An ethernet-passive-optical-network consists of one optical-line-terminator and multiple optical-network-units oith passive optical components. The network is susceptible to variable security threats. In this paper we propose a security model and an encryption layer placed at reconciliation sublayer. We also propose advanced encryption standard as an ideal cipher algorithm to encrypt downstream data . We then discuss three different methods to solve the problem of the last plaintext group, and the methods are realized on digital signal processing. Finally, we study efficiency and delay issues of the three methods.