Data diodes (one-way networks) are often used to effect a hardware based 'air-gap' for high security sites. How do they deal with protocols, such as TCP, that require replys?

I have some inclination that data diodes installed in both directions with some sort of proxy server in the middle might be the answer but am not sure how that does not reduce/compromise the effectiveness of the one way networks. It seems that firewalls and proxy servers would pretty much do the same thing? Am I off track??


It depends on the implementation and on the security requirements. There are solutions which have no back-channel at all in which case you can never be 100% sure that the data are received at the other end. One can try to compensate this by sending the data often enough or with enough error correction but at the end it will not be noticed if the receiver system is simply broken - because there is explicitly no way to get acknowledgments.

And then there are solutions which try to find a different compromise between usability and security by providing a minimum back-channel. One product I know deeper consists of three parts: a micro-kernel in the middle and firewalls on both sides of the micro-kernel. The one-way functionality is implemented using a micro kernel task which uses only minimal code and can thus be better checked for correctness of functionality and robustness. And on both sides of this micro-kernel are the more complex firewalls where applications translate TCP, UDP, FTP or SMTP traffic into the custom one-way protocol transferred by the micro-kernel and back. The minimal back-channel provided by this protocol can signal only success or failure which is just enough to provide early feedback for example in case the receiver crashed and cannot receive more data or even if the FTP transfer failed because the password was wrong. TCP flow control and similar features are implemented by the applications on the firewall and do not travel the micro-kernel.

It seems that firewalls and proxy servers would pretty much do the same thing?

Not really true and not really wrong. The larger the code base is which implements the essential one-way functionality the harder it gets to be sure that there is really only the one-way to communicate. The nice thing about data diodes based on a physical one-way property (like light emitter and receiver) is that they are obviously one-way and can only be bypassed if the attacker has physical access to the system. But the more you move the one-way property away from the obviousness the harder it is to be sure that it is really only one-way.

For example: with physical one-way one could obviously compromise both sides of the diode and still be sure that the one-way property is kept. With the micro-kernel based solutions I've outlined the firewalls on both sides could be compromised too without loosing the one-way property. But it will get bad if the micro-kernel would be compromised. But that's considered impossible without physical access in this solution because the micro-kernel is just what it says: minimal code base, interaction with the outside only through the one-way task and this minimal task is hopefully secure against exploits. With a proxy solution on a single firewall appliance it would be instead enough to compromise this firewall in order to work around the one-way property. Given that firewalls are complex this can be considered more likely than exploiting a micro-kernel or even a physical separation.

Thus: you could achieve one-way functionality using a simple proxy solution but it is hard to prove that it only does one-way in all cases, even if attacked. And the market where data diodes are used has usually high security requirements and often requires that you not only claim that your solution is secure and resistant against attacks but also that you can prove it more or less (i.e. certificates, independent evaluations...). And obvious robustness by design really helps in this case.


The short version is: they don't.

If you're using a data diode, you only want data to flow one way. This means you'll only use protocols that work with one-way traffic, typically primitive ones such as ASCII over Serial. If you need a more sophisticated connection to the outside world, you'll have a computer on the outside translating between your one-way protocol and things like TCP/IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.