XG-PON Security

[Virtual Presenter] Good afternoon everyone. Today I'm here to talk about XG-PON Security which provides optional authentication and security features to protect against threats posed by malicious users. We'll discuss how this security system works as well as how it can help keep your data secure. Let's get started!.

[Audio] XG-PON or 10 Gigabit Passive Optical Network is a highly efficient fiber optic network technology. To protect against malicious users security measures are needed to prevent replacement or re-programming of an ONU. This is because it could result in the reception of all downstream data intended for all connected users or worse packet forgery to impersonate a different ONU..

[Audio] XG-PON security protocol has been designed to protect against malicious attacks on the infrastructure. It eliminates the potential for tampering of street cabinets spare ports or fibre cables by connecting malicious devices. Moreover it stops malicious users from intercepting or generating traffic and executing bit-flipping attacks which can potentially cause harm to the optical network. To make XG-PON security implementation more affordable some security features are optional..

[Audio] Slide number 4 of our presentation focuses on XG-PON Security. We will cover two authentication methods for this fiber system: Registration ID based Authentication which verifies the O-N-U to the O-L-T and Secure mutual Authentication which verifies both the O-N-U to the O-L-T and the O-L-T to the ONU. Furthermore we will look into two other security alternatives – one that uses a shared pre-shared key and the other using IEEE 802.1X protocols. This slide will cover each of these methods and their implications..

[Audio] Slide 5 of the presentation concentrates on the security of XG-PONs. This security is built on Registration ID based Authentication which comprises the master session key or MSK. M-S-K is a 128-bit value that is shared between the O-L-T and the designated ONU. It serves as the basis for all other hidden keys used for secure communication. M-S-K is derived from the ONU Registration ID with the help of AES-CMAC algorithm with a standard key generated with the hex pattern 0x55 repeated 16 times..

[Audio] We are discussing "Registration ID based Authentication" and the session key (S-K---) associated with it. A formula concatenates the O-N-U serial number the PON-TAG and the hexadecimal representation of the A-S-C-I-I string "SessionK" to obtain this key. The key is then used for subsequent key derivations and binds the M-S-K to the security association between the O-L-T and the ONU..

[Audio] This slide is about Derived Shared Keys and OMCI_IK. OMCI_IK is used to generate and verify the integrity of O-M-C-I messages. It's derived from the SK by using the AES-CMAC function. This provides 128 bit encryption and is the hexadecimal representation of the string "OMCIIntegrityKey". In short OMCI_IK is a secure way to ensure integrity of O-M-C-I messages..

[Audio] In this slide we are looking at how the Derived Shared Key (S-K---) can be used to generate a P-L-O-A-M integrity key PLOAM_IK. The calculation is done by using the AES-CMAC algorithm and a predefined 128 bit information message. Once calculated the PLOAM_IK is then used to generate and verify the integrity of the X-G-T-C layer unicast P-L-O-A-M messages. For downstream broadcast P-L-O-A-M messages and for unicast P-L-O-A-M messages exchanged in the course of O-N-U activation prior to availability of the Registration-based M-S-K the default value of PLOAM_IK is used..

[Audio] Slide 9 focuses on the key encryption key or KEK. K-E-K is used to encrypt and decrypt data encryption keys that are stored in the P-L-O-A-M channel. The K-E-K is derived from the SK or shared key by using an AES-CMAC function and a 128-bit message parameter. This message parameter is a hexadecimal representation of the A-S-C-I-I string "KeyEncryptionKey.

[Audio] Slide 10 focuses on the importance of derived keys when it comes to XG-PON security. PLOAM_IK which stands for Physical Layer Operations Administration and Maintenance Integrity Key helps in authenticating the messages sent between the Optical Line Terminal and the Optical Network Unit. OMCI_IK or Optical Multimedia Convergence Interface Integrity Key helps in ensuring that the commands sent from the Optical Line Terminal to the Optical Network Unit are trustworthy. Both PLOAM_IK and OMCI_IK are essential in providing secure reliable communication between the two end points..

[Audio] The slide 11 shows that message integrity check (M-I-C--) field with 8-byte length is used to verify sender identity and protect against forgery. It employs a 40-byte P-L-O-A-M message content and the P-L-O-A-M integrity key to obtain the M-I-C value by AES-CMAC calculation. The direction code for downstream communication is 0x01 and 0x02 for upstream communication..

[Audio] Security of XG-PON networks is the focus of this slide. Payload layer overhead messages (P-L-O-A-M) are encrypted to detect modifications that could be made while in transit to ensure data is secure and its origin can be verified..

[Audio] I'd like to talk about the security implications of XG-PON focusing on the integrity protection and data origin verification for OMCI. To guarantee sender identification is checked and the message is not tampered with a 4-byte message integrity check (M-I-C--) field is included in the O-M-C-I message format. The M-I-C is computed by employing the O-M-C-I integrity key OMCI_IK and the contents of the O-M-C-I message which includes a direction code. The M-I-C is comprised of 32 bits. By this means the sender and receiver can calculate the M-I-C field so as to guarantee that the message is secure..

[Audio] Security measures such as integrity protection and data origin verification are of great importance for the Optical Network Unit Management and Control Interface (O-M-C-I-). Integrity protection safeguards against any unauthorized access and modifications while data origin verification guarantees that data sent by the Optical Network Unit (O-N-U--) has not been altered by any malicious third-party. In this slide we will further explain the concept of these security measures so that everyone comprehends their significance..

[Audio] XG-PON networks require the use of a default key for P-L-O-A-M message exchange and no default key for O-M-C-I message exchange. To protect the transmitted data a M-I-C is generated using the default P-L-O-A-M integrity key. This guarantees that the data will not be changed during its transmission..

[Audio] XG-PON is a type of optical network utilized in telecommunications. It implements a three-step symmetric-key-based challenge-response procedure in the O-M-C-I channel with a P-L-O-A-M handshake in the form of Registration ID exchange. O-L-T and O-N-U generate and exchange random challenges computing a secure M-S-K and derived shared key to be stored for future use. These procedures ensure a reliable and secure connection with trust between both entities..

[Audio] The OMCI-based secure mutual authentication procedure is designed to ensure robust protection of sensitive information as well as the integrity of the communication link between the two end nodes the Optical Network Unit and the Optical Line Terminal. This authentication procedure is characterized by the secure transmission of data and signatures as well as the authentication keys generated and shared by both nodes. Unique session keys are also created as part of the process aiding in protecting and maintaining the confidentiality of the data exchanged between the two nodes..

[Audio] O-L-T sends a challenge to the O-N-U which verifies OLT's authentication status and transmits an Attribute Value Change on the O-N-U authentication state attribute. Depending on the success of the unidirectional OLT-to-ONU authentication a Message Integrity Check on the A-V-C message is generated with either the previously active OMCI_IK or the new OMCI_IK. The new OMCI_IK is then committed active at the ONU..

[Audio] Upon receiving the ONU's authentication state the O-L-T will verify if the M-I-C field was generated using the old OMCI_IK or new OMCI_IK. If the old OMCI_IK was used the O-L-T will dismiss the previously calculated key material. If the new OMCI_IK was used it will be committed by the O-L-T as active. Subsequently the O-L-T creates a Request_Registration P-L-O-A-M message to the O-N-U in order to activate the secure shared keys if authentication is successful. Alternatively it will obtain the registration-based M-S-K and derived shared keys should authentication fails. This P-L-O-A-M message is secured with the default PLOAM_IK and the new PLOAM_IK will be committed by the O-L-T once the message is sent..

[Audio] The concept of key switching for OMCI-based secure mutual authentication is explored in this slide. This secure authentication system is for Optical Network Units (ONUs) and is initiated when the O-N-U receives a downstream Request_Registration P-L-O-A-M message. The O-N-U then sends an encrypted upstream Registration P-L-O-A-M message containing the new PLOAM_IK and KEK. Upon receipt of this message the O-L-T commits the new PLOAM_IK and K-E-K as active concluding the secure authentication process. That concludes our presentation. Thank you for your attention..