Air-Gapped & On-Prem
Data Diodes Explained for IT Directors
· 10 minute read
A data diode is a one-way valve, not a synonym for air gap. If your vendor uses the words interchangeably, they are selling a feeling. Here is the physics, the policy, and the file note.
In the last eighteen months, 'data diode' has started appearing in Indian government AI decks the way 'blockchain' appeared in 2017. It is printed next to a lock icon. Nobody in the room can draw the photons. That is a problem, because a diode is one of the few network controls that is actually simple — and therefore easy to fake in a slide.
A data diode, or unidirectional gateway, is a device that lets bits travel in one direction only. The usual construction is optical: a transmitter on the high side, a receiver on the low side, and no photodiode facing back. There is no TCP handshake, no return SYN-ACK, no way for a packet to argue its way home. That is the whole idea.
IT directors do not need the optoelectronics. They need three distinctions. An air gap is the absence of a network path. A diode is a one-way network path. A firewall is a two-way path with rules. If a vendor says their SaaS is 'diode-grade' because egress is restricted, they are hoping you will not ask where the TLS session began.
Physics, not poetry
On a normal Ethernet link both ends can talk. Protocols assume that. TCP, TLS, most licence checks, most container pulls, most model APIs — they all expect a conversation. A diode breaks the conversation on purpose. That is why 'just put a diode in front of the LLM' is usually a sentence written by someone who has not watched a health-check fail.
What still works through a diode is a stream you are willing to send without acknowledgement: syslog, copied files, mirrored metrics, a one-way export of redacted traces. What does not work is anything that must ask a question and wait: pulling an image, checking a licence, fetching a tokenizer, calling a hosted reranker, opening a support tunnel.
| Control | Return path | Who can undo it on a Friday |
|---|---|---|
| True air gap (no cable) | None | Whoever can plug a cable or Wi-Fi dongle |
| Hardware diode | Physically absent | Whoever can bypass it with a second NIC |
| Unidirectional proxy / 'SW diode' | Present, policy-blocked | Whoever has admin on the proxy |
| Firewall deny-inbound | Present, rule-blocked | Whoever can push a rule or an 'any any' |
| Cloud 'private link' + policy | Present, somewhere | The vendor, and sometimes you |
High side and low side, in government English
The high side is the network you are protecting — the SDC VLAN that holds the grievance corpus, the plant historian, the registrar's mark store. The low side is the network you are willing to expose more — a SOC, a reporting portal, a ministry dashboard on the state WAN. A diode is almost always high-to-low: we will tell you what happened; you will not tell our model what to do.
The other direction exists and is rarer: a low-to-high diode used to import signed updates into a vault. That is a different pair of hosts, a different risk, and a different CAB. Do not buy one appliance and assume it is a round-trip.
Where a diode belongs in an AI stack
Most departmental agents do not need a diode on day one. They need an honest air gap or an honest proxy, a registry, and a SIEM. A diode earns its keep when you must publish something out of a high-side enclave without letting the publisher become an inbound path.
- Export of redacted traces and metrics to a SOC that sits on a different security domain.
- Export of daily statistical reports to a public dashboard without mounting the corpus there.
- OT / IT boundary: plant historian values one-way into an IT RAG, never the reverse.
- Exam or adjudication enclaves that may emit counts but must not accept prompts from the campus Wi-Fi.
A diode does not replace segmentation, identity, or purpose control. It does not stop a privileged admin on the high side from walking out with a disk. It does not make embeddings non-personal. It is a valve. Valves fail when people plumb a bypass — a second NIC 'for management', a vendor support relay, a mis-aimed USB.
How vendors dilute the word
Watch for three substitutions. First, a container that runs rsync one way and is called a diode in the proposal. Second, a cloud 'unidirectional connector' that is a pair of APIs with a key. Third, a laptop-based 'import station' that also has a browser. None of these have a missing photodiode. They may still be useful. They are not diodes.
Ask for the failure mode, not the brochure photo. Power off the device. Unplug the receive fibre. Kill the proxy process. Introduce a crafted packet on the low side. The only acceptable result on a true diode is that the high side does not change its mind. If the vendor will not let you run that test in staging, you are buying a metaphor.
- Demand a wiring diagram with fibre direction marked.
- Demand the protocol list that has been made one-way (syslog, UDP file, proprietary).
- Run a low-side port scan and a TCP SYN toward the high side during the POC.
- Ask what management plane the diode itself uses — some devices have a third interface that is a quiet two-way hole.
- Write the bypass rule: any second NIC on a high-side host is a finding, not a convenience.
Objections you will hear — and what to do with them
Diodes are for defence PSUs, not a secretariat.
Most secretariats do not need one. Some do: an enclave that holds caste certificates, medical boards, or unreleased economic data, and still must feed a dashboard. Decide by the need to emit without listening, not by the romance of the word.
It will break our monitoring.
Good. Monitoring that requires a two-way agent on the high side is a two-way path. Export metrics one-way and watch them on the low side. If a vendor says their agent cannot do that, the vendor is the problem, not the diode.
We already have an air gap.
Then say what still needs to leave. If the answer is 'nothing', you do not need a diode. If the answer is 'logs, reports, and the weekly PPT', you need either sneakernet with a ceremony or a diode. Informal email from the high side is a path.
A two-week diode literacy playbook
- Week 1, days 1–3: draw high side, low side, and every current path including USB and mail. Mark which paths you claim are one-way.
- Days 4–7: for each claimed one-way path, write whether you need physics or can live with policy. Be honest about operators under pressure.
- Week 2: if physics is required, run a vendor-agnostic POC test (SYN from low, power-off, management-plane review). Minute the packet capture.
- End of week 2: either issue a diode BoQ with a bypass ban, or write that policy plus ceremony is the accepted risk. Silence is not a decision.
How this shows up in the file
The note should contain one diagram with arrows that have heads on only one end, a sentence on what is emitted, and a sentence on how inbound artefacts still enter. If the diagram has arrows both ways and the caption says diode, send it back. Caption and physics must agree.
IT directors who can explain a diode in four sentences will stop buying the word and start buying the test. That is the entire point of this explainer.
Procurement language that survives a bidder
If you need a diode, do not write 'military-grade one-way security' in the BoQ. Write the test: no TCP session can be established from the low side to the high side; management plane enumerated; power-off behaviour documented; second-NIC ban. Bidders who sell metaphors will fail a test. Bidders who sell diodes will bring a wiring diagram.
Also write what still comes inbound, because something always does: signed updates, new officers' public keys, a time source. Name that path as a separate import ceremony or a separate low-to-high pair. A tender that says 'diode' and is silent on inbound artefacts will grow a USB habit.
- Require a fibre-direction drawing as an eligibility artefact.
- Require a list of protocols that have been made unidirectional.
- Require the management-interface story, including whether it is a third Ethernet port.
- Require a bypass register: any additional NIC is a change ticket.
When a ceremony is cheaper than a diode
A weekly sealed export of redacted counts to a dashboard may not justify a hardware valve if two officers already sign the bag. A plant historian feeding a model every minute might. Frequency, automation and the cost of a wrong-way copy are the three numbers. Directors who skip those numbers buy jewellery.
Write the choice: physics, or policy plus two-person ceremony, or accept a two-way path. All three can be defensible. Pretending a proxy is physics is not.
This article is a field guide, not legal, procurement, electrical or engineering advice. Confirm numbers, duties and designs against the current Gazette, CERT-In directions, your SDC / NIC / campus standards, a site survey and your counsel before you file them.
Questions this usually raises
- Is a firewall rule that blocks inbound the same as a diode?
- No. A firewall is software policy. It can be changed by a tired admin, a vendor 'temporary allow', or a firmware bug. A true diode makes the return path physically absent, usually with optical isolation. Policy is not physics.
- Do we need a diode if the AI is already air-gapped?
- Only if you must move something out — logs to a SOC, reports to a low-side portal — without creating a path back in. A complete island with sneakernet both ways may not need a diode. A 'mostly island' that still emails PDFs usually does, or it is not an island.
- Can we put a diode on the model-update path?
- You can export hashes and attestations out. You cannot pull weights in through a diode. Inbound artefacts still need a separate, controlled import path: media, a high-side staging vault, or a diode pointed the other way on a different pair of hosts. One diode does not do both jobs.
- Are software 'unidirectional gateways' acceptable?
- Treat them as proxies until an independent test shows the return path is absent under fault. Many products branded unidirectional are TCP proxies with good intentions. Ask for the failure mode when the proxy process dies. If inbound can reappear, it is not a diode.