Abstract: An Ethernet-Passive-Optical-Network consists of one Optical-Line-terminator and multiple Optical-Network-Units with passive optical components. The network is susceptible to variable security threats. In this paper we propose a security model and an encryption layer placed at Reconciliation Sublayer. We also propose Advanced Encryption Standard as an ideal cipher algorithm to encrypt downstream data. We then discuss three different methods to solve the problem of the last plaintext group, and the methods are realized on DSP. Finally, we study efficiency and delay issues of the three methods

Key words: EPON; security; encryption; AES; Pad