AU2018431102B2

AU2018431102B2 - A system for unidirectional data transfer

Info

Publication number: AU2018431102B2
Application number: AU2018431102A
Authority: AU
Inventors: Jian Liang LING; King Siong LYE; Kang Wei Joshua PANG; Yong Cong WU
Original assignee: St Eng Info Security Pte Ltd; ST Engineering Info Security Pte Ltd
Current assignee: ST Engineering Info Security Pte Ltd
Priority date: 2018-07-02
Filing date: 2018-09-07
Publication date: 2022-01-27
Anticipated expiration: 2038-09-07
Also published as: TW202007101A; AU2018431102A1; WO2020009657A1; SG10201805694TA; TWI746903B

Abstract

The present disclosure envisages a system for unidirectional data transfer. The system comprises a sender server from which information is to be transmitted. A sender module is communicatively coupled with the sender server, and the sender module comprises an optical driver for receiving information from the sender server as input signal. The optical driver is configured to generate and transmit a modulated signal based on the input signal. The sender module further comprises an optical receiver optically coupled with the optical driver as a loopback connection, wherein the optical receiver receives the modulated signal and provides a feedback to the sender server. The modulated signal is transmitted to a receiver module which comprises an optical receiver. The receiver module then transmits the modulated signal to a receiver destination server.

Description

A SYSTEM FOR UNIDIRECTIONAL DATA TRANSFER FIELD OF INVENTION

[0001] The present disclosure relates to the field of unidirectional data transmission. In particular, the present disclosure relates to data diodes formed using small form factor pluggable (SFP or SFP+) modules.

BACKGROUND

[0002] A data diode is a network appliance or a device that allows data to travel in only one direction to ensure the security of the networks or data being transferred. The application of data diodes and unidirectional networks exists in high security setups such as defense, where they serve as connections between two or more networks of differing security classifications, also referred to as a "cross-domain solution." Other applications of data diodes and unidirectional networks are found in Critical Information Infrastructure (Cl I) systems such as transportation and utilities. Examples of facilities that employs the use of data diodes are nuclear power plants, electric power generation/distribution, oil and gas production, water/wastewater treatment plants, and manufacturing plants.

[0003] As most networking communication protocols are adapted for bidirectional communication, when unidirectional transmission is desired, a Diode Sender Proxy Software is employed at a sender server or a sending server, and a Diode Receiver Proxy Software is employed at a receiver server or a receiving server. In such implementation, the software employed at the sender service or the sending server is essentially used as a gateway to block or eliminate all incoming (to the sending server) transmissions, while the network is still transmitting in both directions. It is well understood to a skilled person that any such software implementations are still vulnerable to unauthorized access or attack as long as the physical link is still transmitting in both directions.

[0004] Additional hardware components or modifications thus have to be implemented in conjunction with the software to address the shortfall of the software alone. This thus results in a lot of hardware involved in the aforementioned system, i.e. at both sender and receiver sides, which cause the footprint of the entire network to become undesirable, as well as increased set up and maintenance costs and efforts. There is, therefore, felt a need to optimize the footprint of such a data diode configuration. Accordingly, there is a need to optimize the hardware implementation to minimize or eliminate additional footprint and cost.

[0005] Small form factor pluggable (SFP or SFP+) modules is a highly compact, hot-pluggable optical transceiver used for data bidirectional communications applications. An SFP+ module includes a transmitter and a receiver in the fiberoptic technology, it uses an optical carrier (OC) signal to ensure end-to-end connection is present. Disconnecting any line connected to the transmitter or the receiver would render the SPF+ module inoperable as the carrier signal is be lost. Accordingly, when a unidirectional transmission is desired, the Diode Sender Proxy Software and the Diode Receiver Proxy Software are installed on the sending server and the receiving server respectively to ensure transmission in one direction over a bidirectional network setup. The Diode Sender Proxy Software and the Diode Receiver Proxy Software are essential components of the data diode and cannot be replaced. However, as both the SFP+ modules include transmitters and receivers, the network cannot be guaranteed to be unidirectional due to the vulnerability of said Diode Proxy Software. Note that disconnecting either the receiver of the sender SFP+ module or the transmitter of the receiving SFP+ module, or both would simply render the SFP+ module not workable, i.e. no transmission (incoming and outgoing) at ail. [0006] To this end, another implementation of the data diode has been envisaged, which involves the usage of specially configured Network Interface Cards (NIC) to control data flow between the sending server and the receiving server. More specifically, a send only data diode NIC is in communication with the sending server and receives the data from the sending server that needs to be transmitted. Whereas a receive only data diode NIC is employed in communication with the receiving server for receiving the transmission from the send only data diode NIC. While this implementation does help in reducing the system footprint of the data diode to effectively only the two servers, i.e., the sending server and the receiving server, complexity issues arise in the software compatibility between the driver software of the NIC and the server. More specifically, issues of driver software incompatibility may arise between the sending server and the send only data diode NIC, and similarly at the receiving server and the receive only data diode NIC. Conversely, if the aforementioned driver software incompatibility does not arise, there is yet another software incompatibility issue that may arise between the send only data diode NIC and the receive only data diode NIC, which may render the data diode inoperable.

[0007] When there is need to develop a secure network architecture, typically, cyber risk reduction, capital cost, operating cost, sustainability and reliability are the critical concerns to be taken care of.

[0008] There is, therefore, felt a need for a unidirectional data transfer system that overcomes the aforementioned drawbacks.

SUMMARY

[0009] The present disclosure envisages a system for unidirectional data transfer. The system comprises a sender server from which information is to be transmitted. A sender module is communicatively coupled with the sender server, and the sender module comprises an optical driver for receiving information from the sender server as input signal. The optical driver is configured to generate and transmit a modulated signal based on the input signal. The sender module further comprises an optical receiver electronically coupled with the optical driver as a loopback connection, wherein the optical receiver receives the modulated signal and provides a feedback to the sender server. The sender module further comprises a memory containing a p re-determined set of rules for the operation of the sender module.

[0010] The system further comprises a receiver server in which the modulated signal is to be received. A receiver module is communicatively coupled with the receiver server and the sender module, and the receiver module comprises an optical receiver for receiving the modulated signal from the optical driver and feeding the modulated signal to the receiver server. The receiver module further comprises a memory containing a pre- determined set of rules for the operation of the receiver module.

[0011] In one embodiment of the present invention, the optical driver is a laser driver having a laser diode, and the optical receiver has a photodiode.

[0012] According to another general aspect, the memory in the sender module and the receiver module is an electrically erasable programmable read-only memory (EEPROM).

[0013] According to another general aspect, the communication between the optical driver and the optical receiver of the receiver module is facilitated by optical fiber.

[0014] According to another general aspect, the sender module and the receiver module are small form factor pluggable (SFP or SFP+) modules.

[0015] The present disclosure further envisages a sender module for use in a system for unidirectional data transfer. The sender module comprises an optical driver for receiving information from the sender server as input signal. The optical driver is configured to generate and transmit a modulated signal based on the input signal. The sender module further comprises an optical receiver electronically coupled with the optical driver as a loopback connection, wherein the optical receiver receives the modulated signal and provides a feedback to the sender server. The optical receiver further comprises a memory containing a pre-determ ined set of rules for the operation of the sender module.

BRIEF DESCRIPTION OF DRAWING [0016] The aspects and other features of the subject matter will be better understood with regard to the following description, appended claims, and accompanying figures. In the figures, the left-most digit(s) of a reference number identifies the figure in which the reference number first appears. The use of the same reference number in different figures indicates similar or identical items.

[0017] FIG. 1A illustrates a simplified overview of a unidirectional network in accordance with an embodiment of the present invention;

[0018] FIG. 1 B illustrates a block diagram of a system for unidirectional data transfer in accordance with an embodiment of the present invention; [0019] FIG. 2A illustrates a block diagram of a sender module for the system for unidirectional data transfer in accordance with an embodiment of the present invention;

[0020] FIG. 2B illustrates a block diagram of a receiver module for the system for unidirectional data transfer in accordance with an embodiment of the present invention; and

[0021] FIG. 3 illustrates a block diagram of a unidirectional data system in accordance with an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The present disclosure aims to reduce the system footprint of a unidirectional network by optimizing the hardware employed in configuring the unidirectional network. [0023] FIG. 1A illustrates a simplified overview of the unidirectional network 100 in accordance with an embodiment of the present invention. The unidirectional network 100 comprises a sender server 102, a sender SFP/SFP+ module 104, a receiver SFP/SFP+ module 106 and a receiver server 108. The sender SFP/SFP+ module 104 and the receiver SFP/SFP+ module 106 are modified hardware modules adapted in compliance with standard small form-factor pluggable (SFP) transceiver specifications. The sender SFP/SFP+ module 104 is directly connected to the sender server 102 and the receiver SFP/SFP+ module 106 is directly connected to the receiver server 108. When in use, the sender SFP/SFP+ module 104 is connected to the receiver SFP/SFP+ module 106 via an optical cable whereby the sender SFP/SFP+ module 104 and the receiver SFP/SFP+ module 106 are adapted to transmit from sender SFP/SFP+ module 104 to the receiver SFP/SFP+ module 106 only to establish a unidirectional network 100 from the sender server 102 to the receiver server 108 on hardware level. In this embodiment, the sender server 102, the sender SFP/SFP+ module 104, the receiver SFP/SFP+ module 106 and the receiver server 108 can support a multiple of networking protocols. As the unidirectional network is achieved through the sender SFP/SFP+ module 104 and the receiver SFP/SFP+ module 106 on hardware level, no special or dedicated proxy software, drivers whatsoever are required.

[0024] in accordance with an embodiment of the present invention, a system for unidirectional data transfer is configured using new small form factor pluggable (SFP or SFP+) modules employed in communication with a sending server 102 as well as a receiving server 108. Modifications are performed at these SFP or SFP+ modules to make the data transmission between the sending and the receiving servers to be unidirectional while reducing the number of components required in a unidirectional network. The modified SFP or SFP+ modules can also be herein after referred as “new SFP or SFP+ modules”.

[0025] The modifications performed in the aforementioned SFP or SFP+ modules, in accordance with the present invention, are hereinafter explained with reference to FIG. 1B, wherein FIG. 1 B extended the illustrations of the unidirectional network 100 of FIG. 1A with a system adapted for unidirectional data transfer (hereinafter referred to as the system).

[0026] The configuration of the system is herein described with reference to FIG. 1B. The system comprises the sender server 102 from which information is to be transmitted. The sender module 104, which can be an SFP+ module, in accordance with one embodiment, is communicatively coupled with the sender server 102. A Diode Sender Proxy Software is required to be installed at the sender server 102 to facilitate the communication between the sender server 102 and the sender module 104.

[0027] The sender module 104 comprises an optical transmitter 104A for receiving information from the sender server 102 as input signal. This is the information that the needs to be transmitted to a destination server in a unidirectional manner. The optical transmitter 104A is configured receive this information or input signal and generate and transmit a modulated signal based on the input signal. More specifically, the input signal from the sender server 102 is combined with an optical carrier signal of the optical transmitter 104A to generate the modulated signal, in the case where the transmission is facilitated via fiber optics communication technology.

[0028] The sender module 104 further comprises an optical receiver 104B electronically coupled with the optical transmitter 104A as a loopback connection“Cⁿ, wherein the optical receiver 104B receives the modulated signal and provides a feedback to the sender server 102. The sender module 104 further comprises a memory 104C containing a p re-determined set of rules for the operations of the sender module 104. In an embodiment, the memory 104C is an electrically erasable programmable read-only memory (EEPROM).

[0029] The system 100 further comprises the receiver server 108 in which the modulated signal is to be received. A receiver module 106 is communicatively coupled with the receiver server 108 and the sender module 104. In an embodiment, the communication between the sender module 104 and the receiver module 106 is facilitated by fiber optics communication cables. The receiver module 106 comprises an optical receiver 106B for receiving the modulated signal from the optical transmitter 104A and feeding the modulated signal to the receiver server 108. The receiver module 106 further comprises a memory 106C containing a pre- determined set of rules for the operations of the receiver module 106. In an embodiment, the memory 106C is an EEPROM. It is to be noted that the receiver server 108 is required to be installed with a Diode Receiver Proxy Software for facilitating the communication between the receiver module 106 and the receiver server 108.

[0030] in one embodiment of the present invention, the optical driver 104A is a laser driver having a laser diode, and the optical receivers 104B, 106B has a photodiode.

[0031] The operation system and the advantage of the aforementioned configuration of the sender module 104 and the receiver module 106 are hereinafter described. The sender module 104 and the receiver module 106 are in unidirectional communication with each other, which is facilitated by fiber optics communication technology. Typically, the receiver module 106, which can be an SFP+ module, also includes an optical transmitter or a transmitter. But in accordance with the present invention, the receiver module 106 does not require any kind of transmission means. To guarantee a unidirectional communication from the sender server to the receiver server, it is required that the transmission means at the receiver module 106, when present, be disconnected, which is required when a standard SFP/SFP+ module is used. This also facilitates in saving the costs associated with the hardware of the transmission means and the associated circuitry.

[0032] The sender module 104 includes the optical transmitter 104A and the optical receiver 104B. Typically, the requirement of the transmission means is because the Fiber Optic technology uses an Optical Carrier (OC) signal to ensure if an end-to-end connection is present. The optical receiver 104B, in accordance with the present invention, is communicatively coupled to the optical transmitter 104A. The coupling is an electronical coupling facilitated by electronic circuitry. As such, the optical receiver 104B, at all times, is receiving the modulated signal generated by the optical transmitter 104A.

[0033] Now, looking at the operation of the system over the unidirectional network 100 wholistical!y, for establishing an end-to-end connection between the sender module 104 and the receiver module 106, it is required that the optical transmitter and optical receiver of the sender module 104 and optical receiver of the receiver module 106 are in a connected or active state. More specifically, the optical transmitter 104A transmits the modulated signal, which is received by the optical receivers 104B, 106B, thereby making all the transmitter and receiver of the sender module 104 and receiver of the receiver module 106 active. When it is sensed by both the servers 102, 108 that all the transmitter and receivers of the sender module 104 and the receiver module 106 are active, an end-to-end unidirectional connection is established between the sender server 102 and the receiver server 108. [0034] More specifically, the unidirectional connection between the sender server 102 and the receiver server 108 is established because of the absence of the transmission means at the receiver module 106, which can be an SFP+ module, i.e. the data that is transmitted from the sender server 102 is received by the receiver server 108, and the absence of the transmission means at the receiver module 106 prevents any further outgoing transmissions from the receiver server 108 in under the missing return-path from the receiver module 106 to the sender module 104.

[0035] Furthermore, the fact that optical receiver 104B is active and is continually receiving a signal‘tricks' the operating system of the sender server 102 into deciding that since optical receiver 104B is continually receiving an input, and an end-to-end bidirectional connections between the sender server 102 and sender module 104 have been established. In other word, as far each terminal side is concerned, each SFP+ module is still functioning normally as a bidirectional device, but one physical cable can be eliminated, i.e. only one fiber optic cable is connected from the sending side to receiving side. As the return fiber optic cable is eliminated, a unidirectional transmission over the SFP+ module is now guaranteed while maintaining the normal operation of the SFP+ modules. [0036] The advantage of the aforementioned configuration is that the system footprint is substantially reduced. One does not need the additional network interface cards for facilitating the unidirectional data transfer. Furthermore, the absence of the transmission means at the receiver module 106 further optimizes the cost by eliminating the cost that would be otherwise associated with the hardware and the corresponding circuitry of the transmission means.

[0037] The present invention further envisages a sender module, which can be an SFP+ module in accordance with one embodiment, for use in a system for unidirectional data transfer between two servers. [0038] Reference is hereinafter directed to FIG. 2A, wherein FIG. 2 A illustrates a block diagram of a sender module 104 for use in a system for unidirectional data transfer between two servers, in accordance with an embodiment of the present invention. The sender module 104 comprises an optical transmitter 104A, an optical receiver 104B, and a (sender) memory 104C. The configuration of the aforementioned components of the sender module 104 is the same as described in the previous sections of the present disclosure and are not repeated again herein for the sake of brevity of the present disclosure.

[0039] The feature of the sender module 104 that differentiates the sender module 104 from the conventional SFP+ modules is that the optical receiver 104B of the sender module 104 is electronically coupled with the optical transmitter 104A of the sender module itself as a loopback connection "C”. More specifically, the optical receiver 104B of the sender module 104 is not coupled with another transmission module at the destination SFP+ module. The effect of such a configuration is that this modification in the sender module 104 facilitates unidirectional communication between a sender server that is coupled with the sender module 104 and the destination SFP+ module that is coupled with the destination server. The destination SFP+ module is configured devoid of a transmission means. Therefore, any and every data entering the destination server has no means to be transmitted back, thereby ensuring the unidirectional communication between the two servers.

[0040] In accordance with one embodiment, at least the sender module 104 comprises a control unit 200, wherein the control unit 200 further comprises at least one protocol IC 202, at least one Serializer/Deserializer (SERDES) IC 204, and at least one Programmable Logic Device (PLD) or Programmable Array Logic (PAL) 206. All the aforementioned components of the control unit perform their general functions, and the aforementioned components do not form the part of the invention. Rather the control unit 200 has been illustrated in FIG. 2A to provide an exemplary implementation of the sender module 104, which is one part of the present invention.

[0041] FIG. 2B illustrates a block diagram of a receiver module 106 for use in a system for unidirectional data transfer between two servers, in accordance with an embodiment of the present invention. The receiver module 106 comprises an optical receiver 106B, a (receiver) memory 106C and a controller unit 210. As can be noted, the receiver module 106 does not have any optica! transmitter. It can be omitted when the module is fabricated, or it can be simply disconnected physically on the module itself, as it is not required to perform the unidirectional transmission from the sender module to the receiver module 106. Similar as the sender module 104, the controller unit 210 include Protocol IC 212, a SERDES IC 214 and at least one PLD or PAL 216. The components of the control unit 210 perform their general functions known in the art. [0042] As mentioned previously, the use of the sender module 104, in accordance with the present invention helps in reducing the system footprint of the system for unidirectional data transfer to effectively two servers, i.e., the sender server and the receiver server. Furthermore, the configuration of the destination SFP+ module is also optimized, in that the transmission means is absent, thereby resulting in the cost optimization. Furthermore, the use of the sender module, in accordance with the present invention, also eliminates the need of using the network interface cards, thereby overcoming the disadvantages caused due to their usage, as have been explained in the background section of the present disclosure. [0043] The embodiments of the present invention illustrates a new system and method for turning a bidirectional transmission means that require active end-to-end feedback/acknowledgement into a unidirectional transmission means acting as data diode. [0044] FIG. 3 illustrates a block diagram of a data diode network in accordance with an embodiment of the present invention. As shown, the network comprises a sender 302 and a receiver 304. The sender 302 include a transceiver A and the receiver 304 includes a transceiver B connected one to another to establishing transmission. Each transceiver A and B further include a transmitter module Tx and a receiver module Rx. The transmitter module, Tx, of the transceiver A is hardwired to feed data to the receiver module, Rx, of the transceiver A. It is further desired that the socket of the receiver of the transceiver A, if one is available, is sealed off to prevent any physical cable to be connected thereto. On the transceiver B of the receiver 304 side, the transmitter Tx of the transceiver B is omitted or disconnected physically. It is also desired that the socket of the transmitter of the transmitter B, if one is available, is also sealed off to prevent any physical cable be connected thereto. It can be evident from the illustrated figure that the present invention has effectively turn a transceiver into a data diode means as desired.

[0045] It is apparent from the embodiments and illustrations of the present invention that the new SFP/SFP+ device can be adapted on bidirectional network as a data diode from preventing incoming transmission on hardware level, so that the sender side is protected from any cyber intrusions. To avoid the need to deploy the new SFP/SFP+ on all receiving devices, the sender server may be connected to an intermediate gateway supporting SFP/SFP+ devices behind a wide area network. In this case, the new SFP/SFP+ receiver is connected to the intermediate gateway, and it is understood that the sender server is protected as all incoming transmissions are eliminated at the gateway.

[0046] Although embodiments for the sender module and the system of unidirectional data transfer between two servers have been descried in language specific to structural features and/or methods, it is to be understood that the invention is not necessarily limited to the specific features or methods described. Rather, the specific features and methods are disclosed as exemplary embodiments of the system and the method described herein.

Claims

1. A system for unidirectional data transfer, the system comprising:

a sender server from which information is to be transmitted;

a sender module communicatively coupled with the sender server, the sender module comprising:

an optical driver for receiving information from the sender server as input signal, the optical driver configured to generate and transmit a modulated signal based on the input signal; an optical receiver electronically coupled with the optical driver as a loopback connection, the optical receiver receives the modulated signal and provides a feedback to the sender server;

a memory containing a pre-determined set of rules for the operation of the sender module; a receiver server in which the modulated signal is to be received; a receiver module communicatively coupled with the receiver server and the sender module, the receiver module comprising: an optical receiver for receiving the modulated signal from the optical driver and feeding the modulated signal to the receiver server; and

a memory containing a pre-determined set of rules for the operation of the receiver module.

2. The system as claimed in claim 1 , wherein the optical driver is a laser driver having a laser diode.

3. The system as claimed in claim 1 , wherein the optical receivers have a photodiode.

4. The system as claimed in claim 1 , wherein the memory in the sender module and the receiver module is an electrically erasable programmable read-only memory (EEPROM).

5. The system as claimed in claim 1 , wherein the communication between the optical driver and the optical receiver of the receiver module is facilitated by optical fiber.

6. The system as claimed in claim 1 , wherein the sender module and the receiver module are small form factor pluggable {SFP or SFP+) modules.

7. A sender module for use in a network for unidirectional data transfer, the sender module comprises: an optical driver for receiving information from a sender server as input signal, the optical driver configured to generate and transmit a modulated signal based on the input signal;

an optical receiver electronically coupled with the optical driver as a loopback connection, the optical receiver receives the modulated signal from the optical driver and provides a feedback to the sender server; and

a memory containing a pre-determined set of rules for the operation of the sender module.

8. The sender module as claimed in claim 7, wherein the optical driver is a laser driver having a laser diode.

9. The sender module as claimed in claim 7, wherein the optical receiver has a photodiode.

10. The sender module as claimed in claim 7, wherein the memory in the sender module is an electrically erasable programmable read-only memory.

11. The sender module as claimed in claim 7, wherein the sender module is a small form factor pluggable (SFP or SFP+) module.

12. A sender module for use in a network for unidirectional data transfer, the sender module comprises: a transceiver having a transmitter and a receiver, wherein the transmitter output is branched out to couple with the receiver, wherein the receiver operationally receives only signals from the transmitter.

13. The sender module as claimed in claim 12, wherein the sender module is a small form factor pluggable (SPF or SPF+) module.