# Enhancing Resilience in Digital Twins: ASCON-Based Security Solutions for Industry 4.0
## 3 Proposed Solution
### Ditto Java Base Payload Mapping
This class integrates encryption/decryption functionality, ensuring data integrity and security during mapping. Finally, Ditto's connectivity microservice is configured to recognize and load the custom mapper, allowing seamless integration of specific data transformation requirements within the Ditto framework. Figure 3: Flow diagram for custom data encryption and decryption in Ditto. ### Sending Authenticated Encrypted Payload to Ditto

This section demonstrates the proof of concept securing the communication between the IoT device and the Digital Twin (Ditto) using the proposed solution. Figure 3(a) depicts a snapshot captured from the serial monitor output of the board (device) utilizing PlatformIO (embedded development framework). The image showcases the device transmitting an encrypted payload to the 'ut-sensors' topic while including additional data labeled as 'tid' to uniquely identify the device. In Figure 3(b), a captured packet during the communication is displayed. Upon observation, it becomes evident that the topic being utilized is 'ut-sensors', and the message section of the MQTT protocol header contains the device identifier along with the encrypted payload. MQTT broker, hosted on the same server as Ditto, acts as a proxy, facilitating the transmission of authenticated and encrypted payloads through a publish-subscribe model. Once the MQTT broker receives a payload, it notifies Ditto of the new message it has subscribed to. Ditto then retrieves the payload, decrypts it, and maps it into a Ditto protocol message, which is subsequently stored in a database. The communication process between devices and Ditto involves several key steps. Firstly, each device connected to Ditto is assigned a unique device ID, crucial for ASCON's associative input. Secondly, a shared symmetric key exists between the device and its corresponding Digital Twin. When a message needs to be sent, the sender encrypts the payload and publishes it using MQTT under a topic that includes the device's unique ID. Similarly, the device uses its ID to publish messages for Ditto, creating a connection between the sender and receiver. Upon reception, the receiver decrypts and authenticates the MQTT message payload using the preshared symmetric key, ensuring the message's integrity and origin. In cases with multiple IoT devices, the receiver retrieves the appropriate shared key using the device ID, thereby ensuring secure and authenticated communication. Encryption key management strategies for ASCON are crucial to ensure secure key distribution and storage, thereby enhancing the overall security posture of the proposed solution. ASCON employs symmetric encryption, where both encryption and decryption operations use the same secret key \(K\). Figure 4: Serial monitor of ESP32 board and Wireshark capturing communication between the device and Ditto (DT). ### Key Distribution Strategies in ASCON

3.8.1. Preshared Key (PSK)

In scenarios where devices have prior knowledge of each other, a preshared key \(K\) is securely distributed among them. Mathematically, this can be represented as

\[K=K_{\text{PSK}}\]

Here, \(K_{\text{PSK}}\) denotes the preshared key. 3.8.2. Key Exchange Protocols

For dynamic key distribution, ASCON can integrate with key exchange protocols such as Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman (ECDH). These protocols allow devices to establish a shared secret over an insecure channel, which can then be used as the encryption key \(K\). 3.8.3. Diffie-Hellman (DH)

Devices compute a shared secret \(K=g^{ab}\mod p\), where \(g\) is a generator, \(a\) and \(b\) are private keys of the communicating parties, and \(p\) is a large prime number. 3.8.4. Elliptic Curve Diffie-Hellman (ECDH)

Similar to DH but operates over elliptic curve groups, providing stronger security with smaller key sizes. 3.9. Key Storage Practices

3.9.1. Secure Storage

Once established, keys \(K\) are stored securely using cryptographic key storage mechanisms. This ensures that unauthorized access to keys is prevented.