The present invention discloses a method for controlling multicast flow in passive optical network includes: receiving multicast data from the optical line terminal, determining whether the received multicast data satisfies a multicast right control condition, transmitting the multicast data to the user side if the received multicast data satisfies the multicast right control condition, or discarding the multicast data if the received multicast data does not satisfy the multicast right control condition. The present invention also discloses an optical network terminal, an optical line terminal, and a system consisting of an optical network terminal and an optical line terminal and an optical distribute network, which implement the above mentioned method. The present invention could prevent the optical network terminal from receiving illegal multicast data and enhance the multicast security of the whole passive optical network system.