Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Optical Engineering

Design of a mutual authentication based on NTRUsign with a perturbation and inherent multipoint control protocol frames in an Ethernet-based passive optical network

Aihan Yin, Yisheng Ding

Published Nov 6, 2014• 4 citations
Publisher

Abstract

Identity-related security issues inherently present in passive optical networks (PON) still exist in the current (1G) and next-generation (10G) Ethernet-based passive optical network (EPON) systems. We propose a mutual authentication scheme that integrates an NTRUsign digital signature algorithm with inherent multipoint control protocol (MPCP) frames over an EPON system between the optical line terminal (OLT) and optical network unit (ONU). Here, a primitive NTRUsign algorithm is significantly modified through the use of a new perturbation so that it can be effectively used for simultaneously completing signature and authentication functions on the OLT and the ONU sides. Also, in order to transmit their individual sensitive messages, which include public key, signature, and random value and so forth, to each other, we redefine three unique frames according to MPCP format frame. These generated messages can be added into the frames and delivered to each other, allowing the OLT and the ONU to go ahead with a mutual identity authentication process to verify their legal identities. Our simulation results show that this proposed scheme performs very well in resisting security attacks and has low influence on the registration efficiency to to-be-registered ONUs. A performance comparison with traditional authentication algorithms is also presented. To the best of our knowledge, no detailed design of mutual authentication in EPON can be found in the literature up to now.

DOI
10.1117/1.oe.53.11.115101

Related papers

Ethernet Passive Mutual Authentication Scheme on Quantum Networks

Jianuo Tian, Panke Qin, Zongqu Zhao +1 more

In the context of increasing demand for secure and efficient communication networks, addressing the issue of mutual authentication in ethernet passive optical networks (EPONs) has become both valuable and practically significant. This paper proposes a solution based on ideal lattices. The proposed scheme leverages the security of the ring learning with errors (RLWE) problem to establish a robust public-key cryptosystem. By involving ONUs, OLTs, and an SDN controller in the authentication process, it enables mutual authentication through a series of message exchanges facilitated by the SDN controller. Utilizing approximate smooth projection hash functions for secure key exchange and verification, the scheme ensures robust security performance against various attacks, including man-in-the-middle, impersonation, replay, and known key secrecy attacks. Simulation results demonstrate that the proposed solution introduces minimal delay and maintains a high registration success rate compared to traditional authentication methods. Additionally, this paper explores the convergence of quantum network protocols with EPONs, highlighting their potential to achieve unprecedented levels of communication security. Integrating quantum technology with EPON networks, due to the unique security properties of quantum, can also better prevent man-in-the-middle attacks. Secure interception detection techniques based on fundamental quantum properties provide a fundamental security direction for future communication systems, aligning with the growing interest in quantum-resistant cryptographic protocols.

Entropy•Jan 27, 2025•1 citation

Research of Authentication and Encryption in EPON

Qiang Chen

An Ethernet passive optical network (EPON) is a point-to-multipoint network and there are threats to EPON security. In this paper, we introduce a security scheme, including authentication and key exchange protocol based on the public key mechanism and encrypting frame based on the private key mechanism. The proposed protocol is verified in the view of known key secrecy, key compromise impersonation, explicit key authentication and unknown key-share.

China Cable Television•Jan 1, 2004•0 citations

An Authentication and Key Management Protocol for Secure Data Exchange in EPON MAC Layer

In-Kon Kang, Do-Hoon Lee, Bong Ju Lee +1 more

An EPON which is going on standardization in IEEE 802.3ah, is tree topology consists of a OLT and multiple ONU using passive optical components, so this network is susceptible to variable security threats - eavesdropping, masquerading, denial of service and so on. In this paper, we design a security protocol supporting authentication and confidentiality services in MAC layer in order to prevent these security threats and to guarantee secure data exchange The designed security protocol introduce public-key based authentication and key management protocols for efficient key management, and choose Rijndael algorithm, which is recent standard of AES, to provide the confidentiality of EPON Proposed authentication and key management protocols perform authentication and public-key exchange at a time, and are secure protocols using derived common cipher key by exchanging public random number To implement the designed security protocol, we propose the procedures of authentication and public-key exchange, session key update, key recovery. This proposed protocol is verified using unknown session key, forward secrecy, unknown key-share, key-compromise impersonation

한국통신학회논문지•Jan 1, 2003•0 citations

Point to multi-point physical-layer key generation and distribution in passive optical networks

Liuming Zhang, Xinran Huang, Weisheng Hu +1 more

A point to multi-point physical-layer secure key generation and distribution (SKGD) scheme is proposed and demonstrated in passive optical networks (PONs), where the optical line terminal (OLT) broadcasts optical lights with fast fluctuating states of polarization (SOPs) to the optical network units (ONUs). The highly correlated key waveforms are shared between OLT and ONUs, and the high-level security of the SKGD scheme is guaranteed by the high sensitivity of SOP dynamics associated with the specific fiber links. As a proof of concept, a 3.9 Gb/s SKGD is achieved over 11 km single-mode fiber, where a Sagnac interferometer-based polarization scrambler is constructed as the high-speed random source. Moreover, the generated key sequences are verified to be error free and truly random. The proposed SKGD scheme offers a flexible solution for security enhancement in PONs, and is also compatible with the current PON infrastructure.

Optics Letters•Jun 8, 2021•21 citations

Post-Quantum Cryptography Based Secure Mutual Authentication Mechanism for TDM-PONs

Cristian Bermudez Serna, Justus Roßmeier, Lena Wosinska +1 more

Passive Optical Networks (PONs) are widely used in fixed-access networks for delivering connectivity to domestic, commercial and industrial users. Authentication and encryption are required in PONs, because of their vulnerability to Optical Network Unit (ONU) impersonating or downstream data sniffing attacks. The research community has pointed out the vulnerabilities of the authentication mechanisms enforced in PON, and has proposed Shared Mutual Authentication (SMA) using Public-Key Cryptography (PKC) based on Diffie-Hellman. However, this last is vulnerable to attacks from quantum computers. This work proposes using Post-Quantum Cryptography (PQC) for SMA in Time-Division Multiplexing (TDM)-PONs. Kyber is selected for the proposed SMA mechanism. This algorithm is the finalist in the PQC standardization process of the National Institute of Standards and Technology (NIST). The feasibility of the proposed Kyber SMA mechanism is shown in a simulation, and it is compared against a baseline SMA from the 10-Gigabitcapable Passive Optical Network (XG-PON) and a state-of-the-art SMA based on Diffie-Hellman. The proposed Kyber SMA mechanism requires more random bytes, has a longer execution time than the baseline and its overhead is similar to the state-of-the-art mechanism with similar security features but based on classical cryptography. According to the presented evaluations, the proposed approach is feasible and offers an SMA resistant to threats from traditional and quantum computers.

IEEE Future Networks World Forum (FNWF)•Nov 13, 2023•0 citations

Secure Communication Mechanism for Smart Distribution Network Integrated With Subcarrier Multiplexed Quantum Key Distribution

MA Yonghon

Firstly, the risk of information security of the passive optical network(PON) based communication platform for smart distribution grid(SDG) is analyzed, and on this basis a technical thinking of integrating the high efficient subcarrier multiplexed quantum key distribution(SCM-QKD) with PON-SDG is proposed. Secondly, as for the three typical topological forms, namely the tree-form, hand-in-hand form and the chain form, the quantum bit-error-rate(QBER) for PON utilizing SCM-QKD technology and the parameters of quantum sifted-key-generation-rate are theoretically calculated. Calculation and analysis results show that under typical link length of PON and power-split-ratio parameters the SCM-QKD technology can meet the demand on information security of PON-SDG communication service. Finally, the method to share the quantum key distribution between the optical line terminal(OLT) in PON and the optical network unit(ONU) at the user side is given, and based on the key the concrete implementation of the two-way identity authentication and the generation process of the session key between OLT and ONU are given.

Power System Technology•Jan 1, 2013•5 citations
Identity-related security issues inherently present in passive optical networks (PON) still exist in the current (1G) and next-generation (10G) Ethernet-based passive optical network (EPON) systems. We propose a mutual authentication scheme that integrates an NTRUsign digital signature algorithm with inherent multipoint control protocol (MPCP) frames over an EPON system between the optical line terminal (OLT) and optical network unit (ONU). Here, a primitive NTRUsign algorithm is significantly modified through the use of a new perturbation so that it can be effectively used for simultaneously completing signature and authentication functions on the OLT and the ONU sides. Also, in order to transmit their individual sensitive messages, which include public key, signature, and random value and so forth, to each other, we redefine three unique frames according to MPCP format frame. These generated messages can be added into the frames and delivered to each other, allowing the OLT and the ONU to go ahead with a mutual identity authentication process to verify their legal identities. Our simulation results show that this proposed scheme performs very well in resisting security attacks and has low influence on the registration efficiency to to-be-registered ONUs. A performance comparison with traditional authentication algorithms is also presented. To the best of our knowledge, no detailed design of mutual authentication in EPON can be found in the literature up to now.
In the context of increasing demand for secure and efficient communication networks, addressing the issue of mutual authentication in ethernet passive optical networks (EPONs) has become both valuable and practically significant. This paper proposes a solution based on ideal lattices. The proposed scheme leverages the security of the ring learning with errors (RLWE) problem to establish a robust public-key cryptosystem. By involving ONUs, OLTs, and an SDN controller in the authentication process, it enables mutual authentication through a series of message exchanges facilitated by the SDN controller. Utilizing approximate smooth projection hash functions for secure key exchange and verification, the scheme ensures robust security performance against various attacks, including man-in-the-middle, impersonation, replay, and known key secrecy attacks. Simulation results demonstrate that the proposed solution introduces minimal delay and maintains a high registration success rate compared to traditional authentication methods. Additionally, this paper explores the convergence of quantum network protocols with EPONs, highlighting their potential to achieve unprecedented levels of communication security. Integrating quantum technology with EPON networks, due to the unique security properties of quantum, can also better prevent man-in-the-middle attacks. Secure interception detection techniques based on fundamental quantum properties provide a fundamental security direction for future communication systems, aligning with the growing interest in quantum-resistant cryptographic protocols.
An EPON which is going on standardization in IEEE 802.3ah, is tree topology consists of a OLT and multiple ONU using passive optical components, so this network is susceptible to variable security threats - eavesdropping, masquerading, denial of service and so on. In this paper, we design a security protocol supporting authentication and confidentiality services in MAC layer in order to prevent these security threats and to guarantee secure data exchange The designed security protocol introduce public-key based authentication and key management protocols for efficient key management, and choose Rijndael algorithm, which is recent standard of AES, to provide the confidentiality of EPON Proposed authentication and key management protocols perform authentication and public-key exchange at a time, and are secure protocols using derived common cipher key by exchanging public random number To implement the designed security protocol, we propose the procedures of authentication and public-key exchange, session key update, key recovery. This proposed protocol is verified using unknown session key, forward secrecy, unknown key-share, key-compromise impersonation
A point to multi-point physical-layer secure key generation and distribution (SKGD) scheme is proposed and demonstrated in passive optical networks (PONs), where the optical line terminal (OLT) broadcasts optical lights with fast fluctuating states of polarization (SOPs) to the optical network units (ONUs). The highly correlated key waveforms are shared between OLT and ONUs, and the high-level security of the SKGD scheme is guaranteed by the high sensitivity of SOP dynamics associated with the specific fiber links. As a proof of concept, a 3.9 Gb/s SKGD is achieved over 11 km single-mode fiber, where a Sagnac interferometer-based polarization scrambler is constructed as the high-speed random source. Moreover, the generated key sequences are verified to be error free and truly random. The proposed SKGD scheme offers a flexible solution for security enhancement in PONs, and is also compatible with the current PON infrastructure.
Passive Optical Networks (PONs) are widely used in fixed-access networks for delivering connectivity to domestic, commercial and industrial users. Authentication and encryption are required in PONs, because of their vulnerability to Optical Network Unit (ONU) impersonating or downstream data sniffing attacks. The research community has pointed out the vulnerabilities of the authentication mechanisms enforced in PON, and has proposed Shared Mutual Authentication (SMA) using Public-Key Cryptography (PKC) based on Diffie-Hellman. However, this last is vulnerable to attacks from quantum computers. This work proposes using Post-Quantum Cryptography (PQC) for SMA in Time-Division Multiplexing (TDM)-PONs. Kyber is selected for the proposed SMA mechanism. This algorithm is the finalist in the PQC standardization process of the National Institute of Standards and Technology (NIST). The feasibility of the proposed Kyber SMA mechanism is shown in a simulation, and it is compared against a baseline SMA from the 10-Gigabitcapable Passive Optical Network (XG-PON) and a state-of-the-art SMA based on Diffie-Hellman. The proposed Kyber SMA mechanism requires more random bytes, has a longer execution time than the baseline and its overhead is similar to the state-of-the-art mechanism with similar security features but based on classical cryptography. According to the presented evaluations, the proposed approach is feasible and offers an SMA resistant to threats from traditional and quantum computers.
Firstly, the risk of information security of the passive optical network(PON) based communication platform for smart distribution grid(SDG) is analyzed, and on this basis a technical thinking of integrating the high efficient subcarrier multiplexed quantum key distribution(SCM-QKD) with PON-SDG is proposed. Secondly, as for the three typical topological forms, namely the tree-form, hand-in-hand form and the chain form, the quantum bit-error-rate(QBER) for PON utilizing SCM-QKD technology and the parameters of quantum sifted-key-generation-rate are theoretically calculated. Calculation and analysis results show that under typical link length of PON and power-split-ratio parameters the SCM-QKD technology can meet the demand on information security of PON-SDG communication service. Finally, the method to share the quantum key distribution between the optical line terminal(OLT) in PON and the optical network unit(ONU) at the user side is given, and based on the key the concrete implementation of the two-way identity authentication and the generation process of the session key between OLT and ONU are given.