# US 10,313,304 B2 · System for demand-based regulation of dynamically implemented firewall exceptions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,304 B2 - Document ID: US10313304B2 - Status: Granted - Kind: B2 - Application number: 15/071,975 - Filed: 2016-03-16 - Published: 2017-05-04 - Granted: 2019-06-04 - Earliest claimed: 2015-11-04 - Assignees: Panasonic Avionics Corporation - Applicants: Panasonic Avionics Corporation - Inventors: James A. Haak; Kwok Liang Poo - Web page: https://patentgrep.com/patent/US10313304B2 ## CPC - H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones} - H04B 7/1851: {Systems using a satellite or space-based relay (H04B7/18508, H04B7/18521 take precedence; providing specific services H04B7/18523 - H04B7/18576)} - H04L 63/0263: {Rule management} - H04L 63/102: {Entity profiles} - H04W 12/088: using filters or firewalls - H04W 84/12: WLAN [Wireless Local Area Networks] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04B: TRANSMISSION - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A system for regulating dynamic implementation of exceptions in an onboard network firewall includes a client application interface receptive to a data link request from a client device. An onboard connectivity manager includes a firewall interface connected to the onboard network firewall to request the exceptions in response to a connection authorization, a client presence manager receptive to the data link request relayed by the client application interface from the client device, and a network load manager in communication with the firewall interface and the client presence manager. A remote connectivity manager is connected to a remote application service and is in communication with the onboard connectivity manager. The network load manager generates the connection authorization to the firewall interface in response to the connection authorization request and an evaluation of one or more access grant conditions. ## Claims ### Claim 1 A system for regulating the dynamic implementation of exceptions in an onboard network firewall for one or more client devices on a data communications network aboard an aircraft to connect to a remote network node as authorized by a remote application service over a satellite communications link, the system comprising: a client application interface receptive to a data link request from the one or more client devices; an onboard connectivity manager including: a processor; and a memory storing instructions executed by the processor to implement software components including: a firewall interface connected to the onboard network firewall to request the exceptions in response to a connection authorization; a client presence manager receptive to the data link request relayed by the client application interface from the one or more client devices, a presence state for the one or more client devices being activated and maintained following the data link request; and a network load manager in communication with the firewall interface and the client presence manager; and a remote connectivity manager connected to the remote application service and in communication with the onboard connectivity manager; wherein the remote connectivity manager generates a connection authorization request based upon an evaluation of flight details of the aircraft against one or more conditions set by the remote application service, the connection authorization request being generated in advance of any data link requests from the one or more client devices, the connection authorization request including a node identification corresponding to the remote network node with which a particular one of the one or more client devices is permitted to communicate over the satellite communications link; wherein the network load manager generates the connection authorization to the firewall interface in response to receipt of the connection authorization request from the remote connectivity manager and an evaluation of one or more access grant conditions; wherein the system further comprises an application installed on the client device that is operable to communicate with the remote application service, the node identification being specific to the application. ### Claim 2 (depends on 1) The system of claim 1, wherein the node identification includes a node address and a node port definition. ### Claim 3 (depends on 1) The system of claim 1, wherein the remote network node corresponds to the remote application service. ### Claim 4 (depends on 1) The system of claim 1, wherein the evaluation of access grant conditions is selected from a group consisting of: current network usage, current available bandwidth, and historical network usage. ### Claim 5 (depends on 1) The system of claim 1, wherein the onboard connectivity manager generates a request to open a sideband channel in the satellite communications link. ### Claim 6 (depends on 1) The system of claim 1, wherein the network load manager includes; a data traffic monitor in communication with the onboard network firewall and receptive to current data traffic status messages therefrom; a regulator engine receptive to the current data traffic status messages; and a set of rules corresponding to the access grant conditions; wherein the regulator engine processes the set of rules with the current data traffic status messages, in response to which the connection authorization is selectively generated. ### Claim 7 (depends on 6) The system of claim 6, wherein the network load manager further includes: a historical network usage database with historical network usage data stored thereon; wherein the regulator engine processes the set of rules with the current data traffic status messages and the historical network usage data, in response to which the connection authorization is selectively generated. ### Claim 8 (depends on 6) The system of claim 6, wherein the network load manager further includes: a site list of ordered remote network nodes prioritized according to impacts to network capacity; wherein the regulator engine processes the set of rules with the current data traffic status messages and the site list, in response to which the connection authorization is selectively generated. ### Claim 9 (depends on 1) The system of claim 1, further comprising: an in-flight entertainment (IFE) system terminal in communication with the client application interface; and an application installed on the IFE system terminal that is operable to communicate with the remote application service. ### Claim 10 (depends on 1) The system of claim 1, further comprising: an aft crew messaging server in communication with the remote connectivity manager; wherein the presence state includes one or more cabin crew messages that are relayed from the remote connectivity manager to the air crew messaging server upon receipt of the presence state. ### Claim 11 A connectivity manager in communication with a network access controller to remotely, from a remote connectivity manager, permit data traffic between a client node and an upstream network, the connectivity manager comprising: a processor; and a memory storing instructions executed by the processor to implement software components including: a network access control interface in communication with the network access controller, to which the client node is connected, the data traffic originating from the client node to the upstream network, and destined to the client node from the upstream network being selectively passed through the network access controller as at least partially designated via a gateway authorization provided to the network access control interface; a client node presence manager in communication with the network access control interface and the remote connectivity manager, the client node presence manager maintaining a presence state of the client node, and a network load manager in communication with the network access control interface and the client presence manager, the network bad manager generating the gateway authorization to the network access control interface in response to receipt of a connection authorization request and an evaluation of one or more access grant conditions, the connection authorization request being received from the remote connectivity manager in advance of any data link requests from client nodes and being based upon an evaluation of flight details of the aircraft against one or more conditions set by the remote application service; wherein the remote connectivity manager is connected to a remote application service that dynamically defines one or more conditions relating to the presence state of the client node for the evaluation of the connection authorization request by the remote connectivity manager; wherein the client node presence manager is connected to a client node application that requests a data communications link to the upstream network. ### Claim 12 (depends on 11) The connectivity manager of claim 11, wherein the upstream network is a satellite communications-based Internet connection. ### Claim 13 (depends on 11) The connectivity manager of claim 11, wherein the network load manager includes: a data traffic monitor in communication with the network access control interface and receptive to current data traffic status messages therefrom; a regulator engine receptive to the current data traffic status messages; and a set of rules corresponding to the access grant conditions; wherein the regulator engine processes the set of rules with the current data traffic status messages, in response to which the gateway authorization is generated. ### Claim 14 (depends on 13) The connectivity manager of claim 13, wherein the network load manager further includes: a historical network usage database with historical network usage data stored thereon; wherein the regulator engine processes the set of rules with the current data traffic status messages and the historical network usage data, in response to which the gateway authorization is generated. ### Claim 15 (depends on 13) The connectivity manager of claim 13, wherein the network load manager further includes: a site list of ordered remote network nodes prioritized according to impacts to network capacity; wherein the regulator engine processes the set of rules with the current data traffic status messages and the site list, in response to which the gateway authorization is generated. ### Claim 16 A system for dynamically implementing exceptions in an onboard network firewall for one or more client devices on a data communications network aboard an aircraft to connect to a remote network node as authorized by a remote application service over a satellite communications link, the system comprising: a client application interface receptive to a data link request from the one or more client devices; an onboard connectivity manager including: a processor; and a memory storing instructions executed by the processor to implement software components including: a firewall interface connected to the onboard network firewall to request the exceptions in response to a connection authorization; and a client presence manager receptive to the data link request relayed by the client application interface from the one or more client devices, a presence state for the one or more client devices being activated and maintained following the data link request; and a remote connectivity manager connected to the remote application service and in communication with the onboard connectivity manager; wherein the remote connectivity manager generates the connection authorization based upon an evaluation of flight details of the aircraft against one or more conditions set by the remote application service, the connection authorization request being generated in advance of any data link requests from the one or more client devices, the connection authorization request including a node identification corresponding to the remote network node with which a particular one of the one or more client devices is permitted to communicate over the satellite communications link; wherein the system further comprises an application installed on the client device that is operable to communicate with the remote application service, the node identification being specific to the application.