Microsoft patents one-way data flow to block network attacks
Microsoft describes a system that ensures data only moves in a specific direction between network devices. It checks the source of the data against a list of trusted entities and rules to prevent unauthorized information from flowing backward.
In the filing’s own words
Data diode systems and methods are disclosed herein for enhancing data security. Encrypted data transmitted from a first node (e.g., an entity coupled to a network) is received. The data transmitted is encrypted with a public key associated with a second node (e.g., the node to which to which the encrypted data is transmitted). The encrypted data is decrypted with a private key associated with the second node to generate decrypted data. A determination is made whether a digital signature in the decrypted data corresponds to a ledger entry mapped to the first node in a first set of ledger entries. The first node is verified to be a trusted entity based on the digital signature having been determined to correspond to the ledger entry. Based on the verification, the transmission of the encrypted data from the first node is determined to be a permissible data transmission.
What exactly they claim (claim 1)
1. A system for enforcing unidirectional communication between nodes of a network, comprising: a processor; and a memory storing instructions that cause the processor to: receive data transmitted from a first node to a second node over a communication link; obtain information associated with the first node from a maintained data structure, the information identifying at least one attribute of the first node; obtain directional policy information defining one or more permitted communication directions between a set of nodes including the first node and the second node, the directional policy information identifying at least one node from which the second node is permitted to receive data; determine whether the data transmitted from the first node to the second node satisfies the directional policy information based at least in part on the at least one attribute of the first node; and selectively control propagation of the data to the second node to enforce one or more permitted communication directions.
Facts
- Company
- Microsoft (Microsoft Technology Licensing, LLC)
- Official title
- DATA DIODE FOR ENHANCING DATA SECURITY
- Publication number
- US20260270087A1
- Application number
- 19665508
- Filed
- May 1, 2026
- Published
- Sep 10, 2026
- Inventors
- 5
- Claims
- 20
Classified under
H04L 9/3247 Electricity & electronicsMore from Microsoft in Security & privacy
- Microsoft patents system to call 911 for others during video calls Sep 22, 2026
- Microsoft patents system to block fake code suggested by AI Sep 15, 2026
- Microsoft patents voice coding that hides speaker identity for secure calls Sep 17, 2026
- Microsoft patents security checks for AI chats using user and model profiles Oct 1, 2026
- Microsoft patents math model to spot ransomware attacks in real time Sep 1, 2026
Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.