The short answer
Data Diodes
A data diode is a hardware device with a transmitter on one side and a receiver on the other and no return path, so that information can leave the control network and nothing can enter it, not a packet, not an acknowledgment, regardless of any configuration or compromise. A unidirectional gateway pairs a diode with software on each side that replicates a historian, a file share, a database, or a protocol server from the control side to the outside, where users connect to the replica. It fits the boundary where the consequence of an inbound compromise is highest and the traffic is inherently one way: the historian and reporting path from the control network to the DMZ or the office, and the feed to a cloud or a regional operations center. It cannot carry anything that needs a reply, so remote access, vendor support, and any command from outside are excluded by design, which is the point. For most utilities a firewall with one-way rules is proportionate at most boundaries; the diode is chosen for the boundary where the utility wants physics rather than configuration.
Key points
- One direction, enforced by hardware: no return path exists, so no configuration error or compromise can open one.
- The gateway software replicates a historian, a file share, or a protocol server to the outside; users connect to the replica.
- It fits the historian and reporting path outward, and the cloud feed; it excludes remote access by design.
- Protocols that need acknowledgments are handled by the gateway proxies on each side, not across the diode.
- A lost frame cannot be retransmitted by the receiver asking; the gateway uses redundancy and sequence checks instead.
- A firewall with one-way rules is proportionate at most boundaries; the diode is for the one where the consequence justifies hardware.
What it is
A firewall is software with a rule that says traffic may flow one way, and the rule can be changed, bypassed by a vulnerability, or misread by an administrator. A data diode is a fiber transmitter on the control side and a fiber receiver on the outside, with no transmitter on the outside and no receiver on the control side. Light goes one way. There is no rule to change and no path to exploit; an attacker with complete control of every machine outside the diode has no physical means of sending a single bit inward. That property is why diodes are used at the boundaries of nuclear and military systems, and why a utility considers one for the boundary it worries about most.
How data crosses
Network protocols expect replies: a request is acknowledged, a lost packet is retransmitted on request, a connection is negotiated. None of that works across a diode. A unidirectional gateway solves it with software on each side. On the control side, a proxy connects to the historian, the file share, the database, or the protocol server as an ordinary client, reads the data, and sends it through the diode as a stream with sequence numbers and error correction. On the outside, a proxy receives the stream and rebuilds a replica: a second historian that outside users query, a mirrored file share, a database that reports read, a protocol server that outside systems poll. The outside sees a normal server; the control side sees a normal client; the diode in between carries a stream that nothing can answer.
| Carried outward | How | Note |
|---|---|---|
| Historian data | The control historian replicated to an outside historian | The standard use; the outside historian serves the office and the reports |
| Files | A file share on the control side mirrored outward | Reports, exports, logs, backups leaving the control network |
| Database tables | Selected tables replicated | Reporting databases |
| Protocol servers | A Modbus or OPC server on the control side replicated as a server outside | Outside systems poll the replica; their polls never reach the control side |
| Logs and syslog | Streamed outward to a collector | Security monitoring from the outside of the diode |
| Screen images | Periodic captures of displays replicated outward | View-only situational awareness for the office |
What it cannot do
- Remote access, vendor support sessions, and any interactive connection into the control network; those need a reply path and go through the jump host instead.
- Commands or setpoints from outside into the control network; a diode that carries them is not a diode.
- Retransmission on request; the receiver cannot ask, so the gateway sends redundantly and checks sequence, and a gap is reported rather than filled.
- Time synchronization inward; the control network has its own time source.
- Antivirus updates and patches inward; those arrive through a separate controlled path, or through a second diode pointing inward with its own scrutiny, which some vendors offer.
Where it belongs
| Boundary | Diode or firewall | Reasoning |
|---|---|---|
| Control network to DMZ, historian and reporting path | Diode where the consequence justifies it; firewall with one-way rules otherwise | Traffic is inherently outward; the diode removes the inbound path entirely |
| DMZ to office | Firewall | The DMZ is the buffer; a firewall is proportionate |
| Control network to cloud or regional operations center | Diode, or a broker in the DMZ fed one way | Outward publish only; nothing from the cloud reaches a controller |
| Safety system to control network | Diode from the safety system outward, or nothing | The safety system reports status; nothing writes to it |
| Remote access into the control network | Firewall, VPN, jump host, multi-factor authentication | A diode cannot carry it; the path is designed with its own controls |
| Between control zones inside the plant | Firewall | Two-way traffic between zones is normal; rules define the conduits |
Operating one
A diode installation is monitored like any link: the gateway reports the stream health, the sequence gaps, and the replica lag, and the outside historian is compared with the inside one on a schedule. The proxies on each side are servers that are hardened, patched, and backed up. A change on the control side, a new tag, a new file share, is mirrored by a change in the gateway configuration under change management. And the organization accepts the consequence: when someone outside wants to send something in, the answer is the controlled path through the jump host, not a hole in the diode.
Frequently asked questions
- Is a diode required by any regulation for water utilities?
- No regulation requires it; the industrial security standards describe it as a means of achieving the highest security levels at a zone boundary, and some insurers and assessors regard it favorably. It is a design choice for the boundary where the utility decides that configuration is not enough.
- What happens when the outside historian falls behind?
- The gateway reports lag and gaps; the outside replica catches up from the stream if the gateway buffers, and a persistent gap is filled by a re-send initiated from the control side, because only the control side can initiate anything. Monitoring of the gateway is part of the installation.
- Can a diode replace the DMZ?
- It changes what the DMZ is for. With a diode carrying the historian and files outward, the DMZ still hosts the replicas, the jump host for the remote access that the diode cannot carry, and the update path inward. The diode removes the inbound risk on the data path; the DMZ remains for everything else.
- How much do they cost?
- The hardware is modest; the gateway software licensed per replicated application is the larger part, and the total is comparable to a redundant pair of enterprise firewalls. Against the cost of the incident it prevents on the boundary it protects, utilities that have chosen one consider it reasonable.
Related topics
- Industrial DMZ DesignThe buffer zone between the business network and the control system: what goes in it, the no-direct-path rule, push-not-pull data flows, the firewall pair, and the services a utility actually needs to place there.
- Historian SecurityThe historian is the most connected server in a control system and the most exposed: giving the office, reports, and the cloud the data they need without a path to the plant, with a collector in the control zone, a replica in the DMZ, and one-way flow.
- Zones and ConduitsThe IEC 62443 way to segment a control system: grouping assets into zones with a shared security level, inventorying every conduit between them, and turning the drawing into firewall rules. With a worked water utility example.
- IEC 62443The international standard series for industrial automation and control system security: how it is organized, what security levels and foundational requirements mean, and how a utility or integrator actually uses it.
- Firewall Rule DesignWriting the rule set for a control network boundary: default deny, one rule per conduit with its reason, hosts not subnets, protocol and port and function, direction and initiator, logging on every rule, and the review that removes forgotten rules.
- Historian ArchitectureHow process history is collected, stored, and served: the collector, the archive, and the client layers, where the historian sits relative to SCADA and the DMZ, single-server and tiered designs for a utility, the store-and-forward buffer that survives outages, and the sizing that decides how many years fit on a disk.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.