Blockchain for Security in Digital Twins

Abstract

Digital Twins (DTs) have become essential tools for improving efficiency, security, and decision-making across various industries. DTs enable deeper insight and more informed decision-making through the creation of virtual replicas of physical entities. However, they face privacy and security risks due to their real-time connectivity, making them vulnerable to cyber attacks. These attacks can lead to data breaches, disrupt operations, and cause communication delays, undermining system reliability. To address these risks, integrating advanced security frameworks such as blockchain technology offers a promising solution. Blockchains’ decentralized, tamper-resistant architecture enhances data integrity, transparency, and trust in DT environments. This paper examines security vulnerabilities associated with DTs and explores blockchain-based solutions to mitigate these challenges. A case study is presented involving how blockchain-based DTs can facilitate secure, decentralized data sharing between autonomous connected vehicles and traffic infrastructure. This integration supports real-time vehicle tracking, collision avoidance, and optimized traffic flow through secure data exchange between the DTs of vehicles and traffic lights. The study also reviews performance metrics for evaluating blockchain and DT systems and outlines future research directions. By highlighting the collaboration between blockchain and DTs, the paper proposes a pathway towards building more resilient, secure, and intelligent digital ecosystems for critical applications.

1. Introduction

One of the key concepts that has evolved with the emergence of industry evolution (Industry 4.0/5.0, etc.) is the Digital Twins (DT) process, which has broad implications for numerous Cyber-Physical Systems (CPSs), including smart electricity, smart transportation, and smart cities, among others [1,2]. DT bridges the physical and virtual worlds through smart devices, sensors, databases, and process management systems, enabling seamless integration with other advanced technologies to deliver significant benefits across various industries. This is achieved by evaluating and analyzing past decisions, monitoring and regulating processes, and predicting future behaviors and outcomes [3]. Although DTs, the Internet of Things (IoT), and CPSs share similarities, they have different functionalities. CPSs focus on computing, communication, and control for real-time sensing, automated operations [4,5,6], and seamless information integration for industrial applications. IoT primarily facilitates data collection and connectivity between devices and the internet, while DTs incorporate machine learning, intelligence, and cognitive services to structure and optimize data. Moreover, DTs capture the life cycle behavior of assets, ensuring comprehensive monitoring and analysis.

The development and implementation of DTs have been positively influenced by the fast-paced growth of several cutting-edge technologies like IoT, blockchain [7,8,9], Extended Reality, cloud computing, and Artificial Intelligence (AI) [10,11]. Generally speaking, IoT consists of a network of interconnected devices deployed to gather data from real-world objects/things, creating a digital replica of a physical entity. It is projected that by 2029, over 95% of IoT platforms will support DT capabilities [12]. Cloud computing manages and retrieves data efficiently, minimizing computational load and addressing challenges in large-scale data storage. At the same time, Extended Reality technology plans digital and physical environments, allowing real-time interaction between virtual and real-world objects [13]. DTs create virtual representations of PTs, providing users with an immersive experience. Furthermore, AI improves DT by offering analytical tools for data processing, insight generation, forecasting, and problem solving [14]. DTs have found broad adoption across various industries and offer various benefits. For example, DTs improve predictive maintenance in manufacturing, reducing downtime and optimizing production efficiency [15]. Smart cities leverage DTs for infrastructure management, optimizing traffic control, and ensuring efficient management of public utilities [16]. In healthcare systems, DT enhances healthcare delivery by monitoring, treating, and diagnosing diseases of patients [17]. The key advantages of DTs include continuous monitoring, automated control, maintenance prediction, improved decision-making, and increased operational efficiency. However, as DTs become more prevalent, data integrity and privacy security concerns emerge as significant challenges [18].

To increase their efficacy and security, DTs can be connected with a number of technologies like AI, blockchain, cloud, and edge computing. Blockchain, for instance, provides a decentralized and immutable framework for maintaining and sharing large volumes of data produced by DTs [19,20]. Its transparency and security mechanisms guarantee that the data is protected against unwanted alterations. Additionally, smart contracts automate tasks within DT ecosystems, improving the efficiency of data exchanges. AI-driven analytics combined with DTs facilitates deep learning applications, enabling DTs to adapt dynamically and optimize performance. Integrating blockchain and AI within DT frameworks improves data security, reliability, and automation [21].

Despite its numerous benefits, privacy and security concerns are significant challenges in DTs. The primary issues are data integrity, unauthorized access, and system vulnerabilities. In manufacturing, malicious entities can manipulate the DT data to create false predictions, leading to production inefficiencies or equipment failures. In smart cities, unauthorized access to DT systems that control traffic or utilities can result in severe disruptions, including accidents or service outages. Similarly, in healthcare CPSs, DTs handle sensitive patient data, increasing the risk of privacy breaches if robust security measures are not implemented.

Addressing these security concerns in DTs requires innovative approaches beyond traditional security measures. Blockchain technology presents a promising solution with its key characteristics (e.g., decentralized, transparent, and immutable). It can mitigate risks such as data tampering, unauthorized access, and privacy violations. Integrating blockchain into DT ecosystems can significantly improve data protection and prevent malicious activities. Furthermore, new security architectures, such as dual blockchain frameworks [22], have been proposed to enhance secure data sharing between DTs, physical systems, and IoT applications. As DTs evolve, ensuring their security should remain a top priority. Traditional security methods may be inadequate because of the real-time synchronization between a DT and its Physical Twin (PT) through sensors and actuators, making it difficult for static firewalls and access controls to protect them against threats. Moreover, the distributed architecture of DTs, spanning edge devices, cloud platforms, and hybrid networks, makes traditional centralized security methods inefficient in monitoring or responding to privacy and security threats. This necessitates using advanced solutions such as blockchain-based frameworks to protect DT environments against cyber threats and data breaches.

Several studies have focused on blockchain integration with DTs so that data integrity, security, and transparency can be realized. For example, Yaqoob et al. [23] investigated the role of blockchain in transforming DTs for secure manufacturing, focusing on traceability and compliance across different DT levels, design phases, and core applications. Similarly, Suhail et al. [24] emphasized blockchain’s role in ensuring trustworthy data dissemination, predictive maintenance, and industrial decision-making. With an emphasis on data quality and transparency, research efforts [19] have investigated integrating smart contracts and blockchain-based validation techniques to solve vulnerabilities in DTs, tackling scalability and performance issues. Additionally, the significance of decentralized access control systems is emphasized in [25], while the usefulness of blockchain-based distributed ledgers, which lead to data immutability assurance, is further highlighted in [26]. While these studies provide an overview of how blockchain can improve data integrity in DTs, they often neglect the direct vulnerability of DTs to external attacks. Additionally, Karaarslan and Babiker [27] examined security threats targeting DTs, specifically within components, machine learning processes, and data communication. Their study proposes potential countermeasures and highlights the need for robust security frameworks in DTs. However, it falls short of providing detailed guidance on implementing these proposed solutions.

Unlike the existing efforts, our paper aims to address this gap through a comprehensive overview of different attacks targeting DTs while also exploring how blockchain technology can mitigate these attacks and ensure the trustworthiness of shared data within DTs. The major contributions of our paper are as follows:

• Providing a comprehensive analysis of various security threats faced by DTs, focusing on data integrity, unauthorized access, and system weaknesses;
• Exploring blockchain-based solutions to mitigate these risks, including secure data transmission, smart contracts, and dual blockchain frameworks;
• Comparing blockchain technology with traditional security methods, emphasizing its decentralized and immutable nature, which significantly reduces vulnerabilities;
• Reviewing common metrics for assessing the performance of both blockchain and DT systems;
• Identifying open challenges in integrating blockchain with DTs, such as scalability, data privacy, and quantum resilience, and suggesting future research directions.

To support the contributions of this study, we reviewed a total of 135 research papers published between 2017 and 2025, selected for their relevance to the topic. The papers were selected from Google Scholar using different keywords to avoid selection bias. The keywords included “Digital Twins”, “Blockchain”, “Blockchain-Based Digital Twins”, and “Security Concerns in Digital Twins”. This approach ensured coverage across multiple disciplines relevant to the study. We then refined the selection to focus specifically on papers that addressed DTs in the context of blockchain technology or cybersecurity. From the refined selection, we got 125 papers, 39 of which were survey articles.

The rest of the paper is structured as follows: Section 2 provides background information on DT and blockchain technology, including DT levels and blockchain types. In Section 3, we provide a sample architecture for blockchain integration in DT applications and discuss operational components and design trade-offs. Section 4 gives an overview of blockchain applications in DTs. Section 5 examines security threats to DTs and CPSs and proposes blockchain-based solutions to these challenges. Section 6 highlights the advantages of blockchain over traditional methods, while Section 7 discusses some of the metrics used to evaluate blockchain and DT systems. Section 8 provides a sample problem formulation for blockchain integration in a DT application. Section 9 identifies the challenges and future directions for DTs, and Section 10 concludes the paper. All acronyms included in the paper are listed in

Table 1. List of acronyms.

Acronym	Meaning
AI	Artificial Intelligence
CPS	Cyber-Physical Systems
DID	Decentralized Identity
DLT	Distributed Ledger Technology
DoS	Denial of Service
DT	Digital Twin
DTA	Digital Twin Aggregate
DTI	Digital Twin Instances
DTP	Digital Twin Prototype
HF	HyperLedger Fabric
IoT	Internet of Things
IPFS	InterPlanetary File System
MiTM	Man in the Middle
NFT	Non-Fungible Token
P2P	Peer-to-Peer
PBFT	Practical Byzantine Fault Tolerance
PDT	Performance Digital Twin
PoS	Proof of Stake
PT	Physical Twin
PoW	Proof of Work
TTC	Time to Collision

.

2. Background

2.1. Digital Twins

Researchers commonly refer to a DT as a real-time virtual representation or replica of a physical asset. This was made possible by using sensing and other sources of information to replicate the operational life cycle of the PT and effectively detect and diagnose any anomalies or deviations [28,29]. The DT concept was initially proposed by Michael Grieves in 2003 [30] during a presentation on product life cycle management. In 2003, Grieves initially presented the DT concept as a simulation model to mirror vehicles and systems [24,31], with early investigations focusing on its application in aerospace [31]. NASA produced its first DT for a spaceship in 2010 [32]. Since DT is a substantial component in the project, research into DTs became an active research and development trend in aerospace. This also further impacts information technology industries [29].

In principle, DTs use a data-oriented model to simulate or emulate various key functions of PTs constantly. This requires a DT to connect to the target PT to capture run-time information and update the state of physical objects. By doing this, a DT model can represent a PT (e.g., predicting, controlling, or even enhancing their functionality) while learning from the objects it describes. A DT not only simulates but also interacts with the PT to adapt to environmental changes, providing a sense of reassurance about its resilience. According to [33], DTs serve as tools for monitoring and predicting the behavior of things or processes throughout their life cycle and can be categorized into three types: Digital Twin Instances (DTIs), Digital Twin Prototypes (DTPs), and Performance Digital Twins (PDTs). A DTI represents the PT [34], continuously monitoring its behavior. Simultaneously, a DTP contains essential information about its PTs by simulating scenarios and conducting validation testing. These prototypes reduce costs and operational time. PDTs aggregate and analyze data from products operating under real and unpredictable conditions by generating actionable insights for process optimization, maintenance strategy development, and product performance analysis [35].

2.1.1. Digital Twin Architecture

A DT system consists of three key components: a PT, a DT, and data transmission infrastructure. Figure 1 shows the general architecture of a DT system. The physical space of a DT serves as its core foundation [36]. A DT creates a virtual replica of its PT to simulate/emulate systems and further analyze their behavior. This space consists of real-world objects, including components like cameras, equipment, sensors, and systems responsible for collecting data associated with the object’s physical measurements. It supports various users and can model real-world systems (smart manufacturing, smart grid, smart transportation, etc.). However, the operational environment may evolve as the physical system operates over time. In most applications, the two key physically interconnected components are sensors and actuators, which are fundamentally opposed yet frequently work together. While sensors monitor system states and transmit signals when something changes, actuators interpret these signals and execute corresponding actions. Sensors generate substantial operational data, typically gathered in a temporal-spatial format, represented as multi-channel sensor data, which is stored in a data repository [37].

The virtual space in a DT system is used as a real-time duplicate of the physical environment, representing its characteristics and actions. Its input is PT data that has been gathered and processed. The preprocessing phase involves several steps: cleaning, deleting unnecessary data, transformation, data reorganization, and scaling. This produces a high-quality dataset that is then used to build the DT-based system by using either deep learning or first-principle models. This type of DT system development can help visualize the physical space in real time, carry out time-series forecasting to determine the component’s remaining life [38], spot anomalous patterns [37], detect faults, and many more aspects through continuous monitoring.

The communication infrastructure of a DT connects the physical and digital worlds, facilitating interactions in production activities through seamless information exchange and workflow. For example, Grieves [31] emphasized the value of bidirectional connections in DT systems, where a DT interprets data from PTs to produce insights that may be put into practice and communicated back to the DT. Through this process, a digital thread that links the physical and virtual domains is created. Key examples of this communication include synchronizing virtual models with their physical counterparts to maintain consistency, detecting intrusions by comparing real-world data with processed insights, and implementing configuration rules to modify the behavior of PTs. This dynamic connectivity sets DTs apart from conventional simulators that cannot integrate in real time with the physical world. While the previously mentioned components are more common, previous works have presented DT parts from a five-dimensional viewpoint. DTs have five dimensions: physical assets, virtual assets, data, services, and connections [39]. In particular, the components of a DT may differ according to the application and sector.

2.1.2. Digital Twin Functional Layers

DT technology may have several layers based on the application specification and desired level of granularity [40,41]. In most cases, a DT is primarily comprised of four layers: physical, data, model, and application, as shown in Figure 2. Every layer has a unique role, and together, they ensure accurate representation, seamless data flow, and effective utilization of the DT. The physical layer refers to the real-world PT being observed. The data layer is responsible for collecting and storing data from the PT. This data is then processed in the model layer to create a digital representation of assets, making forecasting, analysis, and simulations easier [42]. Apart from the four layers mentioned above, other layers, such as the analytics layer, can be added based on the purpose of the DT. We now provide a more detailed description of each layer’s roles and operations.

2.1.3. Physical Layer

The physical layer provides a foundation for any DT architecture and consists of a PT that the DT aims to model. PTs could be anything from individual components, like cameras and sensors, to complete systems, like infrastructures, vehicles, or biological entities [43]. The definition of a PT varies across applications and can include devices, equipment, or materials. A single PT might consist of multiple smaller components, which can be PTs themselves. For example, an automobile (a bigger PT) can include (smaller PTs) an engine, transmission, and wheels. These physical entities can be interconnected, forming complex systems like smart cities, power, healthcare, and transportation systems [44].

Sensors and actuators are integrated to collect real-time information from a PT and its environment and receive control signals to execute specific tasks. Various sensors are used to monitor the environment and gather real-time data, sensing and quantifying the operational states of the PTs.

For IoT systems, it is crucial to accurately monitor the operational state of a PT. Thus, sensing technology must leverage accurate physical measurement techniques and consider techniques like data fusion or integration. To synchronize the PT and DT, there needs to be a periodic transfer of state information; this information can be obtained and sent out directly from the sensors and actuators present on the PT. A distributed sensor network, deployed internally or externally, ensures the reliability and controllability of the equipment by determining the precise location and unique identity of each target [45].

2.1.4. Data Layer

The data layer involves continuous, bidirectional data flow between the PTs and DTs. This layer handles data that is ready for analysis and long-term storage in knowledge repositories, which contain rules, operational logic, and past records of the system or entity. The substantial amount of data generated from PTs in this layer shall be mapped into meaningful information through big data analysis, complex system models, and advanced machine learning techniques. These data-centric methods support key functions such as monitoring, simulation, recognizing faults, and testing solutions, leveraging techniques such as parametric models from regression and system identification. Furthermore, deploying advanced ML techniques and AI significantly enhances the system’s analytical and decision-making capabilities [46]. The processed sensor data supports simulation models and enhances understanding and accuracy [47].

2.1.5. Model Layer

The model layer is responsible for data modeling. It leverages digital models to define states, behaviors, and many more [42]. This layer is essential for identifying and resolving cybersecurity problems. It logically represents the elements, operations, and characteristics of a PT by structuring and organizing its data. The model layer enhances the understanding and analysis of the physical system by integrating data from multiple sources (e.g., sensing data and simulation results) [48]. The layer also consists of the life cycle, behavior, and logical models that leverage information from the data layer to offer insights on actions, predict failure, and detect real-time state changes. These insights are then implemented as maintenance operations and service strategies in the physical layer. Additionally, insights and recommendations are generated and kept in the data layer’s repositories, including evaluation reports and historical data for future DT analysis cycles [47].

2.1.6. Application Layer

This layer is related to the software systems’ components and is primarily used to display models and insights generated by the data analysis layer within specialized application software. Inbuilt applications can vary significantly depending on the infrastructure. In most use cases, multiple applications run simultaneously on a single personal computer [49]. It is tailored for clients, operators, and institutions, allowing different levels of data access and service delivery across the operational systems of the DT. The layer provides data access and feasibility analysis for operators and agencies. At the same time, users can view specific analysis outcomes and decision details and, in some cases, control the actions of the PT, such as emergency interventions [50]. Through this layer, users can also submit service requests, adjust access permissions, and interact dynamically with the DT to facilitate effective human–computer collaboration.

2.2. Blockchain Technology

In the digital era, blockchain has become a crucial technology offering authentication and authorization capabilities, reducing reliance on multiple centralized administrators. It streamlines the establishment of new internet connections, serving as the foundational layer for transactions on the Internet of Value [51]. It is designed to store transaction records in block format built upon databases, commonly known as Distributed Ledger Technology (DLT), which are connected with blocks close to them to make a secure chain. This process operates in a network that is Peer-to-Peer (P2P). A duplicate of the ledger will be stored on each P2P network node [7,20,29]. The blocks are linked by cryptographic techniques to form a secure chain, ensuring data immutability since recorded transactions cannot be altered. The integrity of the ledger is preserved by recording any updates or changes. This creates a continuous, unbroken chain where no block is removed, and all nodes in the network can access the duplicate ledger. The shared ledger records the transactions of these nodes with their timestamps. When new transactions occur, they are added to the shared ledger and automatically distributed across the network. This method reduces the time and effort needed to safely record transactions on the blockchain and avoids data replication.

The goal for this architecture is to have transparent and decentralized data storage that cannot be altered while supporting models that have specific use cases. On-chain and off-chain are two different methods of data storage on a blockchain. In on-chain storage, data is recorded in the ledger and is made available to all network users, while in off-chain storage, a range of storage technologies are used, such as distributed or centralized [52]. The unspent transaction output model, for instance, is used by Bitcoin to manage accounts, making it well-suited for transparent financial transactions. Ethereum, on the other hand, adopts an account-based model [53] that maintains state, ideal for smart contracts and applications such as decentralized finance and Non-Fungible Tokens (NFTs). However, storing large amounts of data directly on-chain is expensive and inefficient. To address this, many applications use storage solutions like Filecoin or InterPlanetary File System (IPFS), which are off-chain, to store large files while using hashes to reference them on-chain [54]. A typical example can be found in NFT platforms, where large files are stored off-chain, while ownership is tracked on the blockchain. In supply chain systems, Hyperledger Fabric (HF) is often used, which offers a modular, private architecture for securely storing transactional data across nodes. This multi-layered data storage approach helps blockchain maintain a balance between security, efficiency, and scalability across various applications. Data on the blockchain is managed efficiently through smart contracts. They consist of specific pre-programmed conditions written in code that are automatically executed and directly enforced by the smart contract [55]. Once the requirements are satisfied, actions are initiated and executed independently. This functionality supports processes like identity authentication and real-time data inputs [56]. The network’s efficiency, transparency, and trust are guaranteed by the independent implementation of these rules and the blockchain’s tamper-proof nature [57].

Blockchain systems inherently prioritize security through asymmetric cryptography, employing both public and private keys. While public keys are openly accessible, private keys are hidden, and only their respective owners can access them. These keys help validate transaction ownership and ensure the immutability of transactions [58]. Security within blockchain systems encompasses integrity, confidentiality, and transaction authorization [59]. The decentralized characteristic of blockchain, facilitated by a P2P consensus mechanism, helps mitigate the single point of failure [59]. This is a stark contrast compared to centralized storage systems, which are considerably more susceptible to compromise.

2.2.1. Types of Blockchain

To serve diverse applications, blockchains have several architectural types. The choice of architecture relies on the rules regulating the nodes that can access, verify, and validate transactions started by other nodes. The main blockchain architectures are: public, private, or hybrid blockchains, as shown in Figure 3.

Public blockchain: A public blockchain operates on the principle of a public ledger, where every transaction is securely recorded in a decentralized manner without intermediaries. This blockchain model, represented by cryptocurrencies like Bitcoin, relies on consensus mechanisms to validate and authenticate transactions [51]. The emergence of cryptocurrencies and their proliferation have led to the advancement of public blockchains, expanding their potential applications across various industries. Recent research suggests that public blockchain technology will play an important role in future IoT applications, underscoring its versatility and relevance in diverse sectors [60]. These technologies hold great potential for improving security, transparency, and efficiency in IoT ecosystems and other areas.

Private blockchain: This type of blockchain prioritizes security by imposing restrictions and guidelines on who can access and contribute data. They offer varying levels of access control and ensure that only users with access can edit or view specific information [61]. There are several types of blockchains within the realm of permissioned blockchains. Each type has its access privileges. In Type I, only authorized users can read their data. Type II allows all users to read and verify their data. Meanwhile, in Type III, any user can input information, but only authorized individuals are allowed to view it [62].

Hybrid blockchain: A hybrid blockchain offers users a high degree of customization, enabling them to select which transactions are public and determine who can access and use the blockchain network [58]. The core concept of blockchain and its diverse consensus mechanisms have paved the way for a myriad of applications. The transformative potential of blockchain technology is underscored by its ability to solve practical problems and transform various industries [51]. Blockchain technology is being applied across various industries, including healthcare, manufacturing, system management, sports analysis, and accessibility.

2.2.2. Blockchain Consensus Mechanisms

Consensus mechanisms are an important component of the blockchain system. They are introduced to guarantee fault tolerance in transaction verification. Their primary function is to maintain a consistent and reliable agreement across all nodes within the network [63]. Since blockchain systems are dynamic and decentralized, an effective consensus mechanism is required to preserve transaction integrity and facilitate collective agreement among participants. The choice of the specific consensus to use can directly impact the functionality and security of the blockchain. Over time, various consensus algorithms have emerged, each with its own guiding principles and customized to meet specific use cases and system specifications. In this section, three of the commonly used consensus mechanisms will be briefly discussed below:

• Proof of Work (PoW): This is a type of blockchain consensus mechanism that uses cryptographic methods and a significant amount of computing power to ensure integrity and network consensus. In PoW, finding a valid solution is challenging, but it is easy to verify that solution. In this mechanism, participants continuously try to find a valid hash by altering a variable called a nonce [64] in the block header until they generate a hash value that meets or falls below a specific target defined within the block header. All participants in the network engage in this process, and once a participant finds a valid hash, others must verify its correctness. The set of transactions used to compute the valid hash is considered and added as a new block to the blockchain. The participants are referred to as ‘miners’, and the process is referred to as mining. Since mining is resource-intensive and time-consuming, miners get rewards to encourage participation. Occasionally, two miners may generate a valid block simultaneously, potentially leading to a temporary split in the blockchain known as a fork.
• Proof of Stake (PoS): This is a kind of consensus that was introduced as a substitute. This mechanism chooses validators to generate new blocks by considering how much cryptocurrency they have locked up in the system or staked. A validator is randomly chosen to validate the data within a block; the likelihood of being chosen increases with the number of tokens staked. Once the block is successfully validated, the chosen validator receives transaction fees as a reward, and the cycle begins again. Since PoS relies on validators who stake their tokens, this helps ensure the network’s security and integrity. To discourage negligent behavior, slashing [65] is used to penalize and remove underperforming validators. With this method, hardware costs and energy usage are reduced, allowing validators to earn rewards through honest participation. One shortcoming of PoS is that it can potentially lead to centralization and make the network vulnerable to long-range attacks [66] if a node accumulates a large share of the total currency.
• Practical Byzantine Fault Tolerance (PBFT): This algorithm effectively achieves consensus in distributed systems. PBFT is specifically designed to address Byzantine failures where nodes in the network may crash, fail to respond, or deliberately provide incorrect information. It maintains security and functionality if not more than one-third of the total nodes are faulty [67]. It relies on a structured voting process among all participating nodes to reach consensus. The network adds a block to the ledger only if it secures consensus from more than two-thirds of its nodes [65]. This voting-based mechanism ensures fault tolerance and strengthens the system’s integrity, making PBFT suitable for DT environments where reliability and security are critical.

2.3. Advantages of Integrating Blockchain with Digital Twins

Blockchain for DT is a concept that builds virtual replicas of real-world objects using blockchain technology. Blockchain is an emerging technology that commonly operates on a P2P network characterized by distributed storage and encrypted algorithms [68]. This framework employs a consensus protocol to enable secure information sharing and storage among diverse participants within a DT system. By leveraging blockchain, the DT environment establishes a decentralized platform where participants validate and authorize transactions, ensuring the integrity of shared data while promoting operational transparency and information security. DT requires blockchain because it offers numerous advantages, such as the following:

2.3.1. Digital Uniqueness

To ensure the digital uniqueness of DTs, blockchain leverages its core features such as immutability, decentralization, and encryption. This is achieved by securely connecting PTs to DTs using cryptography to generate a signature [69], assign unique identifiers to each DT, and use smart contracts to enforce and verify conditions [70]. Through tokenization, blockchain can represent DTs as NFTs because they ensure the verifiable identification, control, and integrity of the DT. After a token is minted, its data is permanently inserted into the blockchain and cannot be changed. This approach enables traceability of the processes of DTs through on-chain logs by assigning each token a distinct Token ID [71]. Blockchain’s decentralized architecture removes the need for a centralized authority and makes it impossible for any participant to change or duplicate the twin. Additionally, consensus mechanisms validate every transaction or update across the distributed network, ensuring the integrity and uniqueness of data.

2.3.2. Distributed Infrastructure

The life cycle of a DT spans multiple phases, involving various stakeholders who may be engaged in various activities at different locations. A centralized data management system is often not well-suited for a distributed environment such as this. Furthermore, disjointed databases hinder smooth orchestration of the DT life cycle, which requires seamless data integration across various life cycle stages with trustworthy assurance [72,73]. To address this challenge, blockchain can provide a decentralized approach to data storage, prevent the requirement for a single point of control, and foster trust and collaboration among participants. In this setup, not only can the data from the DT itself be stored, but information from other sources can also be securely recorded and accessed across multiple entities or tiers via the blockchain ledger [24].

2.3.3. Securing and Tracing Digital Twin Data

One of the significant concerns of DTs is in safeguarding data privacy, as they handle extensive data collection, processing, and storage, often involving sensitive information. The rise in digitization and connectivity introduces new vulnerabilities, highlighting the importance of DTs relying on trusted data. With its immutable and tamper-proof characteristics, blockchain technology can secure data acquisition across multiple entities, ensuring data integrity and reliability [74]. Its cryptographic mechanisms preserve an unalterable record of DT creation and access transactions. Additionally, using pseudonyms, like public keys, enhances transparency and privacy. This approach enables the secure exchange of DT data with non-trusted individuals at any stage of the DT process, while maintaining confidentiality, integrity, and availability.

2.3.4. Accessibility and Safeguarding Life Cycle Data

DTs are essential in different sectors, allowing access and modifying data, governed by access rights. Data in DTs can only be viewed by authorized entities, with modifications restricted to those with proper permissions. Blockchain-based access control enforces these policies and maintains a history of modifications, thereby mitigating risks of unauthorized changes and related security issues. DTs also require the ability to correlate various DTIs, which mirror individual PTs, into a Digital Twin Aggregate (DTA) that represents a thorough view of the physical system [75]. While DTAs are crucial for holistic insights, they are also high-value targets for cyber attacks, potentially exposing entire product lines to breaches or malicious states. Blockchain secures DTs within DTAs by ensuring only authorized entities can modify data while preserving integrity and trust.

3. Blockchain-Based Digital Twins Architecture

Integrating DTs with blockchain consists of interconnected layers, each performing distinct roles. In most blockchain-based applications, the system will consist of the PT, DT, blockchain, application, and analytics layers, as shown in Figure 4. In real-time operational DTs, data is continuously collected from their corresponding PT through sensors and IoT devices [76]. Edge devices are used to perform local processing to minimize latency and offload cloud resources. Real-time DTs are useful in scenarios where fast decision-making is crucial, such as in autonomous vehicles, smart city infrastructures, and industrial manufacturing systems. In contrast, some DTs do not require live data from the PT if it is needed only for simulation or if the physical asset is at the design level. These DTs are primarily used for testing, analysis, and performance evaluation under controlled conditions. For example, simulating a vehicle’s behavior to test design changes or check its performance under certain environmental conditions. These simulations typically run on cloud platforms or local machines and do not interact with the live environment.

Regardless of the DT type, data is usually preprocessed and filtered before being sent to the blockchain. Real-time or locally processed DT models can use different ML algorithms depending on their application. For instance, data-driven models, such as Long Short-Term Memory (LSTMs) or Graph Neural Networks (GNNs), are commonly used in time-series forecasting and behavior modeling. When integrating blockchain with DTs, the focus is on securing the data and maintaining its integrity. This is achieved through cryptographic methods like encryption and digital signatures to ensure that each transmitted piece of data can be uniquely identified and verified. Once signed, the data is transmitted to the blockchain via APIs. The blockchain layer then ensures data is stored securely and transactions are verified through digital signature validation and decentralized consensus mechanisms.

The required blockchain model can be either public, private, or hybrid. The choice of the type of blockchain to use depends on different factors like level of trust and privacy, access control, and performance expectations. The blockchain is operated by a group of connected participants, depending on the architecture used. In public blockchains, any participant can be a node or validator, which makes them not ideal for DTs, where privacy and scalability are important. They can be used in situations where complete decentralization is required and people’s trust is not an issue. Private blockchains are more commonly used with DT applications; they are operated by an individual company or a group of trusted people who control access to the network and operate the nodes. In hybrid blockchains, some of the data is connected to publicly accessible chains for transparency and auditing [77], but the main operations are conducted privately. They are operated by multiple organizations, such as stakeholders in an industry that work together to manage the blockchain, sharing responsibilities and securely sharing data. For example, using a private blockchain in the manufacturing industry, the blockchain is operated by the factory, maintenance partners, and suppliers, ensuring data integrity and traceability in performance logs, supplies, and maintenance. The use of smart contracts can further enhance the integration of blockchain with DTs. Their self-executing characteristic autonomously enforces specified security and operational regulations without requiring human interaction [78]. In the context of DTs, smart contracts can verify the integrity of sensor data, continuously ensuring each digital replica is accurately and securely monitored. This is achieved by verifying the signed data sent from the DTs by checking the timestamp, data format, and DT status. If the data passes these checks, they are then logged onto the blockchain within the distributed ledger, enabling transparent audits and accountability.

The application and analytics layer includes off-chain processing, cloud storage, data optimization, and visualization. Processes that require high computational power, such as large-scale data analysis, predictions, and historical data archiving, all occur off-chain to maintain blockchain efficiency. Data that includes public keys, timestamps, transaction hashes, and digital signatures used to verify the authenticity of data submissions [79] and event logging is stored on-chain. Analytics results and tracking assignments that are produced off-chain are cryptographically signed, submitted to the blockchain, and verified through smart contracts.

However, having widespread blockchain integration and operation in DT environments remains a design challenge and has several trade-offs:

• Latency and immutability: Blockchain transactions that result in data immutability and trust add delays, whereas in DT environments, these delays might disrupt the frequency of DT-PT updates, which in turn might impact time-sensitive decisions. For example, Ethereum finality takes between 10 and 60 seconds, whereas industrial DT operations take milliseconds.
• Data storage and cost: If the blockchain requires on-chain storage, the frequent DT updates that need to be stored will incur significant costs. For example, storing 10 MB of data on Ethereum on-chain costs hundreds of dollars in fuel.
• Complexity and trust: Introducing blockchains into a DT application ensures data integrity, but it adds several other components like smart contracts, consensus layers, and ledgers, which add a lot of operational and architectural complexities. This might require a significantly higher development overhead and also scalability issues.

Therefore, many researchers are exploring blockchain integration in DT applications at a granular level for smaller problem contexts and then scaling up. A few such solutions are covered in Section 5.

4. Security Attacks and Privacy Concerns

This section explores various security attacks and privacy threats that endanger the DT system’s availability, reliability, and confidentiality. Understanding these security threats is essential for developing robust defense mechanisms and strategies to safeguard Digital Twins against malicious activities.

4.1. Attacks on Digital Twins and CPSs

DTs facilitate the development of effective services, the monitoring of industrial processes, and preventative maintenance. Their primary foundation lies in distributed networks that connect various IoT devices. DTs can assist such systems in resolving operational difficulties promptly compared to traditional trial-and-error methods [23]. Nevertheless, inadequate security measures for DTs and their linked data may leave private business data vulnerable to loss or improper use. Unprotected DTs are susceptible to exposing sensitive operational, security, and design data to hostile parties, which could have a catastrophic impact on any sector. Such attacks can be launched either directly on the DT or through the CPS. Both CPSs and DTs are vulnerable to simultaneous attacks, as attackers can exploit the information provided by DTs and knowledge of the actual physical processes as well. These attacks can be either physical (targeting the PT) or cyber-based. Some examples of such attacks include the following:

• Physical damage: If a DT is compromised, attackers could gain insight into the physical system’s configuration and potentially access important resources through the DT [80]. This information can be leveraged to breach individual privacy or launch cyber attacks. Cyber attacks on critical infrastructure data can significantly impact physical processes, disrupt control capabilities, and much more.
• Single point of failure: Attackers may attempt to destroy critical devices or servers, posing a single point of failure. This disruption can impact the regular operation of DT services, affecting core functionality such as optimization and monitoring, and ultimately destabilize the entire system [81].

4.2. Attack on Digital Twin Operation Modes

A CPS does not have to be fully replicated in DTs [82]. Reasonable feature generalizations or simplifications are possible if they maintain context awareness since the virtual copy in DTs replicates the operation of relevant processes or equipment at a decided level of granularity [83]. More specifically, creating DTs is intended to offer an affordable means of testing the physical system as opposed to emulating the system. The precise depiction of DTs requires frequent updates on the state information from PTs. This increases the probability of an effective attack. The attacks here can be categorized based on the operation mode of the DT and the nature of the attack: active or passive.

Active attack: These attacks are generally targeted at the “Replication mode”, which involves recording an event on a real system first and replaying it at the DT level while imitating the system’s behavior [84]. Here, the PT and DT must be synchronized by a network connection, log files, or sensor data for the DT to accurately represent its PT [85]. By combining the data from the current state with the system specifications, a DT can stay in continuous communication and obtain timely updates from its PT. Attacks in this mode are active because the attacker interferes with the active communication and/or data exchanges between the DT and PT. To take advantage of the replication mode, an attacker must remain active and adhere to explicit or implicit attacking points to avoid issues. Any interference with the synchronization among DTs and PTs is an example of an active attack.

Passive attack: These attacks are usually targeted in the “Simulation mode”, where there is no direct connection between the PT and the DT present in a separate virtual environment. The inputs are user-specified settings and parameters. It can be directly employed or customized to the attacker’s requirements in simulation mode, as it is reproducible using trial-and-error [84]. Attacks in this mode are typically passive, where attackers may not directly alter the system; instead, they observe the system’s behavior in the virtual environment. An attacker may expose underlying system patterns by restarting the simulation and exploiting the virtual environment’s security tests. Additionally, attackers can passively observe the system’s state to learn how to exploit the weaknesses of a PT in a risk-free setting and plan for future attacks on the PT. Simulation mode commonly operates independently, which prevents attackers from launching automated attacks because it lacks a continuous feedback process.

4.3. Attacks on the Digital Twin Layers

DTs face different privacy and security challenges due to their layered architecture. Each layer represents unique vulnerabilities that attackers can exploit. Attackers here can be a rogue employee, an outsider, or even a compromised third-party system, each with varying access levels and intentions to disrupt, steal, or manipulate data within the DT environment.

4.3.1. Physical Layer

The physical layer is particularly susceptible to attacks, such as the following:

Physical tampering and sabotage: Here, the attacker targets hardware components like sensors, actuators, or the PT. For instance, attackers can easily intercept data from wireless sensor networks, especially when the transmission is not encrypted [86], thus eavesdropping on sensitive information. In some cases, they may damage or replace a sensor’s hardware, gaining unauthorized access to the system and extracting sensitive information [40]. Moreover, they can deploy fake sensors to mimic legitimate ones, enabling them to bypass security measures and impersonate authorized components of the system, further affecting the integrity of the network [87]. These physical security breaches can undermine the reliability and trustworthiness of the DT.

Man-in-the-middle attack (MiTM): This is a well-known method of cyber intrusion, which allows an attacker to insert themselves between the PT and DT, as shown in Figure 5. This can be either through listening or aggressively impersonating one of the endpoints [35]. For example, bandwidth sniffing is a type of MiTM attack where the attackers try to obtain information on the devices present and their weaknesses. They can also pinpoint security breaches. Vulnerabilities in the CPS and its DT may be exploited, leading to the unlawful retrieval of private information. Attackers can use network packet interception and activity monitoring to determine whether CPS components are operational or determine CPS activity from the bandwidth utilized by the system to communicate with its DT. Even if the network packets are not fully encrypted or parsed, attackers could infer potential protocols from the bandwidth between the CPS and the DT [88]. Once network communication has been effectively intercepted, attackers can learn how the CPS interacts with the DT.

4.3.2. Data Layer

The attacks on the data layer are performed with the intention of compromising data and network security. This includes attacks such as data poisoning, eavesdropping, and data delay attacks. Here, attackers can eavesdrop on conversations across open ports, unprotected wireless connections, or data transfers [89].

Data poisoning: This refers to a wide range of attacks where an attacker provides non-trusted data [87] to the DT or PT. The data is processed and executed, which can pose data theft, loss of data integrity [90], Denial of Service (DoS), and complete system compromise. Data injection attacks and model attacks are some examples of data poisoning attacks [91,92]. Through data injection attacks, the adversary has the potential to take over the CPS by sending false directives to the PT on behalf of the DT. Furthermore, attackers can trick the DT by sending packets to mimic the current state of the CPS [86]. This kind of attack can confuse and lead to incorrect DT modeling and operation.

Data delay attack: A key component of a DT is real-time synchronization between it and the PT. In these attacks, adversaries try to sabotage this synchronization by introducing communication lags, as shown in Figure 6. The attacker sends the red packets to cause traffic delay, while the blue packets are normal traffic data. This leads to bottlenecks in network utilization, affecting both the PT and DT behaviors and service impacts [86]. In this case, attackers do not need to comprehend the system features or protocols. This attack is similar to a DoS attack.

4.3.3. Model Layer

Attacks in this layer are targeted towards DT modeling. This includes tampering with aggregated data in the virtual world, misinterpreting PT behaviors, and manipulating false simulation rules or injecting false models completely. This can lead to DTs making incorrect decisions that can have varied levels of impact depending on the level of DT integration. Some types of model layer attacks are the following:

Model poisoning attack: DT models can be corrupted by directly inserting malicious code into the synchronization logic, leading to inaccurate state representations and actuator feedback [93], as shown in Figure 7. If an attacker manages to access the DT environment, they can browse system repositories and code and inject malicious code to tamper with DT modeling. With these attacks, a DT will no longer be able to represent its PT, thus leading to inconsistent results. Model poisoning attacks are particularly tricky to address due to their nuanced nature, making them difficult to detect. These can only be revealed through strategic examination of the data and code repositories or when one performs operations on a compromised DT.

Model evasion attack: DTs are at serious risk from adversarial attacks due to their reliance on machine learning models to simulate and predict real-time behavior. Contrary to model poisoning attacks, which alter training data by adding malicious inputs that reduce model accuracy, model evasion attacks [94] target pre-trained models [95] inside the infrastructure of the DT and use inference capabilities to misclassify data or overlook significant anomalies, as shown in Figure 7. Applications, including smart manufacturing, transportation, and smart grids, can be dismantled if their DTs are compromised; therefore, it is crucial to protect the model layer against these attacks and create robust DTs.

4.3.4. Application Layer

The application layer of a DT dictates how the user interacts with the system and also serves as a visualization platform, providing key system insights. An attack in this layer can be targeted directly at users, tricking them into interacting with malicious components or towards the system itself by hijacking sessions and inserting wrong user information. These include attacks on user interfaces, APIs, and access control mechanisms. Some attacks common to this layer are the following:

Session hijacking: This is a common threat in the application layer of a DT because an attacker attempts to establish a genuine connection between the application user and the server to carry out malicious activities. This can lead to phishing, where attackers pose as reputable organizations to collect private data, and malware attacks, where malicious software is installed on the victim’s device through session manipulation using the DT environment, as shown in Figure 8. If an adversary obtains access to the session cookie [96], he/she can impersonate the legitimate user and obtain unauthorized access to sensitive information and control functions. The risks and potential consequences can lead to the attacker gaining control over the PT, data theft, data tampering, and ransomware attacks.

Backdoor attack: A backdoor attack is when malicious or unethical manufacturers include compromised components or code in PT software or hardware [80]. This backdoor can allow attackers to alter or access private information within the DT environment, as shown in Figure 8. For instance, a manufacturer can insert a backdoor into software accessed by DT users, enabling unauthorized control of the DT through the software or the PT. This could compromise the security and reliability of the DT by causing malicious changes to system operations, disruptions in processes or activities, and data exfiltration. Figure 9 shows a summary of the security and privacy concerns discussed above.

5. Blockchain Solutions for Digital Twins

Since DT data is an essential source for the physical operations of a CPS, a DT needs to be constructed using reliable data [62]. In this regard, blockchain-aided DTs enable businesses to manage data on a DLT while ensuring dependable and secure sharing of DT data among involved parties [8].

Table 2. Blockchain-based solutions for DTs.

Reference	Solution Type	Domain	Year
[97]	Data Authentication	Blockchain and DT	2023
[98]	Data Authentication	Blockchain and DT	2024
[99]	Data Authentication	Blockchain and DT	2024
[70]	Smart Contract	Blockchain and DT	2020
[29]	Smart Contract	Blockchain and DT	2023
[100]	Smart Contract	Blockchain	2023
[101]	Smart Contract	Blockchain and DT	2024
[102]	Decentralized Identity	DT	2024
[103]	Decentralized Identity	Blockchain and DT	2025
[70]	Smart Contract	Blockchain and DT	2020
[104]	Data Provenance	Blockchain and DT	2025
[84]	Gamification	DT	2020
[105]	Gamification	Blockchain and DT	2023
[106]	Gamification	DT	2023

shows a summary of the blockchain-based solutions discussed in this section and their domain.

5.1. Data Authentication

The life cycle of a DT involves multiple stages and numerous parties, each with different roles and responsibilities. This multi-party use impacts access control, availability, and the integrity of the DT [62]. Blockchain technology offers an effective solution for managing data distribution among these numerous entities by creating a distributed and secure infrastructure that enforces corporate policies and access permissions, ensuring that only authorized entities have access permissions (access, read, or write operations) to the DT. This control is crucial for mitigating reconnaissance attacks, where unauthorized entities attempt to gather system information. By utilizing blockchain’s authentication mechanisms, each sensor and device can have a unique blockchain fingerprint, making it difficult for malicious entities to impersonate legitimate sensors.

These principles are exemplified in various blockchain-based frameworks. In the aerospace-related application, Aggarwal et al. [97] proposed an advanced blockchain-based authentication scheme, which provides enhanced privacy, data verifiability, and resistance to discrete attacks in aeronautical settings. The scheme ensures identity verification and data confidentiality between the DTs and their corresponding PTs. The application of this scheme in aerospace systems can be challenging due to the need for consensus and synchronization processes that can be difficult to maintain in environments where aircraft experience intermittent connectivity. Gautam et al. [98] investigated a blockchain method for authentication in vehicular DT networks, ensuring secure data authentication between vehicles and their DTs and among DTs. Authentication in vehicular DTs is critical because of the large number of vehicles involved. Scalability is still a major issue in blockchain-based DTs, especially in real-world situations with high mobility and high transaction volumes. Performance and scalability in these situations can be improved by partitioning the blockchain network into multiple chunks, where each chunk will manage a specific group of vehicles or geographical areas. Another problem is latency, which may affect communication between vehicles and their DTs due to blockchain confirmation delays. Using blockchain primarily for audit logging and managing trust relationships can help mitigate latency issues. Moreover, important authentication procedures should be carried out off-chain, and the blockchain should be updated regularly. Similarly, Dai et al. [99] developed a blockchain-empowered data access control scheme for DTs, leveraging mechanisms (i.e., Attribute-Based Encryption (ABE) and IPFS) to ensure a tamper-resistant architecture and efficient storage. These studies demonstrate how blockchain technology can revolutionize the security of DT systems, ensuring data integrity and enabling efficient authentication mechanisms. Leveraging ABE with blockchain offers an innovative approach to safe and secure data sharing while managing access, but it can introduce trust concerns. This is because the key authority knows users’ privacy keys, creating a potential single point of failure. These can be avoided through distributing trust by using approaches like decentralized ABE.

In practical applications, blockchain can facilitate the authentication of data exchange between the DT and CPS. For instance, the PT generates a blockchain fingerprint for the data files before sending them to the DT. If an external adversary steals and corrupts the data, the DT can detect tampering by verifying the absence of the blockchain fingerprint and rejecting the compromised data [107]. This process is further enhanced by timestamping each block in the blockchain and authenticating the data source, destination, and participants involved, as well as timing and tracking the data exchange method [108]. These measures establish high trust and security in data transmission since data can only be decrypted by authorized entities, mitigating eavesdropping and MiTM attacks. Additionally, the blockchain’s secure and immutable log of all interactions enables the detection and prevention of node tampering by immediately flagging any unauthorized changes. The framework presented in Section 8 serves as a practical example of integrating blockchain with DTs to enable data authentication by utilizing blockchain.

5.2. Smart Contracts

Smart contracts enable the automation of application-specific scenarios by executing code within a blockchain. As mentioned in [73], smart contracts can be integrated into the DT environment to represent twin creation transactions, track data-sharing processes [8], and maintain permission information for all involved entities [73,109]. Furthermore, smart contracts’ adherence to predetermined parameters makes them a better option for scenarios where a state change enforces automation, such as when safety and security rules are activated and programmable logic controller functions are called upon.

Iyer et al. [100] used three smart contracts: DataImage, Dataset, and DatasetManager, to ensure the accuracy and secure handling of machine learning datasets through a voting system, user upload incentives, and blockchain authentication. This entire framework was deployed on an Ethereum blockchain application named SeBRUS. These smart contracts addressed various data poisoning attacks, including backdoor attacks. Although the application was not successful in completely obliterating data poisoning attacks, it significantly decreased the possibility of successful attack execution. Additionally, by ensuring dataset integrity, the method can be used to reduce some risks of model poisoning attacks by preventing malicious data submissions and providing data transparency. While the framework was successful in maintaining the unchangeable nature and trackable history of all data interactions, its trust layer can play a vital role in real-time telemetry, like in DTs, to prevent spoofing or data tampering. However, this framework may not be suitable in DT scenarios where high-frequency or continuous updates are essential for real-time simulations or predictions. Instead, it is better suited for DT applications that are not time-critical, where it can serve as a secure data validation layer, for example, in federated simulations, offline AI model training, or auditing of DT data. In supply chain management, Hasan et al. [70] laid the groundwork with a generic DT framework by proposing a blockchain-based method to manage the creation process of DTs, facilitating logistics tracking and managing transaction history. This provides a base structure for designing DTs using Ethereum, allowing for immutable tracking and traceability of DT life cycle events. Building on this, Onwubiko et al. [29] used a permissioned blockchain, Ethereum, and decentralized applications like HF and Besu [110]. The smart contract creates stakeholders and grants them permission to use the DT data. This process enables the tracing of the origin and ownership of data in the DT through its Ethereum address, and it also allows participants to request approval. This process makes blockchain-based DT systems more practical and secure in real-world manufacturing scenarios. Further extending blockchain applications in consumer supply chains and DTs, Chatterjee et al. [101] suggested using blockchain and DT to increase security and efficiency in consumer-focused supply chains with a metaverse theme. Smart contracts were used to automate essential procedures, including data validation, warranty management, and payment settlements, simplifying procedures and reducing human intervention. However, despite these significant contributions, all three works have similar limitations when applied to DTs. These include limited scalability due to latency and transaction costs associated with blockchain, as well as the use of Ethereum, which may not be suitable for high-frequency, real-time DT updates. This poses potential challenges in integrating large-scale, heterogeneous IoT systems.

A potential improvement on these existing solutions involves the use of HF and IPFS. The permissioned architecture of an HF supports robust identity management, selective endorsement procedures, and access restrictions. The advanced chain-code life cycle management of an HF improves auditability, reduces operational vulnerabilities, and resolves privacy concerns associated with Ethereum’s public blockchain model. The distributed storage of IPFS will provide a decentralized, tamper-resistant, and efficient data storage solution that helps reduce redundancy. The security, scalability, and resilience of Digital Twin ecosystems would be improved significantly by this combined integration, which would also offer a more complete and secure framework for decentralized management and interaction within blockchain-based DT systems.

5.3. Decentralized Identity (DID)

In various use cases, DT users involve a number of stakeholders, each requiring access to certain data and functionalities. It is challenging to guarantee secure access and ensure that only authorized users can communicate. Centralized traditional access control systems do not offer a high level of detail or precision in managing access permissions, leading to a high chance of unauthorized actions or data breaches [111]. These security issues can be mitigated by employing blockchain and distributed ledger technologies used by DID to provide a secure, independent identity structure. DID allows users to have authority over their digital identities, making it possible for safe and verifiable interactions within the DT ecosystem. It is crucial to understand the technical basis, application feasibility, and standardization attempts [103] before integrating DID with DTs in any application.

Ruiu et al. [102] dived into the use of DID as a foundational technology for creating and managing secure, privacy-preserving, and user-controlled digital identities in the realms of human DTs and Metaverse. By leveraging DIDs, individuals gain independent control over their digital credentials and personal information, facilitating trusted interactions without the need for centralized authorities. However, while DIDs support decentralized identity management, it can be challenging to ensure secure data sharing and compliance with data protection regulations. In the case of DTs, balancing between transparency and confidentiality can be difficult, particularly when handling sensitive biometric data, which poses significant risks. Another study aimed at improving the quality of product identities [103] explored integrating DIDs, DTs, smart contracts, and blockchain in obtaining real-time, valid information on food products. DIDs were used to securely generate digital identities for physical products and directly link these identities with their corresponding DTs. Through this linkage, stakeholders can securely access real-time information such as product condition, provenance, and certification status. Additionally, smart contracts optimize the verification of certifications, thereby improving traceability and transparency across the supply chain. Establishing a trusted association between physical items and their DTs promotes decentralized authentication, greater transparency, enhanced security, and simplified automation within DTs in supply chain management.

Despite the enhanced security offered by DIDs, they remain susceptible to threats such as key compromise, credential misuse, and phishing. These vulnerabilities underscore the importance of robust key management and safeguarding private keys. When implementing advanced security measures, such as hardware-based key storage using hardware security modules or trusted platform modules, multi-factor authentication and zero trust access controls are necessary in managing the reliability and resilience of DIDs and protect users who govern their own DTs

5.4. Data Provenance Tracking

Several studies have explored the integration of blockchain-based DTs across various fields, revealing common challenges that include scalability issues, a lack of standardization, and data privacy concerns. From the DT perspective, key issues often involve real-time data monitoring, the efficient handling of the huge amount of data produced, and ensuring data quality, integrity, and traceability [112]. Throughout the DT life cycle, data moves through various processes and systems, making it essential to maintain a complete record of its history, from the first step where it originated to how and when it was modified and who modified it. Blockchain technology can support this need by enabling robust provenance tracking [113], allowing stakeholders to trace the entire journey of the data in a secure and accessible manner.

Tavakoli of gamificationet al. [104] proposed a blockchain-enabled data-tracking model to ensure that decisions in predictive maintenance are verifiable and trustworthy in building facilities. Every data interaction from sensor inputs to maintenance activities is recorded on the blockchain, thereby enabling comprehensive data traceability across the DT life cycle. The Ethereum blockchain is used to record metadata for every occurrence, and smart contracts track provenance. The two also manage data creation, updates, and verification. While the paper acknowledges blockchain scalability issues, it does not thoroughly evaluate how the proposed system would perform under large-scale deployments. Hasan et al. [70] tracked provenance at each phase of the DT life cycle, establishing that the record of activities is secure and unalterable by recording them on the DLT. The system ensures transparency and trust by using smart contracts and NFTs to manage participants’ access, permissions, and ownership rights. DT system data and operational history were stored off-chain through IPFS while storing metadata fingerprints on-chain. This architecture fosters trust among stakeholders in collaborative environments. However, it assumes the integrity of input data, which can be a problem because if the data is flawed, the results will be too, since blockchain records data, even if it is incorrect or malicious. To mitigate this, additional security measures, such as digital signatures, sensor validation, or human oversight, should be used with provenance tracking.

5.5. Blockchain with Gamification

Gamification is a method that integrates game mechanics into non-game settings, particularly within the realm of cybersecurity. This method enables analysts to assess the cyber resilience of physical operations within a controlled virtual setting. The gamification approach allows for safe simulation of attacks and countermeasures without jeopardizing critical infrastructure. This enables security analysts to acquire practical knowledge and skills, assess the security of Digital Twins, and identify attacks during the hybrid approach [106]. A study by [105] presented a novel teaching tool that uses web-based game challenges to teach blockchain principles. Students assume the roles of players who mine blocks, create transactions, and participate in network consensus. This hands-on approach encourages student engagement and promotes a deeper understanding of blockchain technology. Although not focused on DTs, its architecture offers valuable insight into how gamification and blockchain can be paired to support trustworthy participation and behavior. A study by [84] explores the use of DTs for ICS security, proposing them as safe environments for intrusion detection, simulation, and proactive defense testing. Blockchain technology can be integrated to secure DT interactions, maintain tamper-proof simulation records, and manage access controls in multi-party systems. Suhail et al. [114] adopted a controlled CPS and a gamification approach to enable incident response. The CPS comprises a physical subsystem and resources for security analysts, allowing them to form teams, implement game scenarios, and analyze risks and resilience to enhance defensive mechanisms. However, it does not incorporate blockchain, which could be added to log participant actions immutably, automate incentive mechanisms through smart contracts, and securely track user performance.

The combined contributions of these papers lay a strong foundation for developing a unified system in which DTs can model critical infrastructure, blockchain ensures data integrity and trust, and gamification fosters active stakeholder participation in monitoring, simulation, and training. By combining their unique contributions, it becomes possible to design a secure, interactive, and resilient DT system suited for applications in cybersecurity, industrial systems, and innovative environments. Integrating blockchain with gamification can significantly strengthen DT security by enabling the transparent, tamper-proof recording of user actions and system interactions. For instance, blockchain can be used to track and validate the security analyst’s actions in real time, while smart contracts automate feedback, scoring, and incentive distribution. Additionally, blockchain-based identity management can enforce role-based access control, ensuring only authorized users interact with the DT platform. This collaboration enhances DT reliability and engagement, as well as increasing the overall effectiveness of DT systems by uniting the accountability of blockchain with the motivational benefits of gamification.

6. Blockchain Technology vs. Traditional Methods for Digital Twins

Integrating DTs with blockchain offers significant advantages over traditional databases due to its decentralized, distributed ledger system, which securely records transactions. Other characteristics are discussed below:

6.1. Decentralization

Blockchain technology can enhance the security and reliability of a DT compared to traditional databases by offering a decentralized and transparent way of managing the data they generate. DTs depend on data collected in real time from IoT devices, which can be vulnerable to data manipulations and cyber attacks [19]. By leveraging blockchain’s decentralized structure, making unauthorized modifications or corrupting data can be difficult, which makes securely storing and sharing the collected data easy. Additionally, the blockchain consensus mechanism is capable of making sure that all users involved in the DT ecosystem can rely on the accuracy of the data because the network validates every transaction before it is uploaded to the blockchain. This ensures the authenticity of the data and improves the transparency of the DT, making it a reliable way for conducting decision-making and operations.

6.2. Immutability

The immutability of blockchain ensures that information will not be changed or tampered with after it has been stored, offering a trustworthy record of all exchanges and transactions [115]. This is important for DTs, as the data in the DT shows the current state of the processes and PTs. Using blockchain technology, every piece of information, including a device’s name, IP address, or other characteristics, can be safely saved in a particular order. Only authorized users with the right private keys can view or change this data [116]. This way, the reliability of the DT is certain while mining and validating transactions on the blockchain, which provides an additional degree of security by confirming that the data has been appropriately verified and is trustworthy before being added to the ledger.

6.3. Data Integrity and Provenance

The P2P ledger system in blockchain enables transparent tracking of data sources and movement, which is crucial for maintaining accountability across various applications. In blockchain, data provenance is the capability of tracing the complete history and life cycle of data from creation to its present state. It facilitates consensus, supports the production and transfer of digital assets, and provides a traceable audit trail [117]. This characteristic is essential in identifying the source of data, determining who created or altered it, and understanding when and how those changes occurred. This helps improve system reliability and data integrity, ensuring a regular flow of trustworthy information, which can reduce the risk of malicious activities in DT environments.

A DT can benefit from blockchain’s secure, transparent, and tamper-proof nature since data from devices and monitoring systems generates vast amounts of sensitive information. By integrating blockchain, the data shared between the DT and CPS is secured through mechanisms like PoW and time stamping [115], ensuring data integrity and transparency. Unlike traditional and centralized methods, where data could be vulnerable to tampering or unauthorized access, the decentralized nature of blockchain allows for secure, auditable transactions, thereby confirming the authenticity of the data. This integration improves DT reliability, data integrity, and error rate, while ensuring frequent information exchange.

7. Common Metrics Used for Blockchain and Digital Twins Solutions

The performance of blockchain and DTs can be assessed using various metrics to make sure they meet key requirements such as trust, security, and reliability. These metrics help assess if the systems align with intended objectives. Evaluating these systems against model-specific performance metrics allows for comparison of their efficiency, scalability, and effectiveness in real-world applications. This section explores some metrics used to assess blockchain and DT performance.

7.1. Security Analysis

In this context, the blockchain and DT code are analyzed for errors to evaluate implementation quality; this can be carried out using tools such as ‘SmartCheck’ [118]. The security tool can provide the analysis of solidity code against vulnerabilities or unwanted behavior such as DoS, costly loops, and timestamp dependence [70]. Analyzing the code ensures it does not contain bugs, indicating its reliability and making sure that it functions without errors or vulnerabilities, thereby establishing trust in its intended use. The code should also be maintainable, suggesting that it can be easily updated or modified without introducing significant issues. These will highlight the code’s robustness and its potential for ongoing development.

7.2. Cost Analysis

In blockchain-based DTs, cost efficiency is used as a key metric to evaluate their feasibility and reliability. For the blockchain, the cost of each on-chain transaction should be minimal so that the contract functions can primarily update the DT state and generate notifications about its current phase. Using a single smart contract per DT reduces overhead, making the blockchain-based solution cost-effective [119]. To ensure a solution remains scalable and cost-efficient, using mappings and arrays can be avoided during implementation, and instead, the current user address can be stored in the logs. This will help avoid unnecessary expenses while achieving the desired functionality for tracking DTs.

7.3. Blockchain

In blockchain-based solutions for DT, the blockchain itself can be used to satisfy DT requirements by ensuring traceability and tracking through the use of tamper-proof logs. During DT creation and modeling, these logs help with process management, problem-solving, and securing the look-up process [70]. Blockchain’s data integrity is one of its key characteristics. Every transaction is both timestamped and hashed. Furthermore, on-chain transactions are immutable since they are protected against replay and MiTM attacks.

7.4. Latency and Throughput

In a blockchain, throughput measures the system’s capacity to process data within a specific time period, and latency is leveraged to quantify the time it takes to process a record or transaction. In [120], throughput and latency were adopted to evaluate a blockchain system’s performance and track carbon footprints in the area of food production and distribution. Similarly, their research [121] used several key metrics to evaluate activities like task offloading and caching in a DT-assisted blockchain-based vehicular edge computing network. Task processing latency was used to measure the time it takes to process tasks and throughput to reflect the efficiency of the blockchain consensus process. The system’s overall performance is assessed through the reward achieved during training and execution, where higher rewards indicate better optimization of parameters such as task division, computing frequency, cache storage, and communication bandwidth.

7.5. Accuracy

Accuracy is commonly used as a criterion to assess baseline models’ performance and provide a standard against which the DT can be compared. By measuring accuracy, the DT model’s effectiveness in mirroring physical processes can be determined, thereby ensuring its utility in various applications. In [122], accuracy was used to assess the efficacy of a model within a blockchain-integrated DT of a library. Specifically, it measured the model’s ability to accurately assess data security in protecting reader privacy and intellectual property. This metric measures the model’s overall performance. Similarly, the work in [123] used accuracy to assess the performance of a broad learning federated continuous learning model that combines blockchain and DTs for faster model training to enhance the security of a distributed data sharing architecture using blockchain for IoT support. Here, prediction accuracy serves as a key metric to evaluate the model’s training effectiveness while user privacy and data security are maintained.

8. A Theoretical Blockchain-Based Digital Twin Framework

We now present a case study to showcase how blockchain-based DT can facilitate secure, decentralized data sharing among autonomous connected vehicles and traffic infrastructure to prevent collisions and optimize traffic flow. The traffic management application ensures vehicle tracking and collision avoidance by integrating DTs for both vehicles and traffic lights and using blockchain to secure data exchange between them. Suppose that vehicles and traffic lights share real-time data on a malfunctioning intersection operating in a flashing red mode. Each vehicle and traffic light maintains a DT that continuously collects real-time data, including speed, position, and direction, and shares the data with a shared permissioned blockchain network. The framework consists of a PT layer, a DT layer, a blockchain network, and edge devices for computing and sensing, as depicted in Figure 10. At the foundation of the framework are sensors and actuators deployed in the physical environment (e.g., traffic lights, vehicles, drones, and CCTV cameras). These devices are responsible for collecting real-time data, such as vehicular movement, traffic density, and environmental conditions. Actuators, in turn, can respond by triggering actions like changing traffic light signals. This continuous interaction forms the data pipeline feeding into the DT platform.

The DT acts as the central intelligence of the system. It receives data streams from edge devices and sensors, and it executes the following tasks:

• Signature verification: Ensures incoming data originates from authenticated and trusted devices, preventing malicious injections;
• Modeling and analysis: Builds virtual models that simulate traffic flow and city conditions, enabling predictive insights;
• Computation optimization: Applies AI/ML algorithms to optimize traffic management, energy use, or resource allocation;
• Visualization/API: Provides interfaces for stakeholders to interact with the twin, including dashboards and APIs for integration with external applications.

Each DT signs the data collected from edge devices and sensors using a private key before submitting it to the blockchain. This step ensures authenticity and integrity by accepting only verified data from the DT and prevents the data from being altered. This layer is critical because it bridges raw or preprocessed sensor data with actionable insights and visualization.

Smart contracts play a central role in ensuring secure, rule-based, and autonomous operations across the DT ecosystem. They are used to enforce tracking, data integrity, and collision prediction. The device policy management component regulates the type of data each device is authorized to generate or transmit, ensuring compliance with system-wide policies and mitigating the risk of rogue device behavior. Complementing this is access control, which provides fine-grained authorization by dictating who or what can access different parts of the Digital Twin ecosystem, thereby preventing unauthorized interactions. Meanwhile, privacy-preserving mechanisms (such as homomorphic encryption, differential privacy, or zero-knowledge proofs) enable the system to protect sensitive data while still allowing its use in analysis and decision-making, addressing a key challenge in real-world deployments. Finally, the audit and compliance component extends beyond simple provenance tracking to offer verifiable trails for regulatory adherence and governance audits, allowing stakeholders to evaluate system behavior against legal and organizational requirements.

The blockchain layer guarantees trust, immutability, and decentralized consensus. Data and transactions validated in the Digital Twin can be anchored to the blockchain. This process secures provenance records and ensures tamper resistance. Blockchain further integrates with IPFS/off-chain storage to handle large datasets that cannot be directly stored on-chain, enabling a scalable balance between security and efficiency.

Finally, the insights and validated decisions generated by the Digital Twin and enforced via blockchain are transmitted back to the physical system. For instance, optimized traffic patterns determined through modeling and validated through smart contracts can dynamically control traffic lights. This creates a closed feedback loop, where real-world infrastructure continuously adapts based on secure, trusted digital insights.

Some metrics that can be considered to assess the effectiveness of this model are the following:

• Latency and throughput: The blockchain’s performance can be assessed using both metrics. The transaction latency calculates the time from when the DT publishes the data to when the blockchain confirms it. Throughput helps determine real-time tracking efficiency by knowing the number of transactions processed per second.
• Collision risk detection accuracy: To determine the accuracy of collision predictions, the true positive rate can be used to calculate the number of correct predictions that are collisions. In contrast, the number of false alarms can be obtained using the false positive rate (FPR). Time to Collision (TTC) error can also be obtained by subtracting the actual TTC from the predicted TTC.
• Cost metrics: The operational cost of the model can be computed by determining the gas fees per transaction in publishing DT updates to the blockchain per vehicle. The cost of false alerts from rerouting or unnecessary braking due to incorrect warnings can be measured.

The framework ensures data integrity through cryptographic hashing; a decentralized consensus means no single point of failure. It also captures the real-time and secure nature of the system while ensuring vehicle safety.

Implementation Tools

Implementing the proposed framework across all the system layers requires a diverse set of tools. To achieve a realistic representation of vehicle dynamics and traffic signal behaviors, MATLAB/Simulink version 10.7 [124] and SUMO [125] are required. Smart contracts within the blockchain can be developed using chaincode in languages such as Go [126] or Node.js [127]. Edge computing devices like NVIDIA Jetson [128] or Raspberry Pi [129] support real-time sensing and secure data authentication by leveraging cryptographic libraries such as OpenSSL [130]. REST APIs [131] facilitate seamless and secure communication and can be used to handle communication between DTs and the blockchain network, while predictive analytics for collision avoidance can be achieved through ML models developed using frameworks like TensorFlow [132] or PyTorch [133]. For comprehensive testing, benchmarking, and visualization of overall system performance, HyperLedger Caliper [134] and Grafana [135] can be utilized.

9. Open Challenges and Future Directions

Blockchain has garnered significant attention due to its unique characteristics, such as anonymity, accountability, security, traceability, and trust [70]. The successful implementation and deployment of blockchain technology in DT requires further research to deal with challenging issues, including scalability, data privacy, integration, and energy consumption.

9.1. Scalability

When integrating blockchain with DTs, the system must support many DTs representing various entities within decentralized networks, such as objects, individuals, nodes, devices, and workstations. Furthermore, the decentralized system must handle numerous deployed DTs while concurrently sustaining the necessary level of resilience, especially in scenarios involving compromised nodes and operational failures [136]. Scalability, here, is in regard to the blockchain’s capacity to handle transactions within a network. Blockchain-based systems are relatively slow because they experience network congestion when processing large volumes of transactions. This slow transaction speed is a significant issue for sectors such as manufacturing, which rely heavily on high-performance transaction processing systems [23]. Consequently, this challenge could become a barrier to blockchain adoption in the future. Scalability issues can be addressed using both on-chain methods like increasing the block size, implementing consensus strategies, optimizing data structures, and sharding, and off-chain methods [137]. Designs such as lightweight chain-structured blockchains, directed acyclic graphs, and Tree chains [138] should be assessed for their ability to improve performance and scalability.

9.2. Data Privacy and Security

Data privacy and security are two of the main problems with DTs. The system is dependent on a lot of sensitive data. The system’s security is at risk from the slightest alteration to this data [139]. Protecting this data from malware and cyber attacks is crucial, as any compromise can lead to the loss of important data within digital environments. Additional challenges include data acquisition and storage, given the vast amounts of data transferred between hardware components [19]. Although promising, the application of blockchain to address these security challenges remains in its early stages. Big data, data fusion, artificial intelligence, and edge/cloud computing are technologies that can be leveraged and integrated with DTs to enable secure data transfer between processors and sensor nodes and create a robust framework for advancing technologies that can effectively tackle these issues.

9.3. Quantum Resilience

Integrating blockchain technology with DT poses a quantum security issue. DTs need audibility, verification, and safe data exchange. Quantum algorithms (e.g., Shor [140] and Grover [141]) can undermine conventional asymmetric encryption and jeopardize the integrity of hash functions; they represent significant threats to blockchain security. Post-quantum cryptography is crucial to protect blockchain-based DTs from quantum attacks. To this end, IOTA [142], Corda, and quantum-resistant ledger [143] are examples of solutions incorporating quantum-safe methods. Secure data transfer between DTs and their physical counterparts depends on quantum key distribution and quantum-safe communication [144]. Blockchain solutions must include distributed data accessibility and auditability to make DTs more resistant to traditional and quantum computing threats. Furthermore, switching to blockchain technology and cryptographic protocols, which are resistant to quantum errors, will help blockchain-based DTs withstand future quantum-based attacks.

9.4. Real-Time Interaction

To realize DTs, designing mechanisms that can support real-time data exchange with real-world smart IoT systems is critical for achieving timely situational awareness [19]. However, the current data communication and networking infrastructures are inadequate for supporting large-scale data exchange with assured low latency. The necessity for immediate high-speed internet connectivity presents another technological challenge that impacts the development and deployment of DTs. Real-time bidirectional communication is challenging because of the dynamic network environment and the inherent unpredictability of wireless channels. Furthermore, continuously updating models and AI predictions requires substantial computational effort, which can impact the connectivity and interaction between DT and PT.

10. Conclusions

This paper provides insights into leveraging blockchain technology to tackle the privacy and security of DT applications. First, we provided an overview of DTs and their components, layers, architecture, and life cycle. We also offered a layered architecture for DTs to aid in better understanding the different operations that occur in DT systems. We then covered the basics of blockchain technology and its architecture types. Before mitigating security issues in DT applications, it is important to understand the nature and the impact of these attacks. For this, we thoroughly analyzed the privacy issues and security attacks from two perspectives: DT operation modes and DT layers. We then provided ample coverage on how one can leverage blockchain to address these issues. We also offered a simple case study that showcases how to formulate blockchain integration for DT applications. After carefully analyzing current issues and their corresponding solutions, we identified that there are still some design issues within this combined paradigm. We listed these under future directions as promising areas for research. For our future work, we are working on technical implementations of blockchain integrations in DT-aided smart transportation and smart health applications.