A hardware device that lets plant data flow out to the business network while making inbound attacks physically impossible.
A data diode is a hardware device that allows data to travel in only one direction between two networks. It protects control systems by sending data out while physically blocking anything from coming back in.
What Is a Data Diode?
A data diode is a network security device that allows traffic to pass in one direction only, usually from the OT network to the IT network. It sits at the boundary between levels of the Purdue model, where plant data leaves the control zone.
The name comes from the electronic diode, which lets current flow in one direction. Here the one way rule is enforced by hardware rather than by software rules.
Inside, the sending side has only an optical transmitter and the receiving side has only an optical receiver. With no return fibre and no transmitter on the receiving side, no signal can travel back.
Owl Cyber Defense notes this technology has protected military and critical infrastructure networks for about three decades. It is now common in power, nuclear, oil and gas and water plants.
How One Way Transfer Works
Normal protocols such as TCP need acknowledgements, which a one way link cannot carry. Proxy software on each side handles this, as explained in our guide on TCP and UDP.
The send proxy talks normally to OT servers, then pushes data across the fibre using a one way method. The receive proxy rebuilds the data and serves it to IT users as if they were talking to the original server.
This protocol break also means attack packets cannot simply ride through. Nothing from the IT side ever reaches the OT side.
4 Ultimate Benefits of a Data Diode
Benefit 3 is the big one. Many of the cyber attacks on industrial sites began with remote access through the IT network.
Benefit 4 ties into the zone and conduit model of IEC 62443, where the diode becomes a very strong conduit between zones.
Data Diode vs Firewall vs Unidirectional Gateway
| Feature | Data Diode | Firewall | Unidirectional Gateway |
|---|---|---|---|
| Direction control | Hardware, one way | Software rules | Hardware plus software |
| Inbound attack path | None | Possible if misconfigured | None |
| Protocol support | Via proxies | Native | Rich application proxies |
| Configuration risk | Very low | High | Low |
| Two way needs | Not supported | Supported | Not supported |
| Cost | Medium to high | Low to medium | High |
Waterfall describes unidirectional gateways as building on data diode hardware and adding protocol validation and application layer controls. The terms are sometimes used loosely, so check what each product includes.
A firewall still has a place for two way traffic, such as engineering access. Compare this with the options in our air gapped vs segmented networks guide.
Types of One Way Solutions
Hardware only, often paired with customer supplied proxy servers.
Diode plus built in proxies for historians, OPC and files.
Two diodes in opposite directions with separate controls.
Optimized for moving files, patches and logs outward.
Paired diodes provide controlled two way sharing while keeping each direction independent. They are used where some data must flow back, such as scheduled setpoint files.
The right type depends on which protocols you must replicate. Check that the vendor supports your historian, OPC and file formats before buying.
Where One Way Diodes Are Used
Historian replication is the most common use. A process historian on the OT side feeds a replica in the DMZ or IT network through the one way link.
For vendor monitoring, the one way link replaces risky remote access tools. Compare this with the options in PLC remote access security.
Bandwidth Formula With a Worked Example
Link utilization = Average rate ÷ Link speed × 100
Worked example:
Historian data = 50 GB per day
50 GB × 8 = 400 Gbit
Average rate = 400,000 Mbit ÷ 86400 s = 4.63 Mbps
Link speed = 100 Mbps
Utilization = 4.63 ÷ 100 × 100 = 4.6 percent
Leave plenty of headroom for bursts, backfill after outages and future tags. Many designs aim to keep average utilization well below half the link speed.
Because a one way link cannot request retransmission, vendors add error correction and buffering. Ask how the product handles lost data during a link break.
One Way Link Utilization Calculator
Use decimal gigabytes here, where 1 GB equals 8000 Mbit. Check your historian export size over a busy week for a realistic value.
- Hardware enforced one way flow.
- No inbound attack path at all.
- Low configuration risk.
- Strong fit with IEC 62443 zones.
- No two way traffic without paired diodes.
- Proxies needed for TCP based protocols.
- Higher cost than a firewall.
- Remote support must use other controlled paths.
Diodes and Unidirectional Gateways PDF
Data Diode Explainer Video
Data Diode Questions and Answers
Related Articles
- Purdue Model for ICS Cybersecurity
- IEC 62443 Zones and Conduits
- Air Gapped vs Segmented ICS Networks
- Zero Trust Architecture for OT Networks
- SCADA Network Security
External References
- Data Diode vs Unidirectional Gateway, Waterfall Security
- Diodes and Gateways, Owl Cyber Defense
- Unidirectional Security Gateway Guide, OPSWAT
- Unidirectional Network, Wikipedia
- Securing OT Networks with Unidirectional Gateways, Industrial Ethernet Book
What We Learn Today
- This device enforces one way flow in hardware with a transmitter only link.
- Proxies on both sides let normal protocols work across the one way link.
- It is ideal for historian replication and blocking inbound attacks on OT.