The whole point of a data diode is that nothing can travel back. But some legitimate flows are conversations: file transfer protocols want acknowledgements, database replication wants confirmations, and operators want to know the transfer succeeded.
This is where most diode projects meet their first real design decision, and where the wrong answer is tempting.
The wrong answer
The wrong answer is softening the diode – adding a narrow, configurable return path “just for acknowledgements”.
The moment a return path exists and is governed by configuration, the guarantee changes category. It is no longer a physical property that can be inspected; it is a rule that can be wrong, that can be changed, and that has to be trusted continuously. That is a firewall, with worse ergonomics and a misleading name.
It also undermines the reason the diode was chosen. Accreditation regimes treat a diode differently from a firewall precisely because the one-way property is demonstrable. A configurable exception removes exactly that.
The right answer
A bidirectional diode pair: two completely independent one-way channels, one in each direction. Each has its own transmitter and receiver, each is hardware-enforced, and the design prevents crosstalk between them.
Traffic in each direction remains physically one-way. The combination supports request and response patterns. Crucially, each channel can be independently monitored, filtered and logged – and each can be assessed on its own terms during accreditation, which is much easier than assessing an exception.
The distinction from a softened diode is not cosmetic. In a pair, no configuration exists that could allow data to reverse within a channel. The return channel is a second, separate, equally rigid one-way path that someone deliberately decided to install.
Pair or two singles?
Two implementations give the same guarantee.
Fibersystem’s Data Diode Bidirectional 1 Gbit packages both channels in one secure, EMC-shielded unit, with dual AC or dual DC power. One unit, one installation, less rack space and less cabling.
The alternative is two separate single diodes pointing in opposite directions. Same property, with physical separation between the units – which some accreditation requirements prefer, because the independence of the two channels is visible rather than internal.
Both are legitimate. The choice is usually made by the accreditation authority rather than by engineering preference, so it is worth asking early which they expect.
When a one-way diode is still right
Reach for bidirectional only when the protocol genuinely cannot be made one-way and middleware is not an option. That is a narrower set of cases than people expect.
If the flow is logs, telemetry, time or streaming, use a standard diode with one-way protocols. It is simpler to install, simpler to accredit, and there is nothing to discuss with the auditor.
If the flow is file transfer, middleware on both sides usually solves it without a return channel at all: the sending side terminates the protocol, the payload crosses as a one-way stream, and the receiving side reconstructs it. Forward error correction handles what acknowledgements would otherwise handle.
The honest question to ask is not “does this protocol expect a reply” – most do – but “does the information need to travel both ways”. Frequently the answer is no, and the reply is a protocol artefact rather than a requirement.
Design considerations
The two channels rarely carry equal traffic, and there is no back-pressure in either. A return channel used only for acknowledgements needs a fraction of the outbound capacity.
The return channel is a path into the protected network, hardware-enforced in direction but not in content. It deserves the same scrutiny a single inbound diode would get – arguably more, because it is easy to think of it as merely part of the outbound solution.
Six months later, someone will propose sending something else across it because it is already there. A recorded scope makes that a decision rather than a drift.
Fibersystem builds bidirectional diodes as single shielded units with dual AC or dual DC power, alongside the standard one-way range in stand-alone, rack module and rugged variants – with TEMPEST Level A and RÖS U1 certified options.
