Abstract:
A system for communication includes a station, including first and second interfaces having different, respective first and second network addresses on a packet data network, and a terminal, including third and fourth interfaces having different, respective third and fourth network addresses. The station is transmits data to the terminal over a first path directed from the first interface to the third network address, while the terminal transmits second data to the station over a second path directed from the fourth interface to the second network address. First and second TCP proxies are deployed respectively in the station and in the terminal, and are configured to emulate a TCP connection between the station and the terminal by transmitting TCP frames from the station to the terminal only over the first path and from the terminal to the station only over the second path.

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
       [0001]    This application claims the benefit of U.S. Provisional Patent Application 62/295,074, filed Feb. 14, 2016, which is incorporated herein by reference 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates generally to digital communications and control, and particularly to systems and methods for secure communications. 
       BACKGROUND 
       [0003]    In a computer network handling sensitive data or physical processes, portions of the network may be connected by one-way links. The term “one-way link” is used in the context of the present patent application and in the claims to refer to a communication link that is physically configured to carry signals in one direction and to be incapable of carrying signals in the opposite direction. One-way links may be implemented, for example, using Waterfall® systems, which are manufactured by Waterfall Security Solutions, Ltd. (Rosh HaAyin, Israel). The Waterfall system provides a physical one-way connection based on fiberoptic communication, using an underlying proprietary transfer protocol. When a transmitting computer is connected by a Waterfall system (or other one-way link) to a receiving computer, the receiving computer can receive data from the transmitting computer but has no physical means of sending any return communications to the transmitting computer. 
         [0004]    One-way links may be used to prevent data either from entering or leaving a protected facility. For example, confidential data that must not be accessed from external sites may be stored on a computer that is configured to receive data over a one-way link and has no physical outgoing link over which data might be transmitted to an external site. On the other hand, in some applications, the operator of the protected facility may be prepared to allow data to exit the facility freely via a one-way link, while preventing data from entering the facility in order to thwart hackers and cyber-terrorists. Unlike conventional firewalls, one-way links permit information to leave a protected facility without risk to the safety or availability of the network in the facility due to attacks originating on an external network. In practice, however, there is sometimes a need to transmit at least small amounts of information from an external network back into the protected facility. 
         [0005]    U.S. Patent Application Publication 2014/0068712, whose disclosure is incorporated herein by reference, describes apparatus and methods for automatically controlling inputs to a protected destination. In a disclosed embodiment, communication apparatus includes a one-way, hardware-actuated data relay, which includes a first hardware interface configured to receive a command from a communications network and a second hardware interface configured to convey the received command to a protected destination when the relay is actuated. A decoder includes a third hardware interface configured to receive a digital signature for the command from the communications network and hardware decoding logic coupled to verify the digital signature and to actuate the relay upon verifying the digital signature, whereby the command is conveyed via the second hardware interface to the protected destination. 
         [0006]    U.S. Patent Application Publication 2016/0112384, which is assigned to the assignee of the present patent application and whose disclosure is incorporated herein by reference, describes a method for communication that includes receiving in a secure installation via a network from a remote user terminal an input comprising a stream of symbols that has been encrypted using a preselected encryption key. The encrypted stream of symbols is decoded in the secure installation using a decryption key corresponding to the preselected encryption key, to produce a clear stream of symbols. A computer program running on a processor in the secure installation is used in processing the symbols in the clear stream and generating a graphical output in a predefined display format in response to processing the symbols. The graphical output is outputted from the secure installation to the network in an unencrypted format for display on the remote user terminal. 
       SUMMARY 
       [0007]    Embodiments of the present invention that are described hereinbelow provide apparatus and methods for secure communication with a protected installation. 
         [0008]    There is therefore provided, in accordance with an embodiment of the invention, a system for communication, which includes a station, including first and second interfaces configured to be connected to a packet data network and to have different, respective first and second network addresses, and a terminal, including third and fourth interfaces configured to be connected to the packet data network and to have different, respective third and fourth network addresses. The station is configured to transmit first data to the terminal over a first path through the packet data network directed from the first interface to the third network address, while the terminal is configured to transmit second data to the station over a second path through the packet data network directed from the fourth interface to the second network address. First and second Transmission Control Protocol (TCP) proxies are deployed respectively in the station and in the terminal, and are configured to emulate a TCP connection between the station and the terminal by transmitting TCP frames from the station to the terminal only over the first path and from the terminal to the station only over the second path. 
         [0009]    In some embodiments, the station includes a first outgoing one-way link connected between the first TCP proxy and the first interface and a first incoming one-way link connected between the second interface and the first TCP proxy. In a disclosed embodiment, the terminal includes a second outgoing one-way link connected between the second TCP proxy and the fourth interface and a second incoming one-way link connected between the third interface and the second TCP proxy. 
         [0010]    Additionally or alternatively, the station includes first and second switches, which are coupled between the outgoing and incoming one-way links and the first TCP proxy and are configured to connect the first TCP proxy to the packet data network via the outgoing and incoming one-way links only when the emulated TCP connection is in use. Typically, the station includes a host computer, which is configured to transmit and receive data packets to and from the packet data network via the outgoing and incoming one-way links, respectively, and which is coupled to the first TCP proxy so as to transmit and receive data over the emulated TCP connection. The first and second switches are configured to isolate the first TCP proxy when the emulated TCP connection is not in use and to convey incoming data packets from the incoming one-way link to the host computer and convey outgoing data packets from the computer to the outgoing one-way link, bypassing the first TCP proxy. In a disclosed embodiment, the station includes a hardware security module (HSM), which is coupled to control actuation of the switches. 
         [0011]    Further additionally or alternatively, the terminal includes a secure protocol support module, including a hardware security module (HSM) on which the second TCP proxy runs. In some embodiments, actuation of the HSM to emulate the TCP connection is conditioned on presentation of a hardware credential to the HSM. 
         [0012]    In some embodiments, the secure protocol support module includes a first switch, which is coupled between the third interface and the HSM, and a second switch, which coupled between the fourth interface and the HSM, and wherein the first and second switches are configured to connect the HSM to the packet data network via the third and fourth interfaces only when the emulated TCP connection is in use. In a disclosed embodiment, the terminal includes a host processor, which is configured to receive and transmit data packets from and to the packet data network via the third and fourth interfaces, respectively, and which is coupled to the HSM so as to transmit and receive data over the emulated TCP connection. The first and second switches are configured to isolate the second TCP proxy when the emulated TCP connection is not in use and to convey incoming data packets from the third interface to the host processor and convey outgoing data packets from the host processor to the fourth interface, bypassing the HSM. 
         [0013]    There is also provided, in accordance with an embodiment of the invention, a method for communication, which includes connecting a station to a packet data network through first and second interfaces having different, respective first and second network addresses, and connecting a terminal to the packet data network through third and fourth interfaces having different, respective third and fourth network addresses. A Transmission Control Protocol (TCP) connection between the station and the terminal is emulated by transmitting first TCP frames from a first TCP proxy deployed in the station to a second TCP proxy deployed in the terminal only over a first path through the packet data network directed from the first interface to the third network address, and transmitting second TCP frames from the second TCP proxy in the terminal to the first TCP proxy in the station only over a second path through the packet data network directed from the fourth interface to the second network address. 
         [0014]    The present invention will be more fully understood from the following detailed description of the embodiments thereof, taken together with the drawings in which: 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0015]      FIG. 1  is a block diagram that schematically illustrates a system for secure monitoring and control, in accordance with an embodiment of the present invention; and 
           [0016]      FIG. 2  is a block diagram that schematically shows details of remote user terminal, in accordance with an embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF EMBODIMENTS 
       [0017]    As noted earlier, at outgoing one-way link from a protected facility is an effective means for allowing information to leave a protected facility without risk to the safety or availability of the network in the facility due to attacks originating on an external network. In practice, however, there is sometimes a need to transmit at least small amounts of information from an external network back into the protected facility, such as commands, software updates or configuration changes to remote unattended sites or manufacturing facilities. There are a number of risks associated with such communications. One risk is that if malware has somehow been introduced into the protected network (possibly by insider collaboration), communications back into the protected network could be used to trigger an attack. Another risk is that an attacker might gain remote control capabilities over a system within the protected network or might use the communications channel into the facility to cause unsafe or unreliable conditions in the protected network, by means of a buffer overflow attack, for instance. 
         [0018]    The above-mentioned U.S. Patent Application Publication 2014/0068712 describes a possible solution to these problems, by permitting a controlled flow of small amounts of information into a protected network. The flow is automatically controlled so that software-based attacks on protected equipment become difficult or impossible to carry out, even if parts of the command and communications system themselves become compromised. In contrast to conventional firewalls, the control is carried out by hardware logic, rather than software. Consequently, remote attackers are unable to change the operating configuration of the protection logic or to cause it to perform any function other than those initially programmed by the logic designer. In the disclosed embodiments, the hardware logic is configured to control the format and content of commands that can be sent to a protected destination. The hardware logic may also authenticate these commands to ensure they were produced by an authorized transmitter. As a result, by compromising an authorized transmitter, an attacker may, at worst, be able to send an incorrect command to the destination, but will not be able to gain control over the protected facility. 
         [0019]    U.S. Patent Application Publication 2016/0112384, also cited above, takes this model a step farther to provide secure remote desktop functionality, while maintaining a high level of security against unauthorized access. These embodiments use hardware components to separate the input from a remote user terminal to the secure installation from the graphical display output that is provided by the installation, and thus avoid creating a closed communication loop that could be exploited by a malicious party. The input to the secure installation comprises a stream of symbols that has been encrypted by the remote user terminal using a preselected encryption key. A decoder in the secure installation converts the encrypted input back into a clear stream of symbols, using a corresponding decryption key. Thus, the remote desktop functionality of the secure installation can be accessed only by a client device that is in possession of the proper encryption key. For enhanced security, the encrypted symbol stream may be generated using a hardware-based encoder in a secure input device of the remote user terminal. 
         [0020]    The sorts of remote control functionality that are described in the above publications rely on the human operator of the user terminal to “close the loop” between the information received by the terminal from the protected facility and the input transmitted from the terminal back to the facility. The input stream to the protected facility is transmitted from one port of the user terminal to a corresponding port of the protected facility via a given network path, while the display output typically traverses a different network path between a different pair of ports. (The separation of the ports is enforced at the protected facility, and the paths are determined independently by routers in the network between the terminal and the protected facility, such as Internet Protocol [IP] routers.) This segregation of the two communication directions alleviates many of the security risks that would otherwise be involved in bidirectional interaction with the protected facility, since it prevents the establishment of process-to-process protocol connections, such as Transmission Control Protocol (TCP) sockets, that are generally required for client/server and peer-to-peer interactions. 
         [0021]    In some cases, however, an actual bidirectional protocol connection is required between the protected facility and a remote terminal or other computer. Such a connection may be needed, for example, in order to update software running at the protected facility, both during the update and afterwards, to enable verification of proper operation, particularly when the facility is in a remote location without skilled personnel (or possibly without any personnel) on site. A bidirectional connection can also be needed in emergency situations, so that headquarters can exert full, direct, and unrestricted control of the site for operational and safety reasons. 
         [0022]    Embodiments of the present invention that are described herein enable the creation of a bidirectional protocol connection over a pair of separate, unidirectional legs through a network, while maintaining a high level of hardware-based protection against malicious exploitation of the connection. These embodiments are based on a TCP proxy, which is capable of opening and maintaining a TCP connection with a remote peer while receiving incoming TCP packets from the peer on an input port with a given Internet Protocol (IP) address and transmitting outgoing TCP packets to the remote peer via an output port with a different IP address. The TCP proxy emulates the operation of TCP over a conventional, bidirectional IP port, so that software applications running on a host processor at either end of the TCP connection can transmit and receive communications via the TCP proxy as though it was a conventional TCP software stack. 
         [0023]    Such TCP proxies can be installed at one or both ends of the TCP link, for example, both in a protected facility and in a remote user terminal that communicates with the facility. For enhanced security, the TCP proxy can be installed and run within attack-resistant hardware modules, such as a hardware security module (HSM). As an additional or alternative security measure, the TCP proxy receives the incoming packets from the input port via an incoming one-way link and transmits the outgoing packets to the output port via a separate, outgoing one-way link. 
         [0024]    In an example embodiment that is described further hereinbelow, one such TCP proxy is installed in a protected, secure facility, and the other in a remote user terminal. In normal operation of this system, as explained above, the secure facility transmits data to the user terminal over one unidirectional path through a network, while the user terminal transmits instructions to the secure facility over a separate unidirectional path, with segregation enforced by one-way links in both the secure facility and the user terminal. During such normal operation, the TCP proxies are isolated from the one-way links, and hence from the network, by hardware-enforced switching circuits. 
         [0025]    For example, connection of the TCP proxies to the network may be subject to actuation by a hardware security model (HSM) at the user terminal, which may be either the same HSM in which the TCP proxy itself runs or a separate HSM that is provided for this purpose. As a result, the TCP connection to the secure facility will be available only when physically actuated by a user of the terminal with the required cryptographic hardware credentials, and the connection is not exposed at any other time to exploitation by attackers elsewhere on the network. When the HSM is not activated, the TCP proxy code itself is encrypted and inaccessible from the network, and thus cannot be exploited to open the bidirectional connection between the user terminal and the secure facility in the absence of authorized personnel with the necessary cryptographic credentials. 
         [0026]      FIG. 1  is a block diagram that schematically illustrates a system  20  for secure monitoring and control, in accordance with an embodiment of the present invention. In this example, system  20  comprises a user terminal  24 , which is used to monitor and control a secure facility, for example a utility control station  22 , such as a transmission and switching station of an electric power utility. Terminal  24  communicates with station  22  via a wide-area network  26 , which may comprise any suitable wired or wireless network, or a combination of such networks, including public networks, such as the public Internet. Station  22  typically comprises an internal control network  40 , which includes operational elements, such as switches, which make, break and adjust power connections, as well as monitoring components, such as sensors. Although for the sake of simplicity, only a single station  22  is shown in  FIG. 1 , in practice utilities generally operate many such stations. In many actual systems, stations  22  are unmanned, and are monitored and controlled remotely, using a single outgoing link to transmit data for monitoring. In the present embodiment, station  22  is controlled by remote user terminal  24 , and offers TCP proxy functionality when required for this purpose, as described herein. 
         [0027]    Although the pictured example relates, by way of illustration, to an electric power utility, the principles of the present invention are not limited to this particular operating context. Rather, the apparatus and methods that are described below may be applied to utilities of other types (such as gas or water utilities, for instance), as well as in industrial environments and substantially any other application in which tight control is to be exercised over data and commands that may be input to a protected installation. Station  22  is just one example of such an installation. Certain embodiments of the present invention are described hereinbelow, for the sake of clarity and without limitation, with respect to the elements of system  20 , but the principles of these embodiments and the techniques that they incorporate may similarly be applied in other operating environments in which an installation is to be protected from undesired data input and unauthorized access. 
         [0028]    Station  22  is typically designed as a closed, secure facility, protected physically against unauthorized entry. A host computer  41  in station  22  inputs commands to the switches on network  40  and monitors the operation of the switches and other components of the station. Typically, network  40  comprises multiple sensors and actuators, which are distributed throughout station  22  and report via a secure internal network to host computer  41 . Computer  41  outputs information, possibly including a graphical display output, via a one-way link  34  to an output interface  38 . Output interface  38  is connected to network  26 , which conveys the output information to terminal  24 . One-way link  34  connects a secure zone  28 , containing the protected components of station  22 , to a buffer zone  30 , which is accessible to network  26 . Although output interface  38  typically comprises a conventional, bidirectional network port, one-way link  34  prevents any sort of access to secure zone  28  via output interface  38 . 
         [0029]    One-way link  34  conveys output information from station  22  to network  26  but is physically incapable of conveying input data from the network to the station. For this latter purpose, station  22  comprises a secure input  36 , which typically has an input interface coupled to network  26  and another interface to the protected elements of the station. In this example, secure input  36  receives and decodes a stream of symbols (typically encrypted symbols) transmitted by terminal  24  over network  26 , and conveys the decoded symbols over a one-way link  32  to host computer  41 . Details of the structure and operation of secure input  36  are described further, for example, in the above mentioned U.S. Patent Application Publication 2016/01123844. Host computer  41  particularly and secure zone  28  in general receive no inputs from network  26  other than via input  36  and one-way link  32 , which are typically contained in station  22  and are thus themselves protected from physical and electrical tampering. 
         [0030]    Terminal  24  receives data output by station  22  through output  38  via an output path  42  through network  26 , and inputs data, such as commands and/or queries, to station  22  via a separate input path  44  to input  36 . As noted earlier, input  36  and output  38  typically comprise separate and independent ports to network  26 , with their own, different network addresses, such as IP addresses. Paths  42  and  44  are thus established separately by routers (not shown) in network  26 . Terminal  24  is similarly configured with separate input and output interfaces, as is shown and described hereinbelow with reference to  FIG. 2 . 
         [0031]    When it is necessary to transmit connection-oriented traffic to and from computer  41  in station  22 , a TCP proxy  46  in the station is actuated. Typically, TCP proxy  46  comprises a processor, which is separate from computer  41  and has suitable interfaces and software to carry out the functions that are described herein. In normal operation of station  22 , switches  48  and  50 , typically hardware-actuated data switches, isolate TCP proxy  46  from network  26 , so that all inputs from one-way link  32  to host computer  41  and other elements of internal control network  40 , as well as outputs from computer  41  and network  40  to one-way link  34 , bypass the TCP proxy. 
         [0032]    When a TCP connection with remote terminal  24  is invoked, however, switches  48  and  50  are actuated to connect one-way links  32  and  34  to and from TCP proxy  46 , which can then begin TCP emulation. Typically, TCP proxy  46  runs on a hardware security module (HSM)  47  installed in secure zone  28 , to prevent tampering and attacks. Additionally or alternatively, TCP proxy  46  and/or switches  48  and  50  comprise other authentication components and software, such as a trusted platform module (TPM). The use of such secure hardware ensures that the switches are actuated and a TCP connection can be set up with terminal  24  only after the user of the terminal has been properly authenticated. 
         [0033]    HSM  47  (and similarly an HSM used for the TCP proxy in terminal  24 , as described below) typically comprises a software-driven processor, such as a central processing unit (CPU), with a memory and suitable communication interfaces for receiving and transmitting TCP data frames from and to switches  48  and  50 . For these purposes, HSM  47  can comprise a commercially-available hardware subsystem, such as the IBM PCIe Cryptographic Coprocessor, which is a tamper-responding, programmable, cryptographic PCIe® card, containing a CPU, encryption hardware, RAM, persistent memory, a hardware random number generator, clock, infrastructure firmware, and software. The software running in the CPU is customized, in the present embodiment, to include the TCP proxy stack and interface. Thus, as noted earlier, the proxy code itself is actually never actually accessible from network  26 . The code is held in the HSM memory in encrypted form and is activated and decrypted, to run on the HSM CPU, only after proper authentication. Because the code runs only internally within the secure execution environment of HSM  47 , even when TCP proxy  46  is activated, it is not possible to copy the code to use it from another computer on the network. 
         [0034]      FIG. 2  is a block diagram that schematically shows details of remote user terminal  24 , in accordance with an embodiment of the present invention. In the pictured embodiment, terminal  24  comprises a user interface, comprising a secure input device  62  and a display  60 , which are physically and functionally separate elements. The special, secure input device and display are useful in routine operations of terminal  24 , when full, two-way TCP communication is not needed. These secure components are not required when terminal  24  operates only in a monitoring mode, without inputting data or commands to station  22 , nor are they needed when the TCP proxies are in use (in which case a conventional user input device and display are sufficient). Secure input device  62  and display  60  are described here, however, along with one-way links  56  and  66 , for the sake of completeness in demonstrating a full-featured, multi-capability user terminal. 
         [0035]    Secure input device  62 , such as a keyboard, mouse, or other user-operated element, receives inputs from an operator of terminal  24  and encodes these inputs as an encrypted symbol stream using a preselected encryption key. One-way link  66  conveys the encrypted output from device  62  to an output interface  68  of terminal  24 . 
         [0036]    Output interface  68  transmits the encrypted symbol stream from input device  62  via input path  44  over network  26  to input  36 , which decodes the symbols and thus provides a corresponding clear symbol stream to host computer  41 . Output interface  68  may, for example, establish a secure connection (such as a Transport Layer Security [TLS] encrypted connection, as is known in the art) with input  36  over network  26 . This sort of conventional data security measure adds a further layer of protection to the operation of the other security measures described herein. This connection, however, which is set up between the IP addresses of output interface  68  and input  36 , carries only the information that is output from terminal  24  via one-way link  66  (and possibly acknowledgment packets from input  36 ), while one-way links  66  and  32  prevent any meaningful data from reaching terminal  24  via the connection. 
         [0037]    Typically, although not necessarily, input device  62  encrypts the operator inputs using hardware logic and holds the encryption key in a memory (not shown) that is inaccessible to the user of terminal  24 . This key may similarly be inaccessible to a host processor  72  that is used in running software-based functions of the terminal. For the purpose of these software-based functions (including applications running over TCP connections to station  22 ), input device  62  may have an additional, non-encrypted mode of operation. Alternatively, one or more additional input devices (not shown) may be connected to terminal  24 , or if terminal  24  is configured to send input to station  22  only over a secure TCP connection, input device  62  may be replaced by an ordinary, non-encrypting input device. 
         [0038]    In parallel to the operation of input path  44  that is described above, an input interface  54  of terminal  24  receives data output generated by station  22  and transmitted over output path  42  through network  26  via output  38 . Input interface  54  conveys the data via one-way link  56  to display  60 , which presents the data in alphanumeric and/or graphical form. For these purposes, input interface  54  typically comprises a network interface controller (NIC), coupled to transmit and receive packets to and from network  26 , along with a suitable communication controller for transmitting data over one-way link  56  and a suitable buffer memory and logic circuits (hardware or software-driven) connecting them. These functions may be carried out, for example, by a Waterfall unidirectional gateway. 
         [0039]    As noted earlier, in normal operation of terminal  24 , input path  44  from output interface  68  of terminal  24  to station  22  and output path  42  from station  22  to display  60  are separate and independent, without any electronic interaction between these paths within terminal  24 . Input interface  54  may establish an additional secure connection (such as a TLS connection) with output  38  over network  26 , which is separate from the connection between output interface  68  and input  36 . The only actual connection that normally exists between input and output paths  44  and  42  is the cognitive connection made by the operator of terminal  24 . 
         [0040]    As explained above, however, the operator of terminal  24  may occasionally need to interact with computer  41  in station  22  using a connection-based client/server or peer-to-peer application. For this purpose, terminal  24  comprises a secure protocol support module  52  with a TCP proxy  70 , which interacts with TCP proxy  46  in station  22  when actuated. As on the station side, TCP proxy  70  comprises a processor, which is separate from host processor  72  and has suitable interfaces and software to carry out the functions that are described herein. Module  52 , including TCP proxy  70  and switches  58  and  64 , is typically implemented as a secure, tamper-proof hardware unit, which is hardened against unauthorized use and disassembly. TCP proxy  70  may be connected to and communicate with host processor  72  via a suitable bus, such as a PCIe bus. 
         [0041]    Within module  52 , at least TCP proxy  70  runs on an HSM  74 , similar to HSM  47  that was described above. Actuation of HSM  74  is conditioned, for example on insertion by the user of a suitable key  76 , such as a smartcard or SIM, or presentation of other hardware credentials, possibly accompanied by other security measures, such as password and/or biometric authentication of the user. For further enhanced security, HSM  74  can require the user to present a further key to activate the TCP proxy software, in addition to the key used to activate the HSM. 
         [0042]    Key  76  typically holds one or more private cryptographic keys. These keys are used by HSM  74  to send activation commands to HSM  47 , and cause HSMs  47  and  74  to activate the proxy code (including decryption of the stored code using the key) and run the code within the secure execution facility of the HSMs. 
         [0043]    In normal operation of terminal  24 , when HSM  74  is not actuated, switches  58  and  64  isolate TCP proxy  70  from network  26 , so that all input from one-way link  56  and output to one-way link  66  bypass the TCP proxy. When HSM  74  is actuated and a TCP connection is invoked, however, switches  58  and  64  operate to connect one-way links  56  and  66  to and from TCP proxy  70 , which can then begin TCP emulation. For this purpose, TCP proxy  70  also instructs switches  48  and  50  in station  22  to connect TCP proxy  46  to input  36  and output  38 , as described above. Typically, the instruction to switches  48  and  50  is accompanied by cryptographic credentials, which are provided by HSM  74 , for example, which enable the controller responsible in station  22  to authenticate the instruction before actuating the switches. 
         [0044]    Alternatively, HSM  74  may be solely responsible for data security in terminal  24 . In this case, switches  58  and  64  may be actuated manually by the operator of terminal  24 , or they may be eliminated entirely. (Switches  48  and  50  in station  22 , however, still provide a useful added measure of security.) Additionally or alternatively, one-way links  56  and  66  in terminal  24  may be replaced by one or more ordinary duplex connections, while maintaining the use of one-way links  32  and  34  to protect station  22  from unauthorized access. 
         [0045]    In any case, once HSMs  47  and  74  have been activated, as described above, TCP proxies  70  and  46  then communicate with one another in order to initiate and set up TCP socket emulation. The interaction between the TCP proxies is similar to that between conventional TCP endpoints, except that in the present case, TCP frames are transmitted from TCP proxy  70  to TCP proxy  46  over input path  44  and from TCP proxy  46  to TCP proxy  70  over output path  42 . As explained earlier, the endpoints of input path  44  have different IP addresses from the endpoints of output path  42 . Once the emulated TCP connection is set up and running, TCP proxies  46  and  70  notify the respective hosts  41  and  72  that the connection is available, so that the desired application can run. 
         [0046]    Typically, all communication between TCP proxies  46  and  70  is signed by keys. Thus, when key  76  is removed, system  20  defaults to a “no proxy” state, in which HSMs  47  and  74  are inaccessible, and switches connecting the TCP proxies to network  26  are locked. Additionally or alternatively, TCP proxies  46  and  70  regularly exchange authorization messages, and shut down if an authorization message does not arrive when expected. 
         [0047]    The elements of station  22  and terminal  24  are shown in the figures and described above in terms of separate functional blocks solely for the sake of convenience and conceptual clarity. In practical implementations, two or more of these blocks may be combined in a single circuit element or, additionally or alternatively, certain blocks may be broken down into separate sub-blocks and circuits. All such embodiments are considered to be within the scope of the present invention. 
         [0048]    It will thus be appreciated that the embodiments described above are cited by way of example, and that the present invention is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present invention includes both combinations and subcombinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art.