Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Creating a bespoke data diode for air‑gapped networks

nelop.com

Post reply on HN
Print view View original

11–20 of 86 posts

Re: Creating a bespoke data diode for air‑gapped networks

#11

Post by nelop »

nancyminusone wrote: post #9
tonyarkles wrote: post #4

Earlier quoted context omitted.

Very curious what the hinted at issues were with using regular unidirectional serial before introducing the pair of Pis.

For that matter, why the optocoupler at all? You only need it if the systems are at different electrical potentials, and even then they are galvanically isolated on the Pis by the magnetics in the Ethernet. But I guess it's not the same as being asked "where's the air gap" pointing at the optocoupler, and saying "there it is"

There are lots of ways to solve this problem.

In the past I have worked in defence, for highly sensitive stuff they wouldn't even allow a common ground between two networks.

That's why I chose an option iolsator, it ensures the two devices are electrically isolated.

It's overkill for this application, but I wanted to set something up right, and if I ever have another project like this that needs to be more secure, it's ready to go.

Re: Creating a bespoke data diode for air‑gapped networks

#14

Post by nelop »

oconnore wrote: post #6
nelop wrote: post #2

I wrote this to share my experience building a secure one-way data transfer solution for air-gapped systems. Happy to answer technical questions about why we chose this architecture and the challenges we faced, lots of ways to solve this problem, but this is my way.

Can you share how the scripts work? That seems to be the most interesting part, but is omitted from the article. The only technical details are UART + an opto-coupler. > Both devices run custom scripts designed to handle data transmission reliably rather than quickly. This approach limits throughput, but reliability is paramount for critical monitoring, where losing data is unacceptable. The scripts are finely tuned…

Yep they are pretty simple, on one end you have a python script that listens to syslog messages, when get gets an interesting one it converts into a binary string and sends out over GPOI14.

This goes through an opto coupler

On the other end there a python script listening on GPIO16, it takes a string of binary data, decodes, checks it's valid, then creates a tagged syslog message. Syslog is configured to forward everything onto a central location for folks to monitor.

Hope that makes sense.

Re: Creating a bespoke data diode for air‑gapped networks

#15

Post by IncreasePosts »

nancyminusone wrote: post #5

Unless you needed Ethernet, you could have done the same thing with a null modem RS-232 cable with the TX pin cut on one end.

How confident are you that a compromised receiving machine able to send arbitrary voltages on 8 of the 9 pins wouldn't be able to trigger some unexpected behavior on the airgapped machine?

Re: Creating a bespoke data diode for air‑gapped networks

#17

Post by nelop »

nappy-doo wrote: post #12

I don't see how this is airgapped. You literally connect a full Pi to the RXing computer. What audit has RX Pi device gone through?

Two separate networks, completely isolated, the only bit connecting the two is the opto coupler.

Was all audited by their internal sec department.

They are happy, it was an interesting problem, they need a bunch of seriously old kit well away from their network, so put it on its own isolated network, but then they realised they also wanted to get some info out of the old kit.

Therefore this project was launched.

Luckily it's not an industry like defense.

Both pi's are locked down, handed over to the right folks and I am locked out.

Re: Creating a bespoke data diode for air‑gapped networks

#19

Post by nelop »

IncreasePosts wrote: post #15
nancyminusone wrote: post #5

Unless you needed Ethernet, you could have done the same thing with a null modem RS-232 cable with the TX pin cut on one end.

How confident are you that a compromised receiving machine able to send arbitrary voltages on 8 of the 9 pins wouldn't be able to trigger some unexpected behavior on the airgapped machine?

Pretty confident, if the recieving machine is compromised, it is only connected to the opto coupler, that ensures only one way traffic, on one pin.

Somehow you would have to get a receive pin to transmit, and then get through the opto coupler and then it just hits a pin that's designed to only send data.

Re: Creating a bespoke data diode for air‑gapped networks

#20

Post by IncreasePosts »

nelop wrote: post #19
IncreasePosts wrote: post #15

Earlier quoted context omitted.

How confident are you that a compromised receiving machine able to send arbitrary voltages on 8 of the 9 pins wouldn't be able to trigger some unexpected behavior on the airgapped machine?

Pretty confident, if the recieving machine is compromised, it is only connected to the opto coupler, that ensures only one way traffic, on one pin. Somehow you would have to get a receive pin to transmit, and then get through the opto coupler and then it just hits a pin that's designed to only send data.

Sorry, I didn't mean for your project, but for using a RS232 null modem like OP suggested
Post reply on HN