# Evolution of Access Network Sharing and Its Role in 5G Networks
## 3 Sharing of Optical Access Networks
### Logical Security  
Typically, security considerations for access sharing (see Section 2) involve the restriction of access to customer premises and underground plant, and the protection of physical assets located in telco exchanges. Due to the broadcast nature of downstream transmission in a shared PON, there are additional considerations that need to be accounted for, over and above those for access sharing models, such as logical security. Logical security relates to the protection of digital assets, such as data, which can be compromised without requiring physical access to the underlying platforms. Since virtualisation has cloudified more and more network functions, threats to logical security have become much greater and more insidious than threats to physical security. This is because logical security attacks can come from any place in the world through access to a compromised ONT. There can be a higher volume of malicious traffic generated which lasts for much longer, evolves in nature and remains undetected when compared to physical security attacks. With PONs being used as a bearer for high value traffic and customers, the physical and logical separation with plain vanilla customers has lessened. The impact and varied nature of security threats has therefore increased substantially. The aspects of logical security can be divided into three group, namely, confidentiality, integrity and availability of data on the shared optical access network [49]. Here we do not concern ourselves with security of terminal devices and assume that network devices such as splitters are physically secured. An example of a threat to availability is where an ONT is programmed to launch an attack that degrades the quality of some or all of the shared optical access system. This could be due to sheer volume of traffic being transmitted, sometimes called a Denial of Service (DoS) attack, or where data is being replayed on the network in order to reset a session state. The control against a DoS attack is to restrict upstream traffic volume through appropriate bandwidth management allocation. An example of a threat to integrity, is where an agent modifies data transmitted, without being detected. This is less likely to happen where the full ONT to OLT session is encrypted, but more likely if just the XGEM payload is encrypted. Lastly, a threat to confidentiality is where information is stolen through the interception of the underlying data transmission. At its most basic level, data being transmitted to one ONT can be intercepted by another ONT, where the downstream transmission (that is, broadcast) is unencrypted. The recourse against this threat is to encrypt the PON channel using as a robust symmetrical encryption regime such as Advanced Encryption Standard (AES) [50] 128, 192 or 256 bit encryption, as defined in ITU-T G.984.3 [51]. At a more advanced level, attacks such as MITM (Man in the Middle) causes an ONT to re-home to a malicious OLT in the PON. The malicious OLT passes traffic to/from the correct OLT, in a manner that the ONT and OLT assume they are communicating directly with each other. Such an attack, of course, requires physical interception of the ODN, however, it raises particular concerns about how the trust relationship is created between the ONT and the OLT, particularly where PONs are increasingly being deployed in diverse environments. Best practice determines that trust relationship is created by authentication and authorisation, in a multi-step and multi-directional fashion, that is the ONT authenticates to the OLT, and the OLT authenticates to the ONT, but also, different layers in the protocol stack cross authenticate against higher and lower layers. XG-PON for example supports 3 levels of authentication [52], that is one-way authentication of ONT registration ID by OLT, two way authentication through OMCI message exchange and finally two way authentication based on IEEE802.X message exchange [53].