diff --git a/agent/Makefile.in b/agent/Makefile.in
index ad1a0b9..2f86ada 100644
--- a/agent/Makefile.in
+++ b/agent/Makefile.in
@@ -42,7 +42,7 @@
 # This specifies the GIT tag in https://github.com/opencord/voltha-protos
 # repo that we need to refer to, to pick the right version of
 # openolt.proto and tech_profile.proto
-OPENOLT_PROTO_VER ?= v3.3.9
+OPENOLT_PROTO_VER ?= v3.4.3
 
 # Variables used for Inband build
 INBAND = "n"
diff --git a/agent/common/core.h b/agent/common/core.h
index d277904..d301a01 100644
--- a/agent/common/core.h
+++ b/agent/common/core.h
@@ -20,6 +20,7 @@
 #include <grpc++/grpc++.h>
 using grpc::Status;
 #include <voltha_protos/openolt.grpc.pb.h>
+#include <voltha_protos/ext_config.grpc.pb.h>
 
 #include "state.h"
 
@@ -200,7 +201,7 @@
 //***************************************//
 Status Enable_(int argc, char *argv[]);
 Status ActivateOnu_(uint32_t intf_id, uint32_t onu_id,
-    const char *vendor_id, const char *vendor_specific, uint32_t pir);
+    const char *vendor_id, const char *vendor_specific, uint32_t pir, bool omcc_encryption_mode);
 Status DeactivateOnu_(uint32_t intf_id, uint32_t onu_id,
     const char *vendor_id, const char *vendor_specific);
 Status DeleteOnu_(uint32_t intf_id, uint32_t onu_id,
@@ -231,7 +232,7 @@
 Status RemoveTrafficQueues_(const tech_profile::TrafficQueues *traffic_queues);
 Status PerformGroupOperation_(const openolt::Group *group_cfg);
 Status DeleteGroup_(uint32_t group_id);
-Status OnuItuPonAlarmSet_(const openolt::OnuItuPonAlarm* request);
+Status OnuItuPonAlarmSet_(const config::OnuItuPonAlarm* request);
 uint32_t GetPortNum_(uint32_t flow_id);
 Status GetLogicalOnuDistanceZero_(uint32_t intf_id, openolt::OnuLogicalDistance* response);
 Status GetLogicalOnuDistance_(uint32_t intf_id, uint32_t onu_id, openolt::OnuLogicalDistance* response);
diff --git a/agent/common/server.cc b/agent/common/server.cc
index 5a30f37..72fc2f7 100644
--- a/agent/common/server.cc
+++ b/agent/common/server.cc
@@ -67,7 +67,7 @@
             request->intf_id(),
             request->onu_id(),
             ((request->serial_number()).vendor_id()).c_str(),
-            ((request->serial_number()).vendor_specific()).c_str(), request->pir());
+            ((request->serial_number()).vendor_specific()).c_str(), request->pir(), request->omcc_encryption());
     }
 
     Status DeactivateOnu(
@@ -318,7 +318,7 @@
 
     Status OnuItuPonAlarmSet(
             ServerContext* context,
-            const openolt::OnuItuPonAlarm* request,
+            const config::OnuItuPonAlarm* request,
             openolt::Empty* response) override {
         return OnuItuPonAlarmSet_(request);
     };
diff --git a/agent/sim/core.cc b/agent/sim/core.cc
index 8537eeb..c024e4f 100644
--- a/agent/sim/core.cc
+++ b/agent/sim/core.cc
@@ -81,7 +81,7 @@
 }
 
 Status ActivateOnu_(uint32_t intf_id, uint32_t onu_id,
-    const char *vendor_id, const char *vendor_specific, uint32_t pir) {
+    const char *vendor_id, const char *vendor_specific, uint32_t pir, bool omcc_encryption_mode) {
     return Status::OK;
 }
 
diff --git a/agent/sim/core.h b/agent/sim/core.h
index ed0fb4d..32d671d 100644
--- a/agent/sim/core.h
+++ b/agent/sim/core.h
@@ -26,7 +26,7 @@
 
 Status Enable_(int argc, char *argv[]);
 Status ActivateOnu_(uint32_t intf_id, uint32_t onu_id,
-    const char *vendor_id, const char *vendor_specific, uint32_t pir);
+    const char *vendor_id, const char *vendor_specific, uint32_t pir, bool omcc_encryption_mode);
 Status DeactivateOnu_(uint32_t intf_id, uint32_t onu_id,
     const char *vendor_id, const char *vendor_specific);
 Status DeleteOnu_(uint32_t intf_id, uint32_t onu_id,
diff --git a/agent/src/core_api_handler.cc b/agent/src/core_api_handler.cc
index 147582c..aa45b0f 100644
--- a/agent/src/core_api_handler.cc
+++ b/agent/src/core_api_handler.cc
@@ -90,13 +90,13 @@
     return s_actions_ptr;
 }
 
-bcmolt_stat_alarm_config set_stat_alarm_config(const openolt::OnuItuPonAlarm* request) {
+bcmolt_stat_alarm_config set_stat_alarm_config(const config::OnuItuPonAlarm* request) {
     bcmolt_stat_alarm_config alarm_cfg = {};
     bcmolt_stat_alarm_trigger_config trigger_obj = {};
     bcmolt_stat_alarm_soak_config soak_obj = {};
 
     switch (request->alarm_reporting_condition()) {
-        case openolt::OnuItuPonAlarm::RATE_THRESHOLD:
+        case config::OnuItuPonAlarm::RATE_THRESHOLD:
             trigger_obj.type = BCMOLT_STAT_CONDITION_TYPE_RATE_THRESHOLD;
             BCMOLT_FIELD_SET(&trigger_obj.u.rate_threshold, stat_alarm_trigger_config_rate_threshold,
                     rising, request->rate_threshold_config().rate_threshold_rising());
@@ -107,7 +107,7 @@
             BCMOLT_FIELD_SET(&soak_obj, stat_alarm_soak_config, clear_soak_time,
                     request->rate_threshold_config().soak_time().clear_soak_time());
             break;
-        case openolt::OnuItuPonAlarm::RATE_RANGE:
+        case config::OnuItuPonAlarm::RATE_RANGE:
             trigger_obj.type = BCMOLT_STAT_CONDITION_TYPE_RATE_RANGE;
             BCMOLT_FIELD_SET(&trigger_obj.u.rate_range, stat_alarm_trigger_config_rate_range, upper,
                     request->rate_range_config().rate_range_upper());
@@ -118,7 +118,7 @@
             BCMOLT_FIELD_SET(&soak_obj, stat_alarm_soak_config, clear_soak_time,
                     request->rate_range_config().soak_time().clear_soak_time());
             break;
-        case openolt::OnuItuPonAlarm::VALUE_THRESHOLD:
+        case config::OnuItuPonAlarm::VALUE_THRESHOLD:
             trigger_obj.type = BCMOLT_STAT_CONDITION_TYPE_VALUE_THRESHOLD;
             BCMOLT_FIELD_SET(&trigger_obj.u.value_threshold, stat_alarm_trigger_config_value_threshold,
                     limit, request->value_threshold_config().threshold_limit());
@@ -139,7 +139,7 @@
     return alarm_cfg;
 }
 
-Status OnuItuPonAlarmSet_(const openolt::OnuItuPonAlarm* request) {
+Status OnuItuPonAlarmSet_(const config::OnuItuPonAlarm* request) {
     bcmos_errno err;
     bcmolt_onu_itu_pon_stats_cfg stat_cfg; /* declare main API struct */
     bcmolt_onu_key key = {}; /* declare key */
@@ -179,7 +179,7 @@
     errors_cfg = set_stat_alarm_config(request);
 
     switch (request->alarm_id()) {
-        case openolt::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS:
+        case config::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS:
             //set the rdi_errors alarm
             BCMOLT_FIELD_SET(&stat_cfg.data, onu_itu_pon_stats_cfg_data, rdi_errors, errors_cfg);
             break;
@@ -911,6 +911,11 @@
         BCMOLT_MSG_FIELD_SET(&interface_obj, itu.gpon.power_level.mode, BCMOLT_PON_POWER_LEVEL_MODE_DEFAULT);
     }
 
+    //Enable AES Encryption
+    BCMOLT_MSG_FIELD_SET(&interface_obj, itu.onu_activation.key_exchange, BCMOLT_CONTROL_STATE_ENABLE);
+    BCMOLT_MSG_FIELD_SET(&interface_obj, itu.onu_activation.authentication, BCMOLT_CONTROL_STATE_ENABLE);
+    BCMOLT_MSG_FIELD_SET(&interface_obj, itu.onu_activation.fail_due_to_authentication_failure, BCMOLT_CONTROL_STATE_ENABLE);
+
     BCMOLT_FIELD_SET(&pon_interface_set_state.data, pon_interface_set_pon_interface_state_data,
         operation, BCMOLT_INTERFACE_OPERATION_ACTIVE_WORKING);
 
@@ -1108,7 +1113,7 @@
 }
 
 Status ActivateOnu_(uint32_t intf_id, uint32_t onu_id,
-    const char *vendor_id, const char *vendor_specific, uint32_t pir) {
+    const char *vendor_id, const char *vendor_specific, uint32_t pir, bool omcc_encryption_mode) {
     bcmos_errno err = BCM_ERR_OK;
     bcmolt_onu_cfg onu_cfg;
     bcmolt_onu_key onu_key;
@@ -1177,7 +1182,24 @@
             return bcm_to_grpc_err(err, "Failed to configure ONU");
         }
     }
-
+    
+    if (omcc_encryption_mode == true) {
+        // set the encryption mode for omci port id
+        bcmolt_itupon_gem_cfg gem_cfg;
+        bcmolt_itupon_gem_key key = {};
+        bcmolt_gem_port_configuration configuration = {};
+        key.pon_ni = intf_id;
+        key.gem_port_id = onu_id;
+        bcmolt_control_state encryption_mode;
+        encryption_mode = BCMOLT_CONTROL_STATE_ENABLE;
+        BCMOLT_CFG_INIT(&gem_cfg, itupon_gem, key);
+        BCMOLT_FIELD_SET(&gem_cfg.data, itupon_gem_cfg_data, encryption_mode, encryption_mode);
+        err = bcmolt_cfg_set(dev_id, &gem_cfg.hdr);
+        if(err != BCM_ERR_OK) {
+                OPENOLT_LOG(ERROR, openolt_log_id, "failed to confiure omci gem_port encryption mode = %d\n", onu_id);
+                return bcm_to_grpc_err(err, "Access_Control set ITU PON OMCI Gem port failed");
+        }
+    }
     // Now that the ONU is configured, move the ONU to ACTIVE state
     memset(&onu_cfg, 0, sizeof(bcmolt_onu_cfg));
     BCMOLT_CFG_INIT(&onu_cfg, onu, onu_key);
diff --git a/agent/test/Makefile b/agent/test/Makefile
index 4f86165..9a8683a 100644
--- a/agent/test/Makefile
+++ b/agent/test/Makefile
@@ -21,7 +21,7 @@
 TOP_DIR=`pwd`
 OPENOLTDEVICE ?= asfvolt16
 
-OPENOLT_PROTO_VER ?= v3.3.9
+OPENOLT_PROTO_VER ?= v3.4.3
 
 GTEST_VER ?= release-1.8.0
 gtest-target = /usr/local/lib/libgtest.a
diff --git a/agent/test/src/test_core.cc b/agent/test/src/test_core.cc
index a6643d6..7efb8c9 100644
--- a/agent/test/src/test_core.cc
+++ b/agent/test/src/test_core.cc
@@ -855,7 +855,7 @@
     ON_CALL(balMock, bcmolt_cfg_set(_, _)).WillByDefault(Return(onu_cfg_set_res));
     ON_CALL(balMock, bcmolt_oper_submit(_, _)).WillByDefault(Return(onu_oper_submit_res));
 
-    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir);
+    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir, true);
     ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
 }
 
@@ -873,7 +873,7 @@
 
     ON_CALL(balMock, bcmolt_cfg_get(_, _)).WillByDefault(Return(onu_cfg_get_res));
 
-    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir);
+    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir, true);
     ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
 }
 
@@ -894,7 +894,7 @@
     ON_CALL(balMock, bcmolt_oper_submit(_, _)).WillByDefault(Return(onu_oper_submit_res));
 
 
-    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir);
+    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir, true);
     ASSERT_TRUE( status.error_message() == Status::OK.error_message() );
 }
 
@@ -912,7 +912,7 @@
 
     ON_CALL(balMock, bcmolt_cfg_get(_, _)).WillByDefault(Return(onu_cfg_get_res));
 
-    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir);
+    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir, true);
     ASSERT_FALSE( status.error_message() == Status::OK.error_message() );
 }
 
@@ -927,7 +927,7 @@
     EXPECT_GLOBAL_CALL(bcmolt_cfg_get__onu_state_stub, bcmolt_cfg_get__onu_state_stub(_, _))
                      .WillOnce(DoAll(SetArg1ToBcmOltOnuCfg(onu_cfg), Return(onu_cfg_get_stub_res)));
 
-    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir);
+    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir, true);
     ASSERT_FALSE( status.error_message() == Status::OK.error_message() );
 }
 
@@ -949,7 +949,7 @@
     ON_CALL(balMock, bcmolt_cfg_set(_, _)).WillByDefault(Return(onu_cfg_set_res));
     ON_CALL(balMock, bcmolt_oper_submit(_, _)).WillByDefault(Return(onu_oper_submit_res));
 
-    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir);
+    Status status = ActivateOnu_(pon_id, onu_id, vendor_id.c_str(), vendor_specific.c_str(), pir, true);
     ASSERT_FALSE( status.error_message() == Status::OK.error_message() );
 }
 
@@ -2642,28 +2642,28 @@
         bcmolt_pon_ni pon_ni = 0;
         bcmolt_onu_id onu_id = 1;
 
-        openolt::OnuItuPonAlarm *onu_itu_pon_alarm_rt;
-        openolt::OnuItuPonAlarm::RateThresholdConfig *rate_threshold_config;
-        openolt::OnuItuPonAlarm::SoakTime *soak_time_rt;
+        config::OnuItuPonAlarm *onu_itu_pon_alarm_rt;
+        config::OnuItuPonAlarm::RateThresholdConfig *rate_threshold_config;
+        config::OnuItuPonAlarm::SoakTime *soak_time_rt;
 
-        openolt::OnuItuPonAlarm *onu_itu_pon_alarm_rr;
-        openolt::OnuItuPonAlarm::RateRangeConfig *rate_range_config;
-        openolt::OnuItuPonAlarm::SoakTime *soak_time_rr;
+        config::OnuItuPonAlarm *onu_itu_pon_alarm_rr;
+        config::OnuItuPonAlarm::RateRangeConfig *rate_range_config;
+        config::OnuItuPonAlarm::SoakTime *soak_time_rr;
 
-        openolt::OnuItuPonAlarm *onu_itu_pon_alarm_tc;
-        openolt::OnuItuPonAlarm::ValueThresholdConfig *value_threshold_config;
-        openolt::OnuItuPonAlarm::SoakTime *soak_time_tc;
+        config::OnuItuPonAlarm *onu_itu_pon_alarm_tc;
+        config::OnuItuPonAlarm::ValueThresholdConfig *value_threshold_config;
+        config::OnuItuPonAlarm::SoakTime *soak_time_tc;
 
         NiceMock<BalMocker> balMock;
 
         virtual void SetUp() {
-            onu_itu_pon_alarm_rt = new openolt::OnuItuPonAlarm;
-            rate_threshold_config = new openolt::OnuItuPonAlarm::RateThresholdConfig;
-            soak_time_rt = new openolt::OnuItuPonAlarm::SoakTime;
+            onu_itu_pon_alarm_rt = new config::OnuItuPonAlarm;
+            rate_threshold_config = new config::OnuItuPonAlarm::RateThresholdConfig;
+            soak_time_rt = new config::OnuItuPonAlarm::SoakTime;
             onu_itu_pon_alarm_rt->set_pon_ni(0);
             onu_itu_pon_alarm_rt->set_onu_id(1);
-            onu_itu_pon_alarm_rt->set_alarm_id(openolt::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS);
-            onu_itu_pon_alarm_rt->set_alarm_reporting_condition(openolt::OnuItuPonAlarm_AlarmReportingCondition::OnuItuPonAlarm_AlarmReportingCondition_RATE_THRESHOLD);
+            onu_itu_pon_alarm_rt->set_alarm_id(config::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS);
+            onu_itu_pon_alarm_rt->set_alarm_reporting_condition(config::OnuItuPonAlarm_AlarmReportingCondition::OnuItuPonAlarm_AlarmReportingCondition_RATE_THRESHOLD);
             rate_threshold_config->set_rate_threshold_rising(1);
             rate_threshold_config->set_rate_threshold_falling(4);
             soak_time_rt->set_active_soak_time(2);
@@ -2671,13 +2671,13 @@
             rate_threshold_config->set_allocated_soak_time(soak_time_rt);
             onu_itu_pon_alarm_rt->set_allocated_rate_threshold_config(rate_threshold_config);
 
-            onu_itu_pon_alarm_rr = new openolt::OnuItuPonAlarm;
-            rate_range_config = new openolt::OnuItuPonAlarm::RateRangeConfig;
-            soak_time_rr = new openolt::OnuItuPonAlarm::SoakTime;
+            onu_itu_pon_alarm_rr = new config::OnuItuPonAlarm;
+            rate_range_config = new config::OnuItuPonAlarm::RateRangeConfig;
+            soak_time_rr = new config::OnuItuPonAlarm::SoakTime;
             onu_itu_pon_alarm_rr->set_pon_ni(0);
             onu_itu_pon_alarm_rr->set_onu_id(1);
-            onu_itu_pon_alarm_rr->set_alarm_id(openolt::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS);
-            onu_itu_pon_alarm_rr->set_alarm_reporting_condition(openolt::OnuItuPonAlarm_AlarmReportingCondition::OnuItuPonAlarm_AlarmReportingCondition_RATE_RANGE);
+            onu_itu_pon_alarm_rr->set_alarm_id(config::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS);
+            onu_itu_pon_alarm_rr->set_alarm_reporting_condition(config::OnuItuPonAlarm_AlarmReportingCondition::OnuItuPonAlarm_AlarmReportingCondition_RATE_RANGE);
             rate_range_config->set_rate_range_lower(1);
             rate_range_config->set_rate_range_upper(4);
             soak_time_rr->set_active_soak_time(2);
@@ -2685,13 +2685,13 @@
             rate_range_config->set_allocated_soak_time(soak_time_rr);
             onu_itu_pon_alarm_rr->set_allocated_rate_range_config(rate_range_config);
 
-            onu_itu_pon_alarm_tc = new openolt::OnuItuPonAlarm;
-            value_threshold_config = new openolt::OnuItuPonAlarm::ValueThresholdConfig;
-            soak_time_tc = new openolt::OnuItuPonAlarm::SoakTime;
+            onu_itu_pon_alarm_tc = new config::OnuItuPonAlarm;
+            value_threshold_config = new config::OnuItuPonAlarm::ValueThresholdConfig;
+            soak_time_tc = new config::OnuItuPonAlarm::SoakTime;
             onu_itu_pon_alarm_tc->set_pon_ni(0);
             onu_itu_pon_alarm_tc->set_onu_id(1);
-            onu_itu_pon_alarm_tc->set_alarm_id(openolt::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS);
-            onu_itu_pon_alarm_tc->set_alarm_reporting_condition(openolt::OnuItuPonAlarm_AlarmReportingCondition::OnuItuPonAlarm_AlarmReportingCondition_VALUE_THRESHOLD);
+            onu_itu_pon_alarm_tc->set_alarm_id(config::OnuItuPonAlarm_AlarmID::OnuItuPonAlarm_AlarmID_RDI_ERRORS);
+            onu_itu_pon_alarm_tc->set_alarm_reporting_condition(config::OnuItuPonAlarm_AlarmReportingCondition::OnuItuPonAlarm_AlarmReportingCondition_VALUE_THRESHOLD);
             value_threshold_config->set_threshold_limit(6);
             soak_time_tc->set_active_soak_time(2);
             soak_time_tc->set_clear_soak_time(2);