one-way information flow
163543·updated Aug 30, 2026An architectural security property of an information path between two systems or domains in which data is permitted to travel in only one direction — from source to destination — with no return channel possible. It distinguishes itself from general access control by regulating *where* data can travel rather than *who* may access it, making bidirectional communication structurally or physically impossible rather than merely policy-prohibited. Standards bodies such as NIST (SP 800-53 AC-4 and SP 800-171 3.1.3) cite it as an enforcement mechanism alongside write-permission verification and regrading, specifically "employing hardware mechanisms to enforce one-way information flows" — typically realized as a data diode or unidirectional security gateway — applied wherever networks of differing confidentiality or integrity must be separated, such as preventing back-channel exfiltration into classified networks or blocking malware ingress into high-integrity industrial control systems.
Source
to enforce one-waythe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: term of art.
- Hardware-enforced one-way information flow control device
- AC-4: Information Flow Enforcement - CSF Tools
- Hardware-enforced one-way information flow control device
- NIST Special Publication 800 NIST SP 800-171r3
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A security property and architectural constraint that governs movement of data between domains of differing trust, classification, or integrity, requiring that data can travel in only one permitted direction across a boundary and cannot return or be exfiltrated in the opposite direction. Formal information-security models such as Bell-LaPadula and Biba favor this approach when information must be transferred between isolated networks of differing confidentiality or integrity. In practice, enforcement employs hardware mechanisms to enforce one-way information flows — such as optical data diodes — as well as software-based policy controls, preventing malware from entering a protected network while permitting remote monitoring and maintaining network isolation. Standards bodies such as NIST use the phrase operationally to denote a specific, enforceable mechanism within information flow control policy, not a general design preference: transferring CUI between systems that represent different security domains introduces the risk that such transfers violate domain security policies, and enforcement includes employing hardware mechanisms to enforce one-way information flows and implementing trustworthy regrading mechanisms to reassign security attributes and labels.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- one-way information flows
- possessive
- one-way information flow's
- pluralpossessive
- one-way information flows'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- An architectural security property of an information path between two systems or domains in which data is permitted to travel in only one direction — from source to destination — with no return channel possible. It distinguishes itself from general access control by regulating *where* data can travel rather than *who* may access it, making bidirectional communication structurally or physically impossible rather than merely policy-prohibited. Standards bodies such as NIST (SP 800-53 AC-4 and SP 800-171 3.1.3) cite it as an enforcement mechanism alongside write-permission verification and regrading, specifically "employing hardware mechanisms to enforce one-way information flows" — typically realized as a data diode or unidirectional security gateway — applied wherever networks of differing confidentiality or integrity must be separated, such as preventing back-channel exfiltration into classified networks or blocking malware ingress into high-integrity industrial control systems.DR-088 backfill from the noun definition column
- §1 · web_lookup_draft
- A security property and architectural constraint that governs movement of data between domains of differing trust, classification, or integrity, requiring that data can travel in only one permitted direction across a boundary and cannot return or be exfiltrated in the opposite direction. Formal information-security models such as Bell-LaPadula and Biba favor this approach when information must be transferred between isolated networks of differing confidentiality or integrity. In practice, enforcement employs hardware mechanisms to enforce one-way information flows — such as optical data diodes — as well as software-based policy controls, preventing malware from entering a protected network while permitting remote monitoring and maintaining network isolation. Standards bodies such as NIST use the phrase operationally to denote a specific, enforceable mechanism within information flow control policy, not a general design preference: transferring CUI between systems that represent different security domains introduces the risk that such transfers violate domain security policies, and enforcement includes employing hardware mechanisms to enforce one-way information flows and implementing trustworthy regrading mechanisms to reassign security attributes and labels.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.