The most secure way to protect process data is by using a data diode to block all incoming data, ensuring that no suspicious content can enter a mission-critical system.
But standard OT network protocols like OPC UA and MQTT need two-way flow, so they cannot work natively through a data diode.
The solution is tunnel/mirroring — encapsulating data in a diode-compatible format on the source side, then reconstructing it at the destination. This preserves all values, timestamps, and quality information without data loss, while guaranteeing end-to-end data consistency from source to subscriber.
A good tunnel/mirror system—such as provided by Cogent DataHub software from Skkynet—also aggregates multiple protocols, supports redundant connections, and can run as a software-only emulation when hardware diodes are not practical.
For OT networks that demand both security and operational continuity, tunnel/mirroring with data diode support is the clear choice.
