For improving the physical layer security of next generation passive optical network (NG-PON2), we propose a security detection scheme by detecting the terminal thermal distribution (TTD) at the optical fiber end face on the optical network unit (ONU), when the fiber link is tapped. The principle of the scheme is given that the thermal energy always exists in fiber links and the TTD at the optical fiber end face can be detected. When the link tapping occurs, the leaking light energy induced by bending converts into the thermal energy, which changes the TTD at the optical fiber end face on ONU of NG-PON2. The TTD models of core and cladding layers at the optical fiber end face owing to bending are built with the double cylindrical coordinate systems, based on the bending loss formula of optical fiber and thermodynamic coupling theory. Then, the simulations for the TTD models are carried out under the different conditions of input power, bending radius and distant of detected point from the center of optical fiber end face, respectively. The simulation results indicate three conditions above are the main factors affecting the TTD changes. Finally, we set up an experimental system in the lab, using a light-emitting diode at 1550nm, and a thermal microscope (Telops-FAST-IR). The experimental results show the TTD of core layer at the optical fiber (G.652D) end face changes 72.5% at the input power of 1dBm with the bending radius from 10mm to 5mm, and are consistent with the simulation ones.