DOCSEARCHbyAlgolia
Submit Docs

Advenica Data Diode Documentation

website·Indexed 30 days ago

https://advenica.github.io/

Technical documentation for Advenica unidirectional data flow network devices and software, including the DD1000i (versions 4.0 to 4.5), DD500E (versions 2.0.0 to 2.1.0), and the Data Diode Engine (DD Engine) proxy software. Covers system components, installation, configuration for UDP, MQTT, OPC UA, and NTP, and technical specifications.

Tokens
143.1K
Snippets
343
Records
1.2K
Agent score
68%

What's inside Advenica Data Diode

  1. Overview of the MQTT service for DD1000i

    The MQTT service enables message passing over a Data Diode by connecting to a broker on the source network and copying messages from configured topics to a broker on the destination network. Messages are sent to the destination broker with the same retain-flag as received from the source. The service supports MQTT version 3.1.1.

  2. Overview of File Transfer service operation

    The File Transfer service enables downloading and uploading files between source and destination domains using SFTP, SMB, or NFS. These protocols can be mixed (e.g., SFTP for download in the source domain and SMB for upload in the destination domain).

    Operational Workflow:

    1. Upstream Side: Continuously monitors the source server. A file is deemed ready for transfer once it has been encountered unmodified for a specific number of consecutive checks.
    2. Transfer: The Upstream service downloads the file and transfers it to the Downstream service.
    3. Downstream Side: Receives the file and uploads it to the destination server.
    4. Cleanup: Once transferred Downstream, the Upstream service removes the file from the source server. If a file is modified during transfer, it is not removed and will be re-transferred.

  3. Overview of the DD1000i HTTP service

    The HTTP service (v4.4) forwards HTTP POST requests from clients in a source network to a pre-configured server in a destination network. It consists of two components: an HTTP server on the Upstream DD Engine and an HTTP client on the Downstream DD Engine. The Upstream service handles concurrent requests and forwards them to the Downstream service, which then establishes a connection to the final destination host.

  4. Overview of the HTTP service data forwarding

    The HTTP service consists of an HTTP server (Upstream DD Engine) and an HTTP client (Downstream DD Engine). It forwards HTTP POST requests from the source network to a pre-configured server in the destination network. The Upstream service handles concurrent requests and returns a success or error response to the client based on whether the request was successfully forwarded. The Downstream service establishes the connection to the destination host and delivers the request.

  5. Overview of the File Transfer service

    The File Transfer service moves files between domains using SFTP, SMB, and NFS protocols. It can combine different protocols for source and destination (e.g., SFTP for download in the source domain and SMB for upload in the destination domain). The Upstream DD Engine monitors a source server for new files; once a file is detected and remains unmodified for a set number of consecutive checks, it is downloaded and transferred to the Downstream DD Engine for upload to the destination server.

  6. Overview of DD1000i Local admin interfaces

    The DD1000i features two separate console interfaces called Local admin: one for the DATA IN section and one for the DATA OUT section. Both are managed identically, but changes made in Local admin only apply to the specific connected section of the device. Note that applying changes may temporarily pause data transfer for operational services.

  7. Overview of the DD1000i HTTP service

    The HTTP service consists of an HTTP server on the Upstream DD Engine and an HTTP client on the Downstream DD Engine. It forwards HTTP POST requests from clients in the source network to a pre-configured server in the destination network. The Upstream service handles concurrent requests and returns a success or error response to the client based on whether the request was successfully forwarded to the Downstream service.

  8. Overview of DD Engine certificate requirements

    The DD Engine requires PEM formatted certificates and keys to facilitate secure communication, authentication, and data integrity between users, devices, and servers. The system specifically utilizes:

    • A Client certificate to verify the client when communicating with the DD Manager.
    • A Server certificate and corresponding key to verify the server when a client communicates with the DD Manager.
    • A CA certificate used to verify the client certificate during communication with the DD Manager.

    For production payload traffic, it is recommended to use unique certificates and keys generated via an organizationally approved PKI.

  9. Overview of the File Transfer service

    The File Transfer service enables the upload and download of files between target servers across different domains using SFTP, SMB, and NFS protocols. These protocols can be mixed; for example, the service can download files from a source domain via SFTP and upload them to a destination domain via SMB.

    The Upstream DD Engine monitors the source server for new files. A file is considered ready for transfer once it has been encountered unmodified for a specific number of consecutive checks. Once stable, the file is downloaded and sent to the Downstream DD Engine, which then uploads it to the destination server.

  10. Overview of DD500E system components

    The DD500E system consists of the physical DD500E hardware device (which sits between two networks), a Configuration Application used to upload settings, and a Configuration file containing the device settings.

  11. Overview of the Data Diode Engine (DD Engine)

    The Data Diode Engine (DD Engine) is proxy software used with hardware Data Diodes to facilitate secure, one-way data flows between network zones. It utilizes a modular architecture where proxies run on host machines chosen by the user to meet specific infrastructure and compliance requirements.

    The system consists of two primary components:

    1. Upstream Proxy: Connected to the source network; it translates bidirectional communication into a unidirectional protocol suitable for transfer through the Data Diode hardware.
    2. Downstream Proxy: Connected to the destination network; it receives the unidirectional data and recreates the original data before forwarding it to the final receiver.

  12. Overview of the HTTP service data forwarding

    The HTTP service consists of an HTTP server (Upstream DD Engine) and an HTTP client (Downstream DD Engine). It forwards HTTP POST requests from clients in a source network to a pre-configured server in a destination network. The Upstream service handles concurrent requests and returns a success or error response to the client based on whether the request was successfully forwarded to the Downstream service.