A Digital Twin Threat Survey

Abstract

Virtual and digital twins are means of high value to characterize, model and control physical systems, providing the basis for a simulation environment and lab. In the case of a digital twin, it is possible to have a replica of a physical environment by means of reliable sensor networks and accurate data. In this paper we analyse in detail the threats to the reliability of the information extracted from these sensor networks, along with a set of challenges to guarantee data liveness and trustworthiness.

1. Introduction

Digital twin (DT) technology has emerged as a promising solution to improve the efficiency and performance of certain complex physical systems, focusing more on those found in industrial and critical infrastructure environments. This technology consists of creating a virtual replica of a physical asset, which is commonly known as the digital twin, using real-time data collected from sensors or other sources. The DT paradigm can be used to simulate, validate, and optimize the performance of the physical counterpart; to test and evaluate changes or improvements to the system before applying them in order to check potential critical failure points; and even to restore the system to a normal operation point after an incident.

DT technology emerged in the latter years of the 20th century, when the first mathematical models where used to describe the behaviour of complex engineering problems [1]. As with every other technology, it has evolved a lot since its first steps and, consequently, we can differentiate between different typologies of DT, each with specific characteristics and applications. The first historically developed ones are called Virtual Twins (VT). A VT is a simplified or abstracted digital model of a certain physical asset or system that can be used for simulation, training, and testing purposes. As global technology evolved and more efficient computation systems arose, DT surpassed VT. A DT is a highly accurate virtual model of a physical asset or system, commonly employed in healthcare, transportation, and manufacturing. But this approach seemed to be outdated as new technologies for gathering data from physical assets were developed. There was a need to evolve the technology further and incorporate the benefits of the continuous synchronization between the data of the real world and that obtained from simulation rather than the static model generated in a DT. Consequently, Hybrid Twin technology emerged. Hybrid Twins establish a permanent bridge between the physical and digital worlds in real time using a combination of physical sensors and virtual models, often used in autonomous vehicles and other complex systems. Finally, a physical twin (PT) refers to the physical asset that is intended to be simulated [1].

The use of the latest DT technology—what in the last paragraph was referred to as Hybrid Twins—holds great promise for enhancing the performance and efficiency of complex physical processes. However, it is important to recognize that proper security measures must be taken to ensure their reliability and effectiveness. Due to their capacity to offer real-time insights into the behaviour and performance of physical systems, DTs have quickly gained popularity in recent years, becoming a promising technology for improving the efficiency and effectiveness of industrial and critical infrastructure systems. They are employed in many different fields, such as manufacturing, healthcare, transportation, and smart grids, to name a few; see Jafari et al. [2].

1.1. Structure of Modern Digital Twins

As mentioned in the previous section, digital twins form complex systems where information must be distributed accurately and efficiently. Thus they are composed of multiple services, each with its own key function in the process. To understand more fully the security risks associated with DT systems, they have traditionally been divided into four layers, as stated in [3,4] and shown in Figure 1. In this figure, we can see the different layers and components of a DT. Each of the layers is divided by a dashed vertical line, forming a layer sequence with the exception of the data management and synchronization layer, present on both the bidirectional data flow between data acquisition and data modelling layers and on the data transmitted from the data modelling layer to the data visualization layer. In yellow colour, we have represented where the hardware components are located on the scheme. In blue we have identified all the stages in which data is involved. In green we mark the position of the AI and software components of a typical digital twin structure. DT layers match with the ones described by the International Standard Organization (ISO) [5]:

• Data Acquisition Layer
  The data acquisition layer is the first layer that takes part in the flow of information generated by a DT. It is responsible for collecting data from sensors attached to physical objects. As underlined in [6], the implementation of DT demands a vast amount of data collected through sensors, embedded systems, offline measurement and sampling inspection methods over physical entities.
• Data Management and Synchronization Layer
  After successfully gathering all the information available from the physical device, it is time for the data to be managed and synchronized. In this layer, all the storing and processing operations of the data collected from the physical object and the transmission from the physical device to the digital part of the DT take part.
• Data Modelling Layer
  Once the information flow has arrived to the DT, it is time to process that information in order to obtain the useful output desired when implementing the paradigm. The data modelling layer is then responsible for creating and updating the DT based on the data collected from the physical object on the first layer and transmitted on the second one. At this level the Artificial Intelligence (AI) governing the model can take its own conclusions from the data received and the actual state of the model, which provides a highly valuable asset for companies in order to automate engineering and management operations [7]. In addition, the adoption of modern techniques such as AI has been identified as a key factor in the growth and use of digital twins [8,9,10]. In this section and the rest of this work we will refer to Artificial Intelligence as it is defined in the proposed EU AI Act: “a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments” [11].
• Data Visualization Layer
  After all the data gathering and processing has occurred, the DT shows to its respective operator all the conclusions obtained after the information flow. Traditionally, the operator following the organization policies and rules, after carefully analysing this representations, takes the consequent decisions on the corresponding physical system. In modern DT systems, this role is progressively assumed by the AI, leaving to the operator a monitoring role.

Once the structure of a DT has been fully understood, we identify three key components within its entirety: hardware, data, and Artificial Intelligence. These elements interact with each other to achieve the primary objective of a digital twin, which is to represent a real-world object or chain of objects within a manufacturing process. Each component plays a distinct role:

• Hardware: Attached to the real-world object, the physical twin is responsible for gathering all the necessary information to virtualize it. It is clearly connected to Internet of Things (IoT) devices, whose growth is significantly contributing to the adoption of the digital twin paradigm as a standard in manufacturing processes for Industry 4.0 [10,12].
• Data: This refers to the information exchanged at every stage of the digital twin process. It encompasses data generated by the hardware components in the data acquisition layer, as well as data resulting from transformations made in the rest of the layers.
• Artificial Intelligence and Software: This encompasses all software components within the digital twin paradigm. Of particular note is the AI system, which can vary widely, from deep learning techniques [13] or Generative Adversary Networks (GANs) [14] to more classical Machine Learning algorithms such as Random Forest [15] or Support Vector Machine [16], among others, all of them playing a key role in the representability of the generated digital twin, as AI techniques are used to collect, analyse, and test the data from a physical object to build its digital copy [17,18].

1.2. Methodology

In order to formulate our research queries, we are going to use PICOC methodology. PICOC was firstly defined by Mark Petticrew and Helen Roberts [19] in 2006 and stands for Population, Intervention, Comparison, Outcomes and Context. PICOC has been proved to be effective on scientific research related to technological areas like Artificial Intelligence [20] or privacy-enhancing technologies [21] among others. With this methodology, we must address five main aspects:

• The Population in which the evidence is being collected, the group of entities that are of interest for the review.
• The Intervention applied in the study, more specifically, which technology is in the scope of this study or which area related to that technology is being reviewed.
• The Comparison to the previously identified intervention.
• The Outcomes we would like to achieve by developing this review.
• The Context of the study.

This theory states that PICOC elements are important in a focused search for evidence, and that each change in them can lead to the obtainment of different evidence and, therefore, different search outcomes. For its application, we must ask ourselves five questions, one per PICOC element, assigning each to one or several keywords associated with the answer to the question, as shown in

Table 1. PICOC analysis. We consider that the Comparison item does not apply to our investigation.

PICOC Item	Question	Answer
Population	What are the new paradigms of Industry 4.0. we are interested in?	Digital Twin
Intervention	Which area related to digital twins would we like to study in our review?	The last techniques to implement the digital twin paradigm and its potential risks
Outcomes	What will be an enrichment outcome of this study for the community?	A framework for identifying and classifying threats to digital twins
Context	What is the current context of digital twins in the digital landscape?	Implementation of new computational paradigms such as Artificial Intelligence or quantum computing techniques.

. As our study is not aiming to compare our outcomes with any other, we have discarded the Comparison question as it is meaningless.

Using the attributes derived from PICOC, we can now formulate the research queries (RQ) we would like to focus on. All of them aim to obtain a more securized industrial and non-industrial environment where digital twin technology is being implemented

• RQ1: Which are the main cybersecurity risks to the digital twin paradigm?
• RQ2: Is it feasible to employ a risk analysis framework from different computation paradigm systems in a DT system?

1.3. Search Process

After having analysed the scope of this review and formulated the corresponding search queries, we have determined the search strings that we can use for finding relevant publications to the research questions. Those search strings can be obtained either from the obtained PICOC table or from the research queries themselves or by considering variations, synonyms and abbreviations. Closely related terms have also been taken into account in order to cover a wider range of publications. We only consider those results with the search strings contained in the title, the abstract or the keywords of the article. In addition, sometimes a combination of AND–OR clauses has been used. Only publications from more recently than 2019 have been taken into account. The search strings were obtained by combining two sets of strings:

• General strings: “digital twin”, “digital twins”, “digital twinning”.
• Additional strings: “attack”, “attestation”, “cyberattacks”, “cyberthreat”, “dependability”, “dependable”, “disaster”, “honey”, “honeypot”, “intrusion detection”, “malware”, “quantum computing”, “quantum”, “ransomware”, “reliability”, “remote safety”, “risks”, “threats”, “trustworthiness”, “verification”.

Papers were obtained by querying the selected database using the combination of each of the strings in the set “General Strings” with each of the strings in the set “Additional Strings”. Figure 2 shows an example string used to query the Scopus database and find scientific publications related to malware attacks in DTs. For such a goal, we have specified that the words digital, twin and malware must be present in the publication title, its abstract or its keywords and we limited the search to those fully open access, alongside the already discussed language and year restrictions.

The scientific database used for extracting the documents is Scopus as it is considered sufficient for covering a wide and sufficient range of publications in such a way that the following analysis can be performed.

1.4. Study Selection Criteria

Figure 3 summarizes the selection-criteria for the papers in this survey. The total amount of scientific publications found with this methodology was 9261. This database was reviewed and some of its elements removed following some criteria, as stated in the following diagram:

Exclusion criteria:

• We have removed duplicated articles leaving us with a total of 3244 articles.
• We have deleted those publications with no identified DOI.
• We have removed those publications not publicly available. For checking this, we have used the Unpaywall Database [22]. This step left us with a total number of 1204 open access publications.
• Only publications written in English and Spanish have been considered.
• The publication must answer at least one research question; otherwise, it has been excluded.

After the complete process, around 200 articles were finally selected and took into consideration for the writing of this survey. The selected articles were finally qualitatively reviewed without applying any sort of quantitative analysis.

2. Digital Twins’ Risks

As we have already seen in Section 1, the DT paradigm represents a promising technology that aims to boost industrial performance. However, although it is being implemented by more and more companies and institutions in their manufacturing processes, hazards and threats exist for all of them, just as for any other digital technology. The continued development and the adoption of DT technology will likely be an important focus of research and innovation in the years ahead.

Threats to DT are wide; they range from cyber-attacks and data breaches to privacy violations, and they can affect their integrity, availability, and confidentiality, compromising the DT paradigm as a result. In addition, sensitive data, such as intellectual property, can be stolen or lost as a result of data leaks, which can have very serious consequences for the organization that has implemented the DT. From this arises the importance of securely protecting the whole DT paradigm against the privacy violations that could happen, which can potentially expose sensitive data. Other DT threats’ repercussions are monetary losses or altercations in the physical facilities of the owner of the DT. An attack on a DT deployed in a manufacturing process can be the source of stopping output and result in large financial losses. Similar to this, a healthcare DT data breach, an area where DTs are being used more and more frequently, might expose patients’ private data. In this manner, understanding potential hazards to DT is therefore crucial, as is taking the necessary precautions to lessen them.

Attackers’ main goals are to effectively compromise DTs and thus also affect those systems who rely on this technology. An attacker who gains access to a DT may exploit it for taking control of the physical device the DT is linked to. This might give the attacker an unwanted authority to have an adverse effect on the physical system, harming the business or the people who depend on it.

For instance, if an attacker gains access to the DT that regulates the temperature of a certain facility, they will be able to use it to raise the temperature to dangerous levels, endangering the health of everyone inside or taking advantage of that situation for another type of attack they may have planned previously.

Cyber criminals with easy access to exploiting vulnerabilities of DTs may be able to steal private information or other intellectual property when they successfully gain access to a DT. In the field of science, both researchers and developers regularly use DT-based systems, and attackers who gain access to them might be able to steal confidential data or priceless intellectual property and, as a result, the attacker will have a significant tactical advantage or will be able to sell the data that have been stolen.

Given the potential benefits for criminals who successfully compromise DTs, it is imperative to take effort to appropriately secure them. This entails putting in place all the security controls established by reference frameworks such as NIST CSF-2.0 [23], which advises to authenticate all users and entities, protect the confidentiality and integrity of all the information that is fed from the sensors to DT, and to conduct regular evaluations of logs and security trails to detect any potential indication of an attack or any security/safety problem. Indeed, those that rely on DTs may suffer deeply as a result of inadequate security, and attackers may gain a major advantage.

For understanding the different threats a digital twin can have, one must take into account the morphology of the DT. Each layer that forms a DT presents a range of potential threats that can cause the malfunction of the whole system, as in every other complex informatics system [24]. With this perspective, Alcaraz et al. [4] present a classification of security threats based on the five main components of a digital twin—Industrial Internet of Things, computing infrastructure, virtualization systems, computing techniques, and Human–Machine interfaces—linking them to a series of operational requirements previously defined [25,26,27]. In Neshenko et al. [28], a different approach is considered, and threats are only divided taking into consideration the target of them: confidentiality and authentication, data integrity and availability. Additionally, they considered different aspects of the IoT ecosystem, such as layer vulnerabilities, security impacts, countermeasures or situational awareness capabilities.

Mullet et al. [29] conducted a comprehensive review of the cybersecurity guidelines that must be followed by manufacturing companies for implementing safe digital twin ecosystems and the threats linked to loss of availability, integrity and confidentiality attending to the business impact they potentially posses.

In this paper we have grouped together the information on these works and extended the list in order to create a list of security threats to digital twins based on the layers that compose their morphology, as defined in Section 1.1.

2.1. Hardware Threats and Countermeasures

The main threat to the DT paradigm concerning the hardware process generation is the fact that an attacker can compromise the multiple sensors employed to gather data. As it is highlighted in [23], endpoint verification must be regularly conducted to prevent the physical parts of a DT from being supplanted or spoofed [30,31]. In this regard, it is possible to leverage different secure device onboarding protocols and secure device onboarding [32,33]. It is also necessary to apply Remote Attestation to protect sensors and endpoints from malware. This security technique allows the integrity of the platform to be verified and unauthorized modifications to be detected, using cryptographic measures to ensure that the platform has not been compromised. However Remote Attestation schemes are difficultly scalable [34], and this can be a severe problem for complex DT systems. Thus, collective Remote Attestation schemes have been proposed for fixing this issue.

Collective Remote Attestation is a variant of the Remote Attestation scheme that allows the detection of coordinated attacks and facilitating the analysis of suspicious behaviour. The main difference with Remote Attestation is that instead of verifying the integrity of a single DT, a joint verification of several of them is performed. This technique is more suitable in environments where multiple DTs are used and a higher detection and response capability is required against more sophisticated attacks. In addition, as mentioned before, collective Remote Attestation also offers greater efficiency and scalability compared to Remote Attestation, making it a more viable option for application in large industrial environments when deploying a DT.

The collective Remote Attestation scientific community typically differentiate five types of attackers [35,36]: the Software Adversary, who has the ability to execute malicious code on a device; the Mobile Software Adversary, capable of compromising a device’s software configuration and removing any trace of their presence on it, the Physical Non-Intrusive Adversary, who can infer device information; the Stealthy Physical Intrusive Adversary, capable of capturing a device and attempting to extract information from it; and the Physical Intrusive Adversary, who additionally has the ability to introduce external hardware into it.

Ambrosin et al. [37] studied different CRA schemes designed and outlined the type of mitigation capabilities against every type of adversary previously discussed between other characteristics. As a result, ERASMUS [35] and SeED [38] stood out among the rest, being only vulnerable to Physical Non-Intrusive and Physical Intrusive Adversaries. Both schemes share the same base; they allow the device to authenticate and independently decide the moment when attestation occurs using a certain secure source of time (Real-Time Clock and Attestation Trigger for SeED and a Reliable Read-Only Clock for ERASMUS). Thus, additional Hardware items must be added to physical twins in order to execute this scheme. However they face some security problems like the lack of a DoS Mitigation policy. This issue can be achieved by implementing a blockchain approach such as that proposed in [39], where a mechanism is designed over Hyperledger Sawtooth, or in [40], which uses Hyperledger Fabric. However, blockchain-based collective Remote Attestation schemes can suffer long latency in transaction validation processes, a critical point, as these CRA schemes rely some of their potential on being fast.

Another CRA protocol that can be highlighted is SALAD [41], which also mitigates three different types of adversaries, being the only scheme that provides mechanisms of defence against Physical Non-Intrusive Adversaries. Physical Non-Intrusive Adversaries are capable of stealing information on the devices by only being located physically next to the physical twin, allowing it to mount side-channel attacks. This is a main threat for the DT paradigm, as new techniques are being developed in order to perform this type of attack using Machine Learning and deep learning techniques, what in the literature is referred to as Side-Channel Analysis, using, overall, two surrogate loss functions, Negative Log Likelihood and Mean Square Error, which show that the deep learning approach can be highly suitable for evaluating implementations secure against Side-Channel Attacks from a worst-case scenario point of view [42]. However, the main pitfall of SALAD comes with its runtime, as it is a complex design, which provokes a high overhead, making it only suitable for environments with a small number of nodes.

Hardware components are also vulnerable to suffering reverse engineering attacks [43]. DTs can help to evaluate the divergence between a real model and the one virtualized through a DT. Divergence measures can be used to solve inverse problems related to the inference of hardware design decisions which, in the end, could posit an infringement of intellectual property [44].

In the interleaving of hardware threats and AI threats, we must refer to threats like the framework presented by Clements and Lao in [45], which allows one to introduce hardware Trojan attacks by means of neural networks at the production stage by any third party in the supply chain. Such hardware Trojans must be very stealthy, since infected devices must pass a normal functional test without being detected. This implies that the activation conditions which trigger the Trojan must be rare and specific. Ref. [45] proposes expanding the taxonomy of neural network attacks to incorporate this new type of attack.

2.2. AI Threats and Countermeasures

As it has been explained in Section 1.1, Artificial Intelligence plays an important role in modern digital twin structures, as by applying Machine Learning techniques the system is able to predict the output in a more comprehensive way, thus achieving a better-performing digital twin. However, the use of such Artificial Intelligence techniques implicitly involves a new challenge that must be solved: the potential security flaws arising from the use of AI techniques.

It has already been proved that these techniques are not completely secure and that methodologies, each time more widely spread in industrial environments, have their own critical fault points. One of these methodologies, outsourcing the training process of the Machine Learning model (MLaaS), is becoming especially popular as the high computational capacity needed is not affordable for the companies that develop it. MLaaS in the hands of an untrustful company is prone to unwanted behaviour if manipulated properly, as it is described in [46]: a backdoor can be planted in every neural network trained model that is undetectable at first glance unless every mathematical intricacy of the resultant neural network is studied in detail. In fact, this is an upcoming problem for the Machine Learning industry, and several backdoor algorithms have already been developed using a wide variety of techniques. For instance Wu et al. [47] classify attack algorithms depending on their threat model, establishing a differentiation between those algorithms in which the attacker is able to manipulate the training data, such as BadNets [48] or SSBA [49], and those in which the attacker is able to manipulate both the training process and the data.

Any Machine Learning technique requires an initial data set that will be used to train the model to solve the problem posed. The problem of uncertainty quantification is explained, in a few words, in the fact that for those inputs that the trained model subsequently receives that are the same (or similar to a certain extent) to those provided in the training set, the behaviour is exactly as desired; however, more noticeable deviations are observed in those cases in which the situation that the DT tries to solve is widely different from those provided in the initial dataset, i.e., when a completely new situation is being treated [50]. This is a problem induced by the inherent variation or randomization of the techniques or due to a lack of initial knowledge, and only the second cause can be remedied by adding sufficient knowledge [51]. Thus, any DT based on Bayesian neural networks or Machine Learning techniques such as interval analysis or fuzzy logic is affected by the problem of uncertainty quantification. As a possible solution, Lin et al. [50] propose the concept of meta-learning in the DT learning process, so it favours the generalization and learning capabilities of neural networks by conducting an exhaustive evaluation of different configurations for neural networks and by leveraging expert knowledge on the identification, modelling and practical validation of specific DT tasks. As it is discussed in [50], model selection is carried out by applying sequential model-based optimization, which implies the use of the design of a meta-learner by a surrogate model and the minimization of a performance function through conditional entropy and a bandit-based criterion. It is also recommended to perform a systematic risk analysis—which can be performed probabilistically—using methods capable of demonstrating a high reliability of critical systems and that take into account the differences between testing and operational conditions when using the DT in a production environment.

Finally, it is important to note that, as we are constantly dealing with Machine Learning models, they require an abundant amount of data to be trained and, therefore, it is necessary to consider the privacy needs of each of the data. For this purpose, the main trend that is gaining strength in recent years is to implement federated learning [52], which can be defined as a collaborative Machine Learning technique without the need to centralize the training data. In this methodology, all of the prediction models shared in the different local devices collaborate and maintain their own training data. Once each local device computes its model, it sends a summary of the model to a server that computes all the information globally, generating a better model and keeping the data in the user’s hands [53]. However, while the use of federated learning is a solution to data privacy issues, it is important to note that it makes the models much more vulnerable to attack by a single or multiple malicious participants within the federated structure, who can inject malicious model replacement to introduce unwanted functionalities and backdoors into the final result. In fact, Bagdarsaran et al. [54] analyse the implications of this type of attack and confirm that it is a much more powerful type of attack than classic data poisoning attacks, making the DT network that employs it more vulnerable.

2.3. Threats to the Data Life-Cycle and Countermeasures

Data is generated, transported and consumed. Normally the flow of data goes from the sensors of the physical system to the DT where data is consumed. Data may change the DT state, and this may trigger reactive behaviours to further actuations in the physical system. In this section we analyse threats to the data life-cycle as follows:

• Threats to data generation
  • Low-Quality Data Threat: In the context of twin technology, this threat can occur in various scenarios, both in the communication between the physical twin and the DT, as well as in communication between DTs. Initially, it can impact the reliability of actions or decisions made by the DT regarding its physical counterpart and can affect inter-twin communications in case collaboration is required.
  • Model Inconsistency Attack: A physically manipulated element can maliciously alter the parameters used in the model training phase, leading to operational issues and even privacy concerns; see Pasquini et al. [55].
  • Model Poisoning Attack: In a collaborative context involving different DTs, an attacker may manipulate the parameters of the AI model with the aim of disrupting collaborative functionality; see Tian et al. [56]. In federated learning environments, local models could be tampered with in an attempt to influence the results of the global model aggregation. The guidelines of [23] to guarantee the reliability of the decision making and taking in DT can be implemented, for example, by means of the deployment of black-box audit using verifiable computation [46]. This approach could help to detect both model inconsistency and poisoning attacks.
  • Threats to Data Backup: Another threat inherited from IT environments pertains to backup data, which serves as a recovery mechanism in the event of data loss or corruption, a necessity to ensure the life-cycle of services associated with DT technology; see Su et al. [57]. Alterations to backup data could result in system malfunction following a restoration operation. On this point, it is necessary to take into account the need to implement encryption backup, and strict access control to all backups, along with regular verification of backup integrity [23].
  • Data/Content Poisoning Attack: This type of threat directly impacts interactions between twins (see Nour et al. [58]), as it can disrupt the system’s operation by injecting malicious data and even interfere with the model training process. Remote Attestation should be used here to detect any attempt to carry out this type of attack. In addition, and according to the guidelines in [23], all information flows should be verified, for example, by creating robust confidential and authenticated channels, which demands the deployment of robust Public Key Infrastructure and the adoption of IPSec to protect the control pane in the DT.
• Threats to data transmission: As communication flows from hardware devices to the computerized structures supporting the Artificial Intelligence models discussed in the previous section, information is transmitted through channels, whether wired or wireless. This involves a classic communication protocol, and hence the transmitted data may be susceptible to typical attack typologies. We would like to emphasize the importance of considering that, as this technology aims to become predominant in the industrial, healthcare [59], and autonomous driving [60] sectors, when it comes to its implementation and security, one must also take into account potential threats arising from the advent of quantum computers.
  • Data Tampering: Without a mechanism to ensure the authenticity of exchanged information, a DT-based system is vulnerable to forgery, alteration, replacement, or deletion of data. This type of threat may manifest during the DT creation phase, by contaminating the training dataset with manipulated data, thereby disrupting the DT’s functionality from its inception.
  • Desynchronization of DT: A distinctive feature of DT-based technology is its bidirectional communication, which, in order to function correctly, must remain synchronized. In response to this requirement, an attacker could compromise the system by tampering with the synchronization associated with twin interactions; see Gehrmann et al. [61]. This threat broadens the attack vector, as it is possible to disrupt either twin (digital or physical) by simply altering the synchrony of its corresponding twin.
  • Eavesdropping Attack: Although not specific to DT-based technology, this type of threat applies to any communication utilizing open or improperly secured channels, potentially gaining access to transmitted data.
  • Message Flooding Attack: This type of attack can impact communications, both inter/intra-twin, and may trigger a DoS attack.
  • Interest Flooding Attack: Such an attack affects not only the availability of the digital resource but can also interfere with the operation of the DT by executing queries that raise CPU usage or increase memory utilization, among others problems [62].
  • Man-in-the-Middle (MITM): This is a typical threat to the network infrastructures used by the DT, especially when communication is effectuated through wireless networks, where malicious servers can be located in the middle of the DT information flow for launching an MitM attack. An insider can launch a routing attack on the devices under their control and modify the information sent, trace the network traffic sequence or deteriorate the quality of the DT maintenance process by altering the DT database or the final representation of the data.
  • Denial of Service (DoS): DoS attacks mainly affect the data acquisition layer devices and are aimed to facilitate another series of attacks, although the physical resources (servers) of the virtualized twin may also be affected. However, in cases where the organization deploys a decentralized infrastructure, the damage is minimized. This is the most difficult type of attack to carry out as DTs are usually set up in closed environments and require the attacker to be close, physically or digitally, to the devices or servers to be compromised.
  The protection against interception attacks involves the use of encryption, integrity verification, and the deployment of adequate security controls for authentication, accountability and audit. Taking into account the heterogeneous nature of the DT ecosystem, there is a need to promote the adoption of standards and interoperable technical solutions. Again, the NIST Cybersecurity Framework provides a set of very useful guidelines for the promotion of those standards in DTs [63].
• Threats to data usage/consumption
  • Private Information Extraction With Insiders: This type of threat occurs in both types of communications within a DT ecosystem. An insider may leverage their position to extract sensitive information shared with the DT from legitimate physical twins. Using this information could enable access to the DT within the system, facilitating attacks within the infrastructure itself.
  • Privacy Leakage in Model Aggregation: Under the collaborative learning paradigm, there is a risk of information leakage during the model aggregation phase applied to the DT ecosystem [64].
  • Privacy Leakage in Model Delivery/Deployment: When offering global AI models from cloud infrastructures, there is a potential risk of model theft during communications between different DTs. If the AI model is obtained, it may be possible to infer information contained in the model parameters. Additionally, with the model in hand, it is possible to implement techniques that allow unauthorized access, enabling the alteration of the model’s output at the attacker’s discretion [65].
  • Knowledge/Model Inversion Attack: During the usage phase of a DT, there is a risk of extracting the representations of training data from the AI model, known as knowledge/model inversion attacks. This type of information extraction can be classified into two types, the first of which is known as a white-box attack, in which direct access is gained to the AI model along with all associated information, and black-box attacks, in which interaction with the AI model occurs through APIs to obtain related information [66].

3. A New Framework for Identifying Digital Twin Threats

After having correctly identified all the possible threats to the digital twin paradigm, it is necessary to consider a framework for prioritizing those that can more greatly affect the company that is implementing the system.

Several risk management frameworks have been proposed by the information security community. Among frameworks with a more general approach is the Information Security Risk Analysis Method (ISRAM) methodology [67], a quantitative methodology to assess and manage information security risks in a consistent and efficient way. Microsoft’s STRIDE [68] method is, in contrast, a qualitative methodology for identifying and analysing security threats to software systems, complementing ISRAM with a more in-depth approach at the threat analysis stage, defining six different types of threats (spoofing, tampering, repudiation information disclosure, denial of services and elevation of privileges). However, these methodologies often tend to be too open-ended. They often leave it up to the user to answer ambiguous questions to determine the degree of risk. More complex frameworks have also been proposed using probabilistic relational models [69] or weight matrix systems [70,71].

Ganin et al. [72] define a framework in which the several risks for cybersecurity assessment and management is divided into threats, vulnerabilities and consequences, attending to the ease of attack, potential outcomes for the attackers and the attacked domain using a Multi-Criteria Decision Analysis (MCDA) [73]. However, this taxonomy might lack the affected parts of each of the risks analysed. In addition, it pretends to create a general framework that may lack specificity when applied to digital twins.

Risk management frameworks are not novel to new computation paradigms, more specifically, to Artificial Intelligence. The already mentioned proposed European Artificial Intelligence Act also states a series of questions related to risks that must be asked prior to the implementation of any AI system. In its Article 9, it encourages developers to stop in cases that, after identifying foreseeable misuses and risks and adopting measures of risk management, residual risks are considered not acceptable [74].

Also working in the AI domain, Camacho et al. [75] apply a Cybersecurity Risk Analysis Framework for Systems with AI Components. Extending previous work [76], they design a comprehensive framework for classifying risks, declassifying them as measurable and non-measurable, and taking into account the organisation, or even the people or the environment, affected if an attack is employed against any of the vulnerabilities. This framework actually covers the impacts identified in the Artificial Intelligence Risk Management Framework [77] elaborated by NIST and is inspired by Information Risk Assessment Methodology [78] designed by the Information Security Forum.

This framework has already been successfully used in this work for analysing the risks of AI components in ADS architecture, proving its usability for new computation paradigms. Thus, we have decided to extend and apply it to analyse the importance of each threat to digital twins and to use the taxonomy for Cybersecurity Objectives (CSO) including those with a direct monetary impact and those not directly measurable in such terms.

Taking into account this taxonomy of threats, we have decided to extend this methodology to the digital twin threats that have been identified in Section 2.3, dividing them into hardware threats, Artificial Intelligence threats and threats to the data life-cycle. The result is presented in

Table 2. Threats to digital twin paradigm classified according to the risk taxonomy defined in [75]. Underlined columns refer to those threats that have effects on other organisations.

	Operational Costs	Cybersecurity Costs	Other Costs	Income Reduction	Reputation Impact	Operational Costs	Other Costs	Income Reduction	Reputation Impact	Fatalities	Injuries to Physical and Mental Health	Injuries to Personal Rights	Personal Economic Damage
Hardware Spoofing	x	x	x		x					x	x
Side-channel attack		x
Reverse Engineering			x
Hardware Trojan attack	x	x				x	x	x	x	x	x
MLaaS by untrustful company	x		x	x	x	x			x	x	x
Uncertainty Quantification	x			x		x	x			x		x
Malicious participant in Federated Learning system	x	x			x	x			x			x
Low-Quality Data	x			x	x	x
Model Inconsistency	x	x		x	x	x				x	x	x
Model Poisoning	x	x		x	x							x
Threats to Data Backup		x			x							x
Data/Content Poisoning Attack	x	x		x	x	x
Data Tampering					x							x	x
Desynchronization	x	x				x
Eavesdropping		x	x	x	x	x	x	x	x			x	x
Message Flooding	x	x
Interest Flooding	x	x	x		x					x	x
Man-in-the-Middle	x	x	x	x	x	x	x	x	x	x	x	x	x
Denial of Service	x	x			x	x
Private Information Extraction With Insiders			x	x	x		x	x	x			x	x
Privacy Leakage in Model Aggregation			x	x	x		x	x	x			x	x
Privacy Leakage in Model Delivery/Deployment	x	x	x	x		x
Knowledge/Model Inversion	x	x	x	x								x	x

.

However, this table has been designed taking into account the entire set of possibilities for applying a digital twin. For each use case, an exhaustive study must be performed modifying the table according to the particularities of the supply chain in which the DT is involved. For example, on a digital twin involved in an e-health diagnostic system [79,80], an eavesdropper can access personal medical records, violating the privacy of the human it belongs to; thus, an injury to personal rights is happening. On the other hand, for a digital twin involved in a supply chain at a factory in which only mechanical decisions are taken, an eavesdropper cannot violate personal rights as no information of this kind is being treated.

4. Conclusions

The evaluation of functionality and safety in complex systems cannot be carried out in a direct way upon the actual and physical system. It is required to conduct virtualization and emulation of the main properties and processes of the physical environment under scrutiny. Digital twins are intended to characterize as best as possible those properties and processes through observability and controllability approaches, which can only be conducted when it is possible to extract data from physical systems and virtually replicate it with high levels of accuracy and reliability. In addition, precise and robust Artificial Intelligence models are demanded to properly replicate the evolution of physical properties and the behaviour of physical processes. In this paper we have highlighted the security and safety threats that could hamper the replication capabilities of digital twins. Our analysis has been focused on drifting and pollution problems affecting sensors as main pathways to gather the information necessary to deploy a digital twin. The dependency matrix of hardware production and the existence of potential backdoors and Trojans at the hardware level have been also considered. The vulnerability surface associated with network communications was discussed in terms of the risks from data interception and modification. These risks must be overcome to advance adequate preparedness in case of the existence of actual and practical quantum threats. Future work will be devoted to designing agile methodologies to plan the transition from current cryptographic primitives and protocols to post-quantum software and hardware solutions as demanded by the European Commission [81], and according to the guidelines and standards proposed by NIST [82]. The principle “trust and verify” must be enforced along the complete data life-cycle, including robust Remote Attestation and the thorough evaluation of computation outsourcing paradigms [46]. Risk analysis must evolve to better address the complexities and perils of the interleaved domain of cybersecurity and Artificial Intelligence.