Data Diodes Explained: One-Way Hardware for Safe IT/OT Segmentation

Last updated: 2 July 2026

TL;DR: Data diodes are hardware devices that force network traffic to travel in one physical direction only. They let operational data leave a control network for monitoring and reporting while making it physically impossible for anything, including malware or a remote attacker, to travel back into the plant. That one-way path is enforced in silicon, not software, so it cannot be reconfigured, bypassed, or exploited by a firewall rule change.

If you run a plant, a substation, or a water network, the safest data flow is the one that can only go outwards. This guide explains how data diodes work, where they sit in the Purdue model and IEC 62443, when to use one instead of a firewall, and how they fit the UK regulatory picture.

What are data diodes and how do they work?

Data diodes are hardware-enforced security devices that permit data transfer in only one direction, physically enforced in the device design rather than configured in software. Data diodes sit between two networks of different trust levels and allow data to flow out of the more sensitive network while making a return path physically impossible.

The name borrows from electronics. An electrical diode passes current one way and blocks it the other. A data diode does the same for network traffic. The one-way property comes from the physical layer: a transmit-only optical or FPGA-based path that has no return channel at all, so there is nothing for a return packet to travel back along.

Because directionality is built into the hardware, a data diode cannot be re-enabled for two-way traffic by a mistaken rule, a firmware compromise, or an insider. As the NCSC-led secure connectivity guidance puts it, data diodes “aid in establishing assurance of uni-directional data flows, through physically enforced directionality designed into the hardware” (NCSC).

The modern form of the data diode is the unidirectional gateway. It pairs the one-way hardware with proxy software that replicates databases, historians, and protocol servers on the IT side, so applications receive a faithful copy of OT data without ever reaching into the OT network. BlackBear, whose hardware Indiott integrates, describes this as proxy servers in OT and IT running independently, “sending OT data to the IT side without the possibility of reverse flow” (BlackBear).

How does a data diode enforce one-way data flow?

A data diode enforces one-way flow by physically removing the return path. On an optical diode the sender has a light source and the receiver has a light detector, with no detector on the send side and no source on the receive side, so a signal can only travel outward. Some designs use FPGA logic to the same end.

This matters because most network protocols assume two-way conversation. TCP, for example, needs acknowledgements sent back to the sender. A diode breaks that assumption, so the vendor software runs proxies on each side that convert two-way protocols into a one-way stream and rebuild it on the far end.

BlackBear uses “an innovative FPGA method, permitting only whitelisted traffic in one direction and blocking any traffic from the other” (BlackBear). Its smart grid product streams MACsec-encrypted output at 1Gbps wire speed, so the one-way constraint does not throttle real telemetry (BlackBear).

The security payoff is simple. If no bytes can physically travel back into the control network, then no command, no exploit, and no malware beacon can either. You get the operational visibility you need without opening the door you were trying to keep shut.

Where do data diodes sit in the Purdue model and IT/OT segmentation?

Data diodes sit on the boundary between the OT control network and the IT or DMZ side, typically between Purdue Levels 3 and 4 or on the industrial DMZ. They let telemetry climb from the process side up to enterprise and cloud systems while blocking any traffic flowing the other way.

The Purdue model splits a plant into five or six levels, from field sensors and controllers at the bottom to enterprise IT at the top, with a clear separation between the OT side that runs the process and the IT side that runs the business. The lower you go, the closer you are to equipment that can cause physical harm if it misbehaves.

A one-way data push architecture, reinforced by firewalls and access controls and optionally by hardware data diodes, prevents an attacker who compromises the enterprise network from reaching the systems that control physical processes. The diode is the strongest form of that push because it removes the return path entirely rather than merely filtering it.

This is where the historian pattern lives. Plants replicate a process historian or SCADA database out to the IT side through a diode, so analysts, dashboards, and business intelligence tools query the copy. The live control data never leaves the OT zone, and nothing from the IT zone can reach in to alter it.

How do data diodes fit IEC 62443 zones and conduits?

IEC 62443 models an industrial system as zones, which group assets with the same security requirements, and conduits, which are the communication pathways between zones. A data diode is a way to implement a unidirectional conduit, allowing output from a higher-security zone to a lower one without any inbound path.

IEC 62443 is the international framework that “defines technical and procedural requirements for securing Industrial Automation and Control Systems (IACS) and Operational Technology (OT)” (Bacula Systems). Segmentation into zones and conduits is its core architectural idea, because it stops lateral movement: breach one zone and an attacker still cannot easily reach the next.

The framework grades protection from Security Level 1, casual or accidental misuse, up to Security Level 4, defined as protection against “nation-state level adversaries or threats that could have severe consequences” (Bacula Systems). The higher the level, the stronger the isolation the conduit must provide.

Firewalls can implement a conduit, but they still pass traffic both ways under a ruleset that can be misconfigured. A data diode implements a conduit whose directionality is physical, which is why it is reached for when a zone holds safety-critical or nationally significant assets and the outbound-only path must be provable, not just configured.

What are the typical use cases for data diodes?

Data diodes are used wherever operational data must leave a sensitive network but nothing can be allowed back in. Data diodes are common in safety-critical plant, utilities and grid substations, oil and gas platforms, defence and classified networks, and for replicating a process historian to enterprise and cloud analytics.

In utilities and energy the pattern is well established: diodes send operational telemetry to centralised monitoring and cloud analytics platforms while preventing cyberattacks from travelling back into the protected network. BlackBear documents deployments on oil and gas platforms, smart grid PLCs, and power grid substations (BlackBear).

• Safety-critical plant: stream process data to monitoring and reporting without exposing the safety instrumented systems that keep people alive.
• Utilities, water and grid: push meter, SCADA, and substation telemetry to a central operations centre while keeping the control layer sealed.
• Historian replication: mirror the OT historian to an IT copy so dashboards and BI query the replica, never the live source.
• Critical national infrastructure: provide regulators and operations teams the visibility they need under a provable one-way constraint.

The common thread is asymmetry of risk. The value of the outbound data is real, but the cost of an inbound compromise, a tripped safety system, a poisoned water supply, a blacked-out grid, is far higher. A diode lets you capture the first without accepting the second.

Data diodes vs firewalls: what are the limits?

A firewall filters two-way traffic under a configurable ruleset; a data diode removes the return path in hardware. Firewalls are flexible and support interactive protocols, but a rule error or firmware flaw can open a hole. A diode cannot be misconfigured into two-way traffic, but it also cannot pass return traffic when you genuinely need it.

That trade-off defines where each belongs. Use firewalls where the OT zone legitimately needs controlled inbound connectivity, such as remote engineering access, and use a diode where the requirement is strictly outbound and the consequences of a breach are severe.

Data diodes are not a complete cross-domain solution on their own. The NCSC guidance is explicit that “data diodes alone provide directionality rather than comprehensive security and should not be treated as a complete cross-domain solution” (NCSC). Content still needs inspection: a diode will happily pass a malformed or malicious file outward, so pairing it with scanning and content controls matters.

Standards bodies treat data diodes as one layer among many. NIST SP 800-82 defines unidirectional gateways as a core component of a layered defence-in-depth strategy for high-risk OT environments, alongside perimeter controls, monitoring, and incident response. The diode is the hard boundary; the rest of the stack does the inspection and detection around it.

Why does this matter now for UK OT and critical infrastructure?

UK operators of essential services face rising OT-specific threats and a tightening regulatory regime. The NCSC Cyber Assessment Framework, now at version 4.0 published on 18 April 2024, is the tool used “to assess the cyber security of UK CNI and related sectors” under the NIS Regulations (NCSC). Segmentation and controlled data flow are central to meeting it.

The threat is measurable. Dragos, in its eighth annual OT year-in-review covering 2024, reported that ransomware activity against industrial organisations surged more than 87% year over year, with manufacturing accounting for more than 50% of observed victims and 25% of cases involving a full shutdown of an OT site (Dragos).

UK policy is moving in step. The NCSC has warned that “the gap between the threat posed to critical national infrastructure (CNI) and the ability of owners and operators of CNI to defend against it was widening” (NCSC), and the forthcoming Cyber Security and Resilience Bill is set to bring almost all OT systems firmly into scope as national resilience assets.

For a UK plant or utility engineer, a data diode is a concrete, auditable answer to a regulator asking how OT data leaves the control network safely. It gives a one-way path you can point to, physically enforced, that lets the data out and keeps the threats out.

Frequently asked questions

What is a data diode in simple terms?

A data diode is a piece of hardware that lets network data travel in one direction only. It works like a one-way valve: operational data can leave a sensitive network, but nothing can travel back in, because the return path physically does not exist.

What is the difference between a data diode and a firewall?

A firewall inspects and filters traffic flowing both ways under a configurable ruleset, so a mistake can open a hole. A data diode removes the return path entirely in hardware, so it cannot be misconfigured into two-way traffic, but it also cannot pass return traffic when you need it.

Are data diodes required by IEC 62443?

IEC 62443 does not mandate diodes by name, but it uses zones and conduits, and a data diode is a common way to implement a unidirectional conduit. Diodes are typically chosen for high security levels where the outbound-only path must be physically provable rather than merely configured.

Can anything get back through a data diode?

No return network traffic can travel back through a correctly designed data diode, because there is no physical return channel. The caveat is that a diode does not inspect content, so the outbound data it passes should still be scanned by other controls.

Where does a data diode sit in the Purdue model?

It usually sits on the boundary between the OT control network and the IT or DMZ side, around Purdue Levels 3 and 4. From there it pushes telemetry and historian data upward while blocking any traffic attempting to move down into the process.

What is a unidirectional gateway?

A unidirectional gateway is a data diode combined with proxy software that replicates databases, historians, and protocol servers on the receiving side. It gives applications a usable copy of OT data over a physically one-way link, without exposing the source network.

Enforce a one-way path with Indiott

Data diodes are the Secure layer of the Indiott stack made physical: hardware that lets your operational data out for monitoring and reporting while keeping every threat locked out of the control network. Paired with the right sensors, gateways, and dashboards, they let you meet NCSC CAF and IEC 62443 expectations with an auditable, one-way boundary.

Explore how we build hardware-enforced segmentation into industrial systems on our OT cybersecurity for CNI solution page and our wider security overview. To design the surrounding controls, see our guide to OT cybersecurity best practices. When you are ready, talk to us about a diode-backed architecture for your plant, utility, or network.