G Lapouge

J Troccaz

P Poignet

Multi-rate unscented Kalman filtering for pose and curvature estimation in 3D ultrasound-guided needle steering

Keywords: Needle steering, Surgical robotics, Multi-rate unscented Kalman filter, 3D ultrasound imaging

This paper presents a new method for estimating the needle pose and curvature in the context of robotically steered needles. The needle tip trajectory is represented by a modified unicycle kinematic model. A multirate unscented Kalman filter is proposed for the first time in needle steering to fuse asynchronous data coming from 3D B-mode ultrasound images, robot sensors and pre-operative elastography measurements. To demonstrate it, 51 unconstrained 3D insertions have been made in various media. The instantaneous localisation error is smaller than 0.6 mm and the prediction of the final tip position is smaller than 2 mm based on the observation of the first 2 cm of 8 cm deep insertions.

Introduction to needle steering

In percutaneous operations, the needle is often inserted by the clinician under ultrasound (US) guidance. Because the clinical efficacy of such procedures is closely linked to the surgeon's ability to reach a specific target with a needle, robotically assisted needle guidance also referred to as "needle steering" has appeared and been the object of intensive research.

There are several ways to steer a needle in soft tissue. In this paper, the focus is put on beveltip needles which naturally bend when inserted in soft media. This phenomenon is due to the needletissue asymmetric interaction forces. This makes it possible for an expert practitioner to steer a needle to avoid an obstacle and to compensate for the tissue motion during the insertion. Such a deflection is however difficult to predict and to control manually, hence the need for surgical robotics.

One challenge in needle steering is to locate and estimate the current pose of the needle in images, for instance ultrasound volumes, and predict its future deflection. Solving this problem may rely on modelling the needle and developing an observer.

A first kinematic model is introduced in [START_REF] Webster | Nonholonomic Modeling of Needle Steering[END_REF]. It shows that bevel-tip needles follow a circular path when inserted in homogeneous phantoms. This model has been successfully used by many studies ( [START_REF] Abayazid | Ultrasound-guided threedimensional needle steering in biological tissue with curved surfaces[END_REF], [START_REF] Carriere | Real-time needle shape prediction in softtissue based on image segmentation and particle filtering[END_REF] and [START_REF] Patil | Needle Steering in 3-D Via Rapid Replanning[END_REF]). However, in most studies, the radius of curvature has been considered constant during the insertion with few exceptions. This radius of curvature is often obtained by prior insertions. Such an approach is incompatible with a clinical application.

The curvature of the needle depends on the stiffness of the tissue it penetrates. It has been studied in [START_REF] Moreira | Biomechanics-based curvature estimation for ultrasound-guided flexible needle steering in biological tissues[END_REF] where the curvature estimation is done both online and offline: online by doing pure insertions and fitting a circle with the acquired planar trajectory; offline with pre-operative elastography measurements. In [START_REF] Carriere | Real-time needle shape prediction in softtissue based on image segmentation and particle filtering[END_REF] a real-time needle shape prediction is proposed using a particle filter in the case of planar insertions. Unlike these studies, the solution detailed here is an estimator based on a fully 3Dcompatible kinematic model. It takes into account the elasticity of the media and does not constrain the insertion to be planar. Dynamic model-based deflection estimation has also been proposed for 2D [START_REF] Khadem | Ultrasound-Guided Model Predictive Control of Needle Steering in Biological Tissue[END_REF] and 3D [START_REF] Chevrie | Online prediction of needle shape deformation in moving soft tissues from visual feedback[END_REF] steering. The approach looks promising and has been validated using 2D ultrasound feedback [START_REF] Waine | Needle Tracking and Deflection Prediction for Robot-Assisted Needle Insertion Using 2d Ultrasound Images[END_REF].

With the exception of [START_REF] Chatelain | 3d ultrasoundguided robotic steering of a flexible needle via visual servoing[END_REF] and [START_REF] Mignon | Beveledtip needle-steering using 3d ultrasound, mechanicalbased Kalman filter and curvilinear ROI prediction[END_REF], there is to our knowledge no recent work about needle steering based solely on 3D B-mode US images. The reason lies in the strong presence of artefacts and noise of such images.

Needles are hard to detect when they are thin or are not perpendicular to the US probe plane [START_REF] Huang | Imaging Artifacts of Medical Instruments in Ultrasound-Guided Interventions[END_REF]. Many solutions ( [START_REF] Abayazid | Ultrasound-guided threedimensional needle steering in biological tissue with curved surfaces[END_REF], [START_REF] Fallahi | Sliding-based image-guided 3d needle steering in soft tissue[END_REF], [START_REF] Moreira | Biomechanics-based curvature estimation for ultrasound-guided flexible needle steering in biological tissues[END_REF], and [START_REF] Rossa | A data-driven soft sensor for needle deflection in heterogeneous tissue using just-in-time modelling[END_REF] among others) involve the use of a 2D probe that is translated to follow the needle tip. This solution to observe the needle also called 2.5D aims to keep the needle axis orthogonal to the imaging plane. In this way, the needle is always in the configuration of the maximum visibility and images are acquired at around 30Hz. Unfortunately, it is not practically feasible for most clinical operations. In addition, the movements of the probe may cause tissue deformation and may affect the needle deflection.

To avoid B-mode US imaging quality issues, Doppler mode imaging has also been exploited in [START_REF] Adebar | Recursive estimation of needle pose for control of 3d-ultrasound-guided robotic needle steering[END_REF] and in [START_REF] Mignon | Using rotation for steerable needle detection in 3d color-Doppler ultrasound images[END_REF]. Although the needle visibility is improved by this imaging modality, specific needle movements are required and the overall precision of this imaging mode is lower than that of B-mode imaging.

As detailed above, there exists a broad variety of solutions for needle pose estimation and prediction, each of them validated on different experimental setups. Therefore, a direct quantitative comparison is made difficult.An overview of some of the most relevant observers in needle steering can be found in Appendix A.

A clinically-compatible 3D US probe with a 1 Hz refresh rate is used here in B-mode. The limited quality of the images and low frame rate are compensated by the precise estimation of the next needle tip pose. It specifies a region of interest for the next segmentation and decreases the likelihood of losing the needle tip in US volumes.

In this paper, an observer taking all available data as input to estimate the needle tip position and predict its future deflection is proposed. A multi-rate approach has been selected to fuse the needle rotation and insertion information provided by the robot, and measurements deduced form the pre-operative shear wave elastography imaging and intra-operative B-mode US volumes. This paper is composed of two parts :

-In section 2, the advantages and limitations of the 3D ultrasound imaging are developed. The model chosen to describe the behaviour of the needle tip is detailed. The proposed observer is then presented.

-In section 3, the observer is first validated through simulation. Then, it is experimentally validated with 51 insertions made with various 24 gauge (0.51 mm diameter 1 ) needles with asymmetric tips. These insertions are made in phantoms and pork tissue samples.

Methods

As already mentioned, 3D ultrasound imaging and kinematic modelling of the needle are considered here. Based on these choices, the methods employed in this paper are detailed below.

3D Ultrasound Imaging

B-mode imaging

In this paper, a motorised end fire transrectal ultrasound probe represented in Figure 1 is set at a fixed position and works in B-mode imaging. 3D volumes are reconstructed from images acquired by rotating an array of piezoelectric transducers located in the probe head. The major drawback of such a setup is the limited image quality it provides. Indeed, when the needle is not orthogonal to the US emission direction, strong artefacts appear [START_REF] Huang | Imaging Artifacts of Medical Instruments in Ultrasound-Guided Interventions[END_REF].

The lack of visibility of fine needles in 3D US volumes is due to their shape. The US waves reflect on the needle smooth surface in one direction and do not hit the transducer back. One possible refinement for regular B-mode imaging would involve roughening the surface of the needle so that the US waves diffuse in all directions and reflect back to the transducer.

Clinically compatible solutions to roughen the needle surface exist such as micro laser etching [START_REF] Mignon | Automatic Robotic Steering of Flexible Needles from 3d Ultrasound Images in Phantoms and Ex Vivo Biological Tissue[END_REF]. However, because of the high complexity of this process, a non-clinical approach applied here is to coat needles with polyurethane foam [START_REF] Huang | Imaging Artifacts of Medical Instruments in Ultrasound-Guided Interventions[END_REF] (see Figure 2). 1 Unit conversion table available at https: //en.wikipedia.org/wiki/American_wire_gauge. Because the needle visibility depends on the needle position and distance to the transducer and the medium it penetrates, the discernibility of the needle is predictable. The visibility quality can be taken into account by the estimator through the measurement noise covariance matrix.

Shear wave elastography imaging

The second imaging modality used in this paper is shear wave elastography imaging (see Figure 3). The propagation of an acoustic radiation force impulse is observed and used to compute Young's Modulus of a soft tissue characterising its elasticity properties [START_REF] Bercoff | Supersonic shear imaging: a new technique for soft tissue elasticity mapping[END_REF]. The radius of curvature of the needle is correlated to the tissue elasticity properties. Therefore, shear wave elastography imaging (SWE) provides a rough measurement of the needle curvature.

Modified unicycle kinematic model

First introduced in [START_REF] Webster | Nonholonomic Modeling of Needle Steering[END_REF], the bicycle kinematic model has since been validated and embraced by most researchers in needle steering. A bevel-tip needle supposedly traces a circular path when inserted inside homogeneous tissues. The arc direction is related to the beveled tip orientation. However, when rotated at 180 • , the needle follows another arc that is not tangent to the previous path. The so-called cutting angle is defined as the angle between the tangents to the trajectory before and after the rotation (see Figure 4).

The bicycle model is replaced in [START_REF] Abayazid | Integrating Deflection Models and Image Feedback for Real-Time Flexible Needle Steering[END_REF] by a modified unicycle model including the cutting angle. This model is easy to implement, while representing a similar needle tip behaviour. Therefore, it has been chosen in this paper. The joint state-space representation of this kinematic model can be written as ẋ = f(x, u) verifying

          x y z α β γ κ           =           cos α cos β 0 sin β 0 cos β sin α 0 κ cos γ sec β + κ βcut 2 sin γ cos γ tan β -βcut 2 sin γ κ sin γ -κ βcut 2 cos γ cos γ tan β βcut 2 cos γ -κ cos γtanβ 1 0 0           u 1 u 2 (1)
where x, y, z are the Cartesian coordinates of the needle tip in the 3D US volume frame [mm]; α, β and γ are the yaw,pitch and roll of the needle tip [rad]; κ is the curvature of the needle tip trajectory [mm -1 ]. The inputs u 1 and u 2 correspond to the insertion speed [mm.s -1 ] and the rotation speed [rad.s -1 ] of the needle tip respectively. β cut is the cutting angle presented in Figure 4. β cut is deduced from data fitting done with several insertions. It varies from 0 • to 6 • and is proportional to the medium stiffness with low sensitivity and inversely proportional to the needle stiffness with high sensitivity. Because this calculation cannot be done in clinical procedures for each patient, β cut is assumed to be purely needle-related.

Multi-rate unscented Kalman filter

Multi-rate filtering

The state-space representation described in (1) is incorporated in an unscented Kalman filter that runs at 100Hz. For the sake of brevity, detailed explanation of the functioning of unscented Kalman filters can be found in [START_REF] Wan | The unscented Kalman filter for nonlinear estimation[END_REF] and detailed equations can be found in Appendix B.

The available measurements come from sensors with different sampling rates: about 1 Hz for 3D US imaging and 100 Hz for robot position sensors. Therefore, the needle tip Cartesian position is acquired every second, and the angle of rotation of the needle around its axis every 10 ms. In the hypothesis that the term "κ cos γ tanβ u 1 " in (1) remains small, the needle base rotation angle is a good estimate of the roll angle γ. Besides, pre-operative shear wave elastography (SWE) measurements can be considered asynchronously to obtain information on the radius of curvature of the needle. The asynchronous functioning is illustrated in Figure 5.

The measurement equation, when all measurements are available and the hypothesis are verified, can be written as To fuse asynchronous data, a multi-rate approach of the unscented Kalman filter as presented in [START_REF] Armesto | Multi-rate fusion with vision and inertial sensors[END_REF] is adapted here. The multi-rate unscented Kalman filter only takes the available measurements into consideration. Therefore, the matrices of the Kalman filter change size with respect to the measurements available at the current step time (indicated by an index ∆ in Appendix B).

h(x) = x y z γ κ (2)
For example, among 8 possibilities, h ∆ (x) = x y z if only the Cartesian position is measured , h ∆ (x) = [γ] if only the rotation is measured, and h ∆ (x) = x y z γ if both are measured. As for concerned matrices, the terms corresponding to unmeasured terms are removed.

Characterisation of measurement and process noise

Throughout the article, the segmented needle tip position is considered as a measure of the true needle tip position with zero mean gaussian noise. To characterize it, Cartesian coordinates provided by needle tip segmentation in 3D US volume have been found by doing 20 manual segmentations of the same tip pose located in the vicinity of the transducer. The resulting measurements showed a standard deviation (std) of 0.3 mm in each direction. The measurements -provided by the robot -of the needle base rotation have a std of 0.2 • . In addition, curvature measurement noise has been deduced from 51 insertions made in various phantoms with elasticity measured with SWE imaging. Assuming that the measurement noise is a white gaussian noise with zero mean, the covariance matrix of the observation noise is taken equal to

R = diag(σ 2 x σ 2 y σ 2 z σ 2 γ σ 2 κ ) with σ x = σ y = σ z = 0.3 mm σ γ = 3.5.10 -3 rad σ κ = 1.10 -3 mm -1 (3)
Based on the detailed study of the process noise made in [START_REF] Adebar | Recursive estimation of needle pose for control of 3d-ultrasound-guided robotic needle steering[END_REF], we have chosen the covariance matrix of the process noise as

Q = diag(q 2 x q 2 y q 2 z q 2 α q 2 β q 2 γ q 2 κ ) W ith q x = q y = q z = 2.10 -3 mm q α = q β = 2.10 -5 rad q γ = 5.10 -4 rad q κ = 2.10 -6 mm -1 (4)
The differences with [START_REF] Adebar | Recursive estimation of needle pose for control of 3d-ultrasound-guided robotic needle steering[END_REF] are introduced empirically to reflect the high frequency of the Kalman filter and the uncertain behaviour of very fine Nitinol needles. Again, the measurement noise is assumed to be white gaussian with a zero mean.

Matrix reset

When crossing the interface between two media with different elasticities, the radius of curvature of the needle path is expected to change. To detect such an interface, from the shear wave elasticity imaging, a map of tissue stiffness is acquired. Regions of similar elasticity can then be defined so as to divide the media into homogeneous partitions separated by these interfaces.

Because the error covariance matrix P defines how much the UKF trusts the current estimation, the diagonal term of P concerning κ is reset when crossing an interface. This expresses the expectation of a change in curvature and allows for a greater variation in the curvature estimation.

Considering minimal knowledge about the needle tip behaviour, P 0 , the initial value of P is defined as

P 0 = diag(p x p y p z p α p β p γ p κ ) with p x = p y = p z = 1mm p α = p β = 5.10 -3 rad p γ = 1.10 -1 rad p κ = 2.10 -6 mm -1 (5)
These values were chosen as the variance of an overestimated Gaussian initialisation noise (see Section 3.2 for more details on US volume-based initialisation).

The quality of the needle visualization in 3D US volumes strongly depends on its distance and orientation with respect to the ultrasound probe (see [START_REF] Reusz | Needlerelated ultrasound artifacts and their importance in anaesthetic practice[END_REF] for more details). Therefore, the terms corresponding to the Cartesian coordinates measurements of the matrix R are reset to take into account such a quality loss. Far from the transducer, the measurements are considered noisier and the corresponding terms are set at higher values.

Standard deviations of the Cartesian coordinates are reset such as

σ init c = (1 + a d dmax )σ c
, where c stands for either x, y or z. σ init c are the reinitialised standard deviations of the Cartesian coordinates. σ c are the ones found in the best measurement case and detailed in [START_REF] Adebar | Recursive estimation of needle pose for control of 3d-ultrasound-guided robotic needle steering[END_REF]. d is the distance between the segmented needle tip and the transducer. d max is the acquisition depth of the transducer (set to 8cm here). a ∈ R + reflects the quality loss of the signal set thanks to prior segmentations (set to 1 here after experimental trials).

Constraints

In the model introduced in (1), the curvature κ is defined as a positive real number bounded by κ max , the maximum curvature. To account for these restrictions, the estimated curvature is constrained with respect to

κ t = κ t if 0 ≤ κ t ≤ κ max κ t-1 else
κ t being the current curvature estimation at time t and κ t-1 the previous estimation.

Although for all simulations and insertions, the curvature has always converged without any blow up. Such a constraint may not only limit the possible overshoot in curvature estimation, but also prevents the estimated curvature from becoming negative when the real curvature is close to zero.

Results

Simulation

State and measurements

The simulations help validate the robustness of the observer by comparing the estimation of the needle tip pose to the real tip pose. The simulation of the needle behaviour relies on the model described in (1) running at 100 Hz. The measurement vector of varying size is described in [START_REF] Abayazid | Integrating Deflection Models and Image Feedback for Real-Time Flexible Needle Steering[END_REF]. A zero mean gaussian noise vector is added to the state and measurement vectors with the standard deviations described in ( 3) and ( 4).

Initialisation

To evaluate the effect of state initialisation on the error of the final tip position estimation, simulations with various initialisation error values on both the orientation of the tip and the curvature were run.

The error on the final tip Cartesian position depicted in Figure 6 shows a fast convergence of the estimator despite a high error in initialised orientation. It is compensated after 20 mm of observation.

On the other hand, a wrong initialisation of the radius of curvature induces a slow convergence of the final position estimation error.

An accurate initialisation of the radius of curvature is therefore crucial compared to orientation initialisation.

Performance of the estimation

To characterise the performance of the proposed solution, 100 pure insertions at 1.5 mm.s -1 have been simulated.

The estimator values are initialised as the first measurement for all parameters when available. α and β are initialised with their real values added to a 5 • std white gaussian noise.

The mean posture estimation errors reported in Table 1 show a good estimation of the needle tip trajectory. The average error is equal to 0.3 mm in position corresponding to the measurement noise and less than 1 The final tip position estimation error depicted in Figure 6 decreases with the number of measurements and the depth of observation. It is sensitive to the initialisation of the filter, mostly to α, β, γ and κ. The threshold for good prediction is chosen to match the mean spatial resolution of the US probe used here, equal to 2 mm. The mean prediction error becomes satisfactory after 40 mm of insertion. This estimator is therefore robust to large initialisation error and provides sufficient estimation quality after observing 40% of the insertion length in the worst scenario possible. The estimation can then be used as feedback to steer the needle more precisely.

Effect of rotations on the estimation

One of the advantages of this observer is that it does not constrain the needle path to be composed of circular arcs or to be a single-plane motion. Nonetheless, if the needle rotates very fast around its axis, the apparent radius of curvature is null. No information about the curvature parameter κ can then be deduced from the insertion. This lack of information on the curvature also happens when the needle is rotated at 180 • for similar reasons. The filter ability to estimate parameters remains linked to the control inputs. Such an effect can be quantified by simulating insertions with various needle rotation speeds u 2 and with orientation changes.

Figure 7b shows the temporal evolution of the diagonal term of P corresponding to the error covariance of κ. Faster rotations induce a slower convergence of this term, thus a slower estimation of the real curvature (cf. Figure 7a) which may decrease the precision of the estimation. Instantaneous rotations close to 180 • also induce lag on the estimation. The convergence of the observer concerning the other state variables are not affected by the rotations in a significant way. (blue), 0.19 rad.s -1 (red) and 0.28 rad.s -1 (black).

Heterogeneous media

During a percutaneous procedure, the needle will go through tissues with various elasticities. The stiffer the medium is, the more efforts will be exerted at the needle tip and the higher the curvature will be. To account for these elasticity changes, the matrix reset is proposed in Section 2.3.

To simulate such a change in tissue elasticity, simulations in which the actual radius of curvature is a step function have been run. As plotted in Figure 8, the observer converges towards the new curvature with a speed and stability linked to the initialisation of the corresponding term in P. The higher P κκ is initialised, the faster the observer converges towards κ at the cost of precision.

Experiments

Experimental setup and procedures

The system is composed of a robot holding the needle to insert it in a phantom. The insertion is observed with a 3D probe as depicted in Figure 9. The robot used for needle insertion has been developed by Hungr [START_REF] Hungr | A 3-D ultrasound robotic prostate brachytherapy system with prostate motion tracking[END_REF] for prostate brachytherapy. The ultrasound volumes are acquired every second with a 3D end-fire probe 4DEC-9/10 used with the Ultrasonix Sonix RP ultrasound system. The US volume voxels are cubes with 0.4 mm edges. The parameters defining the scaling of the unscented Kalman filter are classically chosen such that α U KF = 0.001,

κ U KF = 0, β U KF = 2.
The proposed observer was implemented in the CamiTK framework [START_REF] Fouard | CamiTK: A Modular Framework Integrating Visualization, Image Processing and Biomechanical Modeling[END_REF]. It was coded in C++ with the help of the Eigen library known for its efficiency to cope with size varying matrices. Running on an Intel R Xeon R E3-1240 processor at 3.50 GHz, an iteration of the multi-rate Unscented Kalman filter takes 2.8 ± 0.5 ms. This is compatible with the 100 Hz refresh rate presented here.

A first set of phantoms has been made with paraffin gel mixed with a polymer additive called Vybar to achieve different elasticities. These phantoms were used for 6 cm deep insertions. Deeper than this, the US waves were absorbed by the material. A second set of phantoms is made with Agar (Sigma A-7002) with varying concentrations (1% 2% and 5% of the water weight) for a variable stiffness. The good US propagation in such phantoms allowed for 9 cm needle insertions. Three different 24 gauge needles have been inserted at 1.5 mm.s -1 in several media and with various rotation schemes to validate the robustness of the estimator with 51 insertions. The rotation speed of the needle is chosen as either zero, piecewise constant, or peaks corresponding to a quick orientation changes of the needle around its axis.

For all insertions, the hypothesis concerning γ and formulated in Section 2.3 was verified as illustrated in Figure 11a. Indeed, let's set γ1 = κ cos γtanβu 1 (cf. ( 1)) and γ = γ1 +u 2 . Then, when a rotation speed is applied, u 2 γ1 and γ ≈ u 2 . Besides, when the rotation speed is null, the term γ1 is negligible when compared to possible needle torsion or other angles evolutions. It is therefore considered γ = u 2 and γ is taken as equal to the needle base rotation angle. The needle tip was segmented manually to define the real tip position. Because the ground truth is unknown, the Cartesian error is computed considering the segmented tip as the real needle tip position.

Initialisation

State initialisation is achieved by segmenting a visible small length of needle in a pre-insertion US volume. The segmentation result is an Euclidean vector pointing from the needle's visible base to its tip. From this vector, the initial Cartesian position of the needle, its yaw and pitch are deduced. The bevel-tip rotation is initialised as the robot corresponding sensor measurement. Curvature initialisation relies on elastography using the relation between tissue elasticity and curvature similarly to [START_REF] Moreira | Biomechanics-based curvature estimation for ultrasound-guided flexible needle steering in biological tissues[END_REF] and deduced from prior insertions in phantoms with known elasticity. The error and the observation noise covariance matrices follows the reset protocol described in Section 2.3.

Insertions in homogeneous phantoms

For preliminary experimental validation, 41 insertions have been made in homogeneous phantoms.

A first example of insertion is shown in Figure 10 2 while four insertions are detailed in Figure 11. Estimation error results can be found in Table 2 and Figure 12. Again, these results are not restricted to planar trajectories, they concern all kind of 3D insertions.

As seen in Table 2, the error varies with the medium and the needle material used. Difference in performance among the different media and needles might be explained by their properties. First, the needle is more distinguishable in water-based media such as Agar that provide better US image quality than paraffin. Finally, insertions with higher curvature are likely to behave more randomly. The difference in performance with the simulations (cf. Table 1) may be explained by the difference in the calculation of the error itself. Indeed, the error here is deduced only from noisy measurements and not the unavailable ground truth. Using the same mean of calculation for simulated insertions entails similar error values.

2 Detailed video of the insertion available at https:// youtu.be/bVWG8aIJp5A. A slight difference can be observed between the estimated tip path and the final needle pose. This expected difference shows that the needle body does not exactly follow the needle tip. 11). Developed in the CamiTK framework [START_REF] Fouard | CamiTK: A Modular Framework Integrating Visualization, Image Processing and Biomechanical Modeling[END_REF].

These instantaneous localisation results represent an improvement on the 3D US based method developed in [START_REF] Mignon | Beveledtip needle-steering using 3d ultrasound, mechanicalbased Kalman filter and curvilinear ROI prediction[END_REF]. Besides, the results are on par with [START_REF] Chevrie | Online prediction of needle shape deformation in moving soft tissues from visual feedback[END_REF] and [START_REF] Moreira | Biomechanics-based curvature estimation for ultrasound-guided flexible needle steering in biological tissues[END_REF] in spite of the better image quality provided by the corresponding sensors (see Appendix A for more details).

The mean prediction error of the final tip position, plotted in Figure 12, is smaller than 2 mm after observing the two first centimetres of the insertion. The estimator performance is therefore satisfying for prediction starting from 25% of the total insertion length. In spite of more difficult conditions (thin needles, 3D steering, 3D US), these prediction results seem to be more satisfactory than those in [START_REF] Carriere | Real-time needle shape prediction in softtissue based on image segmentation and particle filtering[END_REF] and [START_REF] Waine | Needle Tracking and Deflection Prediction for Robot-Assisted Needle Insertion Using 2d Ultrasound Images[END_REF]. However this comparison must be put into perspective, as the insertion length and experimental setup differ from these works (see Appendix A for more details).

Insertions in heterogeneous phantoms

Heterogeneous media may have variable stiffnesses which modify the radius of curvature of the needle path. A set of two-layer phantoms has been made using different concentrations of Agar (shown in Figure 3a). Using pre-operative measurements of the phantom elasticity, the matrix resetting described in Section 2.3 is applied: P is reset at the interface between two layers while R is reset continuously.

A curvature estimation done on a two-layer Agar phantom is plotted in Figure 13. The needle is inserted in the softer part of the Agar phantom. The needle tip then penetrates into the second layer after 34 mm of insertion. Performance wise, the matrix reset process induced a faster convergence of the curvature estimation. Using pre-operative elastography measurements, the final tip deflection estimation error decreases from 5.8 mm to 2.2 mm. Without knowledge of where the elasticity changes, the observer converges anyway but slowly. The instantaneous tip estimation remains similar while the prediction quality decreases.

Insertions in biological tissue

Phantoms and biological tissues have different mechanical properties. A first step towards clinical validation of the presented solution is to experiment on biological tissue. To do so, 10 insertions have been made in pork tenderloin and liver with 24 gauge beveled-tip nitinol needles. The overall performance of the estimator remains very close to the case of homogeneous-phantom insertions presented in Table 2. Indeed, the instantaneous error on the tip position estimation is equal to 0.69 ± 0.34 mm which is comparable to the paraffin results. The decrease in performance can be explained by the media properties: biological tissues contain fibres and heterogeneities that may induce a higher randomness of the needle behaviour.

As detailed above, the observer is compatible with biological tissue insertions. This is very promising for future clinical applications.

Concluding remarks

This paper presents an observer capable of estimating the needle pose and curvature, compatible with 3D needle steering and 3D US probes used in B-mode. As already mentioned, unlike in [START_REF] Moreira | Biomechanics-based curvature estimation for ultrasound-guided flexible needle steering in biological tissues[END_REF] or [START_REF] Rossa | A data-driven soft sensor for needle deflection in heterogeneous tissue using just-in-time modelling[END_REF], the proposed solution does not constrain the needle movement. Besides, it is among the few existing works with [START_REF] Chatelain | 3d ultrasoundguided robotic steering of a flexible needle via visual servoing[END_REF] and [START_REF] Mignon | Beveledtip needle-steering using 3d ultrasound, mechanicalbased Kalman filter and curvilinear ROI prediction[END_REF] to work with 3D B-mode US imaging.

The observer fuses asynchronous information coming from the robot, the US imaging system and shear wave elastography measurements. The orientation, curvature and position of the needle tip are . 24 G Nitinol needle inserted in phantoms: 5% Agar phantom (blue, green), 1% Agar phantom (black) or heterogeneous 1% and 5% Agar phantom (red). The error is computed as the difference between the estimation and the measurements. estimated in real time by a multi-rate unscented Kalman filter based on a modified unicycle kinematic model of the needle. Because the probe used in this study is not compatible with shear wave elastography imaging, the elastography measurements presented here are pre-operative. However, the estimator is compatible with intra-operative asynchronous elastography measurements that will be implemented in future research.

The average precision of this method is equal to 0.6±0.3 mm for instantaneous tip position estimation error. The final tip position is estimated with an error equal to 1.7±1.2 mm after observing the first 2 cm of the insertion. The precision of the instantaneous tip position estimation is on par with the works described in [START_REF] Chevrie | Online prediction of needle shape deformation in moving soft tissues from visual feedback[END_REF] and is more satisfactory than the results on 3D US imaging presented in [START_REF] Mignon | Beveledtip needle-steering using 3d ultrasound, mechanicalbased Kalman filter and curvilinear ROI prediction[END_REF]. The final deflection prediction is satisfactory and fully characterised. Its precision is seemingly better that the one presented in [START_REF] Waine | Needle Tracking and Deflection Prediction for Robot-Assisted Needle Insertion Using 2d Ultrasound Images[END_REF] although with ent experimental setups. All the errors computed in the experimental section are obtained by comparison to manual segmentation since the ground truth is not available. The true precision of the system might be higher than what is presented.

The experimental validation done through 51 insertions with different needles in various media has allowed to characterise the uncertainties of the estimation and validate the robustness of the presented solution.

The proposed filtering improves targeting. Indeed, knowing both the needle deflection and the precision of the prediction, adapted control laws can be designed. These control laws could use the information on the uncertainties to propose a robust steering. Path planning could also benefit from additional information on tissue elasticity.

Future research will focus on the integration of the current results in a robust control law. Methods for precise segmentation of the needle tip in noisy 3D US volumes using the estimation results will also be developed. Predict sigma points

X i,k|k-1 = f(X i,k-1|k-1 , u)
With f(x, u) detailed in eq.( 1).

Figure 1 :

 1 Figure 1: 3D volume (in red) acquired by a motorised endfire transrectal ultrasound probe. The sweep direction of the transducer is indicated by an arrow.

Figure 2 :

 2 Figure 2: 2D US acquisitions of needles inserted in soft tissue. The needle body is represented by a red frame and the needle tip by an orange cross. The use of polyurethane coating improves the needle visibility.

Figure 3 :

 3 Figure 3: Shear wave elastography images of an Agar phantom with different elasticities. The red part is stiffer than the blue part.

Figure 4 :

 4 Figure 4: Needle tip behaviour following the modified unicycle kinematic model. Insertion with an instantaneous rotation of 180 • . Trajectory in red, βcut is the cutting angle presented in 2.2, κ is the curvature of the needle path.

Figure 5 :

 5 Figure 5: Proposed structure of the multi-rate unscented Kalman filter. Data flows are represented by arrows. Refresh rates are indicated in red when specifiable.

Figure 6 :

 6 Figure 6: Evolution of the final position prediction error with the depth of observation. Zero mean gaussian noises on orientation and curvature initialization are applied and act on the filter convergence speed. The results are obtained over 100 simulated insertions.

  Evolution of the curvature estimation (dotted lines) compared to the ground truth (line) as a function of time. Convergence of the estimation error covariance term corresponding to κ as a function of time.

Figure 7 :

 7 Figure7: Simulated curvature estimation for an insertion speed u 1 of 1.5 mm.s -1 . Variable rotation speeds u 2 are applied: no rotation (green); 180 • orientation change at t = 25 s (purple); constant rotation speed u 2 of 0.09 rad.s -1 (blue), 0.19 rad.s -1 (red) and 0.28 rad.s -1 (black).

  Curvature estimation (dotted line) compared to the ground truth (line) and noisy measurements from elastography (asterisk).

  Evolution of the covariance matrix term corresponding to κ as a function of time.

Figure 8 :

 8 Figure 8: Simulation of curvature estimation in heterogeneous media. In green, classic reset of Pκκ. In red, ten times greater reset of Pκκ.

Figure 9 :

 9 Figure 9: Experimental setup composed of the Prosper Robot (1), 3D US imaging system (2), Beveled-tip needle (3) and Pork tissue incorporated in Agar (4).

#Table 2 :

 2 of insertions Emean(mm) Estd(mm) Emax(mm) Instantaneous tip position estimation error. S-BT : Steel bevel-tip needle, N-BT : Nitinol bevel-tip needle, S-PC : Steel pre-curved needle.

Figure 10 :

 10 Figure 10: 3D US volume of a needle inserted in an Agar phantom. The volume is represented by three planar sections. Estimated needle tip path represented by the green curve (for detailed data, see green curve in Figure11). Developed in the CamiTK framework[START_REF] Fouard | CamiTK: A Modular Framework Integrating Visualization, Image Processing and Biomechanical Modeling[END_REF].

  Evolution of the needle tip state. Measured (dots) and estimated (curves) Corresponding instantaneous Cartesian estimation error and rotation input u2.

Figure 11 :

 11 Figure11: Estimation of the needle tip state for four independent 3D insertions at the insertion speed u 1 = 1.5 mm.s -1 . 24 G Nitinol needle inserted in phantoms: 5% Agar phantom (blue, green), 1% Agar phantom (black) or heterogeneous 1% and 5% Agar phantom (red). The error is computed as the difference between the estimation and the measurements.

Figure 12 :Figure 13 :

 1213 Figure 12: Mean prediction error of the final tip position (± std) as a function of the observed depth of insertion.

P 3 .

 3 n + λ) + (1 -α 2 + β) Wi m = Wi c = 1/(2(n + λ)) λ = α 2 (n + κ) -n. i = 1, .., 2n. α, β and κ are scaling parameters introduced in 3.2. k and R k being calculated as detailed in 2.Calculate sigma pointsX 0,k-1|k-1 = xk-1|k-1 X i,k-1|k-1 = xk-1|k-1 + (n + λ)P k-1|k-1 i X i+n,k-1|k-1 = xk-1|k-1 -(n + λ)P k-1|k-1 i(M)i is the i th column of the matrix M.

i=0 1 X i,k|k- 1 - 1 )i=0

 111 Wi c X i,k|k-1 -xk|k-With h(x) detailed in eq.(2). ∆ indicates the matrices that change size accordingly to the measurements. Only the sigma points of the available measurements are calculated and propagated.Wi c [Xi(k|k -1) -x(k|k -1)] κk|k ≤ κmax κk-1|k-1 else nb: x is the state estimate. y is the measurement vector.

Table 1 :

 1 • in orientation. Instantaneous state estimation error deduced from 100 simulations. Mean, standard deviation and maximum error values are reported.

		Mean	Std	Max
	E x,y,z (mm)	0.3	0.1	1.3
	E α ( • )	0.6	1.1	16.4
	E β ( • )	0.9	1.1	11.5
	E κ (mm -1 )	0.0007	0.0006	0.0136

Acknowledgements

This work was partly supported by the Investissements d'Avenir programme (Labex CAMI) under reference ANR-11-LABX-0004.

*Prediction error calculated after observing 25% of the insertion length.


Da Mathieu

Emanuele Silva
email: mdasilva@lirmm.fr

Marie-Lise Valea
email: valea@lirmm.fr

Giorgio Di Flottes
email: flottes@lirmm.fr

Bruno Natale
email: dinatale@lirmm.fr

Rouzeyre
email: rouzeyre@lirmm.fr

Stream cipher-based scan encryption in test standards

Keywords: Security, Scan Attacks, Stream Cipher, Scan Encryption

Scan chains offer facilities to steal secret information embedded in a circuit. For instance on a crypto-processor, collecting data related to the round register leads to reveal the secret key used for encryption. To protect against this threat while maintaining the test and debug features, countermeasures are implemented on the test interface or on the scan chain itself. Among the countermeasures, some of them are based on stream ciphers, consisting in the encryption of both controlled and observed data in the scan chain. We show in this paper that the stream cipher protection presents vulnerabilities if the keystream generated by the stream cipher is identical after a reset.

Introduction

To ensure quality and reliability of integrated circuits (ICs), a design approach called Design-for-Testability (DfT) is used for providing testability on the circuit under test. The common DfT solution is the insertion of scan chains, which consists in replacing original flip-flops (FFs) by so-called scan FFs organized in shift-registers during the test phase. At test time, internal states of the circuit are controlled and observed by the serial input/output of the scan chain. The access to the scan chains is ensured by test interfaces. Several standards exist: IEEE 1149.1 0 also known as JTAG for board testing, IEEE 1500 [START_REF]IEEE Standard Testability Method for Embedded Core-based Integrated Circuits[END_REF] for SoC testing, and IEEE 1687 [START_REF]IEEE Standard for Access and Control of Instrumentation Embedded within a Semiconductor Device[END_REF] also known as IJTAG for embedded instruments testing.

While full control and observation on the internal states ensure testability, this is at the expense of security. For IC containing secret information, an attacker is able to exploit scanned out data in order to retrieve secret data, in particular the secret key of crypto-processors.

For instance on the Advanced Encryption Standard (AES [START_REF] Daemen | The Design of Rijndael[END_REF]), the scan attack consists in observing the data stored in the round register by shifting out the scan chain content after the execution of the first round. It is assumed that the attacker knows the details of the encryption algorithm, and he has full control and observation of the scan chain. Yang et al. [START_REF] Yang | Secure scan: a design-fortest architecture for crypto chips[END_REF] have presented the scan attack on AES. Improved scan attacks [6][7] have also been proposed to deal with more advanced DfT structure such as partial scan, response compactor, X-masking when the round register is not entirely observable.

The encryption of the test communication is a solution proposed to protect the test interface or the scan chains. Only authorized user with the knowledge of the secret key can read and send data to scan chains through the test interface. The scan chain content is either encrypted with lightweight block ciphers as in [START_REF] Da Silva | Scan chain encryption for the test, diagnosis and debug of secure circuits[END_REF] [START_REF] Da Silva | Experimentations on scan chain encryption with PRESENT[END_REF], or, with stream cipher in [START_REF] Rosenfeld | Attacks and defenses for JTAG[END_REF] [START_REF] Rosenfeld | Security-aware SoC test access mechanisms[END_REF] [START_REF] Kan | Echeloned IJTAG data protection[END_REF]. The choice of stream cipher vs block cipher is motivated by the expected smaller area overhead, and there are no issues about padding test data into block size as in the former. Stream ciphers generate a keystream from a secret key and an initial value (IV). The plaintext is XORed with the keystream in order to generate the ciphertext.

In this paper, we show how an attacker is able to carry out scan attacks even if a stream cipher encrypts the test communication. The remainder of this paper is organized as follows. Section II recalls the principle of the scan attacks on AES. Section III summarizes the state of the art on the protection based on stream ciphers. Section IV presents the differential attack on countermeasures based on stream cipher. Finally, Section V concludes the paper.

Scan chain attack

The attack procedure in [START_REF] Yang | Secure scan: a design-fortest architecture for crypto chips[END_REF] consists in applying a plaintext during one clock cycle, corresponding to the first round of the AES. The attacker switches the circuit to test mode in order to scan out the partially encrypted result stored in the round register. These steps are repeated until the 128bits key is revealed. The applied plaintexts are closely selected by pairs with a difference of one bit, due to a property highlighted in [START_REF] Yang | Secure scan: a design-fortest architecture for crypto chips[END_REF]. When only one bit differs between two plaintexts, the property allows identifying a key byte uniquely if the Hamming distance between the two results obtained after one AES round is equal to 9, 12, 23 or 24. The attack strategy is thus to try pairs of plaintext until the difference between two intermediate results allows the attacker to determine a key byte. The attacker repeats the attack for every key byte to retrieve the entire AES key. On average, 32 plaintexts are required to determine a key byte. Overall, an attacker needs to apply an average of 512 plaintexts to retrieve the secret key.

State of the art on stream cipher-based countermeasures

In [START_REF] Rosenfeld | Attacks and defenses for JTAG[END_REF], the authors propose the use of a Trivium [START_REF] De Canniere | TRIVIUM Specifications. ECRYPT Stream Cipher Project[END_REF] stream cipher in order to encrypt the content of the JTAG communication. This countermeasure is proposed to cope with attackers observing and controlling the test interface, and also against malicious devices in the JTAG chain. In addition to the data confidentiality ensured by encryption, the device authentication is ensured with a challenge/response protocol, and the message integrity is ensured too with the keyed-hash message authentication code (HMAC). The stream cipher is initialized by an IV hard-coded with fuses, and a secret key that is the response to a challenge sent by a user. An authorized user knows the response to any challenge. Conversely, an unauthorized user without the knowledge of the secret key (i.e. challenge/response pairs) should not be supposed to carry out scan attacks due to the encrypted bitstream.

The solution proposed in [START_REF] Rosenfeld | Security-aware SoC test access mechanisms[END_REF] is to protect cores against a malicious core inside the SoC. The countermeasure consists in encrypting test data of individual cores, preventing observation and control by the other cores. The tester generates a random key in order to encrypt parallel test data shifting through the specific core, thanks to a Trivium stream cipher. This key is shifted to the core via a parallel chain non-visible from other cores. The IV configuration is not described by the authors.

Stream ciphers are also used on IJTAG reconfigurable scan network (RSN) in [START_REF] Kan | Echeloned IJTAG data protection[END_REF]. A Trivium cipher encrypts the bitstream in order to protect against malicious embedded instruments. This solution aims also at protecting against external attacker wanting to use illegally embedded instruments. In order to achieve the required protection, other security features are present: (i) stub chains making difficult to unlock the Segment Insertion Bit (SIB) from an attacker without the knowledge of the RSN structure, (ii) a chain checker detecting too many shifts from an attacker trying to guess the RSN architecture. Concerning the Trivum cipher, the secret key is configured with fuses and the IV configuration is not described.

Differential attack applied on stream cipher-based protection

The differential scan attack can still be applied on these countermeasures based on stream ciphers. For the attack, we assume that the attacker is external to the chip and is able to control and observe the test interface. The test communication is encrypted with a stream cipher whose the secret key is unknown from the attacker. After the initialization of the stream cipher, the test data are XORed with the keystream. The mode of is as follows: at , the test response is XORed with the keystream generated from an initial value and a secret key . The differential attack consists in collecting the first encrypted response , then after a reset of the circuit, collecting the second encrypted response . The reset causes the reinitialization of the generated keystream from the stream cipher. Therefore, if the stream cipher generates the same keystream, i.e., if the key and IV do not change after a reset ( and ), the difference between the two encrypted responses removes the impact of the stream cipher encryption since . The scan attack described in [START_REF] Yang | Secure scan: a design-fortest architecture for crypto chips[END_REF] is thus applicable since it relies on calculating the Hamming distance between the two encrypted responses.

Thus, the differential attack circumvents the countermeasures based on stream ciphers ( [START_REF] Rosenfeld | Attacks and defenses for JTAG[END_REF], [START_REF] Rosenfeld | Security-aware SoC test access mechanisms[END_REF], [START_REF] Kan | Echeloned IJTAG data protection[END_REF]). The feasibility of the attack relies on the fact that the key and IV are kept the same after a reset. Thus, the IV or the key have to be different after a reset in order to prevent the differential attack. The main issue in changing the IV or the key is to share the different values to the authorized testers in order to decrypt the encrypted responses with the corresponding key and IV.

In [START_REF] Rosenfeld | Attacks and defenses for JTAG[END_REF], since the IV is hard-coded with fuses and the secret key is the response to a challenge sent by the user, the attacker needs to send the same challenge twice to carry out the differential scan attack. Even if the attacker does not know the response to the challenge sent, i.e. the secret key, the stream cipher will generate the same keystream for two different responses. The protection with the stream cipher encryption is thus insufficient against an external attacker. The solution can protect, nevertheless, against malicious device in the JTAG daisy chain, since a malicious device can only sniff or modify encrypted test data without controlling the reset of the stream cipher.

The solutions proposed in [START_REF] Rosenfeld | Security-aware SoC test access mechanisms[END_REF] for IEEE 1500 and [START_REF] Kan | Echeloned IJTAG data protection[END_REF] for IJTAG encrypt the test data. Since the IV configuration is not described by the authors, it can be assumed that the IV is fixed. An external attacker can therefore carry out the differential attack on encrypted test data, since the key is fixed in [START_REF] Kan | Echeloned IJTAG data protection[END_REF] and provided by the user in [START_REF] Rosenfeld | Security-aware SoC test access mechanisms[END_REF]. The proposed protections based on stream cipher are mainly intended to protect against an insider in the circuit, which cannot perform the differential attack due to the non-control of stream cipher reset. The solution is strictly restricted against this threat model and cannot be extended to an external attacker, unless adding extra security features like in [START_REF] Kan | Echeloned IJTAG data protection[END_REF].

Conclusions

Scan attacks are a threat against secure circuits. Some countermeasures are based on the bitstream encryption through a stream cipher. In this paper, we describe a differential attack circumventing this protection. To make this attack ineffective, the key or the IV needs to change after a reset of the stream cipher. In this case, this poses an issue of sharing the changed values of IV or key to the authorized tester needing to decrypt the test responses.


Clément Genty

Henri Samier

Simon Richir

Simon Richir Finding

Finding Yourself on the Internet : proposing a Fait and Reliable System

Keywords:

come   L'archive ouverte pluridisciplinaire

Introduction

1957. The Americans are taken by surprise on the occasion of the launch of the Soviet satellite Sputnik. By reaction and also by ego, they created the ARPA 1 , an agency specialized in the technological development of the United States of America. In order to communicate between sites, a US academic, J.C.R. Lickider, imagine a wired network and destined for the army. The project will become ARPANet, for ARPA Network. Access to information on the network that will become the Internet is done through IP addresses that had to be retained. In addition, each change of server entailed a modification of its corresponding address and it was thus necessary to be informed of these: a file 'host.txt', similar to the yellow pages, transited between the participants of the network.

In 1985, an alphanumeric cache system was set up for IP addresses: the Domain Name System. In addition to making the paths easy to remember, it was possible to change the IP address without the end-user having to worry about it. Divided into two categories, domain names are generic (.COM, .NET, .ORG, ...) or country-code (.FR, .UK, .DE, ...) [START_REF] Postel | RFC1591, Domain Name System Structure and Delegation[END_REF].

Based on a standard naming two-character territories, country domain names were the subject of delegation problems imputed to the goodwill of the person in charge of an entity that did not have a name and who depended on only one employee, Jon Postel.

Thus some extensions were and are now delegated by people with no strong links to the country in question: if the .PN was managed for a time by a radio amateur such as .TF by an Englishman, the .NA is still delegated to a German gynecologist. Similarly, many African ccTLDs are managed by an American, unrelated to the countries concerned [START_REF] Genty | Nomde domaine et marques d'entreprise : de la disruption des politiques de nommage à celle des usages[END_REF].

At the same time, the management of the Domain Name System by ICANN, an American organization and until some months, dependent of the US government, caused some problems. Snowden's revelations will only make things worse. Recently, China proposed a personal root, described in the RFC "DNS extension for autonomous Internet" [START_REF] Mueller | Will the Internet Fragment ? Politybooks[END_REF]. Russia, through the political sphere, also highlighted this need for digital sovereignty.

The alternatives of the Domain Name System by ICANN must describe their functioning according to three main points:

• Internet Governance • Economic model • Naming charter
Initiatives exist and still exist: Net4D, invented and developed by Dr. Francis Muguet knew its hour of glory from its presentation in 2007 to the death of the author in 2009. The use of the 'classes' to designate servers was an innovation carried out by Africa, adept at co-development, but criticized by some specialists of the DNS [START_REF] Bortzmeyer | Le projet Net4D d'utilisation des classes DNS[END_REF]. Net4D governance was one of the many benefits of this proposal, with countries around the world managing the proposed organization.

An alternative root to that of ICANN was proposed by a company called Openroot, founded by Louis Pouzin, a famous engineer, creator of the datagram and the origin of the Cyclades network. This company still exists but can not develop until browsers and end users can switch between roots.

In addition to the American domination of domain name management, the fact that anyone could record anything was a problem. Indeed, anyone can file unitedstates.com or Trump.com without being worried. The opening of the new extensions, known as gTLDs, received many crises, including that of the first ICANN president, Esther Dyson in 1998, or DNS engineers.

The monetization of domain names makes it a real intangible asset while the cost of this digital tool was zero in the 1980s. Registration was free. Generated costs and the first come, only served rule created an important speculative market. Brands, administrative entities and individuals are the main victims. The example of cybersquatting with the business of BLOOMBERG.MARKET and VINCI.GROUP are two examples: 30 € and a little ingenuity are enough to waver these two companies worldwide by creating false rumors, causing a decrease of their Stocks.

The life and reign of Mathias Corvin, king of Hungary, saw several turnovers occur during his 32 years of sovereignty [CEVINS, 2016]. The DNS celebrates this year its 32 candles. A reversal is always possible.

Thus, we can cite Eircode, an Irish alternative to the system of streets and numbers for the grid of space. A unique identifier allows the location of each building. Although thrusting in its development, Eircode is now accepted by all.

Similarly, blockchain technology, so promising with the cryptocurrency (Bitcoin, Dodgecoin, Litecoin, ...) can play an important role tomorrow as a DNS infrastructure.

Proposal

In this paper, we propose the introduction of a new TLD, presented at ICANN58, the .FX Representing metropolitan France according to the ISO 3166-1 alpha 2 code, it will thus serve to create a trusted space, where each holder of any right will be entitled to his space, according to a well-defined naming charter . Thus, an airport will be identified according to the subdomain .AEROPORT.FX, a tourism office by TOURISME.FX, a brand by TM.FX,… Each individual will also receive an e-mail address corresponding to this naming charter: firstname.name@france.fx In the case of homonymy, an automatic system for selecting the address from a drop-down list will be used. Any user can use this address, which will be the reference for the French state. A two-times every ten year update will ensure the continuity of management between those deceased and those who have renounced French nationality.