Unidirectional Data Transmission with DMZ-Based Anomaly Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transmission devices for secure communication between safety-critical and open networks lack effective mechanisms to prevent unauthorized data transmission and intrusion attempts while ensuring reliable anomaly detection.
Innovation Solution
A transmission device with unidirectional transmission units and a demilitarized zone (DMZ) containing a detection unit, isolating the detection unit from both networks, allowing for anomaly detection and preventing unauthorized access, while ensuring unidirectional data flow.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a detection unit is integrated into the transmission device to detect anomalies in data, then the security and reliability of data transmission is improved, but the device complexity increases
Solution Approach 1:
A demilitarized zone (DMZ) is introduced as an intermediary network layer between the first network and the second network. The detection unit is placed within this DMZ, allowing it to monitor data packets flowing between networks without being directly exposed to either network's traffic. This intermediary structure enables anomaly detection while maintaining network isolation and preventing the detection unit from becoming a single point of failure.
Solution Approach 2:
The transmission device is segmented into multiple isolated components: the first unidirectional transmission unit, the second unidirectional transmission unit, and the detection unit, with each component having a specific function. The detection unit is further segmented from the data transmission path, receiving copies of data packets through the DMZ rather than processing actual transmission traffic. This segmentation allows the detection unit to perform security analysis without affecting the core transmission function.
2Object-affected harmful factors
If unidirectional transmission units are used to ensure secure data flow, then the protection against unauthorized access is improved, but the adaptability of the transmission device decreases
Solution Approach 1:
The DMZ acts as a mediator that enables the detection unit to inspect and analyze data packets without breaking the unidirectional transmission constraint. By placing the detection unit in this intermediate zone with read-only access to packet copies, the system maintains strict unidirectional data flow while gaining the capability to detect anomalies and unauthorized access attempts.
Solution Approach 2:
Instead of allowing the detection unit to directly access or modify transmission data, the system creates copies of data packets and directs them to the detection unit through the DMZ. This copying mechanism enables comprehensive security monitoring and anomaly detection while preserving the integrity and unidirectional nature of the original data transmission path.
Data Source
Figure 1~2
AI summary
The invention relates to a transmission device for transmitting data between a first network and a second network. The transmission device comprises: a first uni-directional transmission unit which can be coupled to the first network and is configured to exclusively receive data transmitted from the first network to the transmission device, a second uni-directional transmission unit which can be coupled to the second network and is configured to exclusively send data from the transmission device to the second network, and an identification unit which is located between the first uni-directional unit and the second uni-directional unit and which is configured to receive the data received by the first uni-directional transmission unit and to identify anomalies in the received data. The provided transmission device achieves the reliable, optimized identification of anomalies in the first network and increases security in the identification unit against manipulation and against attacks or intrusion attempts from the second network.