Key takeaways
- A data diode concentrates trust — when it fails, nobody is looking for it
- One-way by component choice is not the same as one-way by physical design
- Supply chain substitution is a realistic threat on high-value targets
- Seven questions to verify the unidirectional guarantee before procurement or audit
- The one-way property should never depend on software, firmware or configuration
The device everyone stops auditing
A data diode, or unidirectional gateway, sits at the exact boundary of the sites that matter most: the control network of a power plant, a substation, a refinery, a rail signalling system, a classified enclave. Its job is simple to state. Data flows in one direction, and nothing can ever travel back.
That promise changes how the rest of the site is defended. Once a diode is installed, the conduit behind it is treated as closed. Monitoring on that path is relaxed, compensating controls are removed, and the risk assessment records the return path as physically impossible. Zone and conduit designs under IEC 62443, and risk treatment plans under NIS2, are built on that assumption.
This is what makes the diode a high-stakes component: it concentrates trust. A firewall that fails is one layer among several, and someone is watching it. A diode that fails is a failure nobody is looking for, at the head of the very site everything else was designed to protect.
Two risks that multiply each other
The first risk is a one-way path that is only one-way by component choice. Many products presented as diodes rely on pluggable optical transceivers, the SFP modules found in any switch, to set the direction: a module that only transmits on one side, a module that only receives on the other. An SFP is a commodity part. Bidirectional variants exist, including single-fibre models that send and receive over one strand, and they are hard to tell apart from the outside. In such a design, the direction of the link depends on which module sits in the cage.
The second risk is the supply chain. Transceivers are produced in very large volumes, through long international chains that the end customer cannot audit. Substituting or modifying a module before delivery, or during a maintenance operation, is a realistic scenario for a well-resourced adversary. The value of the target justifies the effort.
Together, the two risks compound. When the transceivers are sealed inside a chassis that the operator is not permitted to open, nobody on site can see what enforces the direction, at acceptance or after any intervention. A substituted component would turn the diode into a two-way path, and it would do so silently, because legitimate traffic keeps flowing exactly as before. The site would then be running a bidirectional link that is documented, audited and insured as a physical separation, behind which the other defences were deliberately reduced.
None of this suggests that a given product is compromised. It means that the single property the whole architecture depends on rests on a statement the customer cannot check.
What to verify: seven questions for any diode supplier
These questions apply to every unidirectional product, ours included. A supplier with a sound design answers them in minutes.
- Where exactly is one-way enforced? Ask for the single element that makes return transmission physically impossible. A passive optical element with no means of emitting in reverse is a physical guarantee. An active component that is expected to stay silent is a configuration.
- Can you see it? The unidirectional element should be inspectable from the outside, with standard fibre connectors, so that your own team can follow the light path by eye at acceptance and after every maintenance visit, without opening a sealed enclosure or voiding a warranty.
- What happens if a transceiver is swapped? Ask the supplier to walk through the scenario: a bidirectional module is inserted on either side. If a return path then exists, the security function lives in a replaceable commodity part. The sound answer is that the swap changes nothing.
- Who evaluated the one-way function, and what was in scope? Read the security target, not the logo. Check that the evaluation covers the unidirectional function itself, at which assurance level, and by which independent authority: a national agency qualification such as ANSSI’s, or a high Common Criteria assurance level.
- Does the evaluation reach production and delivery? A design can be sound and the delivered unit different. Ask whether the manufacturing site, the component provenance and the delivery process were assessed, and how tampering in transit would be detected.
- Is the security function independent of software? Proxies, protocol connectors and firmware are patched throughout the life of the system. The one-way property should never depend on a software version, a licence or a configuration file.
- Can you re-verify it in ten years? Critical sites keep equipment for a long time. After a repair, a replacement or an upgrade, the operator should be able to repeat the same verification as on day one, with its own staff.
How we build it, with our partners
Cyberium’s One-WayAppliance (OWA) is designed around a strict separation of roles. Proxies on each side handle the protocols that operations need: historian replication, OPC UA, file transfer, logs. Between them sits a distinct optical diode core, supplied by partners whose discipline is that single function.
The core is a separate, visible element. The fibre path between the two proxies runs through the diode core on standard optical connectors, outside the proxies. With a passive optical core, there is no transmitter facing the protected side: your team can follow the path and see that it has one direction.
The transceivers carry no security function. The optical modules on our proxies are standard, exposed and replaceable. If one of them were swapped for a bidirectional model, the core would still carry light in one direction only. The swap scenario of question 3 changes nothing.
In a sealed appliance, the operator has to trust what is fitted inside. With a separate core, the one-way element and the fibre path can be inspected at any time.
The assurance comes from the specialists. The OWA is configurable around the optical core that matches the requirement of the site:
Diode core | Partner | Independent assurance | Typical context |
Tapics | Allentis | ANSSI-qualified, designed and produced in France | Critical infrastructure, French and European sovereign requirements |
ELIPS SD | Thales | ANSSI-qualified, approved for NATO Secret and EU Secret | Defence and classified networks |
Ruggedized core | Sentyron | Common Criteria EAL7+ with formal verification | Defence and classified deployments |
We state the boundary plainly: the qualification or certification belongs to the optical core. Our proxies deliver the application functions, at up to 10 Gbps, and they are engineered so that the one-way guarantee never depends on them.
No design makes a supply chain attack impossible. This one keeps the critical function in a small, single-purpose, independently evaluated component with a traceable origin, and it leaves that component where the operator can see it.
Ask to see it
A diode earns the trust placed in it when its one-way property can be seen, explained in one sentence and verified again years later by the people who operate the site. Before the next procurement or audit, take the seven questions to your current supplier, and to us.
To review the unidirectional conduits of your site against this checklist, contact us.
