Method for securely transmitting control data from a secure network

A secure method of transmitting message data identified by a unique message identifier from a secure control system to a non-secure computer comprising the steps of:

• a) assembling the message data into a message;
• b) transmitting the message, via a predetermined non-routable communication protocol over a unidirectional physical communications link from said secure control system directly to said non-secure computer, the unidirectional communications link providing the only communication between the secure control system and non-secure computer;
• c) at the non-secure computer receiving and decoding the message;
• d) when the message had been previously received and decoded correctly, discarding currently decoded message and continuing at step “b”;
• e) identifying whether the decoded message is received correctly;
• f1) when the message is not received correctly, then discarding the currently received message and continuing processing at step “b”;
• f2) when the message was received correctly, then decoding it to identify the message data;
• g) validating whether the message data is received correctly;
• h1) when the message data is not received correctly, then discarding the currently received message and continuing processing at step “b”;
• h2) when the message data is received correctly, then storing the message data along with its unique message identifier as a decoded copy;
• i) repeating steps “b”-“h1/h2” for each message for a plurality of cycles;
• and
• wherein the secure control system receives no feedback data from the non-secure computer,
• each cycle of transmissions begins with a newest pending message being transmitted first and ending with an oldest pending message which has not yet been transmitted a pre-determined number of times, and
• the predetermined non-routable communication protocol does not include a data field that facilitates routing of the message over a packet routing network.

A secure method of transmitting message data identified by a unique message identifier from a secure computer directly to a non-secure computer comprising the steps of:

• a) creating a message header having information identifying the message and indicating its structure;
• b) creating a message checksum from the message header, and message data;
• c) transmitting a message comprising the message header, the message data and the message checksum, via a predetermined non-routable communication protocol over a unidirectional physical communications link from said secure computer directly to said non-secure computer, the unidirectional physical communications link providing the only communication between the secure control system and non-secure computer;
• d) at the non-secure computer receiving the message;
• e) using the message checksum to identify whether the message was received correctly;
• f1) when the message was not received correctly, then discarding the currently received message and continuing processing at step “c”;
• f2) when the message was received correctly, then using the message header to identify the message data;
• g) validating that the message data was received correctly;
• h1) when the message data was not received correctly, then discarding the currently received message and continuing processing at step “c”;
• h2) when the message data was received correctly, then identifying the message identifier and storing this as a decoded copy of the given message identifier;
• i) when all of the message data for this message identifier has not been successfully received in earlier transmissions, saving the decoded copy for further communication or processing;
• j) repeating steps “c”-“i” for each message a predetermined number of times;
• and
• wherein the secure computer receives no feedback from the non-secure computer,
• each cycle of transmissions begins with a newest pending message being transmitted first and followed by an older pending message, which has not yet been transmitted a pre-determined number of times, and
• the predetermined non-routable communication protocol does not include a data field that facilitates routing of the message over a packet routing network.