Key takeaways
- A data diode enforces one-way data transfer at the hardware level — not through software rules, but through physical architecture
- The absence of a return channel eliminates entire categories of attacks that depend on bidirectional communication, and any remote attack when the Diode is placed in the OT > IT direction, essentially airgapping the OT from the IT.
- Proxy software on each side handles protocol adaptation, making data diodes compatible with OT and IT protocols
- Not all data diodes are architecturally equivalent, the distinction between Simple Diode Solutions and Protocol Filtering Diodes matters for high-assurance deployments
- IEC 62443 SL3/SL4 and NERC CIP explicitly recognize hardware-enforced unidirectional gateways as compliant controls
This guide covers what a data diode is, how it works at the hardware and protocol level, what it protects against, and where it belongs in a security architecture.
What Is a Data Diode?
A data diode is a hardware cybersecurity device that enforces strictly one-way data transfer between two network segments. Data flows out of a secure network toward a less-secure one. Nothing flows back. Not because of a rule. Because the hardware is physically incapable of it.
The device contains two nodes: one send-only, one receive-only. The optical transmitter on the send side emits light across a fiber link. On the receive side, there is no transmitter — no hardware component capable of generating a signal in the opposite direction. The directionality is a consequence of the physical design, not a configuration.
Data diodes are also referred to as unidirectional security gateways or optical diodes. These terms are largely interchangeable, though some unidirectional gateways include additional software layers on top of the optical hardware.
How a Data Diode Works
The hardware layer
A data diode is not simply a fiber optic cable with the return wire cut. True unidirectionality requires more than physical asymmetry.
One side of the optical core embeds a receive-only fiber-optic interface, receiving light from the upstream proxy transmitter. The opposite side embeds a transmit-only interface, sending light to the downstream receiver. But asymmetry alone is not sufficient — reflected or residual light could theoretically still travel backward.
This is why a production-grade data diode adds an optical isolator between the two sides: any backward light is attenuated below detectable level, and galvanic isolation between the electrical and optical layers eliminates any remaining electrical return path. The result is a system where remote attack is not just blocked — it is physically impossible.
The proxy software layer
Most network protocols — including TCP/IP — require bidirectional communication. TCP relies on acknowledgments. A session needs a return path to function.
Data diodes solve this with proxy software on both sides of the optical link. The send-side proxy receives traffic from the source system, converts it into a one-way protocol for transmission across the hardware link. The receive-side proxy reconstructs the data and initiates a new session with the destination system.
The source system communicates normally with the send-side proxy. The destination system communicates normally with the receive-side proxy. The optical layer between them has no attack surface — it carries data in one direction and cannot be queried, probed, or exploited from either side.
Protocol Filtering Diodes vs Simple Diode Solutions
Not all data diodes implement the hardware/software split in the same way.
Simple Diode Solutions (SDS) perform the protocol conversion in proxy software on each side of the hardware link.
Protocol Filtering Diodes (PFD) perform the protocol break and packet transformation directly in the hardware — typically in FPGAs — rather than in proxy software. The US Government considers PFD superior to SDS in both security and capability for high-assurance environments.
The distinction matters when choosing a data diode for classified or sovereign network applications.
What the Absence of a Return Channel Eliminates
The security value of a data diode is not just what it blocks, it’s what it makes structurally impossible.
Several attack categories depend entirely on bidirectional network communication:
Command-and-control communications. Malware that reaches an OT system needs to communicate back to its operators to receive instructions. With no return channel, that communication path doesn’t exist. The malware is cut off from its handlers.
Remote access trojans. RATs require a persistent outbound connection from the compromised system to an attacker-controlled server. A data diode at the network boundary severs that connection at the hardware level.
Data exfiltration over the network. An attacker who has accessed sensitive data needs a path to move it out. One-way hardware enforcement means that path doesn’t exist at the boundary, data can only leave the protected network in the direction the hardware permits.
Backchannel exploitation. Firewalls that permit bidirectional traffic — even with strict filtering — maintain a return channel that sophisticated attacks can exploit through zero-days, misconfiguration, or compromised credentials. A data diode has no return channel to exploit.
This is why data diodes are described as providing hardware-enforced isolation rather than hardware-enforced filtering. A firewall filters. A data diode removes the attack surface.
What Data Diodes Are Used For
OT historian replication
The most common deployment in industrial environments: process data from PLCs and SCADA systems flows outbound through the data diode to enterprise-side historians — such as AVEVA PI System, AspenTech IP.21, or Honeywell Uniformance — for analytics and monitoring. Operations remain visible to the business. No inbound path is created.
SOC log forwarding
Security events from OT devices — PLCs, HMIs, RTUs — forward outbound to the enterprise SIEM. The SOC retains full visibility into OT network activity. The OT network remains unreachable from the IT side.
SCADA monitoring from remote locations
SCADA systems at remote or unmanned sites transmit operational data to central monitoring locations via data diode. Operators can observe, but cannot reach back into the remote system through the monitoring connection.
Cross-domain and classified network transfers
In government and defense environments, data diodes enable secure data transfer between networks of different classification levels. Data moves from a high-classification network to a lower-classification one without creating any inbound path into the sensitive environment. Cross-domain solutions for classified environments involve specific certification requirements covered separately.
Immutable backup isolation
A data diode between production systems and backup infrastructure ensures that [backup environments cannot be reached from a compromised production network] — eliminating the ransomware attack path that targets backup systems alongside primary data.
Not All Data Diodes Are Equivalent
The hardware optical layer is consistent across data diode implementations. What varies significantly is the software layer built on top of it.
A data diode with a limited protocol proxy supports only specific data types and transfer modes. A data diode with a mature software layer supports simultaneous transfer of multiple data types — file transfers, database replication, syslog streams, video feeds — across the same hardware link, with logging, monitoring, and management interfaces.
Key differentiators to evaluate:
- Protocols supported natively via proxy software
- Real throughput vs. raw bandwidth. Vendors commonly advertise connectivity capacity — 10 Gbps, 100 Gbps — but this figure describes the physical link, not the actual data transfer rate. What matters is end-to-end throughput: how much data actually crosses the diode when transferring encrypted files over SFTP, replicating a historian, or streaming multiple simultaneous flows. Encryption overhead, protocol encapsulation, and proxy processing all reduce real-world throughput significantly below the headline figure. Cyberium’s OWA publishes real end-to-end bandwidth figures rather than raw link capacity
- Certifications — For high-assurance environments EAL4+ up to EAL7+ for, Sovereign / National certifications requirements for critical infrastructures (ANSSI…)
- PFD vs SDS architecture for high-security government applications
Management and monitoring capabilities
In OT environments, a data diode that’s hard to operate creates its own risk. Key criteria:
- Ease of configurability : how quickly can the device be set up and reconfigured without specialist intervention
- Ease of monitoring : visibility into transfer status, errors, and throughput in real time
- Forgettability : hard and soft robustness meaning the device operates reliably without constant attention; it should work and stay working
- Low footprint : physical form factor (1U rack, low power consumption) matters in industrial environments with constrained space and energy budgets
- Flip or temporary disable : the ability to safely pause or bypass the diode during OT maintenance windows without creating a security gap
Compliance and Regulatory Alignment
IEC 62443: the international standard for industrial control system security — defines security levels from SL1 to SL4. At SL3 and SL4, the standard recognizes unidirectional security gateways as a compliant control for enforcing zone separation. Firewalls satisfy lower security levels; hardware-enforced unidirectional gateways satisfy the highest.
NERC CIP: applicable to Bulk Electric System operators in North America — identifies unidirectional gateways as a compliant mechanism for crossing Electronic Security Perimeters. The standard explicitly accounts for the difference between software-based and hardware-enforced boundary controls.
NIST SP 800-82 and the NIST Cybersecurity Framework reference data diodes in the context of defense-in-depth and network segmentation for ICS environments.
ISO 27001 security controls around confidentiality, integrity, and availability are supported by data diode deployments — particularly in environments where network segmentation and prevention of data leakage are explicit requirements.
The compliance case for data diodes is simpler than for firewalls: the physical enforcement is verifiable without ongoing audit of rule sets. There are no policies to review, no configuration drift to check.
Frequently Asked Questions
What is a data diode in cybersecurity?
A data diode is a hardware device that enforces one-way data transfer between two network segments. Return communication is physically impossible — not blocked by a rule, eliminated by the hardware.
How does a data diode handle TCP protocols?
Via proxy software on each side of the optical link. The send-side proxy converts TCP traffic into a one-way protocol. The receive-side proxy reconstructs it for the destination. The optical layer between them carries data in one direction only.
What is the difference between a data diode and a firewall?
A firewall filters bidirectional traffic based on rules that can be misconfigured or exploited. A data diode enforces one-way communication at the physical layer — no configuration, no CVE history, no return channel.
What is the difference between a data diode and a unidirectional security gateway?
The terms are largely interchangeable. Strictly, a unidirectional security gateway includes the hardware optical layer plus the proxy software and management capabilities on top of it.
What is the difference between a Protocol Filtering Diode and a Simple Diode Solution?
In an SDS, protocol conversion happens in proxy software. In a PFD, it happens in the hardware itself — typically FPGAs. The US Government classifies PFD as superior for high-assurance deployments.
Who needs a data diode?
Any organization where a network breach has physical, safety, or national security consequences — energy, oil and gas, water treatment, defense, government, manufacturing.
