System for demand-based regulation of dynamically implemented firewall exceptions

A connectivity manager in communication with a network access controller to remotely, from a remote connectivity manager, permit data traffic between a client node and an upstream network, the connectivity manager comprising:

• a processor;
• and
• a memory storing instructions executed by the processor to implement software components including:
• a network access control interface in communication with the network access controller, to which the client node is connected, the data traffic originating from the client node to the upstream network, and destined to the client node from the upstream network being selectively passed through the network access controller as at least partially designated via a gateway authorization provided to the network access control interface;
• a client node presence manager in communication with the network access control interface and the remote connectivity manager, the client node presence manager maintaining a presence state of the client node, and
• a network load manager in communication with the network access control interface and the client presence manager, the network bad manager generating the gateway authorization to the network access control interface in response to receipt of a connection authorization request and an evaluation of one or more access grant conditions, the connection authorization request being received from the remote connectivity manager in advance of any data link requests from client nodes and being based upon an evaluation of flight details of the aircraft against one or more conditions set by the remote application service;
• wherein the remote connectivity manager is connected to a remote application service that dynamically defines one or more conditions relating to the presence state of the client node for the evaluation of the connection authorization request by the remote connectivity manager;
• wherein the client node presence manager is connected to a client node application that requests a data communications link to the upstream network.

A system for dynamically implementing exceptions in an onboard network firewall for one or more client devices on a data communications network aboard an aircraft to connect to a remote network node as authorized by a remote application service over a satellite communications link, the system comprising:

• a client application interface receptive to a data link request from the one or more client devices;
• an onboard connectivity manager including:
• a processor;
• and
• a memory storing instructions executed by the processor to implement software components including:
• a firewall interface connected to the onboard network firewall to request the exceptions in response to a connection authorization;
• and
• a client presence manager receptive to the data link request relayed by the client application interface from the one or more client devices, a presence state for the one or more client devices being activated and maintained following the data link request;
• and
• a remote connectivity manager connected to the remote application service and in communication with the onboard connectivity manager;
• wherein the remote connectivity manager generates the connection authorization based upon an evaluation of flight details of the aircraft against one or more conditions set by the remote application service, the connection authorization request being generated in advance of any data link requests from the one or more client devices, the connection authorization request including a node identification corresponding to the remote network node with which a particular one of the one or more client devices is permitted to communicate over the satellite communications link;
• wherein the system further comprises an application installed on the client device that is operable to communicate with the remote application service, the node identification being specific to the application.