 ICACT20260124 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Title: Towards Cyber-by-Design Security for Digital Twins: Implementing Zero Trust Architecture
Authors: Nizar Choubik, Abdelhadi Belfadel , Jerôme Letailleur, Pierre-Marie Bajan, Stephen Creff, and Amira Ben Hamida
Organisation:
Institute for Technological Research SystemX – France
Contact email: Abdelhadi.belfadel@irt-systemx.fr
|
| ICACT20260124 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
“A digital twin is a fit for purpose digital representation … of an … element with synchronization between the element and its digital representation
|
| ICACT20260124 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
The JNI R&D Program ambitions to
Conceive a methodological framework and toolkit for the development of complex industrial systems digital twins.
Prove this environment robustness through its capability of instantiating various DT : predictive maintenance, optimization, resilience, sustainability, …in a secured manner.
Participate to standardization ecosystems to leverage the interoperability (ISO 23247, ISO 30188 and IEC 63278 compliant)
Challenge: Interoperability is crucial for digital twins to function effectively.
|
| ICACT20260124 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
Scientific Challenges:
Domain-specific Digital Twins
Composable Digital Twins
Tool selection support Identifying which methods and technologies are suitable for which challenges, requirements, and Digital Twins goals
Standardization
Tool support
Modeling support
Quality assurance and requirements
|
| ICACT20260124 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
Related DT Challenges: Cyber-security risks in DT Environment
Features that make Digital Twins valuable (such as rich data models, remote control capabilities, or open APIs) also significantly expand the attack surface.
Some authors in the literature emphasized that insecure data pipelines, weak access control, and twin-to-twin interactions are major security concerns in Industry 4.0 environments [ElHajj2024]
DTs act as bridges between Operational Technology (OT) and IT networks, a breach can propagate from cloud interfaces down to shop-floor devices, with potentially serious consequences…
|
| ICACT20260124 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
DT CPT is an architecture and technology agnostic requirements definition framework for DT engineering projects.
|
| ICACT20260124 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
Enhanced Industrial Digital Twins architecting and engineering practices
Digital Twin Reference Architecture ISO/IEC 30188
|
| ICACT20260124 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
Methodological framework for design
|
| ICACT20260124 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
Integrated and Interoperable DT Platform to ease design and operate
JNI Platform |
| ICACT20260124 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
JNI Platform: 3 main components + Trustworthiness support
|
| ICACT20260124 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
JNI Platform - High level Functional Architecture |
| ICACT20260124 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
Toward Proactive Security with Zero-Trust-Architecture for DT
|
| ICACT20260124 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
Proactive Security with Zero-Trust-Architecture for DT
|
| ICACT20260124 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
Per-request decision cycle enforced by the PEP (python Flask App) and PDP (Keycloak-based).
|
| ICACT20260124 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
JNI DT Platform - High level Functional Architecture [updated] |
| ICACT20260124 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
Use Case: Setting a ZTA Approach with Realms and RBAC Strategy for an AAS-based DT Platform |
| ICACT20260124 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
Demonstration
|
| ICACT20260124 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
Performance benchmarking, and scalability assessment (work in progress) |
| ICACT20260124 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
Conclusion:
This contribution demonstrates how Zero Trust Architecture principles can be operationalized in a DT context, advancing a cybersecurity-by-design methodology suited for connected and dynamic industrial systems.
We proposed and implemented the architectural components and deployment steps adapted to industrial environments.
This approach demonstrates that assigning a dedicated realm and Policy Enforcement Point to each core Digital Twin service provides a modular and effective means of applying the NIST ZTA principles.
This approach ensures strong security boundaries by isolating services by default, minimizing potential impact in the event of a compromise, and maintaining strict access control.
Next steps:
Performance benchmarking, and scalability assessments.
Formal security validation, including attack simulations to fully evaluate the architecture’s effectiveness in mitigating digital twin threats.
|
| ICACT20260124 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
End.
Contact email: Abdelhadi.belfadel [at] irt-systemx.fr
|
