Unidirectional Gateway

A unidirectional gateway enforces security at the physical layer by using an optical fiber link with the transmit laser on one side and the receive photodiode on the other. There is no return path for light, making it physically impossible for data to travel back. This is fundamentally different from software firewalls, which rely on configurable rules that can be misconfigured, disabled, or bypassed through vulnerabilities.

• Uses separate transmit and receive optical components
• No shared electronics between the sending and receiving sides
• Eliminates entire classes of remote attacks at the hardware level

The primary use case is securely replicating real-time operational data from a protected OT network to an external IT or business network. The gateway acts as a proxy server on the OT side, collecting data from industrial devices via protocols like OPC UA, Modbus, or DNP3, then forwarding it unidirectionally. On the IT side, a receiving server reconstructs the data stream for historians, dashboards, and analytics platforms.

• Breaks the direct network connection between OT and IT
• Supports common industrial protocols for data collection
• Enables cloud analytics without exposing control systems

Because there is no physical return path, an attacker who compromises the external IT network cannot send any command back to the OT network through the gateway. This renders remote manipulation of Programmable Logic Controllers (PLCs) and other field devices impossible via this path. Even if the receiving server is fully compromised, the attacker cannot inject malicious Modbus writes or DNP3 control commands.

• Prevents remote manipulation of physical processes
• Neutralizes pivoting from IT to OT environments
• Eliminates the attack vector exploited in TRITON and INDUSTROYER campaigns

The core hardware component is often referred to as a data diode—an electronic analog to a check valve in fluid systems. The simplest implementation uses a fiber optic cable with the transmit (TX) pin connected on the source side and the receive (RX) pin connected on the destination side, with no reciprocal connection. More sophisticated implementations use dedicated hardware boards with separate unidirectional data paths.

• Based on the principle of an electronic check valve
• Can be implemented with standard fiber optic components
• Validated under Common Criteria EAL levels for high-assurance environments

A unidirectional gateway does not simply forward packets; it terminates the bidirectional protocol on the OT side and rebuilds a new unidirectional stream. For example, a TCP three-way handshake requires bidirectional communication, so the gateway acts as a TCP proxy on the OT side, extracts the payload, and sends only the data. The IT-side server then republishes this data using a fresh bidirectional session.

• Terminates TCP sessions to enforce unidirectionality
• Strips protocol overhead before forwarding payload
• Prevents protocol-level attacks from traversing the boundary

Unidirectional gateways directly satisfy the network segmentation requirements mandated by multiple industrial cybersecurity standards. They provide a defensible, auditable boundary that simplifies compliance with frameworks requiring strict separation between safety-critical and administrative networks.

• IEC 62443: Satisfies zone and conduit segmentation requirements
• NERC CIP: Meets Critical Infrastructure Protection standards for electronic security perimeters
• NIST SP 800-82: Aligns with guidance for ICS network segmentation
• Simplifies audit evidence by providing a physically verifiable boundary

The physical layer of a unidirectional gateway, typically implemented using an optical fiber with a severed return path or a copper link with a disabled receive circuit. Unlike software firewalls, this creates an air gap at the physical layer, making it impossible for any remote attacker to exfiltrate data or inject commands back through the diode.

• Optical diodes: Use a laser transmitter on the send side and a photodiode receiver on the receive side with no return fiber.
• Copper diodes: Physically disconnect the RX pair on the sending computer and the TX pair on the receiving computer.
• Assurance level: Evaluated under Common Criteria EAL 7+ for mathematical verifiability of the one-way property.

The unidirectional gateway is the definitive enforcement point at the Industrial Demilitarized Zone (IDMZ). It replaces traditional firewalls between Level 3 (Operations) and Level 4 (Enterprise) in the Purdue model. By physically preventing any traffic from the enterprise network reaching the control system, it eliminates the entire class of remote command injection attacks.

• Deployed between the Process Control Network (PCN) and the corporate LAN.
• Allows historians and monitoring tools to receive real-time data without exposing controllers.
• Satisfies NERC CIP requirements for external routable connectivity isolation.

Because the gateway is physically one-way, standard TCP handshakes cannot complete. The sending side must employ a protocol-breaking proxy that terminates the connection, extracts the payload, and forwards it over a simplex protocol like UDP or a custom serial stream. The receiving proxy reconstructs the data and presents it to the destination server.

• Modbus TCP queries are terminated on the OT side; only register values are forwarded.
• OPC UA pub/sub models can be configured to push data without requiring a return acknowledgment.
• Eliminates protocol-level attacks because no bidirectional session ever traverses the boundary.

A primary use case is securely replicating a PI System or other operational historian to the corporate network for analytics and compliance reporting. The unidirectional gateway ensures that even if the enterprise network is fully compromised, the attacker cannot pivot back to pollute or delete the source historian data.

• OSIsoft PI-to-PI replication configured over a data diode using a store-and-forward proxy.
• Maintains data integrity on the secure side while allowing business intelligence tools unrestricted read access to the replica.
• Supports NIST SP 800-82 guidance for ICS security monitoring without introducing risk.

Transferring anti-virus signatures, patch files, and engineering documentation into a protected OT enclave requires a bidirectional flow. A unidirectional gateway cannot perform this natively. Instead, a dual-diode architecture or a separate sneakernet process is used for inbound transfers, ensuring the primary monitoring path remains strictly one-way.

• Outbound monitoring data flows through the primary diode.
• Inbound software updates are transferred via a physically separate, tightly controlled removable media process.
• This separation ensures that a compromise of the file transfer mechanism does not disable anomaly detection visibility.

Unidirectional gateways are the ideal transport mechanism for passive monitoring data. A Network TAP or SPAN port mirrors all ICS traffic to a monitoring appliance, which then forwards parsed metadata and alerts through the data diode to the enterprise SIEM. This guarantees zero impact on the determinism of the control loop while providing full cybersecurity visibility.

• Zeek or Suricata sensors on the OT side generate logs.
• Logs are forwarded via syslog-over-diode to a corporate Splunk or ELK stack.
• Satisfies the requirement for non-intrusive security monitoring in high-availability environments.