Design of a Certifiable One-Way Data-Flow Device
Ronald L. Sharp · AT&T Technical Journal · 1988
This paper describes a possible design for a device that would allow two hosts or networks of different security sensitivities (for example, Top Secret and Secret) to be connected so that information can move from the low-sensitivity system to the high-sensitivity system. The primary challenge was to allow return protocol messages from the high-sensitivity system while not permitting an unacceptable covert channel. Covert channels, as they relate to intersystem communication, are described to give the reader a better idea of the problem.