Secure one-way network gateway
A secure one-way network gateway for transmitting data from a source network to a destination network is disclosed. An input circuit is for coupling to a source network and an output circuit is for coupling to an output network. A memory stores configuration data. Either a single field-programmable device or a pair of field-programmable devices coupled via a one-way link are inserted between the input circuit and the output circuit. The configuration data is loaded into the device(s) to program the device(s) to pass data from the input circuit to the output circuit, to optionally filter the data, and to prevent any data from passing from the output circuit to the input circuit. A processor is coupled to only the memory and a separate management interface. The processor receives updated configuration data via the management interface and replaces the configuration data in the memory with the updated configuration memory.
1. A secure one-way network gateway for transmitting data from a source network to a destination network, comprising:
an input circuit for coupling to the source network;
an output circuit for coupling to an output network;
a memory for storing a first set of configuration data and a second set of configuration data;
a one-way link having an input and an output, the one-way link passing data from the input to the output and preventing any data from passing from the output to the input;
a first field-programmable device coupled to the input circuit and to the input of the one-way link, the first field-programmable device configured to load the first set of configuration data from the memory, the first set of configuration data for programming the first field-programmable device to pass data from the input circuit to the input of the one-way link;
a second field-programmable device coupled to the output of the one-way link and to the output circuit, the second field-programmable device configured to load the second set of configuration data from the memory, the second set of configuration data for programming the second field-programmable device to pass data from the output of the one-way link to the output circuit; and
a processor coupled to the memory and a separate management interface, the processor configured to receive an updated first set of configuration data and/or an updated second set of configuration data via the management interface and to replace the respective first set of configuration data and/or second set of configuration data in the memory with the received updated first set of configuration data and/or updated second set of configuration data.
2. The secure one-way network gateway of claim 1 , wherein the first field-programmable device is a field programmable gate array.
3. The secure one-way network gateway of claim 1 , wherein the second field-programmable device is a field programmable gate array.
4. The secure one-way network gateway of claim 1 , wherein the input circuit is a physical interface circuit.
5. The secure one-way network gateway of claim 1 , wherein the output circuit is a physical interface circuit.
6. The secure one-way network gateway of claim 1 , wherein the first set of configuration data for the first field-programmable device programs the first field-programmable device to filter the data based on filter parameters before passing the filtered data to the input of the one-way link.
7. The secure one-way network gateway of claim 6 , wherein the first set of updated configuration data includes updated filter parameters.
8. The secure one-way network gateway of claim 1 , wherein the memory has a first portion for storing the first set of configuration data within the first field-programmable device and a second portion for storing the second set of configuration data within the second field-programmable device.
9. The secure one-way network gateway of claim 1 , wherein the memory is within the processor.
10. The secure one-way network gateway of claim 1 , wherein the processor is an Advanced RISC (Reduced Instruction Set Computer) Machine (ARM) processor.