Digital twins are largely used to enable the Industry 4.0 and other Internet of Things applications. This approach has been built to support the entire product lifecycle and has advantages such as interoperability, availability, and simulation capabilities. If integrated with distributed ledger technologies, such as blockchains, digital twins can augment their applications, becoming an anchor of trust for constrained IoT devices. This paper describes the Constrained Devices Management Platform, a British Telecommunications plc (BT) research system designed to enhance the security of IoT systems, with an especial focus on data provenance, immutability, and integrity. Lastly, the paper describes how semantics can enhance the Constrained Devices Management Platform (CDMP) capabilities through interoperability.
Digital Twinning can be described as a method for turning physical devices into
digital services [
One of the most prominent applications of DTs is to support the enablement of the
Industry 4.0 [
The Internet of Things (IoT) has various meanings in different applications.
However, one standard definition that is central to the concept of DT is the
provision of connectivity and data exchanging facilities to various devices for
real-time data operations [
The rapid deployment of IoT systems has delivered exceptional opportunities to
various industries, especially regarding data capture and observability. The cost of
deployment of IoT has been decreasing over time, but the attention to
cybersecurity has not accompanied the pace of IoT developments, once it is often
seen as an economic harness to the solution [
Centric to the research that British Telecommunications (BT) does on IoT systems is applying breakthrough networking technologies to enhance the cybersecurity of constrained IoT devices. Recently, the combination of DTs and blockchain has proven useful to counteract cyber threats. DTs provide four main advantages to support cybersecurity applications at a networking level: • • • •
Simulation environment. By using real-time data, the DT may
incorporate predictive analytics so that it can help to determine when an
asset is likely to fail and what are the potential consequences of such
fault. Alternatively, predictive analytics can be used to optimise the
overall system operations [
Data sharing across siloes. DT can act as a data proxy to collect data
from sensors in different environments, instead of each silo capturing
their own data, enhancing interoperability [
Real-time operations management. The digital assets create situational
awareness by building a holistic picture of the environment it represents.
By enabling real-time visibility, recommendations and actions, the users
can perform real-time operations using decisions based on data [
Availability and reliability. Because DT does not rely on the availability
of communication channels, DT provides a globally shared
understanding of what an entity looks like in near real-time [
Distributed Ledger Technologies (DLT) have their most prominent application on
blockchains. DLT is a peer-to-peer networking system where a ledger of
transactions is synchronised among peers [
Combining the aforementioned cybersecurity advantages of DT with the unique trustless and immutability features of blockchains, BT introduced a prototype platform called Constrained Devices Management Platform (CDMP). Wıth a particular focus on data integrity and data provenance for battery and network-constrained IoT devices, the CDMP reduces the networking requirements of the IoT sensors by performing the heavy security operations on a cloud service. The cloud operations include data integrity, provenance, and immutability by combining sensors digital twinning with blockchain storage and hashing operations.
The data from a sensor is transferred in a local area network (LAN) to a network gateway. Upon arrival at the gateway, the message is signed using blockchain scripts (smart contracts) where the message identifier (msgID) and the message hash (msgHash), along with other use case-specific parameters, are stored within the blockchain, and hence are immutable. The gateway will then update the DT with the latest data available. Upon retrieval, the end-user can verify the integrity and provenance of the IoT data fetched from the DT by retrieving the msgHash from the blockchain and comparing it with the hashing operation performed locally. The protocols/APIs used to exchange data with the CDMP are secured on the enhanced gateways, where outgoing communications are completed over a virtual private network (VPN).
The DT framework utilised on this technology concept was Eclipse Ditto. Ditto was integrated with a private instance of the Ethereum blockchain framework, set with a proof-of-authority (POA) consensus algorithm. With POA, the transactions could be processed quicker (in less than a second) without compromising security. POA is also very computational power and energy efficient. While providing the system the necessary immutability and verifiability, this consensus algorithm optimise the costs of deployment and operations of the blockchain. The CDMP, therefore, offers the end-users the ability to perform digital twinning of physical assets while being able to verify the integrity of the messages via crypto operations. Upon delivery, platform indicates whether the message is integral and issues an alert if it is not. In this case, the platform also indicates the unreliable link, if there are more than one signing gateway, and indicates whether the data is ready to be consumed. The diagram in Fig. 1. depicts the data flow on a generic IoT environment where the CDMP is used.
In the current platform, devices are reflected in the DT by a set of attributes and features. The attributes represent the more static properties of the device. The features, which might include a set of properties and a set of desired properties, are used to model the more dynamic aspects of the physical device. Because this framework favours flexibility, allowing the DTs to be very closely aligned with the physical asset, various data models might co-exist in the virtual world. This makes it challenging to manage a system involving many device types where data might be defined in different and even contradictory ways. From a cybersecurity perspective, identifying problematic devices or messages using a collective threat model becomes difficult, potentially requiring bespoke translation to each type of device or message, increasing the complexity of such a system. Adopting an approach based on a common ontology will help to solve these issues. One such approach would be to introduce an abstraction layer between the different devices and the DT. One example is the one employed by Eclipse Vorto1. Vorto allows the creation and management of technology agnostic, abstract device descriptions. An alternative approach would be to create a relationship between the more device-specific twins and a generic ontological representation that forms the abstraction layer. Here, the twin features would contain metadata creating a mapping to an ontology describing the device type or data type concerned. This way, the device data can be expressed in terms of one or more ontologies, facilitating querying and reasoning over the data at the ontological level. Further on, research and standardisation bodies, such as the W3C Web of Things, the Asset Administration Shell, and the Industrial Internet Consortium, define and encourage the use of standardised data models, also in the form of ontologies. Increasing the use of these well-defined data models increase the interoperability, reuse, and reliability of DT systems and would, at the same time, improve cybersecurity mechanisms. All of the aforementioned approaches would allow threat models, which describe suspicious behaviour associated with particular types of devices, to be evaluated in systems involving multiple instantiations of those device types (e.g., different manufacturers or versions). 5
This paper explored the use cases of semantic digital twins for light-weight cybersecurity, focusing on battery and network-constrained IoT devices. It discussed the Constrained Devices Management Platform (CDMP), a system leveraging the combination of DT and blockchain to provide data integrity and data provenance for battery and network-constrained IoT devices. The CDMP improves the network operations and security of IoT devices, reducing the battery and computational power requirements. The paper then discussed the impact of the semantics in DT and how interoperability is vital in an IoT cybersecurity scenario.
The next steps for the CDMP development include customer trials scheduled to start in May 2021. The DMP will incorporate the systems of the ongoing project iTrace2, and Innovate UK project with Costain, Cısco, the University of Warwick, and Senseon. i-Trace is an end-to-end cybersecurity solution using DT, 1 http://www.eclipse.org/vorto/ 2 https://www.i-trace.co.uk/ blockchain, and artificial intelligence to provide a resilient security framework to IoT devices. The use cases will likely be related to smart construction sites. The CDMP will compose the overall architecture to provide the data integrity and data provenance facilities.