TwinShield: A Dual-Gate Application Security Framework for Digital Twin Data Pipelines

Digital twins (DTs) keep a virtual model of a cyber-physical system (CPS) synchronized with its physical counterpart in real time. That link is only valuable if the twin can be trusted, and it is exposed to ma- nipulated telemetry, poisoned data streams, and insecure remote control. These threats are usually tackled one at a time, which leaves gaps across the data lifecycle. This paper presents TwinShield-Sync, a security mid- dleware that protects the full lifecycle in a single architecture. It combines lightweight telemetry attestation, privacy-preserving computation, tamper- evident record keeping, AI-based anomaly detection, and context-aware command validation. To test the approach, we built a prototype for an electric vehicle (EV) charging station using a Python-Flask backend, a Re- act web frontend, MongoDB Atlas, and an Ethereum-based ledger, with a design aligned to the Open Charge Point Protocol (OCPP).