# New Security Improvements in Next-Generation Passive Optical Networks Stage 2 +
## 3 Security in NG-PON2
### Current Situation in NG-PON2  
The NG-PON2 ensures unilateral authentication, where the ONU is authenticated to the OLT CT, and mutual authentication, where the ONU and OLT CT are authenticated to each other. The unilateral authentication (called registration-based authentication) is mandatory for ONU devices connected to the NG-PON2. There are two authentication mechanisms that can be used for mutual authentication between the ONU and OLT CT in the NG-PON2. The first mutual authentication scheme uses the OMCI message exchange. The second mutual authentication scheme uses the Institute of Electrical and Electronics Engineers (IEEE) 802.1X message exchange. Support of mutual authentication mechanisms is mandatory for implementation at the component level, but optional from an equipment specification perspective [7]. The transmission convergence layer implementation has the capability to support both mutual authentication schemes, but the equipment may choose to support only unilateral authentication.  
The above-mentioned authentication methods work with a registration_ID that is stored in an ONU. The registration_ID has length of 288 bits and is stored in nonvolatile storage in the ONU. It is necessary to ensure that the registration_ID is stored securely. If an attacker obtains the Registration_ID, it could clone the ONU. The ONU and the OLT CT calculate the master session key (MSK) and derived shared keys based on the registration_ID. After the calculation of the MSK and derived shared keys, they become active. The OLT CT and ONU discard the MSK and derived shared keys at the start of the activation cycle.  
The confidentiality of a XGEM payload and the integrity of a PLOAM and OMCI messages are ensured in the NG-PON2 system. NG-PON2 uses several keys for ensuring confidentiality and integrity. The AES-CMAC [28] algorithm is used to compute the MSK and derived shared keys, which are the session key (SK); OMCI integrity key (OMCI_IK); physical layer operations, administration, and maintenance (PLOAM); integrity key (PLOAM_IK); and key encryption key (KEK). These keys have a length of 128 bits. MSK is derived from the registration_ID. SK is derived from MSK and the ONU serial number with a length of 64 bits. OMCI_IK, PLOAM_IK and KEK are derived from SK.  
An XGEM payload is encrypted by the AES-128 cipher operated in the counter mode (AES-CTR) [29] in the NG-PON2. The disadvantage of this encryption method is that the integrity of the encrypted message is not ensured. The data encryption keys are transmitted between the OLT CT and the ONU in the encrypted form created by the AES-128 block cipher in an electronic codebook mode (AES-ECB) [30]. This method also does not ensure the integrity of encrypted data.  
Integrity protection and data origin verification for PLOAM messages is ensured by the 8-byte message integrity check (MIC) field of the PLOAM message format. AES-CMAC-64 is used to construct the MIC field.  
Integrity protection and data origin verification for the OMCI traffic is ensured by the 4-byte MIC field of the OMCI message format. AES-CMAC-32 is used to construct the MIC field.  
There is no nonrepudiation of the origin or nonrepudiation of the delivery of data in NG-PON2.