one-way information flow

No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.

A security property and architectural constraint that governs movement of data between domains of differing trust, classification, or integrity, requiring that data can travel in only one permitted direction across a boundary and cannot return or be exfiltrated in the opposite direction. Formal information-security models such as Bell-LaPadula and Biba favor this approach when information must be transferred between isolated networks of differing confidentiality or integrity. In practice, enforcement employs hardware mechanisms to enforce one-way information flows — such as optical data diodes — as well as software-based policy controls, preventing malware from entering a protected network while permitting remote monitoring and maintaining network isolation. Standards bodies such as NIST use the phrase operationally to denote a specific, enforceable mechanism within information flow control policy, not a general design preference: transferring CUI between systems that represent different security domains introduces the risk that such transfers violate domain security policies, and enforcement includes employing hardware mechanisms to enforce one-way information flows and implementing trustworthy regrading mechanisms to reassign security attributes and labels.