使用商用硬件与开源软件实现数据二极管（Data Diodes）
Implementing Data Diodes Using Commodity Hardware and Open Source Software
浏览论文内容
中文总结 AI 辅助
本研究针对商用数据二极管成本高昂的问题，利用商用光纤硬件组装设备，通过测试优化丢包缓解方案，最终开发出跨平台可靠单向数据传输程序pydiode。
中文摘要 AI 辅助
被称为数据二极管的单向网络设备，用于防御复杂网络攻击。部分由于成本高昂，数据二极管目前大多部署在核电站和政府部门中，用于处理涉密信息。尽管市售数据二极管价格昂贵，但这类设备的硬件可由商用光纤网络设备组装而成。不过，要通过数据二极管可靠传输数据需要专用软件：接收端程序无法请求重传丢失的数据包，因此必须最大限度减少并缓解丢包问题。首先，我们开发了一个极简程序用于测量丢包率。我们发现大部分丢包是由接收端程序处理传入数据包速度过慢导致的，且丢包通常呈簇状发生。此外，我们还找到了无需超级用户权限即可在Linux和macOS系统上最大限度减少丢包的方法。接着，我们测试了三款现有的单向数据传输开源程序：netcat、UDPcast和lidi。尽管这些程序在默认配置下可靠性不足，但我们找到了UDPcast和lidi的可靠配置方案。最后，我们将上述研究成果整合进pydiode——我们开发的跨平台可靠单向数据传输程序中。
英文摘要
One-way network devices, known as data diodes, are used to defend against sophisticated cyberattacks. Partly due to their high cost, data diodes are mostly deployed in nuclear power plants and within the government for handling classified information. Although commercially available data diodes are expensive, a data diode's hardware can assembled from commodity fiber-optic network equipment. However, specialized software is needed to send data through a data diode reliably: the receiving program cannot request retransmission of dropped packets, so packet loss must be minimized and mitigated. First, we developed a minimal program to measure packet loss. We found that most packet loss was caused by the receiving program processing incoming packets too slowly, and that packet loss often occurs in clusters. Also, we discovered ways to minimize packet loss on Linux and macOS without using superuser privileges. Next, we tested three existing open source programs for one-way data transfers: netcat, UDPcast, and lidi. Although these programs were unreliable in their default configurations, we identified reliable configurations for UDPcast and lidi. Finally, we incorporated our findings into pydiode, our cross-platform program for reliable one-way data transfers.
发表机构
- Clark University（克拉克大学）
- Dutch Ministry of Defence（荷兰国防部）
机构由 AI 辅助整理，请以论文原文为准。
