Unidirectional Data Diodes

A hardware data diode enforces one-way flow at the physics layer: telemetry leaves OT for analysis while no bit can travel back into the machine.

Enforcement in hardware, not policy

A data diode passes light or electrons in one direction only - typically a transmit-only fiber optic with no receive path physically present. Because the reverse channel does not exist, no software misconfiguration, zero-day, or insider rule change can turn it into a two-way link. Kronos uses diodes at the level 3.5 boundary to export the high-volume, high-value OT telemetry stream (diagnostics, twin state, audit lineage) to IT and offsite analysis while guaranteeing the machine cannot be commanded through that path.

Solving the TCP problem

Most protocols need acknowledgements, which a strict diode forbids. Kronos uses a proxy pair: a send-side agent in OT terminates the local TCP session, serializes data with forward error correction, and streams it across the diode; a receive-side agent in IT reconstructs and re-offers it. Reliability is bought with redundancy, not back-channels.

# Diode send-side framing (conceptual)
# No ACKs cross the diode; loss is masked by FEC + sequence gaps.
def diode_send(record):
    frame = serialize(record)                 # canonical bytes
    frame += reed_solomon_parity(frame, k=32) # forward error correction
    for shard in interleave(frame):
        emit_tx_only(shard, seq=next_seq())   # transmit-only fiber
    # receiver detects gaps via seq; cannot request retransmit

What crosses which way

• OT -> IT via diode: plasma diagnostics, KRONOS-CTRL twin snapshots, control-decision audit lineage, material-accountancy logs.
• IT -> OT: never over the diode. Model and policy updates use the separate gated broker with two-person control - see air gaps and bridging.
• Integrity: exported records are signed on the OT side so IT can verify origin without a return channel.

Design status

Diode framing, FEC, and the proxy pair are implemented and tested against the digital twin's telemetry firehose. The physical diode hardware is specified for the FOAK boundary build; today the one-way constraint is emulated so downstream analytics and the immutable audit log can be exercised end to end.