Trigger alarm actions and alarm-triggered network flows in software-defined networks

A software-defined networking device, comprising,

• a processor;
• a plurality of communication ports for network communications;
• a profile implementation subsystem to selectively implement, via the processor, each of a plurality of network operation profiles, wherein each network operation profile defines network behavior, including the routing of network packets via the plurality of communication ports;
• a non-transitory computer-readable medium to store:
• a first stored network operation profile that includes a trigger alarm action defined to trigger an alarm of a networked intelligent electronic device (IED) based on identification of an increased packet matching a defined packet characteristic, and
• a second stored network operation profile that defines network behavior during a triggered alarm of the IED;
• a network packet matching subsystem of the software-defined networking device to identify an ingressed packet matching the defined packet characteristic and cause:
• an alarm subsystem to trigger the alarm of the IED, and
• the profile implementation subsystem to implement the second stored network operation profile that defines networked behavior during the triggered alarm of the IED;
• and
• a precision time input port to receive a precise time signal, and
• wherein the profile implementation subsystem is further configured to modify implementation of at least one of the first and second network operation profiles based on the precise time signal.

A method of operating a software-defined network, comprising:

• defining, via a software-defined network controller (SDN controller), a first network flow to be implemented by a plurality of networking devices connected as part of a software-defined network (SDN);
• defining, via the SDN controller, a second, alarm-based network flow to be implemented by the plurality of networking devices in response to an identified alarm-triggering packet;
• defining a network packet match template for identifying one or more alarm-triggering packets, wherein the network packet match template defines at least two of:
• a network packet characteristic, a time window, and a network event;
• identifying, via a network packet matching subsystem of a software-defined networking device, a received network packet as an alarm-triggering packet based on the received network packet matching the defined network packet match template;
• and
• implementing an alarm-based network operation profile based on the identified alarm-triggering packet.