Secure one-way interface for a network device
View Patent ↗A one-way interface for a network device which secures status registers therein from unauthorized changes. The interface includes a first server, a one-way data link and a second server. The first server is coupled to the status registers to read information stored therein. The first server reads the information from the status registers and transmits the information on an output. The one-way data link has an input coupled to the output of the first server and an output. The second server has an input coupled to the output of the one-way data link and an output coupled to a network. The second server receives the information from the first server via the one-way data link. The second server transmits the information on the output to a predetermined network destination and/or provides a user interface for providing access to the information via the network.
1. A secure one-way interface for a network device, comprising:
a network device having status registers for storing information, the network device adapted to be directly coupled to a network via a first connection to provide network device functionality, the network device configured to prevent access to the status registers via the first connection and to allow access to the status registers via a separate second connection;
a first server coupled to the status registers in the network device via the second connection to read the information stored in the status registers, the first server configured to read the information from the status registers and transmit the information on an output;
a one-way data link having an input coupled to the output of the first server and an output, the one-way data link configured to transfer data only from the input to the output and to prevent any signal from passing from the output to the input; and
a second server having an input coupled to the output of the one-way data link and an output adapted to be directly coupled to the network, the second server configured to receive the information from the first server via the one-way data link, the second server further configured to transmit the information on the output to a predetermined network destination.
2. The secure one-way interface of claim 1 , wherein the first server is configured to repeatedly read and transmit the information from the status registers on a predetermined basis.
3. The secure one-way interface of claim 2 , wherein the predetermined basis is a predetermined fixed interval.
4. The secure one-way interface of claim 2 , wherein the predetermined basis is a fixed schedule.
5. The secure one-way interface of claim 2 , further comprising a second one-way data link having an input coupled to an output on the second server and an output coupled to an input on the first server,
wherein the second server is further configured to allow a user to enter a command for changing the predetermined basis and to transmit the entered command to the first server via the second one-way device; and
wherein the first server is further configured to receive the command via the second one-way data link and to change the predetermined basis.
6. The secure one-way interface of claim 1 , wherein the first server includes a memory for storing the information and is configured to repeatedly read the information from the status registers at a predetermined fixed interval, to compare the read information with the stored information, and, only if the read information is different from the stored information, to forward the read information on the output and to replace the previously stored information with the read information.
7. The secure one-way interface of claim 1 , wherein the second server includes a memory for storing the information and is configured to receive the information from the first server, to compare the read information with the stored information, and, only if the read information is different from the stored information, to transmit the read information on the output and to replace the previously stored information with the read information.
8. The secure one-way interface of claim 1 , wherein the second server includes a storage device and wherein the second server is configured to store the received information along with identifying information on the storage device.
9. The secure one-way interface of claim 8 , wherein the second server is configured to allow a user to request information via the second interface based upon the identifying information.
10. The secure one-way interface of claim 1 , further comprising a second one-way data link having an input coupled to an output on the second server and an output coupled to an input on the first server,
wherein the second server is further configured to allow a user to enter a command for changing at least part of the information stored in the status registers and to transmit the entered command to the first server via the second one-way device; and
wherein the first server is further configured to receive the command via the second one-way data link and to cause the command to be executed.
11. The secure one-way interface of claim 10 , wherein the second server is configured to require that the user enter a password before allowing the user to select or enter the command.
12. The secure one-way interface of claim 10 , wherein the first server includes a memory for storing the information and is configured to repeatedly read the information from the status registers at a predetermined fixed interval, to compare the read information with the stored information, and, only if the read information is different from the stored information, to forward the read information on the output and to replace the previously stored information with the read information.
13. The secure one-way interface of claim 10 , wherein the user communications to the second interface are encrypted.
14. The secure one-way interface of claim 1 , wherein the information stored in the status register comprises status information and identification information.
15. The secure one-way interface of claim 14 , wherein the identification information comprises a MAC address.
16. The secure one-way interface of claim 1 , wherein the second server is configured to transmit the information in the form of an SNMP Trap message.
17. The secure one-way interface of claim 1 , wherein the network device is one of a router, a workstation, a server, a switch, a bridge, a hub, an IP telephone, an IP video camera, a computer host, a modem rack or a printer.
18. A secure one-way interface for a network device, comprising:
a network device having status registers for storing information, the network device adapted to be directly coupled to a network via a first connection to provide network device functionality, the network device configured to prevent access to the status registers via the first connection and to allow access to the status registers via a separate second connection;
a first server coupled to the status registers in the network device via the second connection to read the information stored in the status registers, the first server configured to read the information from the status registers and transmit the information on an output;
a one-way data link having an input coupled to the output of the first server and an output, the one-way data link configured to transfer data only from the input to the output and to prevent any signal from passing from the output to the input; and
a second server having an input coupled to the output of the one-way data link, a memory and an output adapted to be directly coupled to the network, the second server configured to receive the information from the first server via the one-way data link and store the information in the memory, the second server further configured to provide a user interface for allowing a user to read the stored information via the network.
19. The secure one-way interface of claim 18 , wherein the second server is configured to require that the user enter a password before allowing the user to read the stored information.
20. The secure one-way interface of claim 18 , wherein the network device is one of a router, a workstation, a server, a switch, a bridge, a hub, an IP telephone, an IP video camera, a computer host, a modem rack or a printer.