Abstract: Disclosed are systems and methods for configuring time synchronization in a network. The system includes a time signal source to provide a common time signal to multiple configurable communication devices and a network controller in a control plane, in communication with the multiple configurable communication devices. The network controller is configured to receive time signal source information and to receive device configuration information for a first configurable communication device. The network controller is also configured to determine settings for time signal distribution and to transmit the settings to the multiple configurable communication devices to cause the first configurable communication device to transmit the time signal from the time signal source in a data plane for consumption by the multiple configurable communication devices.

Abstract: Disclosed are systems and methods for configuring communication of a communication network in accordance with a configuration file from the hosts that are on the network. The system may include a network controller that receives a configuration file and determines a configuration of the data plane in accordance with information in the configuration file. The network controller may generate communication flows and send instructions to programmable network devices to implement communication among data consuming/producing devices in accordance with the configuration file.

Abstract: Devices, systems, methods, and techniques for multicast failover handling in a computer communication network are disclosed. The methods herein described are particularly suited to software-defined networks (SDNs), and comply with requirements for assuring delivery of network traffic to each destination from a source engaged in multicast network traffic dissemination, assured delivery of each data packet as introduced into the network by the source device and avoidance of duplicate delivery of data. The methods herein are agile and respond rapidly to changes in a network while traffic is on the network.

Abstract: Devices, systems, methods, and techniques for multicast failover handling in a computer communication network are disclosed. The methods herein described are particularly suited to software-defined networks (SDNs), and comply with requirements for assuring delivery of network traffic to each destination from a source engaged in multicast network traffic dissemination, assured delivery of each data packet as introduced into the network by the source device and avoidance of duplicate delivery of data. The methods herein are agile and respond rapidly to changes in a network while traffic is on the network.

Abstract: Devices, systems, methods, and techniques for multicast failover handling in a computer communication network are disclosed. The methods herein described are particularly suited to software-defined networks (SDNs), and comply with requirements for assuring delivery of network traffic to each destination from a source engaged in multicast network traffic dissemination, assured delivery of each data packet as introduced into the network by the source device and avoidance of duplicate delivery of data. The methods herein are agile and respond rapidly to changes in a network while traffic is on the network.

Abstract: Devices, systems, methods, and techniques for multicast failover handling in a computer communication network are disclosed. The methods herein described are particularly suited to software-defined networks (SDNs), and comply with requirements for assuring delivery of network traffic to each destination from a source engaged in multicast network traffic dissemination, assured delivery of each data packet as introduced into the network by the source device and avoidance of duplicate delivery of data. The methods herein are agile and respond rapidly to changes in a network while traffic is on the network.

Abstract: A controller for an electric power distribution system includes processing circuitry and a memory that includes instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to determine that a first switch of the electric power distribution system is a primary switch communicatively coupled to an intelligent electronic device (IED) of the electric power distribution system, determine that a second switch of the electric power distribution system is a backup switch communicatively coupled to the IED, and distribute a first copy of a security association key (SAK) to the first switch and a second copy of the SAK to the second switch in response to determining that the first switch is the primary switch and the second switch is the backup switch to enable the first switch and the second switch to establish respective media access control security (MACsec) communication links with the IED.

Abstract: A controller for an electric power distribution system includes processing circuitry and a memory that includes instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to determine that a first switch of the electric power distribution system is a primary switch communicatively coupled to an intelligent electronic device (IED) of the electric power distribution system, determine that a second switch of the electric power distribution system is a backup switch communicatively coupled to the TED, and distribute a first copy of a security association key (SAK) to the first switch and a second copy of the SAK to the second switch in response to determining that the first switch is the primary switch and the second switch is the backup switch to enable the first switch and the second switch to establish respective media access control security (MACsec) communication links with the IED.

Abstract: A controller for an electric power distribution system includes processing circuitry and a memory that includes instructions. The instructions, when executed by the processing circuitry, are configured to cause the processing circuitry to determine that a first switch of the electric power distribution system is a primary switch communicatively coupled to an intelligent electronic device (IED) of the electric power distribution system, determine that a second switch of the electric power distribution system is a backup switch communicatively coupled to the TED, and distribute a first copy of a security association key (SAK) to the first switch and a second copy of the SAK to the second switch in response to determining that the first switch is the primary switch and the second switch is the backup switch to enable the first switch and the second switch to establish respective media access control security (MACsec) communication links with the IED.

Abstract: A network communication system may include intelligent electronic devices (IEDs) in a ring communication network. A software-defined networking device may be programmed by a removable or disconnectable software-defined network (SDN) controller to control the flow path of data packets to the IEDs in the ring network. The software-defined networking device may inspect a data packet intended for a first IED to determine that the inspected data packet requests a responsive data packet from the first IED. A flow path failure may be identified based on a failure to detect a responsive data packet from the first IED within an expected response time.

Abstract: A network communication system may include intelligent electronic devices (IEDs) in a dual-ring communication network. A software-defined network (SDN) device may be programmed by a removable or disconnectable SDN controller to control the flow path of data packets to the IEDs in the dual-ring network. A first ring of the dual-ring communication network may be dedicated to high priority data packets, and a second ring of the dual-ring communication network may be dedicated to low priority data packets. The SDN device may implement various levels of redundancy depending on the number and location of link failures detected. A first level of redundancy may direct high priority data packets in the opposite direction, and a second level of redundancy may direct high priority data packets onto the other ring normally used for low priority data packets.

Abstract: A network communication system may include intelligent electronic devices (IEDs) in a ring communication network. A software-defined networking device may be programmed by a removable or disconnectable software-defined network (SDN) controller to control the flow path of data packets to the IEDs in the ring network. The software-defined networking device may inspect a data packet intended for a first IED to determine that the inspected data packet requests a responsive data packet from the first IED. A flow path failure may be identified based on a failure to detect a responsive data packet from the first IED within an expected response time.

Abstract: The present disclosure pertains to systems and methods of handling Address Resolution Protocol (ARP) responses in a software defined network (SDN). In one embodiment, a system may comprise a controller in a control plane to generate an address store comprising information associated with a plurality of devices in communication with the SDN. The controller may also program a plurality of network devices in a data plane based on a plurality of communication flows. The network devices may forward traffic according to the plurality of communication flows received from the controller. The network device may also receive: a request from the first device for information associated with the second device, determine that the first device is authorized to communicate with the second device based on the plurality of communication flows, and generate a response to the request comprising the information associated with the second device based on the address store.

Abstract: The present disclosure pertains to systems and methods of handling Address Resolution Protocol (ARP) responses in a software defined network (SDN). In one embodiment, a system may comprise a controller in a control plane to generate an address store comprising information associated with a plurality of devices in communication with the SDN. The controller may also program a plurality of network devices in a data plane based on a plurality of communication flows. The network devices may forward traffic according to the plurality of communication flows received from the controller. The network device may also receive: a request from the first device for information associated with the second device, determine that the first device is authorized to communicate with the second device based on the plurality of communication flows, and generate a response to the request comprising the information associated with the second device based on the address store.

Abstract: The present disclosure pertains to systems and methods of monitoring communication devices and communication links in a software-defined network (SDN). Network packets may be colored or tagged for routing to a packet analyzer. A VLAN bitmask may be added to a packet to identify the packet for inspection and, optionally, provide origin information identify a switch and/or port of origin. Port mirroring may be utilized and/or eventual routing of network packets to their original destination may ensure that network traffic is not disrupted. In one example, a most significant bit of a VLAN bitmask may be used by a match rule to identify packets intended for a packet analyzer without regard to original packet routing instructions and/or packet content.

Abstract: The present disclosure pertains to systems and methods of monitoring communication devices and communication links in a software defined network (SDN). In one embodiment, a system may include a communications interface configured to receive a plurality of ingress packets. A forwarding subsystem may match a subset of the plurality of ingress packets with the data flow and forwarding the subset of the plurality of ingress packets based on a first instruction set associated with the data flow. A statistical information subsystem may update a meter count associated with the subset of the plurality of ingress packets matched with the data flow. A logic engine configured to determine that the meter count fails to satisfy a threshold, change a port link state based on the failure to satisfy the threshold; and transition from the first instruction set to a second instruction set associated with the flow data.

Abstract: The present disclosure pertains to systems and methods of monitoring communication devices and communication links in a software defined network (SDN). In one embodiment, a system may include a communications interface configured to receive a plurality of ingress packets. A forwarding subsystem may match a subset of the plurality of ingress packets with the data flow and forwarding the subset of the plurality of ingress packets based on a first instruction set associated with the data flow. A statistical information subsystem may update a meter count associated with the subset of the plurality of ingress packets matched with the data flow. A logic engine configured to determine that the meter count fails to satisfy a threshold, change a port link state based on the failure to satisfy the threshold; and transition from the first instruction set to a second instruction set associated with the flow data.

Abstract: The present disclosure pertains to systems and methods of monitoring communication devices and communication links in a software-defined network (SDN). Network packets may be colored or tagged for routing to a packet analyzer. A VLAN bitmask may be added to a packet to identify the packet for inspection and, optionally, provide origin information identify a switch and/or port of origin. Port mirroring may be utilized and/or eventual routing of network packets to their original destination may ensure that network traffic is not disrupted. In one example, a most significant bit of a VLAN bitmask may be used by a match rule to identify packets intended for a packet analyzer without regard to original packet routing instructions and/or packet content.