Method for the cryptographically protected unidirectional data transmission of user data, wherein one or more data packets comprising the user data are transmitted on an end-to-end data transmission path from a first communication unit in a first network, via a one-way communication unit arranged between the first network and a second network, to a second communication unit (rSrv) in the second network, comprising the following method steps: I. negotiating at least one cryptographic parameter between the first communication unit and a third communication unit (vSrV) in the first network for the cryptographically protected data transmission of user data from the first communication unit to the second communication unit, II. generating at least one transmission data structure (HSinfo) containing at least partially the negotiated cryptographic parameters for the cryptographically protected data transmission of the data packet or of the plurality of data packets, III. encrypting the at least one transmission data structure with a key of the second communication unit, IV. transmitting the encrypted, at least one transmission data structure to the second communication unit in the second network, V. decrypting the encrypted, at least one transmission structure, VI. encrypting the user data to be transmitted to the second communication unit with the negotiated cryptographic parameters and transmitting encrypted user data to the second communication unit, and VII. decrypting the transmitted user data with the cryptographic parameters contained in the decrypted transmission structure. one or more data packets comprising the user data are transmitted on an end-to-end data transmission path from a first communication unit in a first network, via a one-way communication unit arranged between the first network and a second network, to a second communication unit (rSrv) in the second network, comprising the following method steps: I. negotiating at least one cryptographic parameter between the first communication unit and a third communication unit (vSrV) in the first network for the cryptographically protected data transmission of user data from the first communication unit to the second communication unit, II. generating at least one transmission data structure (HSinfo) containing at least partially the negotiated cryptographic parameters for the cryptographically protected data transmission of the data packet or of the plurality of data packets, III. encrypting the at least one transmission data structure with a key of the second communication unit, IV. transmitting the encrypted, at least one transmission data structure to the second communication unit in the second network, V. decrypting the encrypted, at least one transmission structure, VI. encrypting the user data to be transmitted to the second communication unit with the negotiated cryptographic parameters and transmitting encrypted user data to the second communication unit, and VII. decrypting the transmitted user data with the cryptographic parameters contained in the decrypted transmission structure. I. negotiating at least one cryptographic parameter between the first communication unit and a third communication unit (vSrV) in the first network for the cryptographically protected data transmission of user data from the first communication unit to the second communication unit, II. generating at least one transmission data structure (HSinfo) containing at least partially the negotiated cryptographic parameters for the cryptographically protected data transmission of the data packet or of the plurality of data packets, III. encrypting the at least one transmission data structure with a key of the second communication unit, IV. transmitting the encrypted, at least one transmission data structure to the second communication unit in the second network, V. decrypting the encrypted, at least one transmission structure, VI. encrypting the user data to be transmitted to the second communication unit with the negotiated cryptographic parameters and transmitting encrypted user data to the second communication unit, and VII. decrypting the transmitted user data with the cryptographic parameters contained in the decrypted transmission structure.