One-way transfer device with secure reverse channel
AssigneeFend Incorporated
InventorsSang Cheon Lee, Colin Patrick Dunn, Paul Carroll, Philip Quebe
Life of this patent
Estimating the term…
Abstract
A data diode provides a flexible device for collecting data from a data source and transmitting the data to a data destination using one-way data transmission across a main channel. On-board processing elements allow the data diode to identify automatically the type of connectivity provided to the data diode and configure the data diode to handle the identified type of connectivity. Either or both of the inbound and outbound side of the data diode may comprise one or both of wired and wireless communication interfaces. A secure reverse channel, separate from the main channel, allows carefully predetermined communications from the data destination to the data source.
Claims20
A data diode, comprising:
- a first processing element;
- a second processing element;
- a main channel coupled between the first processing element and the second processing element, providing hardware-enforced one-way communication from the first processing element to the second processing element;
- and
- a secure reverse channel coupled between the first processing element and the second processing element providing hardware-enforced one-way reverse communication from the second processing element to the first processing element,
- where the reverse communication consists of a request to execute one of a predetermined set of commands,
- wherein the request comprises a representation that corresponds to a command of the predetermined set of commands, and
- wherein the first processing element interprets the representation to determine the command.
A method of sending a command via a data diode, comprising:
- sending a request to execute the command via a secure reverse channel of the data diode that provides hardware-enforced one-way communication from a second processing element of the data diode to a first processing element of the data diode;
- executing the command responsive to a determination by the first processing element that the command is a member of a set of predetermined commands;
- and
- responding to the command with data transmitted via a main channel that provides hardware-enforced one-way communication from the first processing element to the second processing element,
- wherein the request comprises a representation that corresponds to a command of the predetermined set of commands, and
- wherein the first processing element interprets the representation to determine the command.
Dependencies are inferred from the claim text.