Data Diodes & Unidirectional Flows
This guide explains the deployment of hardware-enforced unidirectional data flows, allowing performance data to leave the OT environment for shore-side monitoring without creating a return path for cyber threats. Under IACS UR E26 §4.2.1, zone boundaries must be protected by appropriate conduit controls — for monitoring-only scenarios, a data diode provides a stronger security guarantee than a software firewall.
In modern shipping, the shore office needs real-time engine data, fuel consumption, and hull performance metrics. Connecting the ECR directly to the internet creates a bidirectional path — data out, commands or malware in. A data diode solves this by allowing data to flow out while physically preventing any data — including malicious commands — from flowing back in. It is the digital equivalent of a check valve in a piping system.
The one-way philosophy — hardware vs software security
Unlike a firewall which uses software rules to block traffic, a data diode enforces direction at the hardware level. It is physically impossible for data to move against the direction of the diode regardless of how an attacker manipulates the software or network stack above it.
Physical isolation
Traditional diodes use fibre optics with only a transmitter on one side and a receiver on the other — no transmitter on the receiving side means there is no physical return path. A hacker cannot send a command back to the vessel because the hardware to transmit in that direction does not exist.
Protocol stripping
Unidirectional gateways strip complex bidirectional protocols (like TCP/IP which requires acknowledgement packets) and transmit raw data only. This prevents network exploits that rely on two-way handshakes — there is no TCP SYN-ACK cycle because the ACK cannot physically return.
Firewall vs data diode — when to use each
Maritime deployment use cases
Data diodes are applicable in specific maritime scenarios where data must flow from OT to IT or shore without any return path. Each use case below has a defined data flow direction and an E26 zone boundary reference.
AMS, fuel data, vibration sensors
Performance dashboard, SOC
IDS alerts, firewall logs, CBS events
Threat detection and analysis
Pre-verified ENCs from official source
Chart database updated
E26 documentation requirements
A data diode installation must be fully documented in the CSDD and included in the zone and conduit architecture submitted to Class. An undocumented diode is a network device with no conduit entry — a finding at survey.
The specific regulatory requirements this playbook satisfies. Use these references when preparing for Class survey or responding to a surveyor's checklist.
