What is a data diode?
A data diode is a network device that enforces in hardware that data can flow in only one direction between two networks, so that there is physically no return path for commands, malware or any other communication. In OT environments a data diode usually sits on the boundary between the production network and the office network: process data goes out, but nothing can come in. Other names are unidirectional gateway, one-way gateway or deterministic one-way boundary device. Because the one-way behaviour lives in the electronics and optics rather than in a configuration, a mistake in rules or software cannot reverse the direction.
🧠 How does a data diode work?
The principle is simple. Most data diodes use a fibre-optic link with only a transmitter (laser or LED) on the send side and only a receiver (photodiode) on the receive side. There is no second fibre and no return channel. Light can therefore travel one way only, just as current flows through an electronic diode.
That has direct consequences for protocols:
- No handshake possible - TCP needs a three-way handshake and acknowledgements (ACKs) for every connection. That does not work over a bare diode.
- Proxies on both sides - each side therefore has a server running dedicated software. The send proxy terminates the TCP connection with, for example, a SCADA server or historian and pushes the data across the diode as a one-way stream, usually based on UDP. The receive proxy builds a new connection on the other side.
- No retransmission - the sender never learns whether a packet arrived. Vendors therefore use redundancy, error correction, sequence numbers and checksums. Anything that is still lost can only be reported by the receiver through another channel.
- Protocol emulation - advanced solutions replicate complete databases or emulate servers. The receive side then presents, for instance, a copy of an OPC UA server or historian, while the source stays inside OT.
NIST draws exactly this distinction in SP 800-82 Rev. 3 (September 2023): the hardware is physically unable to send anything back, while the software replicates databases and emulates protocol servers and devices.
🔄 What is the difference between a data diode and a firewall?
A firewall or industrial firewall decides per packet based on rules. A data diode decides nothing: the direction is fixed in hardware.
| Aspect | Data diode | Firewall |
|---|---|---|
| Direction | Physically one way only | Both ways, according to rules |
| Enforcement | Hardware (optics, electronics) | Software and configuration |
| Effect of a configuration error | Traffic stays one-way | Unintended inbound traffic possible |
| Protocols | Only via proxies or replication | Almost any protocol directly |
| Remote management into OT | Impossible through the diode | Possible, with the right rules |
| Content inspection | None, unless filtering is added | Possible through protocol filtering and DPI |
| Typical location | Boundary of the most critical zone | Between zones with two-way traffic |
The choice is therefore not either-or. A data diode does not replace a firewall; it is an additional, hard separation wherever two-way traffic is unnecessary or unacceptable. Where two-way traffic is required, such as for remote access, a firewall in an IDMZ remains the usual solution.
🏭 Where are data diodes used in industry?
Data diodes are particularly suited to highly secured or regulated environments. Typical applications:
- Historian replication - the historian in OT replicates to a copy in the DMZ or IT, where users, MES and ERP read only that copy
- Monitoring from IT - alarms, syslog messages and real-time trends flow to a SIEM or SOC without the SOC being able to reach in
- Network detection - mirrored OT traffic goes to a sensor for anomaly detection outside the protected zone
- Process industry - the NOA diode from NAMUR Open Architecture lets field and process data flow to monitoring and optimisation without touching the control system
- Critical infrastructure - nuclear plants, power grids, drinking water and water management, where a data diode offers air gap-like separation without giving up the use of data
There are two directions, each with its own purpose:
| Direction | Protects | Example |
|---|---|---|
| Inside to outside (OT to IT) | Integrity and availability of the protected network | Process data from PLC and SCADA to IT |
| Outside to inside (low to high) | Confidentiality of the protected network | Defence or government network that receives data but must not leak any |
In OT it is almost always the first direction. The original data diodes of the 1980s and 1990s actually came from the second world: governments that wanted to feed classified networks without any risk of leakage.
🧱 Where does a data diode sit in the Purdue model?
In the Purdue Model a data diode usually sits between levels 2 and 3, or between level 3 and the IDMZ. NIST gives the example of a unidirectional gateway between levels 2 and 3: it protects devices at levels 0 to 2 from an incident at level 3, 4 or 5.
In IEC 62443 terms, a data diode is one way to implement a conduit between two zones. The standard does not prescribe a data diode, but a risk assessment under IEC 62443-3-2 can arrive at a security level so demanding that only one-way traffic is justifiable. In the US nuclear sector, however, one-way flow is the norm. In Regulatory Guide 5.71 (January 2010) the Nuclear Regulatory Commission describes an acceptable way to meet the cyber security rule 10 CFR 73.54: nuclear plants allow only one-way data flow from level 4 to 3 and from 3 to 2, enforced by hardware mechanisms.
🔐 What are the limitations and risks of a data diode?
A data diode solves one problem perfectly, but not everything:
- No way back also means no updates - patches, antivirus signatures and configurations must enter through another, controlled route, such as a scanning station for USB media
- No time synchronisation from outside - NTP from IT does not work, so the OT zone needs its own time source
- Other attack paths remain - Stuxnet showed that an isolated network can be infected via USB; a data diode does not help against USB, on-site contractors or insiders, so USB control remains necessary
- The proxies are software - the servers on both sides must be hardened, patched and monitored
- Bypasses - a second network cable, a 4G modem or a “temporary” maintenance bypass renders the diode useless
- Designing data flows takes time - every protocol must be explicitly supported, and whatever does not fit has to be solved differently
Within Defense in Depth a data diode is therefore one layer, alongside segmentation, monitoring and procedures. It does not conflict with Zero Trust: it limits the trust relationship between zones to data that only flows outwards. As part of overall OT security, it is the strongest form of separation you can apply to a network path.
🧭 How do you implement a data diode step by step?
- Inventory the data flows - which data must leave OT, to whom, how often and over which protocol? Also check which flows currently go inwards and whether they are really needed.
- Define the boundary - choose which zone the diode protects, usually the control zone at levels 0 to 2 or the entire OT environment.
- Choose the type - a simple diode with its own proxies or a complete gateway that replicates historians, OPC servers and files.
- Size the capacity - mainstream products handle 1 to 10 Gbit/s; some vendors offer up to 100 Gbit/s. For most historian and SIEM flows, 1 Gbit/s is ample.
- Arrange the inbound route - define how patches, signatures, time and support reach the OT zone without bypassing the diode.
- Test failure scenarios - what happens on packet loss, a full buffer or a proxy failure? Make missing data visible in the receiving systems.
- Define management and checks - who may change the proxy configuration, and how do you periodically verify that no bypasses have crept in?
The Netherlands has a strong position in data diodes. The Fox DataDiode, originally developed by Fox-IT, is now supplied as the Sentyron DataDiode by Sentyron in Delft. Sentyron is the former cryptography unit Fox Crypto, which parent company NCC Group sold to the Swedish CR Group in 2024. The product is evaluated at Common Criteria EAL7+ (formally verified design) and approved for NATO TOP SECRET. Other well-known vendors include Waterfall Security Solutions and Owl Cyber Defense. For Dutch organisations that fall under the Cybersecurity Act (in force since 15 August 2026) and thus NIS2, a data diode is not mandatory, but it is a strong measure to demonstrably meet the duty of care for the most critical processes and to underpin compliance.
❓ Frequently asked questions
Can a data diode be hacked?
A data diode itself cannot be reversed over the network, because the send side physically has no receiver. Attackers can, however, target the proxy servers on either side or bypass the diode through another connection. A data diode therefore protects the network path, not the entire environment.
Does TCP work over a data diode?
TCP does not work directly over a data diode, because TCP needs acknowledgements in the return direction. A data diode solves this with proxies on both sides that each handle their own TCP connection. Between the proxies runs a one-way stream, often based on UDP with error correction.
What is the difference between a data diode and a unidirectional gateway?
Strictly speaking, a data diode is the hardware that only lets one-way traffic through. A unidirectional gateway combines that hardware with software that replicates databases and emulates servers, so existing applications work with it unchanged. In practice the two terms are often used interchangeably.
Is a data diode mandatory under NIS2 or IEC 62443?
A data diode is not mandatory under NIS2, the Dutch Cybersecurity Act or IEC 62443. These frameworks require appropriate, risk-based measures, and a data diode is one way to isolate a zone strictly. In the US nuclear sector, however, Regulatory Guide 5.71 makes one-way data flow between the highest security levels the expected approach.
Can you perform remote maintenance through a data diode?
Remote maintenance through a data diode is impossible, because there is no inbound path. Organisations therefore handle vendor maintenance through a separate, controlled route, for example a temporarily opened and supervised connection. That route must be managed just as strictly as the diode itself.
How much does a data diode cost?
The price of a data diode depends heavily on capacity, certification and the replication software required. A certified solution with redundant proxies and support for multiple protocols costs considerably more than an industrial firewall. On top of the purchase, budget for the design, integration and management of the data flows.
📌 In summary
A data diode enforces in hardware that data can travel one way only, so process data can leave OT without any return path for attacks or commands. Proxies and replication software make common applications such as historians, SIEM and OPC usable across the one-way link. A data diode does not replace a firewall or good management, but within defence in depth it is the strongest separation for the most critical zones.