Secure one-way data transfer system using network interface circuitry

• US 8,498,206 B2
• Filed: 10/24/2011
• Issued: 07/30/2013
• Est. Priority Date: 04/18/2007
• Status: Active Grant

• Current Assignee: OWL Cyber Defense Solutions LLC
• Original Assignee: Owl Computing Technologies, Inc.
• Inventors: Mraz, Ronald
• Primary Examiner(s): Kizou, Hassan
• Assistant Examiner(s): FARAHMAND, ASHIL S
• Application Number:
  US13/280,036
• Publication Number:
  US 20120042357A1
• Time in Patent Office: 645 Days
• Field of Search: 370229-241, 370/431, 370/463, 709/250
• US Class Current: 370/230
• CPC Class Codes: H04L 12/5601 Transfer mode dependent, e.g. ATM
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

Network interface circuitry for a secure one-way data transfer from a sender'"'"'s computer (“Send Node”) to a receiver'"'"'s computer (“Receive Node”) over a data link, such as an optical fiber or shielded twisted pair copper wire communication cable, comprising send-only network interface circuitry for transmitting data from the Send Node to the data link, and receive-only network interface circuitry for receiving the data from the data link and transmitting the received data to the Receive Node, wherein the send-only network interface circuitry is configured not to receive any data from the data link, and the receive-only network interface circuitry is configured not to send any data to the data link. The network interface circuitry may use various interface means such as PCI interface, USB connection, FireWire connection, or serial port connection for coupling to the Send Node and the Receive Node.

Claims

1. Network interface circuitry for a secure one-way data transfer from a Send Node to a Receive Node over a non-wireless data link, comprising:

a send-only network interface card for transmitting data from the Send Node to the non-wireless data link, the send-only network interface card comprising a data transmitter, a first interface to the Send Node, a first interface circuit for controlling the flow of the data between the first interface and the data transmitter, an unpopulated space reserved for but not populated by a data receiver, and silkscreen words placed on the unpopulated space to indicate the send-only functionality of the send-only network interface card; and

a receive-only network interface card for receiving the data from the non-wireless data link and transferring the received data to the Receive Node, the receive-only network interface card comprising a data receiver, a second interface to the Receive Node, a second interface circuit for controlling the flow of the data between the data receiver and the second interface, an unpopulated space reserved for but not populated by a data transmitter, silkscreen words placed on the unpopulated space to indicate the receive-only functionality of the receive-only network interface card,

wherein the send-only network interface card is configured not to receive any data from the non-wireless data link, and the receive-only network interface card is configured not to send any data to the non-wireless data link, and

wherein the send-only network interface card and the receive-only network interface card are separately administered and require independent authentication keys for communication management.

2. The network interface circuitry of claim 1, wherein the non-wireless data link is an optical data link, the data transmitter comprises an optical emitter and the data receiver comprises an optical detector.

3. The network interface circuitry of claim 2, wherein the optical data link comprises an optical fiber, the data transmitter further includes a first integrated fiber optic connector, and the data receiver further comprises a second integrated fiber optic connector.

4. The network interface circuitry of claim 1, wherein the non-wireless data link is a shielded twisted pair copper wire communication cable, the data transmitter comprises a serial digital cable driver and the data receiver comprises an adaptive cable driver.

5. The network interface circuitry of claim 4, wherein the data transmitter further comprises a first RJ45 connector configured to only send the data to the non-wireless data link and the data receiver further comprises a second RJ45 connector configured to only receive the data from the non-wireless data link.

6. The network interface circuitry of claim 1, wherein the first interface comprises a Peripheral Component Interconnect (PCI) interface, a Universal Serial Bus (USB) connector, a FireWire connector, or a serial port connector.

7. The network interface circuitry of claim 1, wherein the second interface comprises a PCI interface, a USB connector, a FireWire connector, or a serial port connector.

8. The network interface circuitry of claim 1, wherein each of the first and second interface circuits comprises an Asynchronous Transfer Mode (ATM) network interface circuit.

9. The network interface circuitry of claim 8, wherein the ATM network interface circuit comprises an ATM physical interface chip and an ATM segmentation and reassembly chip.

10. The network interface circuitry of claim 1, wherein the send-only network interface card has a low form factor.

11. The network interface circuitry of claim 1, wherein the receive-only network interface card has a low form factor.

12. A secure one-way data transfer system, comprising:

a Send Node;

a Receive Node;

a non-wireless data link;

a send-only network interface card for transmitting data from the Send Node to the non-wireless data link, the send-only network interface card comprising a data transmitter, a first interface to the Send Node, a first interface circuit for controlling the flow of the data between the first interface and the data transmitter, an unpopulated space reserved for but not populated by a data receiver, and silkscreen words placed on the unpopulated space to indicate the send-only functionality of the send-only network interface card; and

a receive-only network interface card for receiving the data from the non-wireless data link and transferring the received data to the Receive Node, the receive-only network interface card comprising a data receiver, a second interface to the Receive Node, a second interface circuit for controlling the flow of the data between the data receiver and the second interface, an unpopulated space reserved for but not populated by a data transmitter, silkscreen words placed on the unpopulated space to indicate the receive-only functionality of the receive-only network interface card,

wherein the send-only network interface card is configured not to receive any data from the non-wireless data link, and the receive-only network interface card is configured not to send any data to the non-wireless data link, and

wherein the send-only network interface card and the receive-only network interface card are separately administered and require independent authentication keys for communication management.

13. The system of claim 12, wherein the Send Node and the Receive Node are computers based on Microsoft Windows operating system.

14. The system of claim 12, wherein the Send Node and the Receive Node are computers based on Unix-based operating system.

15. The system of claim 14, wherein the Unix-based operating system is Linux, Ultrix, or Solaris.

16. The system of claim 12, wherein the non-wireless data link is an optical data link, the data transmitter comprises an optical emitter and the data receiver comprises an optical detector.

17. The system of claim 16, wherein the optical data link comprises an optical fiber, the data transmitter further includes a first integrated fiber optic connector, and the data receiver further comprises a second integrated fiber optic connector.

18. The system of claim 12, wherein the non-wireless data link is a shielded twisted pair copper wire communication cable, the data transmitter comprises a serial digital cable driver and the data receiver comprises an adaptive cable driver.

19. The system of claim 18, wherein the data transmitter further comprises a first RJ45 connector configured to only send the data to the non-wireless data link and the data receiver further comprises a second RJ45 connector configured to only receive the data from the non-wireless data link.

20. The system of claim 12, wherein the first interface comprises a PCI interface, a USB connector, a FireWire connector, or a serial port connector.

21. The system of claim 12, wherein the second interface comprises a PCI interface, a USB connector, a FireWire connector, or a serial port connector.

22. The system of claim 12, wherein each of the first and second interface circuits comprises an ATM network interface circuit.

23. The system of claim 22, wherein the ATM network interface circuit comprises an ATM physical interface chip and an ATM segmentation and reassembly chip.

24. The system of claim 12, wherein the send-only network interface card has a low form factor.

25. The system of claim 12, wherein the receive-only network interface card has a low form factor.

26. A method of transferring data from a Send Node to a Receive Node over an optical data link, comprising the steps of:

providing a first and a second network interface cards in form of unpopulated circuit boards;

populating an optical emitter on the first network interface card to enable data transfer from the Send Node to the optical data link and placing silkscreen words on a space reserved for but not populated by an optical detector to indicate the send-only functionality of the first network interface card;

populating an optical detector on the second network interface card to enable data transfer from the optical data link to the Receive node and placing silkscreen words on a space reserved for but not populated by an optical emitter to indicate the receive-only functionality of the second network interface card;

coupling the first network interface card to the Send Node and a first end of the optical data link;

coupling the second network interface card to the Receive Node and a second end of the optical data link; and

transferring data from the Send Node to the Receive Node over the optical data link,

wherein the first network interface card and the second network interface card are separately administered and require independent authentication keys for communication management.

27. The method of claim 26, wherein the step of coupling the first network interface card to the Send Node comprises the step of using a PCI interface, a USB connector, a Fire Wire connector, or a serial port connector.

28. The method of claim 26, wherein the step of coupling the second network interface card to the Receive Node comprises the step of using a PCI interface, a USB connector, a Fire Wire connector, or a serial port connector.

29. The method of claim 26, wherein each of the first and the second network interface cards comprises an ATM network interface circuit.

30. The method of claim 29, wherein the ATM network interface circuit comprises an ATM physical interface chip and an ATM segmentation and reassembly chip.

31. The method of claim 26, wherein the first network interface card has a low form factor.

32. The method of claim 26, wherein the second network interface card has a low form factor.

33. A method of transferring data from a Send Node to a Receive Node over a shielded twisted pair copper wire communication cable, comprising the steps of:

providing a first and a second network interface cards respectively having a first RJ45 connector and a second RJ45 connector;

configuring the first RJ45 connector to enable data transfer from the Send Node to the shielded twisted pair copper wire communication cable, but disable data transfer from the shielded twisted pair copper wire communication cable to the Send Node;

configuring the second RJ45 connector to enable data transfer from the shielded twisted pair copper wire communication cable to the Receive Node, but disable data transfer from the Receive Node to the shielded twisted pair copper wire communication cable;

placing silkscreen words on an unpopulated space in the first network interface card reserved for but not populated by a third RJ45 connector to indicate the send-only functionality of the first network interface card;

placing silkscreen words on an unpopulated space in the second network interface card reserved for but not populated by a fourth RJ45 connector to indicate the receive-only functionality of the second network interface card;

coupling the first network interface card to the Send Node and a first end of the shielded twisted pair copper wire communication cable;

coupling the second network interface card to the Receive Node and a second end of the shielded twisted pair copper wire communication cable; and

transferring data from the Send Node to the Receive Node over the shielded twisted pair copper wire communication cable,

wherein the first network interface card and the second network interface card are separately administered and require independent authentication keys for communication management.

34. The method of claim 33, wherein the step of coupling the first network interface card to the Send Node comprises the step of using a PCI interface, a USB connector, a Fire Wire connector, or a serial port connector.

35. The method of claim 33, wherein the step of coupling the second network interface card to the Receive Node comprises the step of using a PCI interface, a USB connector, a Fire Wire connector, or a serial port connector.

36. The method of claim 33, wherein each of the first and the second network interface cards comprises an ATM network interface circuit.

37. The method of claim 36, wherein the ATM network interface circuit comprises an ATM physical interface chip and an ATM segmentation and reassembly chip.

38. The method of claim 33, wherein the first network interface card has a low form factor.

39. The method of claim 33, wherein the second network interface card has a low form factor.