Security Analysis of Digital Twins for IoT: A Smart Parking Use Case with Attack Simulation and Cloud Comparison

This research presents the design, deployment, and security evaluation of a smart parking digital twin (DT) system using Internet of Things (IoT) technologies. A local digital twin architecture was developed using a Raspberry Pi and ultrasonic sensors to monitor real-time parking occupancy, enabling low-latency synchronization between physical and virtual environments without cloud dependency. The study then systematically analyzes the security posture of the local DT through simulated cyberattacks, including denial-of-service (DoS), sensor spoofing, man-in-the-middle (MitM), client impersonation, and unauthorized publish/subscribe attempts.

Following this, the system was migrated to cloud-based infrastructures using Amazon EC2 and AWS IoT Core, enabling comparative analysis across deployment environments. The security mechanisms, system scalability, and operational resilience of the local and cloud models were assessed under adversarial conditions. Results indicate that while local systems offer ease of deployment and lower latency, they are significantly more vulnerable without hardened transport and authentication layers. In contrast, AWS IoT Core demonstrated strong perimeter defenses but remained susceptible to misuse of trusted credentials.

This research contributes a layered security threat model and establishes practical guidelines for deploying secure digital twins in IoT contexts. By highlighting the trade-offs between local and cloud-hosted twins, particularly in terms of vulnerability exposure, system observability, and trust enforcement, this work offers actionable insights for future IoT system designers, researchers, and practitioners in the digital twin domain.