Two-way, secure, data communication within critical infrastructures
View Patent ↗Systems and methods for two-way, secure, data communication within critical infrastructures are usable to protect critical infrastructure information while allowing real-time monitoring and remote access. Such communication systems and methods can be used to protect critical data by, for example, providing a single point of access via unidirectional, serial, non-routable connections. Additionally, data flow may be controlled by a first server that is not accessible outside of the critical infrastructure.
1. A system, comprising:
at least one memory of a first server that stores computer-executable instructions;
at least one processor of the first server configured to access the at least one memory of the first server, wherein the at least one processor of the first server is configured to execute the computer-executable instructions to:
receive, from a second server, via a first unidirectional serial link, a first unique datagram comprising at least data and a checksum value, wherein the first unique datagram comprises a first plurality of unique datagrams concatenated based at least in part on a second configuration file associated with the second server;
decrypt the first unique datagram;
verify data from the first decrypted unique datagram against the checksum value; and
when the data is verified:
combine data associated with operation of a power plant and an associated checksum value into a second unique datagram;
encrypt the second unique datagram;
concatenate a second plurality of unique datagrams comprising the encrypted second unique datagram, wherein the concatenation of the second plurality of unique datagrams is based at least in part on a first configuration file associated with the first server, wherein the first configuration file and the second configuration file comprise installation-specific configuration files that are accessible only via the first unidirectional serial link or a second unidirectional serial link, wherein the first configuration file has contents that are the same as contents of the second configuration file, and wherein the first configuration file configures the first server to share the data with the second server using the second unidirectional serial link; and
transmit, to the second server, via the second unidirectional serial link, at least a portion of the second plurality of unique datagrams.
2. The system of claim 1 , wherein the at least one processor of the first server is further configured to execute the computer-executable instructions to:
when the data is not verified:
transmit, to the second server, via the second unidirectional serial link, a retransmit request; and
receive, from the second server, via the first unidirectional serial link, a retransmitted first unique datagram comprising at least data and the checksum value.
3. The system of claim 1 , wherein the at least one processor of the first server is further configured to execute the computer-executable instructions to:
when the data is verified:
transmit, to a critical data store of the first server, a request for critical data; and
receive, from the critical data store of the first server, the critical data.
4. The system of claim 1 , wherein the first unique datagram is received from the second server based at least in part on an instruction from the second server.
5. The system of claim 1 , wherein the first and second servers are coupled via the first and the second unidirectional serial links.
6. The system of claim 5 , wherein the first and the second unidirectional serial links comprise respective diodes.
7. The system of claim 1 , wherein the decryption of the first unique datagram is based at least in part on the first configuration file, wherein the first configuration file is stored in the at least one memory of the first server and the second configuration file is stored in at least one memory of the second server.
8. The system of claim 1 , wherein the first unique datagram comprises numeric data only sent as a continuous, concatenated datagram.
9. A method performed at a first server, comprising:
receiving, from a second server, via a first unidirectional serial link, a first unique datagram comprising at least data and a checksum value, wherein the first unique datagram comprises a first plurality of unique datagrams concatenated based at least in part on a second configuration file associated with the second server;
decrypting the unique datagram;
verifying data from the first decrypted unique datagram against the checksum value; and when the data is verified:
combining data associated with operation of a power plant and an associated checksum value into a second unique datagram;
encrypting the second unique datagram;
concatenating a second plurality of unique datagrams comprising the second unique datagram, the concatenation of the second plurality of unique datagrams based at least in part on a first configuration file associated with the first server, wherein the first configuration file and the second configuration file comprise installation-specific configuration files that are accessible only via the first unidirectional serial link or a second unidirectional serial link, wherein the first configuration file has contents that are the same as contents of the second configuration file, and wherein the first configuration file configures the first server to share the data with the second server using the second unidirectional serial link; and
transmitting, to the second server, via the second unidirectional serial link, at least a portion of the second plurality of unique datagrams.
10. The method of claim 9 , further comprising:
when the data is not verified:
transmitting, to the second server, via the second unidirectional serial link, a retransmit request; and
receiving, from the second server, via the first unidirectional serial link, a retransmitted first unique datagram comprising data and the checksum value.
11. The method of claim 9 , further comprising:
when the data is verified:
transmitting, to a critical data store of the first server, a request for critical data; and
receiving, from the critical data store of the first server, the critical data.
12. The method of claim 9 , wherein the first unique datagram is received from the second server based at least in part on an instruction from the first server.
13. The method of claim 9 , wherein the first and second servers are coupled via the first and the second unidirectional serial links.
14. The method of claim 13 , wherein the first and the second unidirectional serial links comprise respective diodes.
15. The method of claim 9 , wherein the decryption of the unique datagram is based at least in part on the first configuration file, wherein the first configuration file is stored in the at least one memory of the first server and the second configuration file is stored in at least one memory of the second server.
16. The method of claim 9 , wherein the unique datagram comprises numeric data only sent as a continuous, concatenated datagram.
17. A system, comprising:
a first server and a second server coupled via a first unidirectional serial link and a second unidirectional serial link,
at least one memory of the first or second server that stores computer-executable instructions;
at least one processor of the first or second server configured to access the at least one memory of the first or second server, wherein the at least one processor of the first or the second server is configured to execute the computer-executable instructions to:
receive, from the second server via the first unidirectional serial link, a first unique datagram comprising data, an identifier (ID), and a checksum value, wherein the second server initiates transmission of the unique datagram, and wherein the first unique datagram comprises a first plurality of unique datagrams concatenated based at least in part on a second configuration file associated with the second server;
decrypt, by the first server, the first unique datagram based at least in part on a first configuration file stored in the at least one memory of the first server;
verify, by the first server, data from the first unique datagram against the checksum value; and
when the data is verified:
combine, by the first server, data associated with operation of a power plant, an ID, and an associated checksum value into a second unique datagram;
encrypt, by the first server, the second unique datagram;
concatenate, by the first server, a second plurality of unique datagrams comprising the encrypted second unique datagram, wherein the concatenation of the second plurality of unique datagrams is based at least in part on a second configuration file, wherein the first configuration file and the second configuration file comprise installation-specific configuration files that are accessible only via the first unidirectional serial link or the second unidirectional serial link, wherein the first configuration file has contents that are the same as contents of the second configuration file, and wherein the first configuration file configures the first server to share the data with the second server using the second unidirectional serial link; and
transmit, to the second server via the second unidirectional serial link, at least a portion of the second plurality of unique datagrams, wherein the second server initiates the transmission of the at least a portion; and
when the data is not verified:
transmit, to the second server via the second unidirectional serial link, a retransmit request; and
receive, from the second server via the first unidirectional serial link, a retransmitted unique datagram comprising data, an ID, and a checksum value.