User Manual
One Way Diode
Copyright 2024 - Forward Edge-AI, Inc.
Confidential and Proprietary Information. This document contains confidential information belonging to Forward Edge-AI, Inc. and shall not be published, reproduced, modified, copied, disclosed, or used for other than its intended purpose without the express written consent of duly authorized representatives of Forward Edge-AI, Inc.
GLOSSARY OF KEY TERMS
ACRONYM | DEFINITION | ACRONYM | DEFINITION |
COMSEC | Communications Security | NID | Network Interface Device |
DHCP | Dynamic Host Configuration Protocol | EU | Encryption Unit |
EUD | End User Device | PFED | Protocol Free Encryption Device (Isidore’s Code Name at the NSA) |
FQDN | Fully Qualified Domain Name | SWaP | Size, Weight, and Power |
IX | Industrial Ethernet (Type A connector used for ruggedized networking) | UART | Universal Asynchronous Receiver Transmitter (used for console access and serial communication) |
PKI | Public Key Infrastructure |
|
|
1. Overview of Isidore Quantum®: Securing Critical Infrastructures
Forward Edge-AI is committed to enhancing the security of critical infrastructure, including both in-facility systems and remote access via cloud-based storage. The goal is achieved using our cost-effective devices with post-quantum encryption. These devices are designed to protect against advanced cyber threats and safeguard the confidentiality and integrity of sensitive data.
Our sophisticated data-driven analytics algorithm is housed within the Isidore Quantum device, which is crafted for straightforward integration into existing controller chassis. A seamless connection is created through the integration, enabling the Isidore Quantum device to efficiently understand the applications controlled by the controller.
By leveraging artificial intelligence and innovative physics-based modeling, the Isidore Quantum device comprehensively learns the operational dynamics of the system it monitors. Continuous monitoring and precise insights are made possible through this capability, strengthening system management and security.
As cybersecurity threats evolve, the Isidore Quantum device is engineered to update and respond to new challenges both efficiently and effectively, ensuring ongoing protection against both current and future threats. Adaptability and advanced protection make Forward Edge-AI’s solutions essential for modern critical infrastructure, delivering strong security and confidence in a connected environment.
2. Technical Description
2.1 Identifying the Trust Boundary on the Isidore 50
Figure 1. Identifying the Trust Boundary
2.1.1 Red Side
The first Industrial IX Type A Ethernet port on the device and the second USB-C port on the device are assigned as the "red side," representing the trusted zone. The purpose of the zone is to support secure connections to end-user devices or trusted internal network areas that need strong protection.
To establish a connection:
Use an Ethernet cable: Connect your secure “Red side” end-user device or network enclave router/switch to the Isidore device’s “Red side” using an ethernet cable. Data transmitted through the port remains protected and restricted to the trusted internal network under this setup.
2.1.2 Black Side
The second Industrial IX Type A Ethernet port on the device and the first USB-C port on the device are assigned as the "Black side" of the device, representing the untrusted zone. The purpose of the zone is to handle connections to external or lower-trust networks and devices.
To establish a connection:
Use an Ethernet cable: To link the black side of the device to your switch or router. The configuration manages data flow from less secure or external sources while protecting the integrity of the trusted zone.
2.2 Importance of Proper Configuration
Maintaining a clear distinction between these zones is critical for network security. The trusted zone (Red side) should only connect with secure, verified devices, while the untrusted zone (Black side) handles all external connections. The setup reduces the risk of security breaches by isolating potential vulnerabilities in the untrusted zone and strengthening your overall network security.
2.2.1 Hardware Check
Each Isidore Quantum® device is carefully inspected and tested by our engineering team prior to shipment. Each unit is verified to meet quality standards, so it is ready for deployment when received.
2.2.1.1 Device Verification
Upon receiving your devices:
Inspect the Hardware – Ensure there is no visible shipping damage or missing components.
Verify Device Count – Confirm that all devices listed in your shipment are present.
Note: All devices are pre-provisioned with unique node numbers and preloaded firmware to streamline the setup process.
2.2.1.2 Power-On Check
Before integrating the devices into your network:
Connect Power – Attach the device to its designated power source.
Switch On – Use the On/Off switch located on the side panel to power the device.
Verify Operation – Confirm that the unit powers on and is functioning as expected. A successful power-on check ensures the device is ready for network configuration.
2.3 Identifying an Isidore Pair
The Isidore Quantum hub and spoke devices are pre-configured and cryptographically linked, ensuring secure communication and seamless integration.
To easily identify paired devices, each unit is labeled with a product number, as shown in the example with "2". The product number will match between the provisioned devices, confirming they are correctly configured to work together.
Figure 2. Isidore Product Number
2.3.1 Identifying the Node Number
To identify whether a device is Node 0, Node 1, Node 2, etc., check the label affixed to the device.
Figure 3. Node Number
Proper identification of each device’s node number is essential for correct network configuration and overall functionality. The node number determines the IP address of the black-side interface, allowing initial access to the management portal.
Maintaining the integrity of the set of devices provisioned together is crucial for proper routing and initial network setup. By keeping track of this designated set, you can efficiently manage and configure the network, ensuring all devices communicate correctly and securely with their intended counterparts.
2.3.2 Product identification Label
Figure 4. Identification Label
2.3.2.1 Serial Number (SN) Format
Each Isidore device is assigned a unique 16-digit alphanumeric serial number to track product type, hardware/firmware configuration, origin, and production sequence.
Example Serial Number: ISI22A0806UAZZ000123
IMPORTANT: Ensure proper pairing of the boards for functionality. Please verify that each board is correctly paired with its respective counterpart.
3. Wired Connection Overview – One-Way Diode Configuration
Figure 5. Wired Connection
The Isidore Quantum® Encryptors operate as the core of the one-way diode link.
Each encryptor represents one side of the unidirectional channel:
Node 0 – Isidore Encryptor (TX Only)
Node 1 – Isidore Encryptor (RX Only)
These two encryptors are connected point-to-point through a Layer 2 switch that serves as an Untrusted Zone.
The configuration ensures that data can only flow outward from Node 0 to Node 1 and can never return in the opposite direction.
Physical Wiring Diagram
EUD 1 → Node 0 (TX Only) → Switch (Untrusted Zone) → Node 1 (RX Only) → EUD 2
Component | Connection Description | Function |
EUD 1 (User Device 1) | Ethernet cable connects from EUD 1 to Node 0 Inner (Red) port. | Source device sending outbound traffic. |
Node 0 – Isidore Encryptor (TX Only) | Outer (Black) port connects to the switch in the Untrusted Zone. | Encrypts and transmits outbound traffic one-way. |
Switch – Untrusted Zone | Provides a physical bridge between Node 0 and Node 1. Performs no routing. | Acts as a neutral physical connection point. |
Node 1 – Isidore Encryptor (RX Only) | Outer (Black) port connects from the switch to Node 1, and the Inner (Red) port connects to EUD 2. | Decrypts and delivers received data to the destination network. |
EUD 2 (User Device 2) | Ethernet cable connects to Node 1 Inner (Red) port. | Destination device that receives data. |
Data Flow Direction
Transmission
Path:
Data flows outbound only from EUD 1 → Node 0 (TX) → Switch → Node 1 (RX) → EUD 2.
Blocked Reverse
Path:
The diode’s internal hardware design prevents any electrical or logical signal from traveling in the reverse direction (EUD 2 → EUD 1).
No ARP replies, TCP acknowledgments, or other traffic can return across the link.
End User Devices / Network Enclaves:
For network communication between End User Devices (EUDs) or Network Enclaves through the Isidore device, it is essential that these devices or enclaves be routable to one another. If Isidore were removed from the network, the two enclaves or end user devices would be able to communicate over the network.
4. Isidore One- Way Diode Communication
4.1 Uni-Directional Configuration
The Isidore Quantum® devices were configured and tested in a point-to-point topology to validate unidirectional data transfer. In this setup:
Node 0 operates as Transmit Only (TX)
Node 1 operates as Receive Only (RX)
Each node is physically and logically configured to enforce a one-way data flow. This configuration ensures that information originating from Node 0 can be securely transmitted to Node 1, while no data can return in the opposite direction.
System Configuration
Node 0 (TX Only): Connected to the red-side (trusted) network. Its transmit interface is the sole output path for data leaving the network.
Node 1 (RX Only): Connected to the destination or external network. It receives data from Node 0 but cannot transmit any traffic back.
Untrusted Zone (Switch): Serves as the interconnection point between Node 0 and Node 1. No routing logic is applied in the zone; it strictly serves as a physical link.
5. How the One-Way Diode Works
The Isidore one-way diode enforces hardware-level unidirectional communication between two networks. Unlike software-based firewalls or logical restrictions, the diode design physically prevents any electrical or optical signal from traveling in the reverse direction.
In simple terms:
Data flows only from TX → RX.
No return signal, acknowledgment, or response can be transmitted back.
Even if software or network configurations attempt to initiate reverse communication, the hardware prevents it from occurring.
Data integrity, isolation, and protection from external access or leakage are ensured through this approach.
6. Accessing the Management Portal
To configure or manage the Isidore Quantum® Encryptors, you must first connect your PC to the same subnet as the management interface of the devices. The management network uses the 192.168.0.x subnet by default.
Step | Description |
1.0 | Set Your PC’s IP Address
Note: Ensure Wi-Fi and any other network interfaces are disabled so the PC communicates directly with the Isidore device. |
2.0 | Access Node 0 and Node 1
(Default IP for Node 0, unless otherwise configured.)
(Default IP for Node 1, unless otherwise configured.) |
3.0 | Adjust Configuration to Fit Your Network Once logged into each portal:
The device will automatically reboot or restart the network services for changes to take effect. |
4.0 | Verify Access After the configuration is updated:
|
Troubleshooting
|
|
By following these steps, you should be able to successfully configure dual home IP addresses on your Windows machine. Greater flexibility and advanced networking options are enabled through the setup.
Test the Configuration
Once you have configured your computer with the appropriate IP addresses, you can access the management portals for both the node 0 and node 1 by typing the following URLs into your browser. Direct navigation to the management interfaces is enabled by this step, allowing you to view and adjust settings.
For Node 0: Type http://192.168.0.254 into the browser's address bar. You will be directed to node 0’s management portal to update settings, view activity, and manage hub connections.
For Node 1: Enter http://192.168.0.1 in the browser. Accessing the address takes you to node 1’s management portal to adjust and manage client-focused settings and operations.
Using these specific URLs ensures that you are directly accessing the correct device's settings within your network's structure, making it straightforward to manage each device. The method of access is especially effective in environments that require precise control and frequent network setting adjustments.
Step | Description |
1.0 | Enter the device’s IP address in a web browser to access the management portal. If a security warning appears indicating the connection is not private, select Advanced, then select Proceed to Unsafe to continue
|
2.0 | Enter the device’s IP address in a web browser to access the management portal. If a security warning appears indicating the connection is not private, select Proceed to Unsafe to continue. |
3.0 | After navigating to the portal, you will be prompted to log in. Default Credentials: Username: admin Password: 123qwe 
|
4.0 | Each node has a dedicated management portal:
The dashboard serves as the central interface for managing and monitoring all black-side operations of the device.
|
5.0 | From the dashboard, locate the Channel Number under the Action column. Select the three-dot menu and click Edit PFED Attributes. Here, you can set the Protocol, Remote Gateway, and Remote Port. In a Hub-and-Spoke configuration, spoke devices should use the Node 0 device IP as their gateway.
|
6.0 | The view shows how to configure the device to work within your network environment. After changing the network settings, the device must be refreshed.
 |
7.0 | Displays real-time PFED logs for monitoring system activity, troubleshooting, and verifying operational status. PFED System  Log Viewer |
8.0 | Displays the operational status of the PFED. If the system is functioning properly, the status will display as Active. Quick confirmation of device connectivity and communication is made possible through this step. 
Checking PFED Status |
9.0 | Provides direct command-line access to the device for advanced configuration, diagnostics, and troubleshooting. Note: Terminal is best displayed in the Microsoft Edge browser.
Accessing the Terminal |
10.0 | Allows the device to be restored to its factory default state, clearing configurations and returning it to its original setup.
 |
7. Understanding UDP and One-Way Network Behavior
The Isidore Quantum® one-way diode and PFED architecture enforce unidirectional data flow, meaning traffic can only move in one direction from the transmit (TX) node to the receive (RX) node.
High assurance is provided by the design, preventing any data, acknowledgments, or signals from returning against the flow.
While this guarantees physical-layer security, it also changes how traditional network protocols such as UDP and IP routing—operate across the link.
UDP Transmission Behavior
Under normal bidirectional conditions, UDP packets can be sent freely between two endpoints because both devices can exchange ARP and routing information.
However, when a one-way diode is introduced between PFED-A (TX) and PFED-B (RX):
The transmit side (TX) can send UDP packets into the diode path.
The receive side (RX) can successfully receive those packets.
But the transmit-side endpoint (e.g., EUD-A) cannot complete a route or ARP discovery, since no return traffic (even an acknowledgment or ARP reply) can reach it.
As a result, the sender may not be able to originate the UDP session without external routing assistance.
All unidirectional systems are designed to behave this way.
Routing Requirements
Because the EUD or application on the transmit side expects a normal two-way route, additional routing logic or forwarding configuration may be required in your environment to ensure packets reach the PFED’s transmit interface.
This can be achieved by:
Adding a static route on the sending device (EUD or router) that points all destination traffic toward the PFED-A transmit interface.
Using a helper router or stub interface that accepts outbound packets and forwards them into the one-way PFED link.
These routing adjustments are handled at the enterprise or integration level they are not a function of the PFED hardware.
Test Results and Interpretation
During system validation, UDP throughput testing was attempted using a point-to-point diode setup.
Because standard routing and ARP exchanges could not occur across the one-way path:
UDP packets were not transmitted end-to-end under standard network conditions.
The outcome is typical for a unidirectional environment and does not signal any issue with the Isidore or PFED hardware.
In environments where routing logic is properly implemented (such as with Thunder’s integration plan), the PFED devices can achieve and exceed 50 Mbps one-way UDP throughput, which surpasses the 30 Mbps minimum requirement defined in the acceptance criteria.
Key Takeaway
The one-way diode enforces absolute directionality, so UDP transmission requires additional routing logic on the transmitting enterprise network. Once properly configured, the PFED devices fully support one-way, high-throughput UDP data transfer as part of the Isidore Quantum® secure communication framework.
8. Maintenance and Care
Warning: Safety Guidelines for Isidore Devices
Please read the following warnings, precautions, and safety guidelines carefully before using this device. Failure to adhere to these instructions may result in damage to the device, personal injury, or property damage.
To maintain your Isidore devices and ensure their longevity, please follow these guidelines:
Temperature and Environment:
Keep devices in a cool, dry area away from direct sunlight.
Avoid exposing devices to extreme temperatures and humidity.
Ensure devices are stored in a stable clean environment, free from dust and debris.
Cleaning:
Clean devices regularly with a soft, dry cloth.
Avoid using harsh chemicals or abrasive materials near the devices.
Ensure devices are powered off and unplugged before cleaning.
Handling:
Handle devices with care to avoid drops or physical damage.
Do not overload power outlets or use faulty extension cords to power devices.
Ensure all cables are securely connected and in good condition. Replace any damaged cables immediately.
Storage:
Store devices in their original packaging when not in use for extended periods.
Keep devices away from magnetic fields and electronic interference.
Usage:
Follow the guidelines for optimal usage and performance.
Allow adequate ventilation around devices to prevent overheating.
By following these care instructions, you can help ensure the optimal performance and durability of your Isidore devices.
8.1 Water Damage
Avoid Submersion: Do not submerge this device in water under any circumstances. Exposure to water beyond the specified resistance level can cause severe damage to internal components, rendering the device inoperable.
Liquid Ingress Warning: Prevent any form of liquid ingress to safeguard the integrity and functionality of the device. Liquid exposure, including water, can lead to corrosion, short circuits, and other detrimental effects, potentially voiding the warranty.
Moisture Management: Minimize exposure to moisture to ensure optimal performance and longevity of the device. Avoid operating or storing the device in high humidity environments and take necessary precautions to shield it from moisture accumulation.
8.2 Flammability
Fire Hazard Awareness: Exercise caution to mitigate the risk of fire hazards associated with the use of this device. Avoid placing the device near open flames, sparks, or sources of intense heat, as combustible materials within the device may pose a fire risk when exposed to elevated temperatures.
Ventilation Requirements: Ensure adequate ventilation during device operation to prevent overheating, which may increase the likelihood of fire incidents. Avoid obstructing ventilation ports, as thermal buildup could lead to fire hazards.
Emergency Preparedness: In the event of a fire involving the device, prioritize personal safety above all else. Immediately disconnect the device from power sources if it's safe to do so and evacuate the vicinity. Utilize appropriate fire extinguishing methods suitable for electronic fires, such as Class C fire extinguishers.
8.3 Safety Precautions
Make sure to read and understand the user manual and all safety guidelines before using the device.
Keep Out of Reach of Children: Small components in the device can be a choking risk for young children. Store the device away from children and pets.
Avoid Extreme Temperatures: Do not expose the device to extreme temperatures, both hot and cold, as it may affect its performance and lifespan.
Use Manufacturer Accessories: Only use manufacturer recommended accessories and replacement parts recommended by the manufacturer to prevent damage to the device and ensure safe operation.
Regular Maintenance: Perform regular maintenance as outlined in the user manual to keep the device in optimal condition and prevent safety hazards.
Proper Handling: Handle the device with care to avoid drops, impacts, and other physical damage that may compromise its integrity and safety.
Unplug During Maintenance: Always unplug the device from power sources before performing any maintenance or cleaning to prevent electrical shock.
Authorized Service Centers: In case of malfunction or damage, seek assistance from authorized service centers or qualified professionals for repairs and servicing.
Report Safety Concerns: If you encounter any safety concerns or abnormalities with the device, cease use immediately and report the issue to the manufacturer or authorized service center for investigation and resolution.
Note: These warnings and safety precautions are provided to promote safe usage and handling of the device. Ignoring these instructions may void the warranty and result in damage to the device or personal harm.
9. FEAI Customer Support
If you need any help or have any questions, our support team is here to assist you. Please use any of the following methods to reach out to us:
Contact Information
For all support inquiries contact Isidore helpdesk via email: [email protected].
Website: https://forwardedge.ai/
Visit our website for more information, including product documentation and for a live chat with a support representative.
Support Hours
Our support team is available during the following hours:
Monday to Friday: 9 AM to 6 PM (EST)
Saturday and Sunday: Closed
Social Media
Stay connected and get support through our social media channels:
Instagram: https://www.instagram.com/forwardedgeai/
Twitter: https://twitter.com/ForwardEdgeAI
Live Chat
For immediate assistance, use our live chat feature on our support website. Maven, our support bot, is ready to help you in real-time during support hours. Just ask Maven!
THE INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE.
LIMITED WARRANTY: IT IS EXPRESSLY AGREED THAT NO WARRANTY OF MERCHANTABILITY, WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE, NOR ANY OTHER WARRANTY (EXPRESS, IMPLIED OR STATUTORY) IS MADE BY FORWARD EDGE-AI, EXCEPT THAT FORWARD EDGE-AI
WARRANTS THE GOODS TO BE FREE FROM DEFECTS IN MATERIALS AND WORKMANSHIP FOR A PERIOD OF ONE (1) YEAR FROM DELIVERY.
DURING THIS PERIOD, WE WILL REPAIR OR REPLACE, AT OUR DISCRETION, ANY DEFECTIVE PARTS AT NO CHARGE. THIS WARRANTY DOES NOT COVER DAMAGE CAUSED BY MISUSE, ACCIDENTS, UNAUTHORIZED MODIFICATIONS, OR NORMAL WEAR AND TEAR.
IN NO EVENT SHALL FORWARD EDGE-AI OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL OR USE OR MISUSE OF THIS PRODUCT, EVEN IF FORWARD EDGE-AI OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.