Schweitzer Engineering Laboratories, Inc.

Jason A Dearien

Josh Powers

Rhett Smith

Marc Ryan Berner

Dennis Gammel

Barry Jakob Grussling

Joshua Thomas Pereyda

Colin Gordon

Ryan Bradetich

David M Buehler

Tristan Lloyd Mullis

Robert Meine

Benjamin S Day

Timothy P Tibbals

Mark J Bosold

Michael Dylan Cone

Thomas L Ristine

Coby Soss

David M Nieuwsma

Ronald L Baiar

Edward L Evans

Gavin Remaley

Grant O Boomer

A system has an intelligent electronic device (TED) and a switch configured to perform operations that include obtaining a rule associating a media access control security (MACsec) port identifier (PI) of the TED with a data flow, receiving a frame comprising data and the MACsec PI, and transmitting the data of the frame based on the data flow associated with the rule.

Systems and methods for establishing secure communication via a software defined network in an electric power distribution system

Systems and methods are disclosed herein relating to the secure configuration of intelligent electronic devices. Intelligent electronic devices are used in electric power generation and transmission systems for protection, control, automation, and/or monitoring of equipment. The use of tokens and token-based digital signatures in the configuration process of intelligent electronic devices reduces the likelihood of malicious acts or unintended errors. Tokens distributed to engineers, technicians, intelligent electronic devices, computing devices, and/or software decrease the likelihood of errors being introduced in the configuration process.

Secure control of intelligent electronic devices in power delivery systems

A system includes an intelligent electronic device (IED) and a control system configured to perform operations that include initiating establishment of a media access control security (MACsec) communication link via a MACsec key agreement (MKA) protocol, identifying information associated with the IED in response to initiation of the establishment of the MACsec communication link, the information being indicative of a protocol to be used by the IED to communicate data, and establishing a unidirectional MACsec communication link based on the information associated with the IED.

Systems and methods for establishing a secure communication link in an electric power distribution system

The present disclosure pertains to systems and methods of restricting access to devices utilizing tokens. In some embodiments, a system may include a user requesting a token, ensuring the user requesting a token has the permission to request the token and is not the user approving the token. In some embodiments, the system may include the user granting the token, wherein the user granting the token is not the user receiving the token. The system ensures that the user accessing the device has the permission to access the device. Additionally, the system decreases the opportunities for insider attacks and increases the resistance to credential theft attacks. Further, the system increases the accountability for changes and the ability to review changes.

Token-based device access restriction systems

The present disclosure pertains to systems and methods for establishing trust relationships between a software defined network (SDN) controller and a SDN communication device. In one embodiment, a SDN controller may comprise a communications interface configured to communicate with a plurality of SDN network devices. A commissioning subsystem configured to detect a new device associated with the SDN. In response to a new device, a user interface subsystem may be configured to receive a user approval to commission the new device. A trust subsystem configured to establish a first SDN controller trusted credential and to transmit a first device trusted credential based on the first SDN controller credential to the new device. Programming instructions to the new device authenticated using the first SDN controller trusted credential by a SDN programming subsystem.

Communication device for implementing trusted relationships in a software defined network

Systems and methods are described herein for token-based access to an intelligent electronic device (IED) resource in a power delivery system. A token server and an IED resource may be communicatively connected via a communication network. The token server may generate a token associated with access privileges to one or more IED resources. The token server associates an access duration time with the generated token. The user presents the IED resource with the token as part of an access attempt. The IED resource grants access at a first time defined with reference to the device uptime of the IED resource until a second time defined with reference to the device up time. The difference between the first time and the second time corresponds to the access duration time of the token.

Token-based device access restrictions based on system uptime

The present disclosure pertains to systems and methods of monitoring communication devices and communication links in a software-defined network (SDN). Network packets may be colored or tagged for routing to a packet analyzer. A VLAN bitmask may be added to a packet to identify the packet for inspection and, optionally, provide origin information identify a switch and/or port of origin. Port mirroring may be utilized and/or eventual routing of network packets to their original destination may ensure that network traffic is not disrupted. In one example, a most significant bit of a VLAN bitmask may be used by a match rule to identify packets intended for a packet analyzer without regard to original packet routing instructions and/or packet content.

Selective port mirroring and in-band transport of network communications for inspection

The present disclosure pertains to systems and methods for automating the configuration of communication hosts in a software defined network (SDN) associated with an electric power transmission and distribution system. The systems and methods presented herein may utilize communication host profiles to specify various repeatable attributes and customizable attributes that may be utilized to configure the communication host and the SDN. In one embodiment, a system may comprise a communication host profile subsystem configured to select a communication host profile associated with a communication host. The host communication profile subsystem may configure the communication host based on one or more repeatable attributes and on one or more customizable attributes specified in the host communication profile. A traffic routing system may further configure a plurality of communication flows in the SDN based on the communication host based on the host communication profile.

Communication host profiles

The present disclosure pertains to systems and methods to identify high-priority traffic within a software defined network ('SDN') and to route such traffic through physically distinct communication paths. Such routing may help to reduce network congestion faced by high-priority traffic and increase the reliability of transmission of such data. Certain embodiments may further be configured to generate a failover communication path that is physically distinct from a primary communication path. Still further, certain embodiments may be configured to suggest enhancements to a network that may improve a reliability criterion.

Routing of traffic in network through automatically generated and physically distinct communication paths

The present disclosure pertains to systems and method for configuration of communication flows in a software defined network ('SDN'). In one embodiment, a system is operable to configure a communication flow between a first host and a second host. A mode selection subsystem is configured to cause a plurality of network devices in a network connecting the first communication host and the second communication host to transition between an open mode and an SDN operating mode. In the open mode, the network devices may discover a communication path between the first host and the second host. An analysis subsystem may receive information from the plurality of network devices information about the discovered path, and a topology discovery subsystem may be configured to create a communication flow corresponding to the discovered path. The communication flow may allow communication between the first host and the second host in the SDN operating mode.

Configuration of a software defined network

The present disclosure pertains to systems and methods for establishing communication with a remote communication device in a software defined network (SDN) during time when an SDN controller is unavailable. In one embodiment, a local communication device may be configured to receive a plurality of data flows from an SDN controller and to store the plurality of data flows in a persistent data memory. The device may generate a unique identifier for the local communication device that is transmitted to a remote communication device. Following a disruption the results in the SDN controller being unavailable, the local communication device may recover into a default configured state based on the plurality of data flows in the persistent data memory. The local communication device may then transmit the unique identifier to the remote communication device after the disruption to begin a process of reestablishing communication with the remote communication device.

Communication device with persistent configuration and verification

The present disclosure pertains to systems and methods for simulating data packet routing within a software defined network ('SDN'), visualizing the results of the simulation, and permitting a user to search the resulting simulation. In one specified embodiment, a system may receive from a user a simulation parameter associated with a packet to be simulated in the SDN. A packet based on the at least one simulation parameter may be generated. A response of the SDN to the packet may be simulated by identifying applicable traffic routing rules and identifying a subsequent destination based on the applicable traffic routing rules. A record of the subsequent destination may be added to the simulation result, and the process may continue until a terminating condition is satisfied.

Simulating, visualizing, and searching traffic in a software defined network

The present disclosure pertains to systems and methods for assessing reliability of communication links in a software defined network (SDN). In one embodiment, a system may include an SDN architecture subsystem configured to generate SDN architecture information and a bandwidth subsystem configured to generate bandwidth information. A latency subsystem may receive the bandwidth information from the bandwidth subsystem and may be configured to generate latency information using the bandwidth information. A failover subsystem may receive the SDN architecture information, the bandwidth information, and the latency information and generate a failover assessment and a failover route for the communication link. A reliability assessment subsystem may receive the SDN architecture information, the bandwidth information, and the latency information, and the failover assessment and generate a reliability assessment. A traffic routing subsystem may receive the reliability assessment and route data traffic to the failover route based on the reliability assessment.

Network reliability assessment

Provided is a system and method of configuring IEDs to facilitate standardized communication messages among a plurality of IEDs within a power system network based on the IEC 61850 standard. A description file is described for an intelligent electronic device configured in accordance with the IEC-61850 standard. The description file includes a section which indicates which GOOSE message the intelligent electronic device should receive. In yet another embodiment, the description file includes a section which is capable of linking to logic functions of the intelligent electronic device for performing programmable data binding or dynamic data binding. A configuration tool is further provided for editing and creating such description files. A method for selectively receiving messages from an intelligent electronic device configured in accordance with the IEC-61850 standard is also described herein, along with a method for optimizing file space and improving execution speed of an intelligent electronic device configured in accordance with the IEC-61850 standard.

Growing community of inventors

Moscow, ID, United States of America

Jason A Dearien