A standard technique in security devices is a “protocol break”, which can be used for a number of things including “data diodes”.
This requires connecting two devices back-back, hence two R-Pi’s.
I’d like to package them as a single unit, with the user having a KVM switch to select either the “hot” or “cold” device.
One device (“hot”) connects to a network with TCP/IP, then needs to connect “via another means” to the other device (“cold” or “inside”)
I explored USB OTG to USB with “gadget” drivers and was able to effectively use (over USB) serial, ethernet and mass storage.
Can’t use TCP/IP over the USB-ethernet, because that isn’t a “protocol break”, leaving serial and mass storage. I was able to export a virtual disk, partition it with “fdisk” as two partitions and export a pair of filesystems. If the two devices co-operate, only one device writes to an individual filesystem, avoiding corruption.
Normal Linux filesystems are cached by the kernel, so this scheme requires frequent umount/mount cycles which is not particularly robust or reliable.
Which left serial-over-USB. I trialled it and transferred a 2GB file in 11 sec from memory.
Spent some time setting up uucp, but abandoned that because it’s complex overkill and is designed as a mail transport, not the simple file transfer that I need.
My intention was to use a Pi-Zero as the “hot” side, connected to the Network via TCP/IP.
The limited compute capability of the P-Zero makes it more difficult to target and encourages a minimal install, exposing a smaller attack surface.
The “cold” side would be a reasonably configured (full) R-Pi that had enough grunt and storage to operate as a normal desktop computer, though without direct Network access.
Hopefully I could figure out a means to make the “protocol break” transparent to the user, to allow them to focus on their work, not fighting the technology.
The conflict is that I need to connect the Pi-zero to both a USB keyboard/mouse and the other R-Pi for the serial over USB connection. With just one data USB port, I can’t do that.
I don’t want to use a USB hub with the Pi-Zero, leaving the only option two full R-Pi with type A USB ports, somehow connected ‘back to back’.
Perhaps you can suggest how I connect two (full) R-Pi’s together over USB to build this device.