diff --git a/internal/pkg/avcfg/omci_ani_config.go b/internal/pkg/avcfg/omci_ani_config.go
index 64d4c0b..ca5e605 100755
--- a/internal/pkg/avcfg/omci_ani_config.go
+++ b/internal/pkg/avcfg/omci_ani_config.go
@@ -93,6 +93,20 @@
 const (
 	bitTrafficSchedulerPtrSetPermitted = 0x0002 // Refer section 9.1.2 ONU-2G, table for "Quality of service (QoS) configuration flexibility" IE
 )
+const cTechProfileTypeXgsPon = "XGS-PON"
+
+// definitions as per G.988
+// Gem Encryption Key Ring
+const (
+	// No encryption. The downstream key index is ignored, and upstream traffic is transmitted with key index 0.
+	GemEncryptKeyRingNoEncrypt = 0
+	// Unicast payload encryption in both directions. Keys are generated by the ONU and transmitted	to the OLT via the PLOAM channel.
+	GemEncryptKeyRingUnicastPayload = 1
+	// Broadcast (multicast) encryption. Keys are generated by the OLT and distributed via the OMCI.
+	GemEncryptKeyRingBroadcastMulticast = 2
+	// Unicast encryption, downstream only. Keys are generated by the ONU and transmitted to the OLT via the PLOAM channel.
+	GemEncryptKeyRingUnicastDownstreamOnly = 3
+)
 
 // CAniFsmIdleState - TODO: add comment
 const CAniFsmIdleState = aniStConfigDone
@@ -121,6 +135,7 @@
 	pUniTechProf             *OnuUniTechProf
 	pOnuDB                   *devdb.OnuDeviceDB
 	techProfileID            uint8
+	techProfileType          string
 	uniTpKey                 uniTP
 	requestEvent             cmn.OnuDeviceEvent
 	mutexIsAwaitingResponse  sync.RWMutex
@@ -147,7 +162,7 @@
 
 //NewUniPonAniConfigFsm is the 'constructor' for the state machine to config the PON ANI ports of ONU UNI ports via OMCI
 func NewUniPonAniConfigFsm(ctx context.Context, apDevOmciCC *cmn.OmciCC, apUniPort *cmn.OnuUniPort, apUniTechProf *OnuUniTechProf,
-	apOnuDB *devdb.OnuDeviceDB, aTechProfileID uint8, aRequestEvent cmn.OnuDeviceEvent, aName string,
+	apOnuDB *devdb.OnuDeviceDB, aTechProfileID uint8, aTechProfileType string, aRequestEvent cmn.OnuDeviceEvent, aName string,
 	apDeviceHandler cmn.IdeviceHandler, apOnuDeviceEntry cmn.IonuDeviceEntry, aCommChannel chan cmn.Message) *UniPonAniConfigFsm {
 	instFsm := &UniPonAniConfigFsm{
 		pDeviceHandler:  apDeviceHandler,
@@ -158,6 +173,7 @@
 		pUniTechProf:    apUniTechProf,
 		pOnuDB:          apOnuDB,
 		techProfileID:   aTechProfileID,
+		techProfileType: aTechProfileType,
 		requestEvent:    aRequestEvent,
 		chanSet:         false,
 		tcontSetBefore:  false,
@@ -1464,6 +1480,9 @@
 				me.GemPortNetworkCtp_PriorityQueuePointerForDownStream:   gemPortAttribs.downQueueID,
 			},
 		}
+		if oFsm.techProfileType == cTechProfileTypeXgsPon {
+			meParams.Attributes[me.GemPortNetworkCtp_EncryptionKeyRing] = GemEncryptKeyRingUnicastDownstreamOnly
+		}
 		oFsm.mutexPLastTxMeInstance.Lock()
 		meInstance, err := oFsm.pOmciCC.SendCreateGemNCTPVar(log.WithSpanFromContext(context.TODO(), ctx), oFsm.pDeviceHandler.GetOmciTimeout(), true,
 			oFsm.PAdaptFsm.CommChan, meParams)