Architecture features for a media-centric firewall
AssigneeDisney Enterprises, Inc.
InventorsMichael J. Strein, Benjamin H. Kepler
Life of this patent
Estimating the term…
Abstract
The embodiments herein describe a firewall for a media production system to provide flexible security between an on-premises production environment and remote media production applications and devices (e.g., cloud-based virtual production environments). As new media devices and applications (referred to generally as media nodes) are added at remote locations, the firewall is updated to permit the media nodes to communicate with the on-premises production environment. The embodiments herein described an automatic (e.g., software driven) process where a network orchestrator can detect a change in the media nodes and update the rule set in the firewall accordingly.
Claims21
A method, comprising:
- providing a silo in a firewall containing a rule set that is preauthorized for dynamic changes, wherein the firewall protects an on-premises media production environment;
- detecting at least one of an addition or a subtraction of a media node in a remote media production environment;
- generating a rule change for the firewall that at least one of (i) permits an added media node to communicate with the on-premises media production environment or (ii) prohibits a subtracted media node from communicating with the on-premises media production environment;
- transmitting the rule change to the firewall;
- and
- upon determining, at the firewall, that the rule change affects the rule set in the silo, updating the rule set based on the rule change.
A system comprising:
- a local network configured to provide a service;
- a firewall configured to protect the local network from unauthorized access, wherein the firewall comprises:
- a first silo containing a first rule set preauthorized for dynamic changes, and
- a second silo containing a second rule set that is not authorized for dynamic changes;
- and
- a network orchestrator configured to:
- detect at least one of an addition or a subtraction of a computing resource in a remote network, wherein the computing resource is configured to perform tasks corresponding to the service in the local network,
- generate a rule change for the firewall that at least one of (i) permits an added computing resource to communicate with the service in the local network or (ii) prohibits a subtracted computing resource from communicating with the local network, and
- transmit the rule change to the firewall, wherein the firewall is configured to update the first rule set based on the rule change only after determining the rule change affects the first rule set in the first silo and not the second rule set in the second silo.
A non-transitory computer readable medium having program instructions embodied therewith, the program instructions executable by a processor to perform an operation, the operation comprising:
- providing a silo in a firewall containing a rule set that is preauthorized for dynamic changes, wherein the firewall protects an on-premises media production environment;
- detecting at least one of an addition or a subtraction of a media node in a remote media production environment;
- generating a rule change for the firewall that at least one of (i) permits an added media node to communicate with the on-premises media production environment or (ii) prohibits a subtracted media node from communicating with the on-premises media production environment;
- transmitting the rule change to the firewall;
- and
- upon determining, at the firewall, that the rule change affects the rule set in the silo, updating the rule set based on the rule change.
Dependencies are inferred from the claim text.