LightGuard: A Physically Unidirectional Optical Data Transfer System for Air-Gapped Environments

Air-gapped industrial environments need routine cross-domain data transfer, yet the available mechanisms trade off poorly: certified unidirectional gateways require persistent inter-zone cabling that conflicts with the physical-isolation intent of classified-network regulations, while manual optical-disc shuttling is slow, procedurally vulnerable, and incurs per-transfer consumable cost. We present LightGuard, an optical transfer system that establishes a physically isolated, cable-free channel via a screen-camera pair, encoding data as color-QR-code (C-Code) sequences. Its core is a computational-offloading architecture that delegates all decode-intensive processing to a dedicated intermediary device, driven by a cost-benefit criterion (Criterion 1) and four deployment considerations spanning software heterogeneity, operator impact, camera-attachment compliance, and copy resistance; a three-stage pipeline (chunking, Zstandard compression, fountain coding) tolerates the lossy channel. Measured on real hardware, the system sustains 98.77 KB/s optical-link throughput (∼ 91 KB/s end-to-end)—a 2–15 × gain over prior QR-based visible-light systems under their reported optima—at 2.5–5 W. Direct endpoint decoding, by contrast, saturates the internal host (97% CPU) where the offloaded configuration needs 24% and runs 1.42 × faster, and 40/40 unattended transfers recover byte-identical files within a single playback loop. LightGuard is positioned as a cable-free complement to certified gateways, aligned with the isolation intent of standards such as China’s BMB17.