Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Creating a bespoke data diode for air‑gapped networks

nelop.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: Creating a bespoke data diode for air‑gapped networks

#51

Post by Alex2037 »

magicalhippo wrote: post #42
Alex2037 wrote: post #26

Earlier quoted context omitted.

yes, but if your adversary is capable of exploiting a one-way diode to RCE, you might as well just give up.

Prepare to give up I'd say[1][2]. [1]: https://arxiv.org/abs/1503.07919 [2]: https://arxiv.org/abs/2012.06884

both of these require the isolated machine to be heavily compromised to begin with.

there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,

Re: Creating a bespoke data diode for air‑gapped networks

#52

Post by zephen »

If galvanic isolation is necessary, there are "digital isolators" (that's a good search term if you are interested) that are much faster than optocouplers and that don't suffer from the same sort of degradation (over a few years, the LED gets dimmer and dimmer).

But there's probably no galvanic isolation going on here anyway, so a wire, or at most a simple logic buffer, would probably suffice.

If I'm connecting two things from different power domains, I like to use gates (or level shifters, if necessary) that are designed for the task. These will keep stray currents from causing electromigration problems when one is powered on and the other is powered off, and some of these are very fast, over 100 MB/s.

Re: Creating a bespoke data diode for air‑gapped networks

#54

Post by UltraSane »

Alex2037 wrote: post #26
Hizonner wrote: post #13

A "diode" is not an air gap. If there is any flow in either direction, you don't have an air gap. This isn't hard to understand.

yes, but if your adversary is capable of exploiting a one-way diode to RCE, you might as well just give up.

Yes, this is about as secure as any network connection can be made.

Re: Creating a bespoke data diode for air‑gapped networks

#56

Post by mhb »

MisterTea wrote: post #43

> An opto coupler, also known as an opto isolator, allows an electrical signal to pass from one device to another using light, preventing direct electrical connection. *This ensures data flows in a single direction, maintaining the integrity of the air gap.* I would like to know how they come to such a conclusion as this is either a misunderstanding or an AI solution. The opto isolator does not maintain the air gap.…

I don't understand your point. Isn't the galvanic isolation implemented in the optoisolator by an air gap between the light transmitter and receiver? Maybe I don't know the definition of air gap?

Re: Creating a bespoke data diode for air‑gapped networks

#57

Post by mikewarot »

bigfatkitten wrote: post #37

Why not use optical ethernet as ‘real’ cross domain solutions do? Probably cheaper if you don’t mind eBay, and gives you an easy upgrade path to 10Gbps or more in future. Two port NIC on the low side. Port 2 has its TX side connected to Port 1’s RX, just so the port will see a carrier and show link up. Port 1 TX goes to the high side machine’s RX, with TX left open. From here, you have a whole ton of protocol options…

My understanding is that there has to be a heartbeat sent in both directions for fiber Ethernet to work. There are work arounds, but then you're back up into the commercial product price range.

Re: Creating a bespoke data diode for air‑gapped networks

#58

Post by mikewarot »

The main function of this gear is preventing the ingress of control to a sensitive network, whilst also allowing a controlled outflow of data for monitoring. I think the design choices made were all quite reasonable. Given that it passed an audit, it seems reasonably trustworthy.

The stock raspberry pi doesn't have wireless ports to serve as potential side channels. The use of an opto-isolator means that data is constrained by physics to only flow in the desired direction, no matter what happens in either Raspberry Pi.

It should be possible to replicate this for less that $200 in hardware.

Re: Creating a bespoke data diode for air‑gapped networks

#59

Post by bigfatkitten »

mikewarot wrote: post #57
bigfatkitten wrote: post #37

Why not use optical ethernet as ‘real’ cross domain solutions do? Probably cheaper if you don’t mind eBay, and gives you an easy upgrade path to 10Gbps or more in future. Two port NIC on the low side. Port 2 has its TX side connected to Port 1’s RX, just so the port will see a carrier and show link up. Port 1 TX goes to the high side machine’s RX, with TX left open. From here, you have a whole ton of protocol options…

My understanding is that there has to be a heartbeat sent in both directions for fiber Ethernet to work. There are work arounds, but then you're back up into the commercial product price range.

Using a two port NIC on the transmit side as I described addresses this. This is exactly how commercial CDS vendors like BAE Systems do it.

Re: Creating a bespoke data diode for air‑gapped networks

#60

Post by bigfatkitten »

pragma_x wrote: post #47
bigfatkitten wrote: post #37

Why not use optical ethernet as ‘real’ cross domain solutions do? Probably cheaper if you don’t mind eBay, and gives you an easy upgrade path to 10Gbps or more in future. Two port NIC on the low side. Port 2 has its TX side connected to Port 1’s RX, just so the port will see a carrier and show link up. Port 1 TX goes to the high side machine’s RX, with TX left open. From here, you have a whole ton of protocol options…

That's kind of brilliant. I had no idea that kind of thing would actually work. I always assumed that bidirectional connections were needed to allow ETH frames to function, electrically. I further assumed this applied to optical networking too.

For 100BaseFX and 1000BaseSX at least, there’s no auto negotiation for link speed etc. As long as it sees a carrier from what it thinks is the other end of the link, it’s happy.
Post reply on HN