24 ms·
Creating a bespoke data diode for air‑gapped networks
- nelop 9mo agoI wrote this to share my experience building a secure one-way data transfer solution for air-gapped systems. Happy to answer technical questions about why we chose this architecture and the challenges we faced, lots of ways to solve this problem, but this is my way.
- tonyarkles 9mo agoVery curious what the hinted at issues were with using regular unidirectional serial before introducing the pair of Pis.
- nancyminusone 9mo agoFor that matter, why the optocoupler at all? You only need it if the systems are at different electrical potentials, and even then they are galvanically isolated on the Pis by the magnetics in the Ethernet. But I guess it's not the same as being asked "where's the air gap" pointing at the optocoupler, and saying "there it is"
- nelop 9mo agoThere are lots of ways to solve this problem. In the past I have worked in defence, for highly sensitive stuff they wouldn't even allow a common ground between two networks. That's why I chose an option iolsator, it ensures the two devices are electrically isolated. It's overkill for this application, but I wanted to set something up right, and if I ever have another project like this that needs to be more secure, it's ready to go.
- tonyarkles 9mo ago> In the past I have worked in defence, for highly sensitive stuff they wouldn't even allow a common ground between two networks. I actually agree very much with this. If you're looking for strong assurance that there is no possible back-channel, devices like optocouplers help significantly. It's not hard for me to think of a way to surreptitiously send data backwards through a common ground, or normal silicon diode, or a magnetic coupler like an Ethernet transformer, but optoisolators make it significantly more challenging.
- nelop 9mo agoThe problems was all my fault :-) I was trying to use a port that was not designed for serial data. When data was sent across it was getting mashed. I think it's because both ports were not uart, therefore when the binary data was sent if they were not perfectly in sync it would get mashed, I might have been able to solve it by sending a clock as well. But the easier option was to just change everything to the uart ports and it magically worked.
- StevenThompson 9mo agoIt was probably due to the lack of flow control. Serial doesn't work well when it's one-way. I did something similar to send logs waaaay back in the day, and it would constantly flip bits or send characters out of sequence, etc. I had to transmit very slowly to get it to work stably without any flow control. I want to say that I limited it to 9600 kbps before it started to become reliable.
- oconnore 9mo agoCan you share how the scripts work? That seems to be the most interesting part, but is omitted from the article. The only technical details are UART + an opto-coupler. > Both devices run custom scripts designed to handle data transmission reliably rather than quickly. This approach limits throughput, but reliability is paramount for critical monitoring, where losing data is unacceptable. The scripts are finely tuned to ensure that every log entry is transmitted securely without risk of cross-contamination between networks.
- nelop 9mo agoYep they are pretty simple, on one end you have a python script that listens to syslog messages, when get gets an interesting one it converts into a binary string and sends out over GPOI14. This goes through an opto coupler On the other end there a python script listening on GPIO16, it takes a string of binary data, decodes, checks it's valid, then creates a tagged syslog message. Syslog is configured to forward everything onto a central location for folks to monitor. Hope that makes sense.
- c0nsumer 9mo agoThis is pretty neat, but is what you pictured the final product? It doesn't strike me as sufficiently robust for deployment. More like an engineering concept...
- nelop 9mo agoThe final product is in a pi enclosure that is stackable, the two pi's live inside with the opto coupler installed inside. It does the job, but the enclosures are plastic, they are tough, but I would preferred some machined aluminium.
- nancyminusone 9mo agoUnless you needed Ethernet, you could have done the same thing with a null modem RS-232 cable with the TX pin cut on one end.
- nelop 9mo agoYep that would work, there's a whole heap of ways to solve the problem, have heard of people using fiber connections and curring one side. But I just wanted something simple for me, I know Linux and Raspberry pi's so decided to go down this route, having a pi on each side gives me the option to run scripts and tweak as required.
- IncreasePosts 9mo agoHow confident are you that a compromised receiving machine able to send arbitrary voltages on 8 of the 9 pins wouldn't be able to trigger some unexpected behavior on the airgapped machine?
- nelop 9mo agoPretty confident, if the recieving machine is compromised, it is only connected to the opto coupler, that ensures only one way traffic, on one pin. Somehow you would have to get a receive pin to transmit, and then get through the opto coupler and then it just hits a pin that's designed to only send data.
- IncreasePosts 9mo agoSorry, I didn't mean for your project, but for using a RS232 null modem like OP suggested
- justincormack 9mo agoPins on modern hardware like that are all bidirectional you set the direction in software normally.
- nelop 9mo ago
- nappy-doo 9mo agoI don't see how this is airgapped. You literally connect a full Pi to the RXing computer. What audit has RX Pi device gone through?
- nelop 9mo agoTwo separate networks, completely isolated, the only bit connecting the two is the opto coupler. Was all audited by their internal sec department. They are happy, it was an interesting problem, they need a bunch of seriously old kit well away from their network, so put it on its own isolated network, but then they realised they also wanted to get some info out of the old kit. Therefore this project was launched. Luckily it's not an industry like defense. Both pi's are locked down, handed over to the right folks and I am locked out.
- deleted 9mo ago[deleted]
- Hizonner 9mo agoA "diode" is not an air gap. If there is any flow in either direction, you don't have an air gap. This isn't hard to understand.
- Havoc 9mo agoUnless the mossad is after you one way light based coms may as well be
- stronglikedan 9mo agoLast I checked, light does indeed cross gaps of air, so "air gapped" is at least more appropriate than your comment.
- hackstack 9mo agoBy that logic, an open wifi router would be considered air gapped, n’est pas?
- Alex2037 9mo agoyes, but if your adversary is capable of exploiting a one-way diode to RCE, you might as well just give up.
- magicalhippo 9mo agoPrepare to give up I'd say[1][2]. [1]: https://arxiv.org/abs/1503.07919 https://arxiv.org/abs/1503.07919 [2]: https://arxiv.org/abs/2012.06884 https://arxiv.org/abs/2012.06884
- Alex2037 9mo agoboth of these require the isolated machine to be heavily compromised to begin with. there are a lot of such extremely hypothetical attacks no one should take seriously. you might as well worry about sensitive data being exfiltrated from your unshielded optical nerve,
- OutOfHere 9mo agoCould've used a speaker and microphone with an appropriate noise-resistant digital encoding.
- nelop 9mo agoOhhh that's a cool idea. I love any project that uses audio.
- TeMPOraL 9mo agoI think the benefit of a discrete optocoupler is in keeping the communication point-to-point, so no other device (malicious or otherwise) can "listen in". A low-power light signal won't penetrate a solid enclosure; it's much harder to prevent mechanical vibrations from leaking information beyond the coupler - you'd need to keep the speaker and microphone on some kind of suspension (springs and shock absorbers) acting as a low-pass filter.
- XorNot 9mo agoAll speakers can act as microphones. But due to physics you'd have a much harder time turning a photodiode into a light emitting one (the physics means you only can get IR out and the LED can't receive anything that way).
- TeMPOraL 9mo ago> the physics means you only can get IR out and the LED can't receive anything that way Gut feeling tells me there is a way, if you use way more power than normal for this :). Much like with making speakers receive sound (you need to amplify the received signal afterwards) and making microphones produce it. But it doesn't really matter whether or not you can reverse the analog signal flow, if the digital side treats the I/O pins as unidirectional.
- XorNot 9mo agoIf the digital side could be trusted we'd just set it to send only mode and be sure it'll behave - in reality we don't trust it. The threat model where you use a data diode presumes an adversary might totally compromise the sending side - the guarantee you're trying to add is that whatever malware they push down the line has no ability to exfiltrate data regardless of how compromised it is.
- Damogran6 9mo agoI'm assuming you don't have any audit requirements for this application. The stupid pricing for hardware often isn't in the hardware, it's in the compliance.
- russdill 9mo agoHere it might fail. If you were sufficiently motivated and controlled the software stacks on the rpi's you may be able to get data to flow in the other direction. LEDs have their voltage modulated by light. And it's possible that is the voltage on the transistor if properly modulated it may able to emit light. It's a lot of ifs and requires the adc of the rpi to be sensitive enough (and one of the pinmux options). But it's why certifying is important. Oh, and if you controlled the software stack on the two rpi's there's a good chance there's a side channel somewhere
- wakawaka28 9mo agoI reckon it is also possible to set up a second channel covertly at a higher frequency. It may also have surprising flaws. People have read network packets from router indicator LEDs lol.
- UltraSane 9mo agoAlso very low sales volume.
- buckle8017 9mo agoThose wires are certainly long enough to be antennas.
- buildbot 9mo agoThis is a real vector - I had this happen in undergrad EE where my serial line to my microcontroller had a bunch of legible garbage on it. Turns out my MacBook charger was also using serial to talk to the laptop, with enough power to radiate to the otherwise isolated microcontroller serial line.
- EAtmULFO 9mo agoJust use DNS.
- bigfatkitten 9mo agoWhy not use optical ethernet as ‘real’ cross domain solutions do? Probably cheaper if you don’t mind eBay, and gives you an easy upgrade path to 10Gbps or more in future. Two port NIC on the low side. Port 2 has its TX side connected to Port 1’s RX, just so the port will see a carrier and show link up. Port 1 TX goes to the high side machine’s RX, with TX left open. From here, you have a whole ton of protocol options. For things like syslog, you can just use a static ARP entry on the low side to forward events to the high side’s IP address via UDP. For reliable transport, there are lots of options for reliable multicast now using erasure coding etc that don’t require a reverse channel.
- pragma_x 9mo agoThat's kind of brilliant. I had no idea that kind of thing would actually work. I always assumed that bidirectional connections were needed to allow ETH frames to function, electrically. I further assumed this applied to optical networking too.
- bigfatkitten 9mo agoFor 100BaseFX and 1000BaseSX at least, there’s no auto negotiation for link speed etc. As long as it sees a carrier from what it thinks is the other end of the link, it’s happy.
- mikewarot 9mo agoMy understanding is that there has to be a heartbeat sent in both directions for fiber Ethernet to work. There are work arounds, but then you're back up into the commercial product price range.
- bigfatkitten 9mo agoUsing a two port NIC on the transmit side as I described addresses this. This is exactly how commercial CDS vendors like BAE Systems do it.
- PaulCarrack 9mo ago
- neuroelectron 9mo agoIs raspberry pi a good choice for this? How auditable is the SOC on this thing? As I understand it, there is an administrative core that you can't reprogram and that has DMA to the user core and provide DRM decoding. It could be doing anything.
- MisterTea 9mo ago> An opto coupler, also known as an opto isolator, allows an electrical signal to pass from one device to another using light, preventing direct electrical connection. *This ensures data flows in a single direction, maintaining the integrity of the air gap.* I would like to know how they come to such a conclusion as this is either a misunderstanding or an AI solution. The opto isolator does not maintain the air gap. It only provides galvanic isolation which is likely unnecessary in this situation. Galvanic isolation is useful in situations where you want to isolate circuits from electrical potential issues (ground loops and so on) or isolation from noise and faults.
- bmgxyz 9mo agoI think they only care about preventing data flow in one direction while still allowing it in the other. This isn't strictly an air gap, but it fits their use of the term "data diode". The fact that the unidirectional flow of information is achieved through galvanic isolation is probably just a side effect. In the ideal case, no information can flow from the photosensitive element to the LED. A determined attacker could probably exploit lots of side channels here, though.
- idiotsecant 9mo agoA single optoisolator will certainly enforce one-way airgap. Two optoisolators are required for tx and rx.
- mhb 9mo agoI don't understand your point. Isn't the galvanic isolation implemented in the optoisolator by an air gap between the light transmitter and receiver? Maybe I don't know the definition of air gap?
- avidiax 9mo agoI feel like it's easier to just have Ethernet and a strict HW firewall with the admin interfaces totally disabled (have to full reset to get back in). You can either just block packets in one direction, or you can add a small amount of risk and allow UDP and TCP with zero payload in one direction. That would allow you to reliably stream in one direction and request from either direction, albeit with a slightly exploitable channel (timing, reliability or the space of values allowed in the protocol). You already have to trust the RPI hardware to not enable WiFi on either side, so why not trust a router?
- wolrah 9mo ago> I feel like it's easier to just have Ethernet and a strict HW firewall with the admin interfaces totally disabled (have to full reset to get back in). Easier? Maybe, for certain values of easy, but as others have noted it's not hard to build a data diode setup using fiber ethernet and from there you just have to hardcode some ARP data and maybe a route entry to allow UDP to flow. The thing is that with your solution as long as the firewall works properly data shouldn't be able to leak in the wrong direction. With a proper data diode, as long as physics continues to function more or less how we understand it you can prove that data can not leak in the wrong direction. That's a huge difference, especially when it comes to explaining what you're doing to non-technical higher ups, auditors, lawyers, etc.
- zephen 9mo agoIf galvanic isolation is necessary, there are "digital isolators" (that's a good search term if you are interested) that are much faster than optocouplers and that don't suffer from the same sort of degradation (over a few years, the LED gets dimmer and dimmer). But there's probably no galvanic isolation going on here anyway, so a wire, or at most a simple logic buffer, would probably suffice. If I'm connecting two things from different power domains, I like to use gates (or level shifters, if necessary) that are designed for the task. These will keep stray currents from causing electromigration problems when one is powered on and the other is powered off, and some of these are very fast, over 100 MB/s.
- tripletao 9mo ago> over a few years, the LED gets dimmer and dimmer That shouldn't happen unless the LED is driven near the top of its current rating, which shouldn't be necessary unless you're pushing the limits of its rise/fall times (in which case a different part would be advisable as you say). A random app note shows 95% of initial current transfer ratio after 25 years at If = 5 mA, and depending on the necessary bit rate we could probably design for at least 2x initial margin on that CTR. Such a design would last effectively forever. https://www.we-online.com/catalog/media/o303314v410%20ANO006a%20EN.pdf https://www.we-online.com/catalog/media/o303314v410%20ANO006... I think the galvanic isolation is mostly a feelgood here, allowing people to say it's "air-gapped" even though that's not directly relevant (since Wi-Fi is also "air-gapped"). A simple gate or level shifter can also enforce unidirectional data flow as you say.
- zephen 9mo agoUpvoted for: > which shouldn't be necessary unless you're pushing the limits of its rise/fall times Right, I should have clarified this. To make them go fast, you can often use more power (to a point), and that can shorten the LED lifespan. (To be fair, there are techniques to give you a bit faster speed without making them too bright, like pulse-shaping, but it didn't appear anything that fancy was going on there.) And, unfortunately, "fast" for the optoisolator isn't very, in any case. The cut-off frequency for the first datasheet I found corresponding to that app note was 80 KHz. > I think the galvanic isolation is mostly a feelgood here, And... I don't get this. If it does nothing useful, why bother? IMO, the primary good use for an optoisolator these days is either for something analog-ish like the feedback for a switch mode power supply, or for when you're breadboarding something with really high voltages and don't want to bother with SMT devices.
- UltraSane 9mo agoCommercial data diodes tend to use fiber optics and disable the transmitter on one end and the receiver on the other end.
- mikewarot 9mo agoThe main function of this gear is preventing the ingress of control to a sensitive network, whilst also allowing a controlled outflow of data for monitoring. I think the design choices made were all quite reasonable. Given that it passed an audit, it seems reasonably trustworthy. The stock raspberry pi doesn't have wireless ports to serve as potential side channels. The use of an opto-isolator means that data is constrained by physics to only flow in the desired direction, no matter what happens in either Raspberry Pi. It should be possible to replicate this for less that $200 in hardware.
- estimator7292 9mo agoEveryone commenting about the strict definition is a very smart boy. Good job and gold stars all around for the productive conversation! You're solving the real problems of our times here.
- firesteelrain 9mo agoThere are reasons that the US Government is super serious about certifying data diodes and cross domain solutions because you need to be absolutely sure what you are doing doesn’t accidentally leak data where it doesn’t need to go. Real data diode and cross domain solutions are super expensive for this reason.
- elevation 9mo agoOnce I have a reliable network diode in place, is there an open source software stack to help me move the various kinds of OS updates, repos, and mirrors that I need? I can do this kind of stuff, but I know I’m reinventing the wheel.
- vrolijk 9mo agoYou can find a collection of data diode information at the Github vrolijk. Https://www.github.com/vrolijk/osdd