with a DevID module, so ENTITY-MIB objects are
correlated with and can supplement DevID information cryptographically
bound to the device.
The initial version of this ieee8021DevIDMIB used the object name
prefix 'devID' rather than 'ieee8021DevI' as recommended by
RFC 4181. The 'devID' prefix has been retained for backwards
compatibility and internal consistency.