Connect 2 Pi's for file transfer, but with minimum networking [closed]

Question

I want to connect two Pi's together for the purpose of transferring files, but I want to do it in the most secure method possible. One Pi ("Device 1") will be connected to the internet, and when a file is uploaded to it, I plan to move the file programmatically to another device ("Device 2") which is "only just reachable" from the internet connected device.

Ideally I would do it with a single wire, and the wire would include an opto-coupler to prevent data being read from Device 2 by Device 1. This way, Device 2 would be almost air gapped. This is not practical though since I need a minimum speed of 5 mbps, and it needs to be a reliable transfer (i.e. error corrected).

Obviously I don't want to use Bluetooth or WiFi due to their non-physical nature. In an effort to minimize the attack surface, I would prefer to use a serial bus rather than ethernet.

I am happy to use whichever Pi models required, for example a Pi 4 plus as Zero.

Here are the options that I have looked at and (so far) discounted:

• 1 Wire: not practical
• UART: too slow
• I2C: too slow (chip dataset says Zero can be a slave, but only at 400bps)
• SPI: no driver for Pi in slave mode
• Pi Zero as USB Gadget (with OTG cable): apparently this is just converting to USB to ethernet, so defeats the purpose

I have looked briefly at using USB-RS422 (or USB-RS485) converters, but have yet to fully understand them.

What other options am I missing? What is the most secure way to transfer a file between two Pi's at a min speed of 5 mbps?

Answer 1

Does using an intermediate controller count? Use e.g. Blue Pill, configure both SPIs on it, SPI1 in receive only slave mode, SPI2 in transmit only slave mode. Both RPis will be SPI masters (which is supported). Then you develop a simple firmware which copies data from SPI1 to SPI2. Both SPI on Blue Pill run at up to 18 Mbit/s.

P.S. And no, both WiFi and Bluetooth have a physical nature. Everything in the nature has a physical nature :) Even more, both of them use basically same physical phenomena as optocouplers — electromagnetic waves. Only frequencies differ. Also, note, classic Fast Ethernet (100BaseT) is a serial bus. You have only one 1 transmit pair, and you put bits there serially, one after another.

Answer 2

If you have a reasonable network controller, you can do this by segmenting the networks and defining routing firewalls.

This is pretty easily accomplished using openwrt or any other software defined network capable router. In fact, I do this using zerotier for my web hosting machines - only https connections come to the machines -- if I need to ssh in, it can only be done from the zerotier network.