Abstract: A control processor (CP) manages authenticated channels for encryption in a communication system. The CP includes a management interface and processing circuitry configured to establish a local authenticated channel with a local modem and to provide encryption parameters enabling the local modem to manage a trusted channel with a remote modem. The CP receives, via the local authenticated channel, an alarm message indicating that the remote modem is in an unmanaged state due to failure of a remote authenticated channel between the remote modem and a first remote CP. In response, the CP generates and communicates a reauthentication command toward the remote modem via the local modem and the trusted channel. The reauthentication command causes the remote modem to reestablish the remote authenticated channel with a second remote CP, optionally using runtime authentication material obtained by the CP from a user or network management server.

Abstract: This disclosure provides systems, methods and apparatuses for managing encryption in a network. A local modem is managed by a local control processor (CP) via a local authenticated channel. The local authenticated channel is established between the local modem and a first CP (as the local CP) using runtime authentication material. When the first CP is removed or becomes inoperative, the local modem detects an authentication failure associated with the local authenticated channel. The local modem can communicate an alarm message via a trusted channel to a remote modem. In response to the alarm message, the local modem can receive a reauthentication command via the trusted channel. The reauthentication command is configured to cause the local modem to establish a new local authenticated channel with a second CP (such as a new local CP to replace the first CP).

Abstract: This disclosure provides systems, methods, and apparatuses for network devices of a transport network to obtain quantum key distribution (QKD) keys from a QKD system. The disclosed techniques enable network devices to exchange secure application entity identifications (SAE IDs) via a trusted channel between each pair of network devices. A trusted channel is a channel where the endpoints are known, and data integrity is protected in transit. Depending on the communications protocol used, a trusted channel is a communication channel in which the network devices have authenticated each other or in which the channel data privacy is protected in transit. A pair of network devices can exchange SAE IDs via a trusted channel so that each network device in the pair can obtain corresponding key material from the QKD system.

Abstract: This disclosure provides systems, methods and apparatuses for managing encryption in a network. A local modem is managed by a local control processor (CP) via a local authenticated channel. The local authenticated channel is established between the local modem and a first CP (as the local CP) using runtime authentication material. When the first CP is removed or becomes inoperative, the local modem detects an authentication failure associated with the local authenticated channel. The local modem can communicate an alarm message via a trusted channel to a remote modem. In response to the alarm message, the local modem can receive a reauthentication command via the trusted channel. The reauthentication command is configured to cause the local modem to establish a new local authenticated channel with a second CP (such as a new local CP to replace the first CP).

Abstract: This disclosure provides systems, methods, and apparatuses for network devices of a transport network to obtain quantum key distribution (QKD) keys from a QKD system. The disclosed techniques enable network devices to exchange secure application entity identifications (SAE IDs) via a trusted channel between each pair of network devices. A trusted channel is a channel where the endpoints are known, and data integrity is protected in transit. Depending on the communications protocol used, a trusted channel is a communication channel in which the network devices have authenticated each other or in which the channel data privacy is protected in transit. A pair of network devices can exchange SAE IDs via a trusted channel so that each network device in the pair can obtain corresponding key material from the QKD system.