Computing System Data Lock for Secure Remote Maintenance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computing systems face challenges in securely transmitting data from non-secure networks to security-critical networks while maintaining the integrity and security of the closed network, particularly for remote maintenance and updates.
Innovation Solution
A computing system with an input data path containing an input data diode and a data lock that allows unidirectional data transmission to the computing device and prevents reverse transmission, combined with a buffer and switches to ensure secure data reception from external devices, and an output data diode for controlled data exchange with an auxiliary device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data networks are completely disconnected for high security, then security protection is improved, but remote maintenance capability deteriorates
Solution Approach 1:
The data transmission path is segmented into multiple unidirectional stages: external network → interface device → input data diode → data lock → computing device. Each segment provides security isolation while enabling controlled data flow for maintenance purposes.
Solution Approach 2:
A data lock serves as an intermediary buffer between the input data diode and the computing device. It temporarily stores incoming data and controls its release to the computing device, preventing direct external access while enabling maintenance operations.
2Reliability
If data diodes are used for unidirectional transmission, then security is improved, but bidirectional communication capability deteriorates
Solution Approach 1:
The data lock operates in periodic cycles: buffering phase (connected to input data diode) and transmission phase (connected to computing device). This periodic switching enables bidirectional communication functionality while maintaining unidirectional security constraints at each moment.
Solution Approach 2:
The data lock dynamically switches its connection state between the input data diode and the computing device. This dynamic behavior allows the system to adapt between receiving data from external sources and transmitting data to the computing device, effectively providing bidirectional communication through unidirectional components.
3Productivity
If direct remote access is enabled, then maintenance efficiency is improved, but security risk increases
Solution Approach 1:
The data lock acts as a mediator that decouples the external interface from the computing device. Maintenance personnel can efficiently transmit data through the interface device and input data diode, while the data lock ensures that no direct access path exists, thereby maintaining security despite enabled remote maintenance.
Solution Approach 2:
The system maintains continuous security protection through the always-active unidirectional data flow constraints imposed by the input data diode and the controlled buffering in the data lock. This continuous security mechanism enables efficient maintenance operations without intermittent security vulnerabilities.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
Ensures continuous disconnection from external devices, preventing direct attacks and allowing secure, controlled data transmission from external devices to the computing device, ensuring data integrity and security.
Implementation Method 1
the input data diode to allow data to be transmitted in the direction of the computing device and to prevent this in the opposite direction
Implementation Method 2
the data lock to have a first and a second connection and a buffer for buffering data and to be configured such that the buffer can either be exclusively connected to the first or second connection, but not to both connections at the same time
Data Source
AI summary
A computing system has with a computing device. The computing system has an input data path, which unidirectionally connects an interface device of the computing system to the computing device, and an output data diode, which unidirectionally connects the computing device to at least one output interface of the computing system. The input data path has a series circuit which is arranged downstream of the interface device and contains an input data diode and a data lock. The input data diode allows a transmission of data in the direction of the computing device and prevents the transmission of data in the opposite direction. The data lock has a first and a second terminal and a temporary storage unit for temporarily storing data and is configured such that the temporary storage unit can be selectively connected solely to the first or second terminal but not simultaneously to both terminals.