Data Diodes and Unidirectional Gateways: When One-Way Is the Right Way

Every connection into a control network is a path an attacker might use. Yet the business needs data from operations: production figures, equipment health, alarms, compliance reports. And the control network needs things from outside: patches, antivirus signatures, vulnerability data. One-way transfer is how many critical sites reconcile the two.

What one-way transfer means

A data diode allows data to travel in only one direction between two networks. In its purest form, the one-way property is enforced in hardware: an optical link with a transmitter on one side and a receiver on the other, and no physical path back.

A unidirectional gateway combines that one-way link with software on each side, so ordinary applications can use it. Because most industrial and IT protocols expect a reply, the gateway’s software acts on their behalf: it collects data on the protected side, sends it across, and presents it on the other side as if the original system were there. A historian can be replicated, files transferred and events forwarded, without the outside ever talking to the inside.

Why not just use a firewall?

Firewalls are essential, and every OT network should have them. But a firewall is two-way by design. It decides what may pass by its rules, and rules can be:

• misconfigured, with an “allow any” added during commissioning and never removed;
• bypassed, through a vulnerability in the firewall itself or in an allowed service;
• changed, by an attacker with administrative access, or by a well-meaning engineer.

A unidirectional design removes the return path altogether. Even a fully compromised system on the outside cannot send a command back across, because there is no channel for it. That is why one-way transfer is common at the boundaries of the most critical zones, and why it suits the conduits between levels described in the Purdue model explained and IEC 62443.

Common uses

• Historian replication. Business users read a replica outside the control network instead of the live historian inside it.
• Monitoring and logging. Security events and logs flow out to a central team without giving that team a way in.
• Central reporting. Sites report into a multi-site view that is read-only by design.
• Safety and protection systems. The most critical zones share their status without accepting any input.

Getting updates in

One-way out solves half the problem. Control systems still need patches, antivirus signatures, vulnerability data and hardening benchmarks. Bringing them in through an open connection, or on unchecked USB drives, undoes the protection.

The safer pattern is a separate, controlled flow in the other direction:

1. Updates are obtained from trusted sources and verified outside the control network.
2. They are staged, so engineers can see exactly what is about to go in.
3. They cross over a dedicated, encrypted, one-way channel that carries nothing else.
4. On the inside, they are distributed to the systems that need them, on a schedule, and their installation is recorded.

Our OT patch management guide covers what happens after the updates arrive.

Questions to ask before deploying

• What data needs to leave, and how fresh must it be? Replication of a historian has different needs from forwarding alarms.
• Which protocols must cross? The gateway software must support them.
• How will updates come in? Plan the inbound path at the same time, not as an afterthought.
• How will remote access work? If the answer is “the same way it does today”, the one-way link may be bypassed by a VPN beside it.
• Can the boundary be locked down? In an incident, the ability to cut every remote path at once is valuable.

How Novaigu helps

UDR moves data out and updates in between sites over private, encrypted, IP-to-IP unidirectional transfer, protected by IPsec, TLS and end-to-end encryption. It distributes patches, antivirus, vulnerability (CVE), benchmarking and hardening updates to one site or many, collects data from safety instrumented systems and third-party systems, and has a lockdown mode that disables remote access entirely. It runs as a virtual or physical appliance and feeds Mission Control, which gives a read-only view of every site.