Practical Setup for Transferring Large Files in Air-Gapped Networks Without USB

In secure zones completely isolated physically from external networks, USB drives and external hard drives cannot be used. The bottlenecks that arise when large data must be introduced into an environment where even the physical ports of terminals are blocked can exhaust field engineers. The Decima technology, which restores data by reading a dynamic QR code stream on a screen with a camera, is an optical transmission method used in such situations. However, because it is a non-standard method that leaves no OS media access logs, hardware parameters must be fine-tuned meticulously to prevent field test failures.

Designing a Decima Offline Transmission Environment That Passes Air-Gapped Security Audits

Introducing Decima without authorization invites audit citations for bypassing the information leakage monitoring system. To meet security regulations for defense research institutes and financial institutions, unidirectional communication proof and the installation of a blackout structure are essential.

Prepare the 3-stage security review documentation for submission to the Information Protection Committee. Analyze visual leakage and malware infiltration scenarios through self-risk assessment, and describe that Decima operates via visible light communication and is a unidirectional mechanism that does not generate external RF radio waves. Specify the approved transmitting terminal and receiving smartphone information, and verify the pre- and post-SHA-256 verification procedures.
Build a dedicated transmission space that meets the specifications of the blackout structure. To prevent visual side-channel leakage from adjacent areas, install opaque partition walls with a light-shielding rate of 99.9% or higher and assemble a darkroom-type cage enclosing the transmitting monitor and receiving terminal. To prevent recognition errors caused by reflected light, finish the interior of the cage with matte black finishing materials.
Compare control measures by data transmission method.

Transmission Method	Physical Isolation	Transmission Speed	Security Audit Approval Difficulty	Data Integrity Verification
USB & External Hard Drive	Maintained when using control media	>100 MB/s	Very High (Prohibited at source)	Manual SHA-256 Verification
Hardware Data Diode	Complete unidirectional isolation	10 MB/s ~ 1 GB/s	Low (Meets existing standards)	Protocol Internal Verification
Decima Optical Transmission	Pure optical air gap	100 KB/s ~ 600 KB/s	Medium (Blackout regulations required)	Automatic SHA-256 & LT Fountain Code

Implementing this approval process and physical blocking specification secures a control environment that passes information protection audits while reducing hardware diode construction costs.

Optimizing Decima Configuration Values Tailored to Smartphone Camera Specifications

Decima uses a Luby Transform-based fountain code algorithm. The receiving side must collect $N_{ ext{target}} = leftlceil 1.15 imes K ight ceil$ normal frames, which is about 1.15 times the total number of blocks $K = leftlceil rac{S_{ ext{file}}}{S_{ ext{block}}} ight ceil$ , to successfully restore the file. If asynchronous behavior occurs among the camera sensor processing speed, display refresh rate, and WASM decoder CPU processing power, frame drops will skyrocket.

Set the minimum focus distance and AF state of the receiving smartphone. After measuring the distance between the monitor screen surface and the smartphone lens, align the cradle to a position without focus hunting, and activate AF and AE lock in the camera app to fix the focus and exposure. Position the QR code graphic so that it occupies 70% to 80% of the entire camera viewfinder area.
Input parameters optimized for device specs into the configuration file. For flagship terminals capable of WASM decoding at 60 fps or higher, such as the iPhone 17 Pro Max, apply tx_fps=30~60, bytes_per_frame=2331~2953, 4-code layout, and error correction L (7%). For mid-performance AP terminals, input tx_fps=20~24, bytes_per_frame=1465, and error correction M (15%). For low-performance entry-level terminals, lower it to tx_fps=10~15 and bytes_per_frame=500~1000.
Conduct fine-tuning tests aiming for a per-second decoding failure rate of less than 5%. Execute a test transmission and monitor whether worker pool dropped frames occur. If decoding errors occur, lower tx_fps in increments of 5 to reduce terminal CPU load. Repeat until the per-second failure rate stabilizes below 5%.

Applying this parameter optimization process reduces frame decoding error rates during transmission by over 80%, shortening work time.

Pre-splitting and Integrity Verification Framework to Prevent Large File Transmission Interruption Accidents

Transmitting hundreds of megabytes of files as a single stream will exceed the receiving smartphone browser heap memory or cause the receiving tab to be forcefully terminated due to camera thermal throttling from prolonged transmission. Considering mobile browser storage limitations, the maximum stable capacity for a single stream is around 64 MB. Large files must be divided into chunks ranging from 5 MB to 10 MB using a pre-splitting batch script, and then transmitted along with a generated manifest file.

Run the pre-splitting and checksum generation script on the workstation. Use the split command in a Bash environment to divide the original file into 10 MB chunks and calculate the unique hash value of each chunk file using the sha256sum command. Automatically generate a manifest.json structure file recording the original file name, total size, chunk-specific IDs, and SHA-256 values.
Sequentially transmit the split chunks and manifest file. Transmit the manifest file first via optical transmission to load structural information into the receiving terminal memory. Render the chunk files one by one onto the Decima screen in the generated order for transmission, and keep the receiving engine automatically comparing the SHA-256 values specified in the 20-byte frame headers with the real-time restored binary.
Re-verify individual chunk integrity on the receiving terminal and reassemble them into the original. Input the received chunks into the receiving-side script to cross-check against the original hashes in the manifest. Resend only specific chunks where damage is confirmed from their original locations to prevent reset risks, and merge all chunks whose integrity has been verified.

`bash
#!/bin/bash
TARGET_FILE=$1
CHUNK_SIZE_MB=10
OUTPUT_DIR="./chunks_output"

if [ -z "$TARGET_FILE" ]; then
echo "Usage: ./split_pipeline.sh "
exit 1
fi

mkdir -p " $OUTPUT_DIR" rm -f "$ OUTPUT_DIR"/*

split -b " ${CHUNK_SIZE_MB}M" -d -a 3 "$ TARGET_FILE" "$OUTPUT_DIR/part_"

MANIFEST_FILE=" $OUTPUT_DIR/manifest.json" echo "{" > "$ MANIFEST_FILE"
echo " "original_file": " $(basename "$ TARGET_FILE")"," >> "$MANIFEST_FILE"
echo " "total_size": $(stat -c%s "$ TARGET_FILE")," >> " $MANIFEST_FILE" echo " \"chunks\": [" >> "$ MANIFEST_FILE"

CHUNKS=(" $OUTPUT_DIR"/part_*) TOTAL_CHUNKS=$ {#CHUNKS[@]}

for i in " ${!CHUNKS[@]}"; do FILE_PATH="$ {CHUNKS[ $i]}" FILE_NAME=$ (basename " $FILE_PATH") HASH=$ (sha256sum "$FILE_PATH" | awk '{print $1}')

comma=","
if [ $i -eq $((TOTAL_CHUNKS - 1)) ]; then
    comma=""
fi

echo "    {\"chunk_id\": $i, \"file_name\": \"$FILE_NAME\", \"sha256\": \"$HASH\"}$comma" >> "$MANIFEST_FILE"

done

echo " ]" >> " $MANIFEST_FILE" echo "}" >> "$ MANIFEST_FILE"

Establishing this pre-splitting framework prevents memory overflow issues in the receiving terminal browser, and even if an error occurs during transmission, only the damaged chunk needs to be retransmitted, reducing rework time.

Know-How on Physical Setup for Field Optical Transmission Environments

Primary causes of optical transmission failures in the field include flicker phenomena caused by collisions between the display pulse-width modulation (PWM) cycle and the camera rolling shutter, as well as specular reflections from fluorescent lighting. If the LED panel scan frequency and shutter speed mismatch, horizontal stripes are scanned, damaging the location detection pattern of the QR module.

Fix the camera shutter speed and display scan frequency. Apply the panel effective scan frequency formula.

ext{Effective Scan Frequency} = rac{ ext{Display Refresh Rate (Hz)}}{ ext{Scan Count}}

In a 60 Hz or 120 Hz monitor environment, enter the smartphone's Pro camera mode to manually fix the shutter speed to $1/240 ext{ seconds}$ or $1/480 ext{ seconds}$ , and switch the anti-flicker mode to 50 Hz or 60 Hz.

Attach anti-reflective film and set specular reflection blocking tilt angles. Attach anti-reflective or anti-glare film without bubbles onto the transmitting monitor surface. Utilize a precision micro-jig mount to fix the physical distance between the monitor center axis and the camera lens with an error within $pm 1 ext{ mm}$ . Form an optical offset tilt angle of $5^circ sim 10^circ$ between the monitor plane and the smartphone receiving axis to completely block light glare from ceiling lighting.
Analyze field error logs and take action according to the troubleshooting guide.

Occurred Error Phenomenon & Log Message	Main Root Causes	Immediate Field Action Guide
`no-signal.ts` (Nothing happening? Hint output)	QR position recognition failure or frame reception interruption	Readjust jig distance so that the QR code fills 70% or more of the viewfinder and check AR film
`progress.ts` Persistent Frame Drop Occurs	WASM decoder CPU processing capacity exceeded (`worker-pool.ts`)	Lower `tx_fps` from 24 FPS to 15 FPS in transmission settings and reduce `bytes_per_frame`
QR frame top/bottom pixel corruption and banding	Display PWM frequency and camera rolling shutter conflict	Enter Pro camera mode and change shutter speed to $1/240 ext{s}$ or $1/480 ext{s}$
`LTDecoder.assemble()` Out of Memory Error	Single file size exceeds receiving smartphone RAM limit	Rerun split script to reduce single chunk file size to $5 ext{ MB}$ or less

Completing precise physical mounting and manual camera settings enables stable transmission without frame re-collection even under low-light environments or high-frequency lighting.

Practical Setup for Transferring Large Files in Air-Gapped Networks Without USB

Designing a Decima Offline Transmission Environment That Passes Air-Gapped Security Audits

Prepare the 3-stage security review documentation for submission to the Information Protection Committee. Analyze visual leakage and malware infiltration scenarios through self-risk assessment, and describe that Decima operates via visible light communication and is a unidirectional mechanism that does not generate external RF radio waves. Specify the approved transmitting terminal and receiving smartphone information, and verify the pre- and post-SHA-256 verification procedures.
Build a dedicated transmission space that meets the specifications of the blackout structure. To prevent visual side-channel leakage from adjacent areas, install opaque partition walls with a light-shielding rate of 99.9% or higher and assemble a darkroom-type cage enclosing the transmitting monitor and receiving terminal. To prevent recognition errors caused by reflected light, finish the interior of the cage with matte black finishing materials.
Compare control measures by data transmission method.

Transmission Method	Physical Isolation	Transmission Speed	Security Audit Approval Difficulty	Data Integrity Verification
USB & External Hard Drive	Maintained when using control media	>100 MB/s	Very High (Prohibited at source)	Manual SHA-256 Verification
Hardware Data Diode	Complete unidirectional isolation	10 MB/s ~ 1 GB/s	Low (Meets existing standards)	Protocol Internal Verification
Decima Optical Transmission	Pure optical air gap	100 KB/s ~ 600 KB/s	Medium (Blackout regulations required)	Automatic SHA-256 & LT Fountain Code

Implementing this approval process and physical blocking specification secures a control environment that passes information protection audits while reducing hardware diode construction costs.

Optimizing Decima Configuration Values Tailored to Smartphone Camera Specifications

Set the minimum focus distance and AF state of the receiving smartphone. After measuring the distance between the monitor screen surface and the smartphone lens, align the cradle to a position without focus hunting, and activate AF and AE lock in the camera app to fix the focus and exposure. Position the QR code graphic so that it occupies 70% to 80% of the entire camera viewfinder area.
Input parameters optimized for device specs into the configuration file. For flagship terminals capable of WASM decoding at 60 fps or higher, such as the iPhone 17 Pro Max, apply tx_fps=30~60, bytes_per_frame=2331~2953, 4-code layout, and error correction L (7%). For mid-performance AP terminals, input tx_fps=20~24, bytes_per_frame=1465, and error correction M (15%). For low-performance entry-level terminals, lower it to tx_fps=10~15 and bytes_per_frame=500~1000.
Conduct fine-tuning tests aiming for a per-second decoding failure rate of less than 5%. Execute a test transmission and monitor whether worker pool dropped frames occur. If decoding errors occur, lower tx_fps in increments of 5 to reduce terminal CPU load. Repeat until the per-second failure rate stabilizes below 5%.

Applying this parameter optimization process reduces frame decoding error rates during transmission by over 80%, shortening work time.

Pre-splitting and Integrity Verification Framework to Prevent Large File Transmission Interruption Accidents

Run the pre-splitting and checksum generation script on the workstation. Use the split command in a Bash environment to divide the original file into 10 MB chunks and calculate the unique hash value of each chunk file using the sha256sum command. Automatically generate a manifest.json structure file recording the original file name, total size, chunk-specific IDs, and SHA-256 values.
Sequentially transmit the split chunks and manifest file. Transmit the manifest file first via optical transmission to load structural information into the receiving terminal memory. Render the chunk files one by one onto the Decima screen in the generated order for transmission, and keep the receiving engine automatically comparing the SHA-256 values specified in the 20-byte frame headers with the real-time restored binary.
Re-verify individual chunk integrity on the receiving terminal and reassemble them into the original. Input the received chunks into the receiving-side script to cross-check against the original hashes in the manifest. Resend only specific chunks where damage is confirmed from their original locations to prevent reset risks, and merge all chunks whose integrity has been verified.

`bash
#!/bin/bash
TARGET_FILE=$1
CHUNK_SIZE_MB=10
OUTPUT_DIR="./chunks_output"

if [ -z "$TARGET_FILE" ]; then
echo "Usage: ./split_pipeline.sh "
exit 1
fi

mkdir -p " $OUTPUT_DIR" rm -f "$ OUTPUT_DIR"/*

split -b " ${CHUNK_SIZE_MB}M" -d -a 3 "$ TARGET_FILE" "$OUTPUT_DIR/part_"

CHUNKS=(" $OUTPUT_DIR"/part_*) TOTAL_CHUNKS=$ {#CHUNKS[@]}

for i in " ${!CHUNKS[@]}"; do FILE_PATH="$ {CHUNKS[ $i]}" FILE_NAME=$ (basename " $FILE_PATH") HASH=$ (sha256sum "$FILE_PATH" | awk '{print $1}')

comma=","
if [ $i -eq $((TOTAL_CHUNKS - 1)) ]; then
    comma=""
fi

echo "    {\"chunk_id\": $i, \"file_name\": \"$FILE_NAME\", \"sha256\": \"$HASH\"}$comma" >> "$MANIFEST_FILE"

done

echo " ]" >> " $MANIFEST_FILE" echo "}" >> "$ MANIFEST_FILE"

Know-How on Physical Setup for Field Optical Transmission Environments

Fix the camera shutter speed and display scan frequency. Apply the panel effective scan frequency formula.

ext{Effective Scan Frequency} = rac{ ext{Display Refresh Rate (Hz)}}{ ext{Scan Count}}

Attach anti-reflective film and set specular reflection blocking tilt angles. Attach anti-reflective or anti-glare film without bubbles onto the transmitting monitor surface. Utilize a precision micro-jig mount to fix the physical distance between the monitor center axis and the camera lens with an error within $pm 1 ext{ mm}$ . Form an optical offset tilt angle of $5^circ sim 10^circ$ between the monitor plane and the smartphone receiving axis to completely block light glare from ceiling lighting.
Analyze field error logs and take action according to the troubleshooting guide.

Occurred Error Phenomenon & Log Message	Main Root Causes	Immediate Field Action Guide
`no-signal.ts` (Nothing happening? Hint output)	QR position recognition failure or frame reception interruption	Readjust jig distance so that the QR code fills 70% or more of the viewfinder and check AR film
`progress.ts` Persistent Frame Drop Occurs	WASM decoder CPU processing capacity exceeded (`worker-pool.ts`)	Lower `tx_fps` from 24 FPS to 15 FPS in transmission settings and reduce `bytes_per_frame`
QR frame top/bottom pixel corruption and banding	Display PWM frequency and camera rolling shutter conflict	Enter Pro camera mode and change shutter speed to $1/240 ext{s}$ or $1/480 ext{s}$
`LTDecoder.assemble()` Out of Memory Error	Single file size exceeds receiving smartphone RAM limit	Rerun split script to reduce single chunk file size to $5 ext{ MB}$ or less

Completing precise physical mounting and manual camera settings enables stable transmission without frame re-collection even under low-light environments or high-frequency lighting.

Practical Setup for Transferring Large Files in Air-Gapped Networks Without USB

Related Video

This File Transfer Doesn't Use the Internet At All (decimen)

Practical Setup for Transferring Large Files in Air-Gapped Networks Without USB

Designing a Decima Offline Transmission Environment That Passes Air-Gapped Security Audits

Optimizing Decima Configuration Values Tailored to Smartphone Camera Specifications

Pre-splitting and Integrity Verification Framework to Prevent Large File Transmission Interruption Accidents

Know-How on Physical Setup for Field Optical Transmission Environments

More from the community

사내 시스템에 llm api 붙일 때 마주하는 현실적인 한계와 대응법

레거시 백엔드에 GPT-6 Astra 붙일 때 예산 승인과 보안 통과를 먼저 끝내는 법이 있습니다

에이전트끼리 대화하다 6천만 원 청구서가 나오는 이유

사내 RAG 벡터 검색에 Okta 권한 필터를 직접 거는 방법

브라우저 에이전트에게 내 구글 계정을 통째로 넘기면 안 되는 이유

Apple Won the AI Race

Comments (0)

Practical Setup for Transferring Large Files in Air-Gapped Networks Without USB

Designing a Decima Offline Transmission Environment That Passes Air-Gapped Security Audits

Optimizing Decima Configuration Values Tailored to Smartphone Camera Specifications

Pre-splitting and Integrity Verification Framework to Prevent Large File Transmission Interruption Accidents

Know-How on Physical Setup for Field Optical Transmission Environments