Abstract:
A system ( 125 ) performs network management in a quantum cryptographic network ( 115 ). The system ( 125 ) monitors parameters associated with multiple links and multiple nodes of the quantum cryptographic network ( 115 ). The system ( 125 ) manages the multiple links and multiple nodes of the quantum cryptographic network ( 115 ) based on the monitored parameters.

Description:
GOVERNMENT CONTRACT 
     The U.S. Government has a paid-up license in this invention and the right in limited circumstances to require the patent owner to license others on reasonable terms as provided for by the terms of Contract No. F30602-01-C-0170, awarded by the Defense Advanced Research Project Agency (DARPA). 
    
    
     INCORPORATION BY REFERENCE 
     The present application relates to co-pending application Ser. No. 09/943,709, entitled “Systems and Methods for Path Set-Up in a Quantum Key Distribution Network,” filed on Aug. 31, 2001; and co-pending application Ser. No. 09/944,328, entitled “Quantum Cryptographic Key Distribution Networks with Untrusted Switches,” filed on Aug. 31, 2001. The disclosures of the co-pending applications are incorporated by reference herein in their entirety. 
     FIELD OF THE INVENTION 
     The present invention relates generally to cryptographic systems and, more particularly, to systems and methods for managing quantum cryptographic networks. 
     BACKGROUND OF THE INVENTION 
     Conventional packet-switching networks permit cheap and reliable communications independent of the distance between a source node and a destination node in the network. These conventional networks often rely upon either public keys or shared private keys to provide privacy for messages that pass through the network&#39;s links. Public key cryptographic systems have the drawback that they have never been proven to be difficult to decipher. Therefore, it is possible that a method of efficiently cracking public key systems may one day be discovered. Such a discovery could make all public key technology obsolete. All supposedly “secure” networks based on public key technology would thus become vulnerable. Shared private keys also have the drawback that the logistics of distributing the private keys can be prohibitive. 
     Quantum cryptography represents a recent technological development that provides for the assured privacy of a communications link. Quantum cryptography is founded upon the laws of quantum physics and permits the detection of eavesdropping across a link. Quantum cryptographic techniques have been conventionally applied to distribute keys from a single photon source to a single photon detector, either through fiber optic strands or through the air. Although this approach is perfectly feasible for scientific experiments, it does not provide the kind of “anyone to anyone” connectivity that is provided by current communications technology. Conventional quantum cryptographic techniques require a direct connection to anyone with whom one wishes to exchange keying material. Obviously, a large system built along these lines would be impractical, since it would require every person to have enough sources and/or detectors, and fiber strands so that they could employ a dedicated set of equipment for each party with whom they intend to communicate. 
     Furthermore, conventional quantum cryptographic techniques fail to adequately handle the situations in which eavesdropping is present on a link or when a dedicated link fails (e.g., a fiber is accidentally cut). In conventional quantum cryptographic techniques, further key distribution across the dedicated link becomes impossible until eavesdropping on the link ceases or the link is repaired. 
     It would, thus, be desirable to implement a quantum cryptographic network that could provide the “any to any” connectivity of conventional packet-switching networks, such as the Internet, while eliminating the need for a direct connection between parties distributing quantum key material, and which may further sustain key distribution even with link failure and/or when eavesdropping exists on the link. Conventional packet-switching networks have employed numerous different types of network management protocols and systems for configuring and managing the nodes of the networks. In a quantum cryptographic network that provides “any to any” connectivity, network management protocols and systems may be employed to assist in building and maintaining a multi-node, multi-link quantum cryptographic network. A quantum cryptographic network with network management functionality may be more easily configured, monitored and actively managed. 
     Therefore, there exists a need for systems and methods that can provide network management functionality for configuring, monitoring and managing links and nodes of quantum cryptographic networks. 
     SUMMARY OF THE INVENTION 
     Systems and methods consistent with the present invention address this and other needs by interconnecting one or more network management terminals with the nodes of a quantum cryptographic network for configuring and managing the operational parameters associated with the nodes and links of the network. The one or more network management terminals may configure and initialize the nodes and links of the quantum cryptographic network. The network management terminal(s) may further monitor parameters associated with quantum key distribution (QKD) at each node of the quantum cryptographic network. The network management terminal(s) may also actively control the nodes and links of the quantum cryptographic network based on the monitored parameters. The network management terminal(s) may further provide graphical and/or textual displays of monitored parameters such that network management entities may be apprised of a current state of nodes and links in the network. 
     In accordance with the purpose of the invention as embodied and broadly described herein, a method of performing network management in a quantum cryptographic network includes monitoring parameters associated with at least one of multiple links and multiple nodes of the quantum cryptographic network. The method further includes managing the multiple links and multiple nodes of the quantum cryptographic network based on the monitored parameters. 
     In a further implementation consistent with the present invention, a method of controlling at least one quantum cryptographic parameter associated with at least one node of multiple nodes of a quantum cryptographic network includes sending a message to the at least one node of the multiple nodes via a communications network. The method further includes selectively controlling the at least one quantum cryptographic parameter via the message. 
     In an additional implementation consistent with the present invention, a method of notifying a quantum cryptographic network management device of an occurrence of one or more events at least one node of a quantum cryptographic network includes determining the occurrence of the one or more events at the at least one node. The method further includes notifying the quantum cryptographic network management device of the one or more events. 
     In yet another implementation consistent with the present invention, a method of displaying quantum cryptographic parameters associated with multiple nodes in a quantum cryptographic network includes monitoring quantum cryptographic parameters associated with the multiple nodes. The method further includes displaying the monitored quantum cryptographic parameters in at least one of textual and graphical form at a remote location. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate exemplary embodiments of the invention and, together with the description, explain the invention. In the drawings, 
         FIG. 1  illustrates an exemplary network in which systems and methods, consistent with the present invention, may be implemented; 
         FIG. 2  illustrates exemplary components of the QKD network of  FIG. 1  consistent with the present invention; 
         FIG. 3  illustrates exemplary components of a network management terminal consistent with the present invention; 
         FIG. 4  illustrates an exemplary management information database associated with the network management terminal of  FIG. 3  consistent with the present invention; 
         FIG. 5A  illustrates an exemplary configuration of a QKD endpoint consistent with the present invention; 
         FIG. 5B  illustrates exemplary components of the quantum cryptographic transceiver of  FIG. 5A  consistent with the present invention; 
         FIG. 6  illustrates an exemplary functional block diagram of a QKD endpoint consistent with the present invention; 
         FIG. 7  illustrates an exemplary configuration of an untrusted QKD switch consistent with the present invention; 
         FIG. 8  illustrates an exemplary quantum key distribution process consistent with the present invention; 
         FIG. 9  is a flow chart that illustrates an exemplary QKD configuration and initialization process consistent with the present invention; 
         FIGS. 10-11  are flow charts that illustrate an exemplary process for notifying a network management terminal of unplanned events occurring at QKD endpoints consistent with the present invention; 
         FIG. 12  is a flow chart that illustrates an exemplary process for monitoring QKD endpoints from a network management terminal consistent with the present invention; 
         FIG. 13  illustrates an exemplary graphic interface associated with a network management terminal consistent with the present invention; and 
         FIG. 14  is a flow chart that illustrates an exemplary QKD endpoint control process consistent with the present invention. 
     
    
    
     DETAILED DESCRIPTION 
     The following detailed description of the invention refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims. 
     Systems and methods consistent with the present invention provide mechanisms for configuring, monitoring and actively managing nodes and links of a quantum cryptographic network. Consistent with the present invention, one or more network management terminals may be interconnected with the nodes of a quantum cryptographic network for configuring and managing operational parameters associated with the nodes and links of the network. The network management terminals may, thus, assist in managing the nodes and links of the quantum cryptographic network to ensure that the desired “any to any” connectivity is maintained. 
     Exemplary Network 
       FIG. 1  illustrates an exemplary network  100  in which systems and methods for distributing encryption keys via quantum cryptographic mechanisms, consistent with the present invention, may be implemented. Network  100  may include QKD endpoints  105   a  and  105   b  connected via sub-network  110  and QKD sub-network  115 . Two QKD endpoints  105   a  and  105   b  are shown by way of example only and network  100  may include multiple QKD endpoints  105  connected via sub-network  110  and QKD sub-network  115 . 
     QKD endpoints  105   a  and  105   b  may each include a host or a server. QKD endpoints  105   a  and  105   b  that include servers may further connect to private enclaves  120 . Each private enclave  120  may include local area networks (LANs) (not shown) interconnected with one or more hosts (not shown). Sub-network  110  can include one or more circuit-switched or packet-switched networks of any type, including a Public Land Mobile Network (PLMN), Public Switched Telephone Network (PSTN), LAN, metropolitan area network (MAN), wide area network (WAN), Internet, or Intranet. The one or more PLMNs may further include packet-switched sub-networks, such as, for example, General Packet Radio Service (GPRS), Cellular Digital Packet Data (CDPD), and Mobile IP sub-networks. 
     QKD sub-network  115  may include one or more QKD switches (not shown) for distributing encryption keys between a source QKD endpoint (e.g., QKD endpoint  105   a ) and a destination QKD endpoint (e.g., QKD endpoint  105   b ). The QKD switches of QKD sub-network  115  may include trusted or untrusted switches. Trusted QKD switches include QKD switches that consist of a known level of security. Untrusted QKD switches include QKD switches that are either unsecure, or are of an unverifiable level of security. 
     Subsequent to quantum key distribution via QKD network  115 , QKD endpoint  105   a  and QKD endpoint  105   b  may encrypt traffic using the distributed key(s) and transmit the traffic via sub-network  110 . Network  100  may further include one or more network management terminals (NMTs)  125 . NMT(s)  125  may interconnect with one or more private enclaves  120  and/or sub-network  110 . NMT(s)  125  may configure, initialize, and actively control the QKD switches (not shown) and QKD endpoints  105  of network  100 . 
     Exemplary QKD Network 
       FIG. 2  illustrates an exemplary diagram, consistent with the present invention, that depicts QKD switches  205  of QKD sub-network  115 . QKD sub-network  115  may include one or more QKD switches  205   a - 205   f  interconnected via one or more links that may carry light throughout the electromagnetic spectrum, including light in the human-visible spectrum and light beyond the human-visible spectrum, such as, for example, infrared or ultraviolet light. The interconnecting links may include, for example, conventional optical fibers. Alternatively, the interconnecting links may include free-space optical paths, such as, for example, through the atmosphere or outer space, or even through water or other transparent media. As another alternative, the interconnecting links may include hollow optical fibers that may be lined with photonic band-gap material. As shown in  FIG. 2 , QKD endpoints  105   a  and  105   b  may each connect with one or more QKD switches of QKD sub-network  115 . Each QKD switch  205  may connect with sub-network  110  such that NMT(s)  125  can individually control each of QKD switches  205 . 
     Exemplary Network Management Terminal 
       FIG. 3  illustrates exemplary components of an NMT  125 . NMT  125  may include a processing unit  305 , a memory  310 , an input device  315 , an output device  320 , a network interface(s)  325  and a bus  330 . Processing unit  305  may perform all data processing functions for inputting, outputting, and processing of NMT data. Memory  310  may include Random Access Memory (RAM) that provides temporary working storage of data and instructions for use by processing unit  305  in performing processing functions. Memory  310  may additionally include Read Only Memory (ROM) that provides permanent or semi-permanent storage of data and instructions for use by processing unit  305 . Memory  310  can also include large-capacity storage devices, such as a magnetic and/or optical recording medium and its corresponding drive. 
     Input device  315  permits entry of data into NMT  125  and may include a user interface (not shown). Output device  320  permits the output of data in video, audio, or hard copy format. Network interface(s)  325  may interconnect NMT  125  with sub-network  110  or a private enclave  120 . Bus  330  interconnects the various components of NMT  125  to permit the components to communicate with one another. 
     Exemplary Management Information Database 
       FIG. 4  illustrates an exemplary management information database (MID)  400  that may be associated with an NMT  125  consistent with the present invention. MID  400  may be stored in memory  310  of NMT  125 , or may be located externally to NMT  125 . MID  400  may include multiple records, each record associated with different QKD endpoints  105  of network  100 . Each record of MID  400  may include an identifier associated with a QKD switch  205 , or a network address associated with a QKD endpoint  105 . Each record may further include numerous parameters associated with a respective QKD switch  205  or QKD endpoint  105 . Such parameters may include, but are not limited to, the speed at which lasers and detectors of respective QKD endpoints  105  are operating, a quantum cryptographic protocol used across any given link of network  100 , one or more wavelengths currently being used at a respective QKD endpoint  105 , a number of QKD bits in frames transmitted from a respective QKD endpoint  105 , a network address associated with a respective QKD endpoint  105 , and device failure indications associated with a respective QKD endpoint  105  or QKD switch  205 . Such parameters may further include out of range conditions associated with the operation of a respective QKD endpoint  105 , high or low Quantum bit error rates (QBER) associated with a respective QKD endpoint  105 , high or low photon detection rates associated with a respective QKD endpoint  105 , a number of QKD bits available in a respective QKD endpoint  105 , and how many QKD bits/second are currently being produced in a respective QKD endpoint  105 . The parameters may also include how many QKD bits/second are currently being consumed in a respective QKD endpoint  105 , how many different security associations (SAs) are currently active in a respective QKD endpoint  105 , and one or more temperatures associated with devices in a respective QKD endpoint  105 . 
     Exemplary QKD Endpoint 
       FIG. 5A  illustrates exemplary components of a QKD endpoint  105  consistent with the present invention. QKD endpoint  105  may include a processing unit  505 , a memory  510 , an input device  515 , an output device  520 , a quantum cryptographic transceiver  525 , a network interface(s)  530  and a bus  535 . Processing unit  505  may perform all data processing functions for inputting, outputting, and processing of QKD endpoint data. Memory  510  may include RAM that provides temporary working storage of data and instructions for use by processing unit  505  in performing processing functions. Memory  510  may additionally include ROM that provides permanent or semi-permanent storage of data and instructions for use by processing unit  505 . Memory  510  can also include large-capacity storage devices, such as a magnetic and/or optical recording medium and its corresponding drive. 
     Input device  515  permits entry of data into QKD endpoint  105  and may include a user interface (not shown). Output device  520  permits the output of data in video, audio, or hard copy format. Quantum cryptographic transceiver  525  may include conventional mechanisms for transmitting and receiving encryption keys using quantum cryptographic techniques. 
       FIG. 5B  illustrates exemplary components of quantum cryptographic transceiver  525 . Quantum cryptographic transceiver  525  may include a photon source  540 , a phase/polarization modulator  545 , a photon detector  550 , and a photon evaluator  555 . Photon source  540  can include, for example, a conventional laser. Photon source  540  may produce photons according to instructions provided by processing unit  505 . Photon source  540  may produce photons of light with wavelengths throughout the electromagnetic spectrum, including light in the human-visible spectrum and light beyond the human-visible spectrum, such as, for example, infrared or ultraviolet light. 
     Phase/polarization modulator  545  can include, for example, conventional Mach-Zehnder interferometers. Phase/polarization modulator  545  encodes outgoing photons from the photon source according to commands received from processing unit  505  for transmission across an optical link. Photon detector  550  can include, for example, conventional avalanche photo detectors (APDs) or conventional photo-multiplier tubes (PMTs). Photon detector  550  can detect photons received across the optical link. Photon evaluator  555  can include conventional circuitry for processing and evaluating output signals from photon detector  550  in accordance with conventional quantum cryptographic techniques. 
     Returning to  FIG. 5A , network interface(s)  530  may interconnect QKD endpoint  105  with sub-network  110  or private enclave  120 . Bus  535  interconnects the various components of QKD endpoint  105  to permit the components to communicate with one another. 
     Exemplary QKD Endpoint Functional Block Diagram 
       FIG. 6  illustrates a diagram of an exemplary functional block diagram  600  of a QKD endpoint  105  consistent with the present invention. Functional block diagram  600  may include a QKD protocol unit  605 , Internet Key Exchange protocol (IKE)  610 , optical process control  615 , network management client  620 , security policy database (SPD)  625 , and security association database (SAD)  630 . QKD protocol unit  605  may further be comprised of an interface layer  640 , a sifting layer  645 , an error correction layer  650 , a privacy amplification layer  655  and an authentication layer  660 . The interface layer  640  may include protocols for deriving QKD symbols from photons transmitted via QKD network  115  and received at a quantum cryptographic transceiver  525  of a QKD endpoint  105 . Values of the QKD symbols (e.g., high or low symbol values) may be interpreted at layer  640  by the polarization, phase or energy states of incoming photons. Interface layer  640  may measure the polarization, phase or energy state of each received photon and interpret the measurement as corresponding to whether a first detector fired, a second detector fired, both first and second detectors fired, neither detector fired, or any other relevant measurements such as the number of photons detected. 
     Sifting layer  645  may implement protocols for discarding or “sifting” certain of the raw symbols produced by layer  640 . The protocols of sifting layer  645  may exchange basis information between the parties to a QKD symbol exchange. As an example, when QKD endpoint  105   a  receives polarized photons from QKD endpoint  105   b , sifting layer  645  may measure the polarization of each photon along either a rectilinear or diagonal basis with equal probability. Sifting layer  645  may record the basis that is used for measuring the polarization of each photon. Sifting layer  645  may inform QKD endpoint  105   b  the basis chosen for measuring the polarization of each photon. QKD endpoint  105   b  may then, via the protocols of sifting layer  645 , inform QKD endpoint  105   a , whether it has made the polarization measurement along the correct basis. QKD endpoint  105   a  and  105   b  may then “sift” or discard all polarization measurements in which QKD endpoint  105   a  has made the measurement along the wrong basis and keep only the measurements in which QKD endpoint  105   a  has made the measurement along the correct basis. For example, if QKD endpoint  105   b  transmits a photon with a symbol encoded as a 0° polarization and if QKD endpoint  105   a  measures the received photon via a diagonal basis (45°-135°), then QKD endpoint  105   b  and  105   a  will discard this symbol value since QKD endpoint  105   a  has made the measurement along the incorrect basis. 
     Error correction layer  650  may implement protocols for correcting errors that may be induced in transmitted photons due to, for example, the intrinsic noise of the quantum channel. Layer  650  may implement parity or cascade checking, convolutional encoding or other known error correction processes. Error correction layer  650  may additionally implement protocols for determining whether eavesdropping has occurred on the quantum channel. Errors in the states (e.g., polarization, phase or energy) of received photons may occur if an eavesdropper is eavesdropping on the quantum channel. To determine whether eavesdropping has occurred during transmission of a sequence of photons, QKD endpoint  105   a  and QKD endpoint  105   b  may randomly choose a subset of photons from the sequence of photons that have been transmitted and measured on the same basis. For each of the photons of the chosen subset, QKD endpoint  105   b  publicly announces its measurement result. QKD endpoint  105   a  then informs QKD endpoint  105   b  whether its result is the same as what was originally sent. QKD endpoint  105   a  and  105   b  both may then compute the error rate of the subset of photons. If the computed error rate is higher than an agreed upon tolerable error rate (typically about 15%), then QKD endpoint  105   a  and  105   b  may infer that substantial eavesdropping has occurred. They may then discard the current polarization data and start over with a new sequence of photons. 
     Privacy amplification layer  655  may implement protocols for reducing error-corrected symbols received from layer  650  to a small set of derived symbols (e.g., bits) to reduce an eavesdropper&#39;s knowledge of the key. If, subsequent to sifting and error correction, QKD endpoint  105   a  and  105   b  have adopted n symbols as secret symbols, then privacy amplification layer  655  may compress the n symbols using, for example, a hash function. QKD endpoint  105   a  and  105   b  may agree upon a publicly chosen hash function ƒ and take K ƒ(n symbols) as the shared r-symbol length key K. The hash function randomly redistributes the n symbols such that a small change in symbols produces a large change in the hash value. Thus, even if an eavesdropper determines a number of symbols of the transmitted key through eavesdropping, and also knows the hash function ƒ, they still will be left with very little knowledge regarding the content of the hashed r-symbol key K. 
     Authentication layer  660  may implement protocols for authenticating transmissions between QKD endpoint  105   a  and  105   b  via network  110 . Such protocols may include any conventional authentication mechanisms known to one skilled in the art (e.g., message authentication codes (MACs)). 
     IKE protocol  610  may implement key exchange protocols and algorithms. Optical process control  615  may control opto-electronics of quantum cryptographic transceiver  525 . In exemplary embodiments that use framing, optical process control  615  may impose the framing on the QKD link. Optical process control  615  may continuously transmit and receive frames of QKD symbols and report the results to QKD protocol suite  605 . Network management client  620  may communicate with NMT  125  using a network management protocol, such as, for example, Simple Network Management Protocol (SNMP)  665 . Other protocols such as CMIP, telnet, or CORBA may also be used. The network management protocol may, for example, receive commands (e.g., GET commands) from NMT  125  about specific controllable items to determine the current value of some parameter. The network management protocol of client  620  may also, for example, receive commands from NMT  125  to change parameter settings. Network management client  620  may communicate internally, via remote procedure calls or other means, to other software entities within QKD endpoint  105 . 
     SPD  625  may include a database, together with algorithms, that classify received data units to determine which data belong in which security associations. This may be accomplished by matching various fields in the received data units with rule sets in the database. SAD  630  may include a database, together with algorithms, that perform Internet Protocol Security (IPsec) on data units as needed for a given security association (e.g., encryption, decryption, authentication, encapsulation). 
     Exemplary QKD Switch 
       FIG. 7  illustrates exemplary components of a QKD switch  205  consistent with the present invention. QKD switch  205  may include a processing unit  705 , a memory  710 , a network interface(s)  715 , a Micro-Electro-Mechanical Systems (MEMS) mirror element  720 , and a bus  725 . MEMS mirror element  720  may be interconnected with one or more links that may include quantum cryptographic (QC) fibers  730 . 
     Processing unit  705  may perform all data processing functions for inputting, outputting, and processing of QKD switch data. Memory  710  may include RAM that provides temporary working storage of data and instructions for use by processing unit  705  in performing processing functions. Memory  710  may additionally include ROM that provides permanent or semi-permanent storage of data and instructions for use by processing unit  705 . Memory  710  can also include large-capacity storage devices, such as a magnetic and/or optical recording medium and its corresponding drive. 
     Network interface(s)  715  interconnects QKD switch  205  with sub-network  110 . MEMS mirror element  720  may include an array of optical switching mirrors such as, for example, any of those disclosed in U.S. Pat. Nos. 5,960,133; 5,960,131; 6,005,993; 6,154,5,86; and 5,911,018. MEMS mirror element  720  directs photons, containing quantum encryption keys encoded via phase and/or polarization states, through a path along a fiber of QC fibers  730  in QKD sub-network  115  according to instructions from processing unit  705 . Bus  725  interconnects the various components of QKD switch  205  to permit the components to communicate with one another. QC fibers  730  may include one or more optical fibers. 
     Exemplary Quantum Key Distribution 
       FIG. 8  illustrates exemplary quantum key distribution from QKD endpoint  105   a  to QKD endpoint  105   b , via QKD sub-network  115  using QKD switch  205  MEMS mirror elements  720 , consistent with the present invention. To distribute an encryption key, quantum cryptographic transceiver  525   a  at QKD endpoint  105   a  transmits photons through a path along QC fiber links  730  interconnecting, for example, QKD switches  205   a ,  205   c ,  205   d  and  205   f  and quantum cryptographic transceiver  525   b  at QKD endpoint  105   b . At each QKD switch  205 , a MEMS mirror element  720  directs the incoming photon to an appropriate outbound QC fiber link in accordance with techniques disclosed in co-pending application Ser. No. 09/944,328, entitled “Quantum Cryptographic Key Distribution Networks with Untrusted Switches.” 
     Exemplary QKD Endpoint Configuration and Initialization Process 
       FIG. 9  is a flowchart that illustrates an exemplary process, consistent with the present invention, for configuring and initializing, from an NMT  125 , QKD switches  205  and QKD endpoints  105  of network  100 . As one skilled in the art will appreciate, the method exemplified by  FIG. 9  can be implemented as a sequence of instructions and stored in memory  310  of NMT  125  for execution by processing unit  305 . 
     The exemplary process may begin with the establishment of quantum cryptographic protocols used across given links of QKD sub-network  115  [act  905 ]. NMT  125  may, for example send messages to selected QKD switches  205  and/or QKD endpoints  105  of network  100  to establish a quantum cryptographic protocol across a given link. Such quantum cryptographic protocols may include any conventional QKD protocol, such as, for example, BB84 or B92. NMT  125  may configure the speeds at which QKD endpoint  105  lasers and detectors may operate [act  910 ]. NMT  125  may, for example, send messages to selected QKD endpoints  105  to configure the laser and detector speeds. NMT  125  may further configure the wavelengths at which QKD endpoints  105  of network  100  transmit [act  915 ]. Any given QKD endpoint  105  may have the capability to transmit at multiple wavelengths and NMT  125  may select one or more wavelengths of the multiple wavelengths at which the QKD endpoint  105  should transmit. NMT  125  may send messages to selected QKD endpoints  105  to select the one or more wavelengths. NMT  125  may, optionally, for QKD endpoints  105  that distribute quantum cryptographic keys via frames, set a number of bits in frames transmitted from a given QKD endpoint  105  [act  920 ]. QKD endpoints  105  may transmit keys via frames as disclosed in co-pending application Ser. No. 10/271,103, entitled “Systems and Methods for Framing Quantum Cryptographic Links,” and filed on Oct. 15, 2002, the disclosure of which is incorporated by reference herein in its entirety. NMT  125  may send a message to selected QKD endpoints  105  to set the number of bits in transmitted frames. 
     NMT  125  may assign network addresses for given QKD endpoints  105  [act  925 ]. Such network addresses may include, for example, Internet Protocol (IP) addresses. NMT may send a message to selected QKD endpoints  105  to assign the network addresses. NMT  125  may further configure which security associations (SAs) should use quantum cryptography [act  930 ]. The SAs may include a one-way relationship between a sending QKD endpoint  105  and a receiving QKD endpoint  105  that affords security services to the traffic carried on it. SAs are used in conventional network security protocols, such as, for example, Internet Protocol Security (IPsec). NMT  125  may configure the SAs by sending a message to the appropriate QKD endpoints  105 . NMT  125  may further configure how many QKD secret bits should be mixed into a given IKE key used in key exchange [act  935 ]. NMT  125  may send a message to selected QKD endpoints  105  to configure the number of QKD secret bits mixed into an IKE key. NMT  125  may additionally configure how often IKE re-keying should be performed [act  940 ]. NMT  125  may send a message to appropriate QKD endpoints  105  to configure the IKE re-keying interval. 
     Acts  905 - 940 , as described above, may be performed sequentially or in parallel. 
     Exemplary QKD Endpoint Event Notification Process 
       FIGS. 10-11  are flowcharts that illustrate an exemplary process, consistent with the present invention, for notifying an NMT  125  of unplanned events that occur at a QKD endpoint  105 . As one skilled in the art will appreciate, the method exemplified by  FIGS. 10-11  can be implemented as a sequence of instructions and stored in a memory  510  of each QKD endpoint  105  of network  100  for execution by a respective processing unit  505 . 
     The exemplary process may begin with a determination of whether there has been a QKD device failure [act  1005 ]. Such a QKD device may include a component or device of QKD endpoint  105 , such as, for example, lasers or detectors. If there has been a QKD device failure, QKD endpoint  105  may send a message to NMT  125  identifying the device failure [act  1010 ]. QKD endpoint  105  may further determine whether any out of range conditions have occurred [act  1015 ]. The out of range conditions may include any significant deviations from normal operating parameters of QKD-endpoint  105 . Such out of range conditions may include, for example, abnormal temperatures or power failures associated with devices of QKD endpoint  105 . If any out of range conditions have occurred, QKD endpoint  105  may send a message to NMT  125  indicating each of the out of range conditions [act  1020 ]. QKD endpoint  105  may also determine the occurrence of high or low quantum bit error rate (QBER) values [act  1025 ]. QKD endpoint  105  may maintain thresholds beyond which high or low QBER values are indicated. If high or low QBER values exist, QKD endpoint  105  may send a message to NMT  125  indicating each of the high/low QBER values [act  1030 ]. 
     QKD endpoint  105  may determine whether any high or low rates of photon detection have occurred [act  1035 ]. QKD endpoint  105  may maintain photon detection rate thresholds beyond which high or low rates are indicated. If high or low photon detection rates have occurred, QKD endpoint  105  may send a message to NMT  125  indicating occurrences of the high or low rates of photon detection [act  1040 ]. QKD endpoint  105  may further determine whether the physical cabinet housing QKD endpoint  105  is open [act  1105 ]. If so, QKD endpoint  105  may send a message to NMT  125  indicating the open cabinet [act  1110 ]. QKD endpoint  105  may also determine whether QKD bits are running low [act  1115 ]. QKD endpoint  105  may maintain a lower QKD bit threshold beyond which a low number of QKD bits are indicated. If the QKD bits are running low, QKD endpoint  105  may send a message to NMT  125  indicating the low number of QKD bits [act  1120 ]. 
     The messages described in acts  1010 - 1120  above may be batched together in a single message or in several messages to reduce the message traffic between QKD endpoint  105  and NMT  125 . 
     Exemplary QKD Endpoint Monitoring Process 
       FIG. 12  is a flowchart that illustrates an exemplary process, consistent with the present invention, for monitoring parameters, from a NMT  125 , associated with QKD being implemented at QKD endpoints  105  of network  100 . As one skilled in the art will appreciate, the method exemplified by  FIG. 12  can be implemented as a sequence of instructions and stored in memory  310  of NMT  125  for execution by processing unit  305 . “Monitoring” as described with respect to acts  1205 - 1245  below may involve one or more messages sent from NMT  125  to QKD endpoints  105  of network  100  requesting the monitored parameters. Each QKD endpoint  105  may reply to a received message with a message sent to NMT  125  that includes the monitored parameters. “Monitoring” as described with respect to acts  1205 - 1245  below may additionally include a periodic message (or messages) sent from each QKD endpoint  105  of network  100  that includes data regarding selected parameters monitored by NMT  125 . 
     The exemplary process may begin with NMT  125  monitoring how many QKD bits are available in a given QKD endpoint  105  [act  1205 ]. NMT  125  may further monitor how many QKD bits per second are currently being produced in a given QKD endpoint  105  [act  1210 ]. NMT  125  may also monitor how many QKD bits per second are currently being consumed in a given QKD endpoint  105  [act  1215 ]. NMT  125  may monitor how many times a QKD bit “running low” condition has occurred in a given QKD endpoint  105  [act  1220 ]. A counter may be periodically reset and the number of times a QKD bit “running low” condition occurs may be counted before the next counter reset. 
     NMT  125  may monitor how many different SAs are currently active and using QKD bits in a given QKD endpoint  105  [act  1225 ]. NMT  125  may also monitor a current QBER in a given QKD endpoint  105  [act  1230 ]. NMT  125  may additionally monitor current temperatures of devices in a given QKD endpoint  105  [act  1235 ]. NMT  125  may further receive one or more unplanned event notifications from QKD endpoints  105  [ 1240 ]. The unplanned event notifications may result from the exemplary process described above with respect to  FIGS. 10-11 . NMT  125  may display monitored parameters via output device  320  [act  1245 ]. 
       FIG. 13  illustrates an exemplary graphical interface  1305  of output device  320  on which a network map and the various parameters monitored in acts  1205 - 1240  above may be displayed. Graphic interface  1305  may also include a window  1310  that displays monitored parameters textually. As shown in  FIG. 13 , window  1310  may display textual data indicating the times at which various monitored events, associated with nodes (e.g., QKD endpoints  105  or QKD switches  205 ) of network  100 , have occurred. The network map displayed in graphic interface  1305  may include icons representing the various nodes of network  100  that may turn different colors upon the occurrence of certain events. For example, the icons may turn red when errors or alerts occur. Output device  320  may additionally output audible sounds, such as beeps or alarms, upon the occurrence of unusual or significant events. In addition to displaying monitored parameters, NMT  125  may share the monitored parameter data with other computer systems via data files stored on disk, or via network protocols such as CORBA. 
     Exemplary QKD Endpoint/Switch Control Process 
       FIG. 14  is a flowchart that illustrates an exemplary process, consistent with the present invention, for NMT  125  control of QKD endpoints  105  and or QKD switches  205  of network  100 . As one skilled in the art will appreciate, the method exemplified by  FIG. 14  can be implemented as a sequence of instructions and stored in memory  310  of NMT  125  for execution by processing unit  305 . 
     The exemplary process may begin with NMT  125  increasing and/or decreasing an amount of privacy amplification applied at one or more QKD endpoints  105  of network  100  [act  1405 ]. NMT  125  may send a message to selected QKD endpoints  105  commanding them to increase or decrease the amount of privacy amplification applied to the QKD process. For example, parameters of a hash function ƒ used for privacy amplification may be varied to increase/decrease the number of resulting key K symbols. NMT  125  may further command one or more QKD endpoints  105  to switch to different optical wavelengths [act  1410 ]. Each QKD endpoint  105  may support multiple wavelengths and NMT  125  may command selected QKD endpoints  105  to switch to a different wavelength of respective supported wavelengths. NMT  125  may change network addresses associated with one or more QKD endpoints  105  of network  100  [act  1415 ]. NMT  125  may send a message to appropriate QKD endpoints  105  notifying them of a change in their assigned network addresses, such as, for example, a change in their assigned IP addresses. NMT  125  may change a number of QKD bits required for certain types of SAs [act  1420 ]. NMT  125  may also command one or more QKD endpoints  105  of network  100  to switch from one form of QKD protocol to another [act  1425 ]. For example, NMT  125  may command one or more QKD endpoints  105  to switch from BB84 protocol to B92 protocol, or vice versa. 
     CONCLUSION 
     Systems and methods consistent with the present invention, therefore, provide mechanisms for configuring, monitoring and actively managing nodes and links of a quantum cryptographic network. A network management terminal may be interconnected with the nodes of a quantum cryptographic network for configuring and managing operational parameters associated with the nodes and links of the network. The network management terminals may, thus, assist in managing the nodes and links of the quantum cryptographic network to ensure maintenance of the desired “any to any” connectivity. 
     The foregoing description of embodiments of the present invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention. While a series of acts have been described in  FIGS. 9-12  and  14 , the order of the acts may vary in other implementations consistent with the present invention. Also, non-dependent acts may be performed in parallel. No element, act, or instruction used in the description of the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article “a” is intended to include one or more items. Where only one item is intended, the term “one” or similar language is used. 
     The scope of the invention is defined by the following claims and their equivalents.