I was just wondering how I could build a private network where it is physically impossible to gain access from outside but still have the option to publish data to some remote server. As an example: Let's say I have a network of devices that controls some kind of critical infrastructure and I don't want anyone to be able to access it except for the people on-site. However, I'd still linke to send diagnostic information without notable delay to a remote server that can be accessed from the internet.
Assumptions about the attacker:
- can break into any system that is connected to the internet
- does not have physical access to the private network
So we can't just put a server that acts as a firewall between the public and private network, because every software has flaws and the attacker would gain access to the private network as soon as the firewall has been broken (except if we had a firewall where the rules are embedded in hardware or for some other reason impossible to be modified without physical access. Are there such devices?)
What could solve the problem is a device that physically allows only unidirectional communication (in our case from the private to the public network). I don't know if there are any such devices, but I came up with some ideas:
- use any kind of write-only media, like CD-ROMs. Issues: high latency and requires specialized hardware to automatically move CDs between machines.
- paper printer/scanner setup: Have a printer in your private network that feeds directly into a scanner that is connected to the public network. Latency reduced to just a few seconds, but error-prone due to OCR.
- Fiber-optic communication: On the side of the receiver, physically remove the optical transmitter (or remove the receiver on the other side), therefore only unidirectional communication is possible. Probably won't work with Ethernet though (are there any network protocols that properly handle unidirectional communication?)
Before I continue to make a fool out of myself because I've missed the obvious solution, I'd love to hear your comments on this :)