# New Security Improvements in Next-Generation Passive Optical Networks Stage 2 +
## 4 Our Proposal of Security Improvements in NG-PON2
Because there is one octet for ID message definition we just continued with next IDs. The Registration_PUF PLOAM message (see Tables 3 and 4) serve to transmit the Registration_ID_PUF to the OLT CT. The content of the Request_Registration_PUF1 and Request_Registration_PUF2 message is the same as that in the Request_Registration_PUF, but in the third octet (Message type ID) is 0x1E, \"Request_Registration_PUF1\" for Request_Registration_PUF1, and 0x1F, \"Request_Registration_PUF2\" for Request_Registration_PUF2. Next, in octets 5-40, only the challenge is transmitted in the Request_Registration_PUF1 and only the helper data in the Request_Registration_PUF2 are transmitted. Unused byte positions are filled by 0x00 values. The ONU must has both the challenge and helper data in order to generate the Registration_ID_PUF. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Message** & **Message Name** & & & **Effect of** \\
**Type ID** & **(Applicability)** & **Function** & **Trigger** & **Receipt** \\ \hline \multirow{4}{*}{0x1D} & Request\_Registration\_PUF (TWDM only) & To request an ONU’s Registration\_ID\_PUF. & At the implementor’s discretion; ONU has been previously activated. & Send the Registration\_PUF message \\ \cline{2-5}  & Request\_Registration\_PUF1 (TWDM only) & To request an ONU’s Registration\_ID\_PUF. & At the implementor’s discretion; ONU has been previously activated. & Send the Registration\_PUF message \\ \hline \multirow{4}{*}{0x1E} & Request\_Registration\_PUF2 (TWDM only) & To request an ONU’s Registration\_ID\_PUF. & At the implementor’s discretion; ONU has been previously activated. & Send the Registration\_PUF message \\ \cline{2-5}  & Request\_Registration\_PUF2 (TWDM only) & To request an ONU’s Registration\_ID\_PUF. & At the implementor’s discretion; ONU has been previously activated. & Send the Registration\_PUF message \\ \hline \hline \end{tabular}
\end{table} 
Table 1: New downstream physical layer operations, administration, and maintenance (PLOAM) messages. Figure 2: Initialization phase in SI-NG-PON2. In the first step, the OLT CT sends a challenge and helper data to the ONU. If the ONU received a challenge and helper data, it can calculate the Registration_ID_PUF in this way. The ONU implements the received challenge as the input of PUF, and the calculated output of PUF with the received helper data is employed as the input of CC; see Equation (1). \[Registration\_ID\_PUF=CC\left(PUF\left(challenge\right),HD\right). \tag{1}\] \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Octet** & **Content** & **Description** \\ \hline
1–2 & ONU-ID & Directed message to one ONU. \\ \hline
3 & Message type ID & 0x1D, “Registration\_PUF \\ \hline
4 & SegNo & Repeated from downstream \\  & & & Request\_Registration\_PUF \\
4 & SegNo & (Request\_Registration\_PUF1) \\  & & & message, or 0 if generated in \\  & & & response to a ranging grant \\  & & & in the Ranging state (O4). \\ \hline
5–40 & Registration\_ID\_PUF & A string of 36 octets that \\  & & & has been generated by \\  & & & a PUF and CC in an ONU. \\  & & & Registration\_ID\_PUF \\
5–40 & Registration\_ID\_PUF & may be useful in identifying \\  & & & a particular ONU installed \\  & & & at a particular location \\  & & & and for a generation of \\  & & & the MSK and derived shared keys. \\ \hline
41–48 & MIC & Message integrity check computed \\  & & & using the default PLOAM integrity key. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Content of Registration_PUF message.