# New Security Improvements in Next-Generation Passive Optical Networks Stage 2 +
## 1 Introduction  
Network operators continue to witness an exponential growth of traffic transmitted over their infrastructure/networks. Increasing the bandwidth means bringing an optical fiber from the edge point closer to the access part of their networks. Bringing fiber closer to customers requires the proper installation and standardized technology. Installation works are able to provide the companies, but the standardized technologies are part of network operator members of the full service access network (FSAN) that cooperates on the definition of their requirements for new passive optical network (PON) technologies [1]. Currently, the gigabit PON (GPON) specification of PON is widely used around the world [2]. However, this technology is approximately 10 years old, and the price of active elements, such as theoptical line termination (OLT) and optical network unit (ONU), and its compatibility with the older standard indicate that next-generation (symmetric) PON (XG(S)-PON) will have a larger revenue in 2021 in comparison with GPON [3]. It also proves that the speed of PON is not the most important aspect [4; 5]. The next-generation PON stage 2 (NG-PON2) currently operates as a pilot project; on the other hand, the first specification of NG-PON2 was approved in 2015, which serves to illustrate the path from standardization to real deployment. NG-PON2 networks are the first to support up to 8 wavelengths in the downstream and upstream direction. The end unit selects the proper wavelength in the activation process once it has been turned on for the first time or restarted or by the physical layer operations, administration, and maintenance (PLOAM) control message. The specification of the physical layer, such as attenuation classes, the split ratio, etc., can be found in [6]. NG-PON2, as well as all other PONs in the downstream direction, are broadcast to all ONU at the ODN, and the upstream direction uses the time division multiplex (TDM) technique with time slots. The NG-PON2 standard must ensure protection against the following threats. * As downstream data in NG-PON2 are broadcast to all ONUs attached to the NG-PON2 OLT channel termination (OLT CT) [7], it is necessary to ensure that a malicious user would not be capable of replacing or reprogramming an ONU to receive all downstream data intended for all connected users. * As upstream data received by the OLT CT can originate from any ONU attached to the optical distribution network (ODN) [7], it is necessary to ensure that a malicious user would not be capable of replacing or reprogramming an ONU and forge frames to impersonate a different ONU. * Furthermore, it is necessary to ensure that an attacker could not connect to a malicious device at various points of the infrastructure that could intercept and/or generate traffic and could impersonate an OLT CT or an ONU. * It is also necessary to ensure that an attacker could not perform the replay attack and bit-flipping attack. The replay attack represents a situation when the attacker records frames transmitted on the PON and replays them back onto the PON later. The bit-flipping attack represents a situation when the attacker changes packets transmitted on the PON. If we want to ensure the above-mentioned protection in NG-PON2, we must use cryptographic algorithms for this purpose. The most important terms in cryptographic security are authentication, confidentiality, integrity, and nonrepudiation. Authentication protocols can be used to verify the authenticity of communicating entities. Unilateral or mutual authentication can be carried out between communicating entities. The first entity is authenticated to the second entity or vice versa in the case of unilateral authentication. Both entities are authenticated to each other in the case of mutual authentication. Confidentiality ensures that only authorized entities can know classified information. Confidentiality can be ensured by encryption algorithms.