What Is a Data Diode?
Some control networks must send out monitoring data but can never accept anything back. A data diode enforces that rule in hardware, not software - making the one-way path a physical certainty.
Data Diode in one line: A data diode is a hardware device that allows data to travel in one direction only. It physically breaks the return path - typically using a fiber-optic transmitter on one side and a receiver on the other with no reverse channel - so data can flow out of a secure OT network for monitoring, but nothing, including malware or commands, can flow back in. Because the restriction is physical, it cannot be bypassed by configuration errors or software compromise.
Why one-way in hardware, not software
A firewall enforces direction with rules, and rules can be misconfigured, disabled, or defeated by an exploit. A data diode enforces direction with physics. In the classic design, the sending side has only an optical transmitter and the receiving side has only an optical receiver, joined by a fiber that carries light one way. There is simply no wire or optical path for a signal to return.
This gives a data diode a security property no firewall can match: it is provably impossible for traffic to move against the diode, regardless of software state on either side. For the most sensitive networks, that hardware guarantee is the entire point.
The challenge of one-way protocols
Most industrial and IT protocols assume two-way communication - a TCP connection needs acknowledgments coming back, and a polling protocol expects responses. A pure one-way link breaks all of that. So a data diode is deployed as part of a unidirectional gateway: proxy software on the send side terminates the normal two-way protocol, converts the data to a one-way stream, pushes it across the diode, and a matching proxy on the receive side reconstructs it into a normal protocol for the destination.
This means diodes work best for replication and monitoring flows - streaming historian data, mirroring an OPC server, or forwarding syslog - where the destination only needs to receive. They cannot be used where the outside must send commands or configuration back into the protected network, because by design that path does not exist.
Data diodes in oil and gas and critical infrastructure
Data diodes appear where the consequence of an intrusion is severe: pipeline SCADA control centers, offshore platforms, refineries, and safety systems. Regulators and internal security standards for critical infrastructure increasingly favor unidirectional gateways for the link between the control network and any less-trusted zone, precisely because the isolation is physical.
A common architecture places a diode between the OT historian and the corporate or cloud analytics environment. Production data, alarms, and trends replicate outward for engineers and management to see, while the control network remains physically unreachable from the business side. This delivers visibility without opening an attack path back to the process.
Diodes are stricter and less flexible than firewalls, and they cost more, so they are reserved for the highest-value boundaries. Many facilities use a firewall or a DMZ for most segmentation and a data diode only for the small number of flows that truly must be one-way.
Selecting a Unidirectional Gateway
The diode itself is the simple part of the purchase - the real evaluation is the proxy software on each side. Start by listing every flow you intend to push out: historian replication, OPC UA or Modbus values, syslog and security events, file drops, database mirroring. Each of those needs a supported connector on the send side and a matching reconstruction on the receive side, and a flow the proxies do not support either cannot cross or forces an awkward workaround. Write the flow inventory before you talk to any supplier, and treat an unsupported flow as a hard finding, not a footnote.
Then size for headroom. Aggregate the sustained volume of all flows plus the bursts - a historian backfill after an outage can be many times the steady rate - and remember the link cannot ask the far side to slow down. Certification requirements come from your own site security standard, and the environmental questions (panel mounting, temperature, power) are the same as for any other piece of network hardware. If a single flow is genuinely business-critical, ask early whether a redundant pair is justified, because a diode is a single series element in the path.
Deployment Patterns That Work
The most common placement follows the Purdue reference architecture: a replica historian or data concentrator sits in the DMZ at the plant boundary, the control network replicates upward to it over conventional segmentation, and the diode carries data from that replica out to the enterprise or cloud side. That way the diode protects the highest-value boundary while ordinary firewalled zones handle everything below it. The Purdue model gives the vocabulary for agreeing where that boundary sits.
Plan deliberately for everything that silently assumes a return path. The receive-side proxy cannot pull patches, licenses, or DNS answers through the diode, and neither side can time-sync from the other, so each side needs its own time source or timestamps will disagree in every investigation that follows. Sites that considered a full air gap often land on a diode instead, because it delivers comparable inbound isolation without the removable-media habits an air gap breeds - a trade examined in our air-gapped SCADA security guide.
Failure Modes on a Link That Cannot Talk Back
The characteristic failure of a one-way link is silent loss. The receiver cannot acknowledge, so the sender never learns a frame was dropped, and the receive proxy cannot request a retransmit. Mature deployments compensate at the application layer: the send side numbers everything it transmits, inserts a periodic heartbeat, and re-sends recent history on a schedule rather than on request; the receive side alarms when sequence gaps appear or the heartbeat goes quiet. Monitoring must exist independently on both sides, because neither side can see the other's health.
A commissioning pass for a new diode installation looks like this:
- Verify every inventoried flow arrives on the receive side with correct content, not just link-up indicators.
- Interrupt the fiber mid-transfer and confirm the send side buffers or alarms per its design, and that the receive side flags the gap.
- Confirm both sides have independent, working time sources and that timestamps agree within your tolerance.
- Trigger a burst such as a historian backfill and watch for drops at peak rate.
- Document the resend schedule and who owns gap alarms on each side.
Frequently Asked Questions
How is a data diode different from a firewall?
A firewall enforces traffic direction with configurable software rules, which can be changed or exploited. A data diode enforces one-way flow physically, usually with a fiber link that has no return path, so the restriction cannot be bypassed by software at all.
Can you send control commands through a data diode?
No. By design there is no reverse path, so commands or configuration cannot travel back into the protected network. Diodes are for outbound monitoring and replication flows only; a bidirectional need requires a firewall or gateway instead.
Why not just use a firewall everywhere?
Firewalls are more flexible and cheaper, and they handle two-way traffic, so they cover most segmentation. Data diodes are reserved for the highest-consequence boundaries where a hardware-enforced, non-bypassable one-way guarantee is worth the cost and rigidity.
How do you know data actually made it across a data diode?
You instrument both ends, because the link itself cannot confirm delivery. The send-side proxy numbers its transmissions and emits heartbeats; the receive side alarms on sequence gaps or heartbeat silence. For historian replication, gap detection on the receive side plus scheduled re-sends from the send side close most holes without any reverse channel.
Can a data diode carry file transfers and backups?
Yes, if the gateway's proxy software supports a file-drop flow. The send side watches a folder and streams files across; the receive side reassembles and verifies them, typically with checksums, and quarantines anything that fails verification. Since no acknowledgment can return, robust deployments re-send files on a schedule and keep the source copy until the operational process confirms arrival out of band.
Sources & Further Reading
Primary references from the standards bodies and regulators that define this topic:
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.