Secure one-way network gateway

A secure one-way network gateway for transmitting data from a source network to a destination network is disclosed. An input circuit is for coupling to a source network and an output circuit is for coupling to an output network. A memory stores configuration data. Either a single field-programmable device or a pair of field-programmable devices coupled via a one-way link are inserted between the input circuit and the output circuit. The configuration data is loaded into the device(s) to program the device(s) to pass data from the input circuit to the output circuit, to optionally filter the data, and to prevent any data from passing from the output circuit to the input circuit. A processor is coupled to only the memory and a separate management interface. The processor receives updated configuration data via the management interface and replaces the configuration data in the memory with the updated configuration memory.

FIELD

This disclosure relates to a secure one-way network gateway, and more particularly to a secure one-way network gateway providing data filtering and implemented using one or more field-programmable gate arrays.

BACKGROUND

Many organizations have processing and communication environments which include different networks subject to differing levels of security. Such environments may include a highly secure network used to communicate confidential or secret information, and one or more less secure networks that do not process confidential or secret information. Such highly secure networks may have strict limitations on the type of data that can be imported thereto or exported therefrom. In addition, the data within a highly secure network may be subject to differing security requirements.

In some cases, a one-way network gateway is used to transfer data from a highly secure network (the source network) to a less secure network (the destination network), or vice versa. A one-way network gateway is preferably hardware-based in order to ensure that data may only pass from the source network to the destination network and to prevent data or any signal whatsoever from passing from the destination network to the source network. The one-way network gateway may receive information at the input via a particular protocol, e.g., User Datagram Protocol (UDP). The one-way network gateway may include a filter that filters the files or other data received at the input to prevent any malware or other harmful files from passing to the destination network and/or to ensure that only approved files received at the input on the source network are passed to the output on the destination network. A typical one-way network gateway includes a source-side server coupled to a destination-side server only via a hardware-enforced one-way link. The hardware-enforced one-way link may comprise a fiber optic link, with the fiber coupled only to a transmitter in the source side server at a first end thereof and to a receiver in the destination-side server at a second end thereof. This one-way link architecture ensures that nothing can be transferred from the destination-side server to the source-side server because there is no data path at all in the reverse direction. One drawback of this type of one-way network gateway is that two servers are required, which can be costly.

Field configurable devices, such as field programmable gate arrays (FPGAs), may be substituted for servers in a one-way network gateway to provide a less expensive solution. However, FPGAs are typically configured using data that is supplied to the FPGA device after the FPGA device is installed in a system. For example, the configuration data is typically loaded into the FPGA device from an external memory each time the system is powered on. Because the processing performed by each FPGA device may need to be updated from time to time (e.g., to update filter parameters), external access is required to each such external memory. However, this external access path must be kept completely isolated from the data path to ensure that there is on ability to gain access to any data passing from the source network to the destination network and to ensure that there is no ability to insert malware of any type into the data path via this external access path.

Accordingly, there is a need for a secure one-way network gateway based on field-programmable devices which isolates the data path from the external access path.

The features, functions, and advantages of the present disclosure can be achieved independently in various embodiments of the present disclosure or may be combined in yet other embodiments in which further details can be seen with reference to the following description and drawings.

DETAILED DESCRIPTION

In the present disclosure, like reference numbers refer to like elements throughout the drawings, which illustrate various exemplary embodiments of the present disclosure.

Referring now toFIG. 1, a first embodiment of a secure one-way network gateway100is shown. Gateway100transmits data from a source network coupled to an input (RJ45 interface110) to a destination network coupled to an output (RJ45 interface112) while preventing any information whatsoever from passing from the destination network to the source network. Gateway100may be powered via a separate USB power interface160. A first RJ45 interface110is provided as an input for connection to source network (not shown). A PHY (physical interface) circuit120is coupled to receive input data from RJ45 interface110. PHY circuit120implements the physical layer functions of the OSI model and acts as the input side network interface for gateway100. PHY circuit120is preferably chosen to provide a one Gigabyte Ethernet interface for communication via UDP packets.

A field-programmable device130, preferably a FPGA, forms a data flow path from an input coupled to first PHY circuit120to an output coupled to a second PHY circuit122. FPGA130is coupled to receive data from the output of PHY circuit120. FPGA130is a single-chip solution having red black separation capability, as is known in the art. FPGA130has two portions, source side portion131and destination side portion132separated by a boundary133. FPGA130is configured to implement a one-way link135that allows source side portion131to pass data to destination side portion132, but prevents destination side portion132from passing any data whatsoever to source side portion. Source side portion131is configured to receive data on an input from PHY circuit120, implement a filter on such data (optionally), and to pass the filtered data via the one-way link135to the destination side portion132. Destination side portion132is configured to receive data via the one-way link135and to forward the received data on an output to PHY circuit122. PHY circuit122receives data from the output of FPGA130and formats it for transmission via a destination side network coupled to RJ45 interface112.

As explained above, an FPGA is typically configured using data loaded into the FPGA device from memory each time the gateway is powered on. As known in the art, in some designs an external memory is provided to store the FPGA configuration data and in others the FPGA may include an internal memory that stores the FPGA configuration data. In gateway100, a separate processor140(preferably an ARM processor) is provided as a buffer between management interface150and FPGA130. Management interface150provides an external link which allows the FPGA configuration data to be updated. This is required, for example, to update the filter parameters used by the filter implemented in source side portion131of FPGA130.

ARM processor140may include an internal memory141for storing the FPGA configuration data in cases where the FPGA130does not include such an internal memory. In this case, a user can connect an external computer to management interface150via a conventional (e.g., USB) protocol and transmit an updated FPGA configuration data set to ARM processor140for storage in the internal memory141of the ARM processor140. Once the updated FPGA configuration data set is stored in the internal memory141of the ARM processor140, it will be loaded into FPGA130upon the next power cycle of gateway100.

When FPGA130includes an internal memory136for storing the FPGA configuration data set, ARM processor140is configured to receive the updated FPGA configuration set from an external computer via management interface150and to forward it for storage in the internal memory136of FPGA130. In a similar manner, FPGA130will be updated based on the updated FPGA configuration set upon the next power cycle of gateway100.

Two connections are shown between ARM processor140and FPGA130in order to demonstrate that FPGA130has two distinct portions (source side portion131and destination side portion132) as discussed above. Management interface150is separate from the input RJ45 interface110and the output RJ45 interface112and can only communicate to ARM processor140. In this manner, the management interface150is completely isolated from the data path formed by FPGA130after configuration, ensuring that no malware of any sort can be inserted into the data flow path of FPGA130via management interface150and that there can be no ability to access any data within the data flow path of FPGA130via management interface150.

In a second embodiment of a gateway200for providing a secure one-way network gateway shown inFIG. 2, two separate FPGAs230and232are provided, instead of a single FPGA providing red black separation as in the first embodiment. Gateway200transmits data from a source network coupled to an input (RJ45 interface110) to a destination network coupled to an output (RJ45 interface112) while preventing any information whatsoever from passing from the destination network to the source network. FPGA230provides the functionality provided by source side portion131inFIG. 1. FPGA230receives data on an input from PHY circuit120, implements a filter on such data (optionally), and passes the filtered data to an input of FPGA232via a one-way link235. One-way link235can be any known type of link that creates a hardware-enforced one-way data path, e.g., an optical isolator. FPGA232provides the functionality provided by destination side portion132inFIG. 1. FPGA232receives data via the one-way link235and forward the received data on an output to PHY circuit122.

In theFIG. 2embodiment, processor240(preferably an ARM processor) operates in a similar manner as ARM processor140inFIG. 1, but is required to manage two separate sets of FPGA configuration data, one for FPGA230and another for FPGA232. In particular, ARM processor240may include an internal memory241for storing the two sets of FPGA configuration data in cases where FPGA230and232do not include such an internal memory. In this case, a user can connect an external computer to management interface150via a conventional (e.g., USB) protocol and transmit updated FPGA configuration data sets to ARM processor140for storage in the internal memory241of the ARM processor140. Once the updated FPGA configuration data sets are stored in the internal memory241of the ARM processor140, each such data set will be loaded into the appropriate one of FPGA230and FPGA232upon the next power cycle of gateway200.

When FPGA230and FPGA232each includes an internal memory231,233for storing the associated FPGA configuration data set, ARM processor240is configured to receive updated FPGA configuration sets from an external computer via management interface150and to forward each updated configuration data set for storage in the internal memory231,233of the appropriate one of FPGA230and FPGA232. In a similar manner, FPGA230and FPGA232will be updated based on the associated updated FPGA configuration set upon the next power cycle of gateway200.

As with the first embodiment, gateway200provides a secure one-way network gateway in which the management interface150is completely isolated from the data flow path formed by FPGA230, one-way link235, and FPGA232after configuration, ensuring that no malware of any sort can be inserted into that data flow path via management interface150and that there can be no ability to access any data within that data flow path via management interface150.

Although the present invention has been particularly shown and described with reference to the preferred embodiments and various aspects thereof, it will be appreciated by those of ordinary skill in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. It is intended that the appended claims be interpreted as including the embodiments described herein, the alternatives mentioned above, and all equivalents thereto.