OT cyber security · unidirectional
BlackBear Data Diodes
The network your attacker cannot cross
BlackBear makes hardware-enforced OT cyber security: unidirectional gateways (data diodes) and secure protocol conversion that let operational data out of a plant, substation or control network while making inbound attack physically impossible. Where a firewall is policy, a diode is physics. Supplied and integrated in the UK by Indiott as the SECURE layer of the stack.
Talk to an engineer ● Answered within one working day
The BlackBear range
DD9000I data diode
FPGA-based unidirectional gateway with protocol proxies on both sides. One 1 Gbps RJ45 port each side, redundant 9-57 VDC input, fanless IP30 DIN-rail from -40 to +70 °C. Carries DNP3, IEC 60870-5-104, IEC 61850, Modbus TCP, MQTT, SFTP, syslog and camera streams one way, with OPC UA on request.
BIG9000I intelligent gateway
The same diode with an eight-port Gigabit managed switch on the plant side, PoE optional, and Layer 3 to 7 inspection of horizontal and vertical traffic. An optional reverse path passes validated DNP3, IEC 104, IEC 61850 and Modbus TCP commands back down to the plant.
UMC24 one-way fibre link
Physically one-way Ethernet-to-fibre converters, sold as a transmit half and a receive half. 1 Gbps over SFP, multimode to 550 m or singlemode to 10 km, dual 5-48 VDC inputs, DIN-rail. The simplest one-way link where no protocol handling is needed.
A diode in the middle, a proxy either side
A protocol computer on the plant side terminates the OT connection, an FPGA-based diode carries the data across at the physical layer, and a second protocol computer rebuilds it for the IT side. There is no return path and no end-to-end TCP/IP session, so nothing on the IT network can reach a PLC, RTU or IED. Because both proxies speak the protocol, SCADA and historians still see ordinary polling and event traffic.
Fitted in the cabinet, not just at the edge
BlackBear units are fanless DIN-rail boxes rated -40 to +70 °C, so they go in the same cabinet as the equipment they protect. Typical placements: between a substation SCADA server and its RTUs and IEDs, between control-room HMIs and a process plant's PLCs, and between NVRs and site cameras. That puts one-way enforcement at Purdue levels 1 and 2, closer to the asset than a data-centre DMZ.
150 diodes across a national railway
On one of South Asia's major railway networks, traction power SCADA runs from 90 control centres linked to more than 1,000 assets. Each master station carries two DD9000 diodes: one from SCADA to the energy management system, one from SCADA to the DMZ web servers behind the remote dashboards. 150 units were installed in total, so managers watch live data without a single inbound path into the control network.
The short answer
Where can you buy BlackBear data diodes in the UK?
Indiott (PSI Technologies Ltd) supplies and integrates BlackBear hardware-enforced data diodes and secure unidirectional gateways in the UK, as the SECURE layer of a full industrial IoT stack. Systems are specified to your OT architecture and quoted within one working day, with UK-based engineering support through deployment.
Frequently asked questions
What is a BlackBear data diode?
A hardware-enforced unidirectional gateway: it lets operational data leave a plant, substation or control network while making an inbound connection physically impossible. Where a firewall enforces policy, a diode enforces physics.
How is a data diode different from a firewall?
A firewall is software that filters two-way traffic and can be misconfigured or exploited; a data diode is hardware that permits exactly one direction of flow, so there is no inbound path to attack. Many OT architectures use both: diodes at the IT/OT boundary, firewalls within zones.
What protocols can cross the one-way boundary?
BlackBear secure protocol conversion carries Modbus, OPC UA, syslog, file transfer and historian traffic across the unidirectional link, so dashboards and cloud analytics keep working without a return path into the control network.
Who are data diodes for?
Utilities, manufacturers, energy and critical-infrastructure operators who must publish OT data to IT or the cloud while keeping the control network unreachable, typically within an IEC 62443 zones-and-conduits architecture.
How do I get pricing?
BlackBear systems are specified to the site, so pricing is by quote. Send an outline of your architecture and requirements and Indiott will respond within one working day.
Related
Buying this in the UK
- Supplied by Indiott, a trading name of PSI Technologies Limited (Companies House 03689664, VAT GB 730 2340 83), Hampshire, United Kingdom.
- Every price is published ex VAT at indiott.com — no quote needed to see it.
- Typically dispatched within 14 working days from the UK, on a VAT invoice.
- Call 023 9223 3611 or request a quote.
Scope it with an engineer.
Tell us the asset, the site and the constraint. You get a bill of materials and a straight answer within one working day.