Building affordable one-way network devices using common hardware
Implementing Data Diodes Using Commodity Hardware and Open Source Software
Cryptography and SecurityNetworking and Internet Architecture
Summary
Data diodes are special devices that let information flow in only one direction to protect against cyberattacks. They are usually expensive and used in sensitive places like nuclear plants. The authors showed how to create reliable data diodes using regular, easy-to-get network parts and free software. They fixed problems with data loss and made a program called pydiode to send data safely without losing information. This makes one-way network security more affordable and accessible.
What this means in practice
- •For industrial control teams: Deploy cost-effective one-way data transfer devices for securing critical systems using standard fiber-optic hardware and open source software.
- •For network security engineers: Improve reliability of one-way network data transfers in sensitive environments without needing privileged system access or specialized hardware.
Authors
Peter Story, Gert-Jan den Besten
Abstract
One-way network devices, known as data diodes, are used to defend against sophisticated cyberattacks. Partly due to their high cost, data diodes are mostly deployed in nuclear power plants and within the government for handling classified information. Although commercially available data diodes are expensive, a data diode's hardware can assembled from commodity fiber-optic network equipment. However, specialized software is needed to send data through a data diode reliably: the receiving program cannot request retransmission of dropped packets, so packet loss must be minimized and mitigated. First, we developed a minimal program to measure packet loss. We found that most packet loss was caused by the receiving program processing incoming packets too slowly, and that packet loss often occurs in clusters. Also, we discovered ways to minimize packet loss on Linux and macOS without using superuser privileges. Next, we tested three existing open source programs for one-way data transfers: netcat, UDPcast, and lidi. Although these programs were unreliable in their default configurations, we identified reliable configurations for UDPcast and lidi. Finally, we incorporated our findings into pydiode, our cross-platform program for reliable one-way data transfers.