Towards Secure Gigabit Passive Optical Networks

Signal Propagation based Key Establishment

Lukas Malina, Petr Munster, Jan Hajny and Tomas Horvath

Department of Telecommunications, Brno University of Technology, Technicka 12, Brno, Czech Republic

Keywords:

Communication, Cryptography, Gigabit Passive Optical Networks, Key Establishment, Security.

Abstract:

Nowadays, the Passive Optical Networks (PONs) technology is widely deployed in broadband access net-

works. This paper deals with the security issues of Gigabit PON (GPON) standardized by the International

Telecommunications Union (ITU), namely, standard ITU-T G.984 that is widely implemented in Europe these

days. We describe and analyze the security of this standard and show its security risks. In spite of that trans-

mitted data are encrypted to provide their conﬁdentiality on a multipoint ﬁbre connection, session secret keys

during their establishment can be observed by adversaries. To address this security ﬂaw, we propose a key es-

tablishment protocol that securely sets the session secret keys between two communication parties in GPON.

Furthermore, we provide the security analysis of the proposed protocol.

1 INTRODUCTION

Passive Optical Network (PON) is the main technol-

ogy for new and current access networks. In general,

passive optical networks are widely used due to the

absence of the active elements in Optical Distribu-

tion Network (ODN). Internet Services Provider (ISP)

does not need to have access to all subscriber net-

works called the last mile. The subscribers (users)

use end units called Optical Network Units (ONUs).

On the other hand, the provider manages Optical Line

Termination (OLT).

Nowadays, there are many standards of PON. In

general, these standards are divided into two parts:

the ITU and the Institute of Electrical and Electronics

Engineers (IEEE) standards. The standards of IEEE

dominate in Chinese and Asian access networks, and

the ITU standards dominate in the European access

networks. Because the gigabit passive optical net-

work technology is widely implemented in European

networks, we deal especially with the security of the

GPON technology.

Passive optical networks usually provide standard

security methods for data encryption, authentication

and key establishment. The encryption of data is vol-

untary in these networks. Nevertheless, the most no-

table security threat is that all end units (ONUs) are

able to read trafﬁc which is broadcasted in down-

stream. Before data encryption, ONUs receive the

broadcast communication and capture the messages

in setup stages. Moreover, secret keys for encryption

are sent as plain texts in the ITU-T G.984 standard.

Therefore, adversaries are able to decrypt communi-

cation if they observed these secret keys.

In this paper, we describe and analyze the security

of gigabit passive optical networks. We focus on the

ITU-T G.984 standard (ITU, 2014). We outline the

security threats in GPON and the ﬂaws of key estab-

lishment employed in this standard. Further, we pro-

pose a novel key establishment protocol to address the

security ﬂaws of the standard. Our secure key estab-

lishment approach protects against eavesdroppers in

the upstream and downstream communication. Our

solution enhances security in gigabit passive optical

networks.

1.1 State of the Art

Since 1995, many standards of passive optical net-

works have been developed. In GPON, the down-

stream direction is transfered via broadcast which

causes that ONU units are able to read whole trafﬁc.

There are many works which deal with general secu-

rity issues in the passive optical networks, the down-

stream direction especially.

The authors (Drakulic et al., 2012) explore the

detection algorithms for an attacker in the PON net-

works. They use a Frame Error Rate (FER) param-

eter for each ONU unit. They do not use any pro-

vision system but only detection algorithms. They

349

Malina L., Munster P., Hajny J. and Horvath T..

Towards Secure Gigabit Passive Optical Networks - Signal Propagation based Key Establishment.

DOI: 10.5220/0005559903490354

In Proceedings of the 12th International Conference on Security and Cryptography (SECRYPT-2015), pages 349-354

ISBN: 978-989-758-117-5

 2015 SCITEPRESS (Science and Technology Publications, Lda.)

ﬁrstly described the weakness of transmission data in

the downstream direction. The work (Froehlich et al.,

2005) employs a patented Optical Tapped Delay Line

(OTDL) channelizer. This technology is able to chan-

nelize an information-carrying light into many narrow

spectral subbands and change a phase of each of them.

OTDL can be used in ﬁbre and free-space optical

communication transmission systems. They present

the option of using these systems for Wavelength-

Division Multiplexing (WDM) systems but do not

show how the management changes the key for a sep-

arate wavelength in real time applications. Further,

the paper (Kochman and Wornell, 2012) introduces

the key distribution in free-space optical communi-

cation. The authors incorporate Pulse-Position Mod-

ulation (PPM) over multiple spatial degrees of free

spaces. They use the quantum key distribution model

to establish a key in a quantum channel and a classi-

cal channel. The work (Martinez-Mateo et al., 2014)

deals with the quantum key distribution in passive op-

tical networks. The authors present how to implement

the quantum cryptography into the standard access

optical networks. They present a solution for Time

Division Multiplexing (TDM) based PON. For exam-

ple, in TDM-Based PON with 128 ONUs, a quantum

emitter (and a receiver) has to be connected to one

port of an optical splitter. In general, current networks

are combination of TDM and WDM networks.

The papers (Hajduczenia et al., 2007), (Mendonca

et al., 2012) and (Xu et al., 2010) introduce the se-

curity issues in passive optical networks and the en-

cryption method of next generation PON systems. In

the paper (Hajduczenia et al., 2007), the security is-

sues of Ethernet PON (EPON) are discussed. On the

other hand, the article describes security issues and

attacks in EPON networks: eavesdropping, denial-

of-Service, masquerading and theft-of-service. The

paper (Mendonca et al., 2012) introduces security is-

sues which address reﬂection. In general, the au-

thors describe dividing the signal in the optical splitter

and the measurement of reﬂection in a PON physical

medium. The knowledge of the frame structure and

a sensitive detector are required for the detection of

transmitted data.

The authors (Eun and Kwon, 2006) analyze the

design of key security in EPON. They use a pseudo

random function for generating keys. The output of

the function is a 160 bit random. Their solution needs

some requests of ONU and OLT to change a key. In

EPON and all others PON networks, downstream is

transferred as broadcast, which means that all nodes

receive the whole signal. Only ONU with the same

ONU-ID can decode the frame. On the other hand,

the EPON networks use the well-known structure of

the frame. Optical trafﬁc analyzer enables to read the

parameters of the network (source and destination ad-

dresses, lengths, types, timestamps, data etc.).

The article (Xu et al., 2010) deals with high speed

encryption methods for next generation PON systems.

The designed method is divided into 3 parts: key gen-

eration, key synchronization and key exchange. Se-

cret encryption keys are sent from ONUs to OLT to

prevent other ONUs from eavesdropping these keys.

Nevertheless, the authors do not describe the ﬁrst

communication states between OLT and ONU units.

In these states, the ﬁrst key establishment is realized.

Further, the possibility of upstream eavesdropping has

not been considered in the paper.

In GPON networks, the frames have the compli-

cated structure, i.e., many encapsulations with vari-

able lengths of parts. Nevertheless, ONUs are able to

listen the downstream communication in PONs and

GPONs. Further, we assume the presence of an adver-

sary who is able to listen both directions and read data

from ONUs, including keys that are sent in upstream

like in (Xu et al., 2010). Due to this fact, we deal with

more robust key establishment. The goal of this paper

is to provide secure GPON systems by a proposed se-

cure key establishment protocol and data encryption.

1.2 Our Contributions

The contributions of this paper are summarized in the

following text:

1. We analyze security in gigabit passive optical net-

works and emphasize some security ﬂaws of the

ITU-T G.984 standard (ITU, 2014) that occur dur-

ing the establishment of the session secret keys.

2. We propose a novel key establishment protocol

which is based on secure assumptions and uses

the signal propagation measurement to establish

a common value between two communication

nodes. The propagation value between certain

ONU and OLT serves as a weak password and

an identiﬁer and protects against impersonating

attacks. Our key establishment protocol protects

against passive adversaries.

2 SECURITY IN GIGABIT

PASSIVE OPTICAL

NETWORKS

The communication units (OLT and ONU) need to be

synchronized in the downstream direction (from an

OLT view). The synchronization process starts in the

ﬁrst state called Initial state (O1). ONU asserts LOS

SECRYPT2015-InternationalConferenceonSecurityandCryptography

350

(Loss of Signal) and LOF (Loss of Frame) with 1 for

both parameters. Once downstream trafﬁc is received,

the parameters LOS and LOF are set to 0. The OLT

unit needs to calculate a ﬁbre distance for each con-

necting ONU. We can calculate the ﬁbre distance by

the following equation (ITU, 2014):

= (RT D

− RT

) · 102, (1)

where FD

represents the ﬁbre distance between OLT

and ONU, RT D

means the round-trip delay in µs

measured by OLT, RT

is the response time of the

ONU unit, and constant value 102 m/µs represents the

refractive indices for G.652 ﬁbers.

Synchronization frames (3 messages with the

Psync part) are received by ONU, and then ONU

moves to the Standby state (O2). ONU waits for the

global parameters (a delimiter value, a power level

mode and a pre-assigned delay). The description of

these parameters is out of the scope of this article.

When ONU gets from OLT the global parameters and

then ONU moves to the Serial Number state (O3).

The O3 state is the most important for the ONU unit

because the unit receives the unique identiﬁer ONU-

ID with the Assign ONU-ID message. Then, the

ONU unit changes the state to the Ranging state (O4).

In this state, ONU still cannot send the user data to

the network because it must be synchronized with the

GTC (GPON Transmission Convergence) frame. It

is necessary to change a pre-assigned delay with an

equalization delay. The equalization delay is mea-

sured from the ﬁrst entering into this state. The con-

trol unit (OLT) can calculate the time of the equaliza-

tion delay by the following equation (ITU, 2014):

Teqd = T

1490,i

+ RspTime

+ EqD

+ T

1310,i

= T

1490,i

1310

1490

+ RspTime

+ EqD

(2)

where RspTime

is the response time (µs), EqD

is an

estimation of the equalization delay for ﬁbre distance

from the previous formula, n

1310

represents the group

velocity refractive index for 1310 nm in ODN (Opti-

cal Distribution Network), n

1490

represents the group

velocity refractive index for 1490 nm in the ODN. The

fraction with group velocities can be called as the in-

dex correction factor. It can be expressed as:

1490,i

= (Teqd − RspTime

− EqD

)

1490

1310

+ n

1490

(3)

By substituting the expression for the receive instance

of the GTC frame N, we obtain:

Trecv

N,i

= T send

N,i

+ T

1490,i

. (4)

The ﬁnal formula is:

Trecv

N,i

= T send

+ Teqd

1490

1310

1490

OLT

−(EqD

+ RspTime

)

1490

1310

1490

ONU

(5)

ONU knows the propagation delay values and moves

to the Operation state (O5). The O5 state is the ﬁ-

nal state for ONU which wants to communicate with

OLT and transmits user data. On the other hand, the

OLT unit can offer encryption in the O5 state. In de-

fault setting, data encryption is disabled but ISP can

allow the encryption. Data encryption between OLT

and ONU units requires a key exchange protocol.

OLT must send the key change request to end

unit/s (ONU/s). After ONU receives the key change

request, ONU conﬁrms the request and generates

the key. The generated key is transmitted back to

the OLT unit in the Physical Layer Operations, Ad-

ministrations, and Maintenance (PLOAM) messages.

The length of the PLOAM message is limited. That

is the reason why the generated key is sent to OLT

in two messages in the GTC frame. These two mes-

sages are sent three times in the PLOAM part. OLT

must receive each copy of the key in the PLOAM mes-

sage. If OLT does not receive all copies, it generates

a new key change request. After receiving the new

key, OLT starts the key exchange (replacing the old

key with the new one). After replacing the old key,

OLT notiﬁes ONU with the command which contains

the frame number and the new key. This command is

sent three times. ONU needs to receive each copy of

the command for the using this new key. The com-

plete process of this key exchange is depicted in Fig-

ure 1.

OLT

ONU

The units are in OERATION_STATE (O5)

Security announcement

Key change request

Key change request confirmation

Key is generating

PLOAM message with key

OLT change/update a key

OLT sends a command containing the frame

number and new key

OLT sends a command containing the frame

number and new key

OLT sends a command containing the frame

number and new key

PLAIN

TEXT

PLAIN

TEXT

Figure 1: The messages between OLT and ONU during the

key exchange process.

TowardsSecureGigabitPassiveOpticalNetworks-SignalPropagationbasedKeyEstablishment

351

Splitter 1:64

ONU

ODN

OLT

Last mile

Eavesdropper

Downstream

Upstream

Eavesdropper

splitter

Eavesdropping of upstream

Figure 2: GPON scheme with eavesdropper.

In general, the ﬁnal version of the ITU-T standard

(ITU, 2014) presents that a new key is sent as a plain

text in the PLOAM message due to the upstream di-

rection is not easy to capture. Nowadays, adversaries

are able to connect the splitter of the upstream channel

to split the signal from ONU. OLT detects that the line

is down for a certain time and decreases the optical

power for ONU that is under the attack. This scenario

is not easy to realize in practice but we have to assume

that an adversary is able to do it. On the other hand,

the scenario is different for the downstream direc-

tion. The downstream data are transmitted via broad-

cast. In other words, each ONU is able to read the

downstream direction. Thus, an adversary can ana-

lyze commands and PLOAM messages and can try to

decrypt data because OLT sends the command in the

ﬁnal state with the number of the frame and the secret

key three times in the plain text. The standard ITU-

T G.984 (ITU, 2014) too much relies on the charac-

ter of passive optical networks where eavesdropping

is hard to realize. The main security risk of PON is

the presence of the splitter. If the attacker is able to

connect on a free port of the splitter then he/she can

capture transmitted data. In worse case, the attacker is

able to connect another splitter and gets the upstream

transmission. Upstream eavesdropping is studied in

the paper (Gutierrez et al., 2007). The scenario of

GPON with an eavesdropper is shown in Figure 2.

Due to using the splitter, the attacker can read both

direction and get the keys that are sent in plain texts.

Therefore, this security ﬂaw must be addressed and

more secure key establishment approach must be em-

ployed into current passive optical networks.

3 OUR NOVEL KEY

ESTABLISHMENT PROTOCOL

In this section, we describe our novel key establish-

ment approach in gigabit passive optical networks.

Our proposed protocol runs after the authentication

protocol in the Operation state (O5) and substitutes

the current and insecure key exchange described in

ITU-T G.984 (ITU, 2014).

The proposed protocol is based on the Difﬁe-

Hellman key establishment protocol that is modi-

ﬁed to a SPEKE (Simple Password Exponential Key

Exchange) approach (Hao and Shahandashti, 2014).

Nevertheless, we do not use a generator g that

is created from a hash of a password like in the

IEEE P1363.2 and the ISO/IEC 11770-4 standards.

The common unique value T

prop

between two com-

munication sides is based on a propagation value

which is measured between ONU

and OLT nodes be-

fore the key establishment protocol. The signal prop-

agation value is measured by ONU

and OLT on the

transmission convergence (TC) layer. There is a small

probability that the T

prop

might be a little different on

both sides (ONU

and OLT). Therefore, the measure-

ment is conﬁrmed by ONU

that sends the HMAC

value of T

prop

, an actual time and the authentication

credential of ONU

to prevent a guessing attack. The

measurement of T

prop

can be repeated to get the equal

value on both sides. In our protocol, the T

prop

value

protects against the impersonating attack due to that

the value is unique only for the certain pair of ONU

and OLT. The protocol is depicted in Figure 3. The

key establishment protocol runs between the ONU

unit and the OLT unit in two rounds (two messages)

and is described in the following text:

• We assume that the DH public parameters (g, p, q)

are securely shared among ONU

and OLT. Fur-

ther, the unique value T

prop

is equal at both sides

(ONU

, OLT) that establish a session key (K

• ONU

generates a random secret value

x ∈ (1, q − 1) and computes public DH pa-

rameter M = g

. Then, the identity of ONU

(ID ONU

) and M are sent to OLT.

• OLT receives ID ONU

and M. OLT ﬁrstly

checks if ID ONU

is in a list of ONUs. If

ID ONU

is found, then stored parameter T

prop

is loaded. OLT generates a random secret value

y ∈ (1, q − 1) and computes public DH param-

eter N = g

. Then, OLT computes the session

key K

= H(ID ONU

, min (N, M), max(N, M),

, T

prop

) where H is a secure hash function

(e.g. SHA2). The session key is securely stored

in OLT. Moreover, OLT computes a key con-

ﬁrmation value KC = HMAC(K

,’check session

key’||T

prop

|| ID ONU

). OLT sends ID ONU

N and KC to ONUs in broadcast channel.

• ONU

receives ID ONU

, N and KC by broad-

cast. ONU

ﬁrstly checks if ID ONU

is its

SECRYPT2015-InternationalConferenceonSecurityandCryptography

352

ONU OLT

ID_ONU, M

ID_ONU, N, KC

Compute M=g

Check

ID_ONU, M

Compute

N=g

, K

, KC

Check N

Compute K

Check KC

DH parameters {g, p, q},

prop

broadcast

unicast

= H(ID_ONU,min(M,N), max(M,N),N

or M

, T

prop

)

RNG x from {1, q-1}

RNG y from {1, q-1}

DH parameters {g, p, q},

prop

Figure 3: Proposed key establishment protocol.

own. Then, ONU

computes the session key K

H(ID ONU

, min (N, M), max(N, M), N

, T

prop

)

and checks incoming KC by recomputing the

HMAC(K

,’check session key’||T

prop

||ID ONU

)

where HMAC is a secure keyed-hash mes-

sage authentication code function (e.g. HMAC-

SHA256). If recomputed KC is equal then ONU

and OLT can start encrypted communication us-

ing the established session key K

. Otherwise, the

secret key is discarded.

4 SECURITY ANALYSIS

In this short paper, we provide the informal security

analysis of our key establishment protocol. We as-

sume that an attacker has access to the communication

and is able to eavesdrop messages in both directions

(upstream and downstream). Furthermore, we assume

that attackers do not have computational power which

allows them to break current cryptographic assump-

tions that are considered to be secure. Due to the op-

tical network environment and high communication

speeds, we assume that attackers are not able to real-

ize man in the middle attacks on the physical layer.

Then, we assume that attackers do not have physical

access to ONUs and OLT. The goal of the attacker is

get the secret key and then decrypt transmitted data.

Also, we consider malicious ONU which wants to im-

personate another ONU to get its data. This adversary

is able to resend, modify and create new messages. In

the following subsections, we describe how our proto-

col protects against possible attacks and adversaries.

4.1 Protocol Protects against

Eavesdroppers

An attacker, who eavesdrops on the communication

between ONU and OLT during our protocol, is not

able to get the secret key. The attacker needs to know

secret x or y and T

prop

in order to compute the valid se-

cret key. The attacker has to solve the Difﬁe-Hellman

problem and must know a valid T

prop

value to get the

secret key. Further, the attacker is not able to get the

secret key from cipher texts while he/she is eaves-

dropping on the encrypted communication. The se-

curity of the secret key is based on the security of

a symmetric cipher used (e.g. AES).

4.2 Protocol Protects against

Impersonating ONU

An attacker (e.g. malicious ONU

) who tries to im-

personate another ONU

with ID ONU

has to know

the valid signal propagation value T

prop

of ID ONU

to compute the secret session key. Nevertheless, we

assume that this value is unique and secret for each

pair of ONU

and OLT. The value is measured and

stored after valid authentication of ONU and before

every key establishment. The attacker without T

prop

is not able to compute the same secret key K

such as

OLT. Further, the attacker who gets T

prop

is not able

to compute the previous secret keys of ONU

and read

ONU

’s data because the attacker does not have the

secret DH parameter (x) that is needed for the compu-

tation of the secret key.

4.3 Protocol Protects against Replay

Attack

If an attacker captures the protocol message which is

sent from ONU

to OLT then he/she can try to replay

this message to get the secret key. OLT responses with

the protocol message that contains new and different

parameters, the DH parameter N

and the KC

param-

eter. The attacker is not able to compute the secret

key with these parameters and without the knowledge

of x and T

prop

4.4 Protocol Protects against Forgery

and Modiﬁcation Attacks

If messages in the protocol are tampered by an at-

tacker during their transmission then the key conﬁr-

mation KC parameter is not equal on ONU

and OLT

sides and ONU

does not use the established secret

key. The modiﬁcation of KC without the knowledge

of x or y and T

prop

is hard if the used HMAC function

is secure.

TowardsSecureGigabitPassiveOpticalNetworks-SignalPropagationbasedKeyEstablishment

353

4.5 Protocol Protects against On-line

Dictionary Attack

If an attacker tries to guess T

prop

by running the key

establishment protocol then he/she sends messages

and get the responses with KC. Nevertheless, KC pa-

rameters from OLT are computed from the secret keys

derived from random secret values (y). Thus, the at-

tacker has only one attempt per one protocol run to

try guess T

prop

4.6 Protocol Protects against Off-line

Dictionary Attack

If an attacker captures the protocol messages then

he/she attempts to guess T

prop

by recomputing KC.

Nevertheless, KC is computed by using the secret key

which is derived from the random secret value (y).

The attacker is not able to recompute KC without y.

4.7 Protocol Protects against Weak

Password Leakage

In case that an attacker knows the value T

prop

that rep-

resents a weak password in the protocol then the at-

tacker is not able to compute the secret keys that are

already used without knowing a secret value x or y. To

obtain these secrets from messages transmitted in the

key establishment protocol, the attacker must be able

to break the discrete logarithm problem or perform

the man in the middle attack that is hard to realize in

GPON.

5 CONCLUSIONS

In this paper, we analyze the security of gigabit pas-

sive optical networks. Due to the possibility of eaves-

dropping in downstream and upstream directions, the

more secure key establishment protocols are needed.

We propose the key establishment protocol that is

based on Difﬁe-Hellman key exchange and the signal

propagation time value. Our protocol provides the se-

cure key establishment between ONUs and OLT. The

protocol protects against various attacks and eaves-

droppers in GPON.

In future work, we would like to implement our

solution into real GPON devices and get experimental

results about the performance of the proposed proto-

col.

ACKNOWLEDGEMENTS

Research described in this paper was ﬁnanced by the

National Sustainability Program under grant LO1401,

by the Czech Science Foundation under grant no. 14-

25298P and the Technology Agency of the Czech Re-

public project TA0301081. For the research, infras-

tructure of the SIX Center was used.

REFERENCES

Drakulic, S., Tornatore, M., and Verticale, G. (2012).

Degradation attacks on passive optical networks. 2012

16th International Conference on Optical Network

Design and Modelling (ONDM), pages 1–6.

Eun, J.-S. and Kwon, Y. (2006). The design of key se-

curity in ethernet pon. 2006 8th International Con-

ference Advanced Communication Technology, vol.

1(1):1026–1030.

Froehlich, F., Price, C., Turpin, T., and Cooke, J. (2005).

All-optical encryption for links at 10 gbps and above.

MILCOM 2005 - 2005 IEEE Military Communica-

tions Conference, pages 1–7.

Gutierrez, D., Cho, J., and Kazovsky, L. G. (2007). Tdm-

pon security issues: upstream encryption is needed.

In Optical Fiber Communication Conference, page

JWA83. Optical Society of America.

Hajduczenia, M., Inacio, P. M., Silva, H. D., Freire, M., and

Monteiro, P. (2007). On epon security issues. IEEE

Communications Surveys, vol. 9(issue 1):68–83.

Hao, F. and Shahandashti, S. F. (2014). The SPEKE Proto-

col Revisited. Springer.

ITU (2014). G.984.3 : Gigabit-capable passive optical net-

works (g-pon): Transmission convergence layer spec-

iﬁcation.

Kochman, Y. and Wornell, G. W. (2012). On high-efﬁciency

optical communication and key distribution. 2012

Information Theory and Applications Workshop, vol.

1(1):172–179.

Martinez-Mateo, J., Ciurana, A., and Martin, V. (2014).

Quantum key distribution based on selective post-

processing in passive optical networks. IEEE Pho-

tonics Technology Letters, vol. 26(issue 9):881–884.

Mendonca, C., Lima, M., and Teixeira, A. (2012). Security

issues due to reﬂection in pon physical medium. 2012

14th International Conference on Transparent Optical

Networks (ICTON), vol. 1(1):1–4.

Xu, X., Shou, G., Guo, Z., and Hu, Y. (2010). Encryption

method of next generation pon system. 2010 3rd IEEE

International Conference on Broadband Network and

Multimedia Technology (IC-BNMT), vol. 1(1):384–

387.

SECRYPT2015-InternationalConferenceonSecurityandCryptography

354