Using digital twins as a shared information model for secure software lifecycle management in IoT

Abstract

Secure software updates are essential for maintaining Internet of Things (IoT) systems throughout their operational lifetime. However, software lifecycle information is typically fragmented across software repositories, deployment services, device management platforms, and runtime monitoring systems, limiting interoperability and end-to-end lifecycle visibility. This paper proposes a Digital Twin (DT)-based information model that uses the DT of each device as a shared information contract throughout the operational stages of the IoT secure software update lifecycle. The proposed model extends the DT with software lifecycle information, enabling deployment intentions, installation status, verification results, and runtime observations to be exchanged through a shared representation across heterogeneous software management components. The approach is realised as an extension of Eclipse Ditto and evaluated in a laboratory set-up for telemedicine gateways that combines a real gateway with fleets of emulated devices. A real security update could be followed revision by revision in the gateway’s DT; queries over the DTs identified vulnerable, updated and failed devices correctly, despite injected installation and verification failures and temporarily offline devices; and new lifecycle information and an additional lifecycle component were introduced without changing the existing ones. The coordination carried out through the DT remained small in comparison with the installation work on the device itself, while the throughput of the DT platform bounded how quickly an update could be assigned across a large fleet.

The authors' abstract, as published at the source. Discover Computing, 2026 · DOI ↗