Air-Gap File Transfer Using Authenticated Handheld Mediators

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for data exchange between operational technology (OT) and information technology (IT) networks in an air-gap architecture are insecure, relying on removable media like USB drives, which pose cybersecurity risks, inefficiencies, and inefficiencies in data analysis and decision-making.

Innovation Solution

A system and method utilizing a handheld computing device and central stations with authentication and sanitization processes to securely transfer files across an air gap, ensuring integrity and security through two-factor authentication, malware inspection, and real-time security updates.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If traditional removable media such as USB drives are used for file transfer between OT and IT networks, then data exchange can occur across the air gap, but cybersecurity risks increase due to malware infection, data leakage, and unauthorized access

Engineering Contradiction:

Improvedata exchange capabilityVSAvoidcybersecurity risks

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a secure file transfer device as an intermediary between the IT network and OT network. This device acts as a controlled mediator that enables file transfer while implementing security measures such as authentication, malware scanning, and authorized personnel verification, thereby resolving the contradiction between data exchange capability and cybersecurity risks

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary security actions before file transfer occurs, including authentication of users and devices, malware scanning of files, and verification of authorization. These preliminary checks prevent malicious content from entering the OT network, addressing the security risks while maintaining data exchange functionality

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If removable USB drives are used for file transfer, then data can be exchanged between networks, but the process becomes time-consuming, error-prone and cumbersome

Engineering Contradiction:

Improvedata exchange capabilityVSAvoiddata transfer efficiency

Core Design Contradiction:

Adaptability or versatilityVSProductivity

Solution Approach 1:

The patent replaces the mechanical process of physically inserting and removing USB drives with an automated electronic file transfer system. The secure file transfer device enables wireless or automated wired transmission of files, eliminating manual handling errors and reducing transfer time, thus improving productivity while maintaining data exchange capability

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system implements self-service capabilities through automated authentication, file scanning, and transfer processes. Once configured, the system automatically verifies user credentials, scans files for malware, and completes transfers without requiring manual intervention for each operation, significantly improving efficiency

Inventive Principle:

Principle #25Self-service

3Reliability

If an air gap architecture is implemented to isolate OT networks from IT networks, then security from external attacks is improved, but data exchange between networks becomes difficult

Engineering Contradiction:

Improvesecurity isolationVSAvoiddata exchange capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The secure file transfer device serves as a controlled intermediary that bridges the air gap between IT and OT networks. It maintains the security isolation by preventing direct network communication while enabling controlled file transfer through authenticated users, thus resolving the contradiction between security isolation and data exchange capability

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system segments the file transfer process into distinct secure stages: authentication phase, scanning phase, and transfer phase. Each stage is isolated and controlled, allowing data exchange while maintaining the air gap security architecture intact

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12580968B2System and method for secure data exchange between operational technology systems and external networks in air-gap architecture environment

Publication Date: 2026.03.17 SAUDI ARABIAN OIL CO

AI summary

A system for secure data exchange between an operational technology network and an external information technology network separated by an air gap. The system includes a handheld computing device, a first central station coupled to the external information technology network and a receptacle for detachable coupling to the handheld computing device. The system also includes a second central station coupled to the operational technology network and a receptacle for detachable coupling to the handheld computing device. The system manages secure file transfers between the first central station and the second central station in which a file is uploaded to the detachable handheld device, and in which the handheld device is detachable and moveable from the first central station to the second central station or vice versa. Thereafter, the handheld device is attachable to the central station to which it has been moved to enable secure downloading of the file.