Schweitzer Engineering Laboratories, Inc.

Robert Meine

Rhett Smith

Colin Gordon

David James Dolezilek

Tristan Lloyd Mullis

Amandeep Singh Kalra

Steven D Herrmann

Dennis Gammel

Jason A Dearien

Josh Powers

A controller for an electric power distribution system includes processing circuitry and a memory that includes instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to determine that a first switch of the electric power distribution system is a primary switch communicatively coupled to an intelligent electronic device (IED) of the electric power distribution system, determine that a second switch of the electric power distribution system is a backup switch communicatively coupled to the IED, and distribute a first copy of a security association key (SAK) to the first switch and a second copy of the SAK to the second switch in response to determining that the first switch is the primary switch and the second switch is the backup switch to enable the first switch and the second switch to establish respective media access control security (MACsec) communication links with the IED.

Systems and methods for establishing a backup secure communication link in an electric power distribution system

Devices, systems, methods, and techniques for multicast failover handling in a computer communication network are disclosed. The methods herein described are particularly suited to software-defined networks (SDNs), and comply with requirements for assuring delivery of network traffic to each destination from a source engaged in multicast network traffic dissemination, assured delivery of each data packet as introduced into the network by the source device and avoidance of duplicate delivery of data. The methods herein are agile and respond rapidly to changes in a network while traffic is on the network.

Multicast fast failover turnaround overlap handling

Multicast fast failover handling

A controller for an electric power distribution system includes processing circuitry and a memory that includes instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to determine that a first switch of the electric power distribution system is a primary switch communicatively coupled to an intelligent electronic device (IED) of the electric power distribution system, determine that a second switch of the electric power distribution system is a backup switch communicatively coupled to the TED, and distribute a first copy of a security association key (SAK) to the first switch and a second copy of the SAK to the second switch in response to determining that the first switch is the primary switch and the second switch is the backup switch to enable the first switch and the second switch to establish respective media access control security (MACsec) communication links with the IED.

A network communication system may include intelligent electronic devices (IEDs) in a ring communication network. A software-defined networking device may be programmed by a removable or disconnectable software-defined network (SDN) controller to control the flow path of data packets to the IEDs in the ring network. The software-defined networking device may inspect a data packet intended for a first IED to determine that the inspected data packet requests a responsive data packet from the first IED. A flow path failure may be identified based on a failure to detect a responsive data packet from the first IED within an expected response time.

SDN flow path modification based on packet inspection

A network communication system may include intelligent electronic devices (IEDs) in a dual-ring communication network. A software-defined network (SDN) device may be programmed by a removable or disconnectable SDN controller to control the flow path of data packets to the IEDs in the dual-ring network. A first ring of the dual-ring communication network may be dedicated to high priority data packets, and a second ring of the dual-ring communication network may be dedicated to low priority data packets. The SDN device may implement various levels of redundancy depending on the number and location of link failures detected. A first level of redundancy may direct high priority data packets in the opposite direction, and a second level of redundancy may direct high priority data packets onto the other ring normally used for low priority data packets.

Reconfigurable dual-ring network redundancy

The present disclosure pertains to systems and methods of handling Address Resolution Protocol (ARP) responses in a software defined network (SDN). In one embodiment, a system may comprise a controller in a control plane to generate an address store comprising information associated with a plurality of devices in communication with the SDN. The controller may also program a plurality of network devices in a data plane based on a plurality of communication flows. The network devices may forward traffic according to the plurality of communication flows received from the controller. The network device may also receive: a request from the first device for information associated with the second device, determine that the first device is authorized to communicate with the second device based on the plurality of communication flows, and generate a response to the request comprising the information associated with the second device based on the address store.

Address resolution protocol response handling

The present disclosure pertains to systems and methods of monitoring communication devices and communication links in a software-defined network (SDN). Network packets may be colored or tagged for routing to a packet analyzer. A VLAN bitmask may be added to a packet to identify the packet for inspection and, optionally, provide origin information identify a switch and/or port of origin. Port mirroring may be utilized and/or eventual routing of network packets to their original destination may ensure that network traffic is not disrupted. In one example, a most significant bit of a VLAN bitmask may be used by a match rule to identify packets intended for a packet analyzer without regard to original packet routing instructions and/or packet content.

Selective port mirroring and in-band transport of network communications for inspection

The present disclosure pertains to systems and methods of monitoring communication devices and communication links in a software defined network (SDN). In one embodiment, a system may include a communications interface configured to receive a plurality of ingress packets. A forwarding subsystem may match a subset of the plurality of ingress packets with the data flow and forwarding the subset of the plurality of ingress packets based on a first instruction set associated with the data flow. A statistical information subsystem may update a meter count associated with the subset of the plurality of ingress packets matched with the data flow. A logic engine configured to determine that the meter count fails to satisfy a threshold, change a port link state based on the failure to satisfy the threshold; and transition from the first instruction set to a second instruction set associated with the flow data.

Growing community of inventors

Boise, ID, United States of America

Robert Meine