Data Diodes and Unidirectional Gateways
Hardware that physically allows data to flow in only one direction, so telemetry can leave a protected zone while no command can enter.
One-Way by Physics, Not Configuration
A data diode is a hardware device that permits data to travel in a single direction and makes the reverse direction physically impossible, often using an optical link with a transmitter on one side and a receiver on the other, and no return path. Because the restriction is physical rather than a software rule, it cannot be misconfigured, bypassed, or turned around by an attacker. A firewall can be reconfigured; a diode cannot pass what it has no wire to carry.
The Classic Use Case
The common need is to export data from a highly protected network, telemetry, logs, historian data, without allowing anything to come back in. A data diode lets monitoring and analytics systems in a less trusted zone receive a continuous feed from the protected zone while guaranteeing no command, malware, or intrusion can travel the other way.
Trade-offs
- Absolute inbound protection: no return path exists to exploit
- No acknowledgments: protocols needing two-way handshakes must be adapted
- Higher cost and complexity than a firewall
- One-way only: unsuitable where genuine bidirectional traffic is required
Diode Versus Firewall
A firewall filters bidirectional traffic and is flexible but fallible. A diode is inflexible but gives a guarantee no software control can match. They are complementary: diodes protect the flows that must be one-way, firewalls manage the flows that must be two-way.
Fusion Context
For a fusion plant, exporting operational telemetry for monitoring and analysis without exposing the control network to inbound traffic is a natural fit for a data diode. In the Hyperion breeder and burner designs, one-way gateways let telemetry leave the most protected control segments while making inbound command paths physically impossible, reinforcing segmentation with a guarantee rather than a rule.