Data Diode is the data pattern that ensures unidirectional data flow between networks and is useful for enterprises who want to connect networks with different security levels. This patterns will be used to ensure that data is only allowed to flow from the low side (low security network) to high side (high security network). This type of a dataflow, in most cases is controlled at the network level, but if a need arise to control this at a data layer this EIP pattern can be used. Let’s look at the image below
As you can see in this diagram, two WSO2 ESB’s reside on two sides of the network. The ESB in the unsecure network is connected to different applications in the unsecured network. It also connects to the ESB in the secure network and the communication is encrypted (if needed integrity and non-repudiation can also be ensured) using WS-Security.
The ESB in the secure network has all its outbound transports (except JMS transport) removed, hence the ESB can only receive messages from the unsecured network whilst it can only send out messages to a pre-designated message queue.
Consumers of this data can listen to the queue and pull messages from the queue once they are queued.
Setting up the ESB to work in this pattern would require the execution of following steps
- Remove/Disable all out-going transports except the JMS and local transport. This can be done by disabling/removing all transportSenders from the following configuration file.
The transportSender section of the configuration file should only have the two transports below.
<transportSender name="local" class="org.wso2.carbon.core.transports.local.CarbonLocalTransportSender"/> <transportSender name="jms" class="org.apache.axis2.transport.jms.JMSSender"/>
- Configure a message queue, you can configure a JMS or AMQP based message queue. More instruction on how to configure the queue can be found in the following link
- Create a Proxy service as given below.
- Finally Secure the proxy service, you can follow the instructions below to secure a proxy service using the WSO2 ESB.
You can now try to invoke the DiodeProxy from the unsecure network, you will notice that no response would be received back from this proxy. Even if a new proxy service is created in the secured ESB, the communication would still be blocked by the ESB as all but the JMS is blocked in the secured ESB.