Pablo Lujan

Jessica Angulo-Capel

Morgan Chabanon

Felix Campelo
email: felix.campelo@icfo.eu

Interorganelle communication and membrane shaping in the early secretory pathway

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The spatial compartmentalization of cellular functions is a hallmark of eukaryotic cells. The efficiency by which these cells coped with increasingly complex functions was evolutionarily achieved by the appearance of membrane-bound organelles, which ensure a tight spatial and temporal regulation of intracellular biochemical reactions. A direct consequence of intracellular compartmentation is that each organelle has a well-controlled and well-defined biochemical composition (organelle identity). Another consequence is the functional importance of the morphology of these organelles, which is controlled by the tight interaction between membrane mechanics, composition, and cellular biophysics (organelle shaping). Situations where organelle identity and/or shape are compromised can have extreme physiological and pathophysiological consequences.

Importantly, the notion that intracellular organelles are independent entities working as distinct functional modules has been refuted in the last decades with the discovery of new means of interorganelle communication and functional crosstalk. Here, we review some recent advances on how inter-organelle communication controls the shape, identity, and export function of the two main organelles of the early secretory pathway: the endoplasmic reticulum (ER) and the Golgi complex.

General principles of inter-organelle communication

Organelles have different ways of communicating to one another (Table 1):

Inter-organelle signaling. This indirect, long-range mode of communication is mediated by signaling molecules and occurs without the physical proximity of the two organelles. On the global cellular scale, organelles can use mechanical cues arising from the cytoskeleton or the extracellular matrix to communicate to one another (mechanotransduction). For example, the Golgi-associated small GTPase Arf1 can be activated downstream of integrin-based cell-matrix adhesions, thereby impacting on Golgi organization and function [START_REF] Singh | Cell-matrix adhesion controls Golgi organization and function through Arf1 activation in anchorage-dependent cells[END_REF]. Notably, cell contraction regulates Golgi lipid metabolism, COPI-mediated trafficking, and SCAP/SREBP localization by activation of the lipid phosphatase Lipin-1 [START_REF] Romani | Extracellular matrix mechanical cues regulate lipid metabolism through Lipin-1 and SREBP[END_REF].

Intracellular trafficking. Secretory pathway organelles use membrane-bound transport carriers for long-range communication. Besides their well-established role in shuttling cargoes between organelles, these carriers can also convey additional functions, such as the triggering of mitochondrial fission by Golgi-derived vesicles [START_REF] Nagashima | Golgi-derived PI(4)P-containing vesicles drive late steps of mitochondrial division[END_REF], or the regulation of procollagen export from the ER by ER-Golgi intermediate compartment (ERGIC)-derived membranes [START_REF] Raote | TANGO1 builds a machine for collagen export by recruiting and spatially organizing COPII, tethers and membranes[END_REF][START_REF] Raote | A physical mechanism of TANGO1-mediated bulky cargo export[END_REF].

Membrane contact sites. Direct inter-organelle communication occurs when the membranes of two or more organelles come to close proximity to one another into a functional contact, commonly referred to as a membrane contact site (MCS). In MCSs, membranes (i) are in close apposition tethered by protein-protein or protein-lipid interactions, (ii) do not fuse together, and (iii) carry a specific biological function [START_REF] Scorrano | Coming together to define membrane contact sites[END_REF]. Although the existence of MCSs was already reported in the early days of electron microscopy, it was not until the 1990s when specific biochemical activities and physiological functions were directly linked to these structures (reviewed in [START_REF] Scorrano | Coming together to define membrane contact sites[END_REF]). Since then, and particularly during the last decade, our understanding of such mode of inter-organelle communication has dramatically improved. As a result, the field of MCSs has emerged as a major topic in cell biology [START_REF] Scorrano | Coming together to define membrane contact sites[END_REF][START_REF] Wu | Here, there, and everywhere: The importance of ER membrane contact sites[END_REF][START_REF] Mesmin | Lipid exchange and signaling at ER-Golgi contact sites[END_REF][START_REF] Bohnert | Stepping outside the comfort zone of membrane contact site research[END_REF].

Inter-organelle transient connections. Finally, it has been suggested that organelles directly communicate to one another by the transient formation of membranous connections between them. Although the existence of such connections in a physiological context remains debated, they have been proposed to serve as a means to tunnel cargo trafficking between Golgi cisternae [START_REF] Nakano | Passage through the Golgi[END_REF][START_REF] Trucco | Secretory traffic triggers the formation of tubular continuities across Golgi sub-compartments[END_REF][START_REF] Beznoussenko | Transport of soluble proteins through the Golgi occurs by diffusion via continuities across cisternae[END_REF], and between the ER and the Golgi/ERGIC [START_REF] Raote | Protein transport by vesicles and tunnels[END_REF] for the delivery of large proteins.

Inter-organelle communication for ER export ER morphology and organization

The ER membrane forms a continuous but intricate network of sheets, helicoidal ramps, and tubules (of ~60 nm in diameter in mammals), which is maintained by a variety of proteins [START_REF] Shibata | Mechanisms Shaping the Membranes of Cellular Organelles[END_REF][START_REF] Wang | Reconstituting the reticular ER network -Mechanistic implications and open questions[END_REF] and expands throughout the cytoplasm [START_REF] Shibata | Rough sheets and smooth tubules[END_REF][START_REF] Nixon-Abell | Increased spatiotemporal resolution reveals highly dynamic dense tubular matrices in the peripheral ER[END_REF][START_REF] Schroeder | Dynamic nanoscale morphology of the ER surveyed by STED microscopy[END_REF][START_REF] Terasaki | XStacked endoplasmic reticulum sheets are connected by helicoidal membrane motifs[END_REF] (Figure 1a). Despite its continuity, the ER membrane presents specialized functional sub-domains, such as ER exit sites (ERES). ERES are enriched in COPII components and serve as departure gates for secretory cargoes [START_REF] Centonze | Crosstalk of endoplasmic reticulum exit sites and cellular signaling[END_REF][START_REF] Aridor | COPII gets in shape: Lessons derived from morphological aspects of early secretion[END_REF][START_REF] Kurokawa | The ER exit sites are specialized ER zones for the transport of cargo proteins from the ER to the Golgi apparatus[END_REF]. Morphologically, ERES are distinct from the rest of the ER, forming single-or multi-budded structures and cup-like structures [START_REF] Bannykh | The organization of endoplasmic reticulum export complexes[END_REF][START_REF] Gomez-Navarro | Cargo crowding contributes to sorting stringency in COPII vesicles[END_REF] (Figure 1a,b). ERES preferentially position on saddleshaped or highly curved tubular regions of the ER membrane [25]. Although the number and spatial distribution of ERES varies considerably among species, there are generally more ERES in the perinuclear area than in the cell periphery [26].

Preserving a balanced morphology of the ER network is important for cargo export. For example, depletion of Atlastin -a dynamin-like GTPase that tethers and fuses ER tubules into three-way junctions-leads to defects in cargo loading into COPII carriers [27]. These defects are reverted when an Atlastin mutant capable of tubule tethering but not of tubule fusion is expressed. In the absence of Atlastin-mediated tubule tethering, the ER network has a lower connectivity and the membrane is less tense. In addition, the lateral mobility of lipids and proteins is slowed down in Atlastin-depleted cells, leading to less frequent cargo-receptor interactions and cargo export defects [27]. Since both membrane tension [START_REF] Quemeneur | Shape matters in protein mobility within membranes[END_REF] and ER network dynamics [START_REF] Nixon-Abell | Increased spatiotemporal resolution reveals highly dynamic dense tubular matrices in the peripheral ER[END_REF][START_REF] Holcman | Single particle trajectories reveal active endoplasmic reticulum luminal flow[END_REF]

ERES/cis-Golgi communication

A subset of ERES is generally associated to early Golgi elements, such as the cis-Golgi cisternae and/or the ERGIC [START_REF] Kurokawa | The ER exit sites are specialized ER zones for the transport of cargo proteins from the ER to the Golgi apparatus[END_REF] (Figure 1a). In yeast, ER arrival sites -ER regions where Golgi-derived COPI vesicles fuse toenclose the ERES to which they are functionally and dynamically linked [START_REF] Chowdhury | ER arrival sites associate with ER exit sites to create bidirectional transport portals[END_REF]. However, despite the growing evidence of the entanglement between ERES and early Golgi elements, it still remains unclear how the ERES structure is dynamically maintained in relation to the overall functional organization of the early secretory pathway.

ER export is altered in different physiological conditions [START_REF] Aridor | COPII gets in shape: Lessons derived from morphological aspects of early secretion[END_REF]. Particularly, nutrient starvation induces ERES enlargement and enhances the association between ERES and ERGIC. This leads to the translocation of COPII components to the ERGIC, where they form COPII-coated vesicles for autophagosome biogenesis [START_REF] Ge | Remodeling of ER -exit sites initiates a membrane supply pathway for autophagosome biogenesis[END_REF].

Of special interest is how inter-organelle communication between ERES and the ERGIC/cis-Golgi membranes assists ER export (Figure 1b). Procollagens and other large and complex cargoes, such as chylomicrons or apolipoproteins, have challenged the conventional view of how small COPII-coated spherical vesicles mediate export from the ER [START_REF] Raote | Protein transport by vesicles and tunnels[END_REF][START_REF] Mccaughey | ER-to-Golgi trafficking of procollagen in the absence of large carriers[END_REF]. TANGO1 is an ERESlocalized transmembrane protein that connects COPI-coated ERGIC membranes and COPIIcoated ERES to allow for efficient procollagen shuttling between these two organelles. TANGO1 forms ring-like structures at ERES [START_REF] Raote | TANGO1 builds a machine for collagen export by recruiting and spatially organizing COPII, tethers and membranes[END_REF][START_REF] Raote | TANGO1 assembles into rings around COPII coats at ER exit sites[END_REF] where it binds both procollagens and COPII components [START_REF] Saito | TANGO1 facilitates cargo loading at endoplasmic reticulum exit sites[END_REF]. In addition, TANGO1 recruits ERGIC-derived membranes to the ERES [START_REF] Raote | TANGO1 builds a machine for collagen export by recruiting and spatially organizing COPII, tethers and membranes[END_REF][START_REF] Nogueira | SLY1 and syntaxin 18 specify a distinct pathway for procollagen VII export from the endoplasmic reticulum[END_REF][START_REF] Santos | TANGO1 recruits ERGIC membranes to the endoplasmic reticulum for procollagen export[END_REF][START_REF] Liu | Tango1 spatially organizes ER exit sites to control ER export[END_REF][START_REF] Reynolds | Tango1 coordinates the formation of endoplasmic reticulum/ Golgi docking sites to mediate secretory granule formation[END_REF]. Interestingly, ERES-recruited ERGIC membranes seem to have a different function other than in retrograde trafficking: by fusing to the ER, these membranes can locally modify the biophysical properties of the ERES to facilitate procollagen export [START_REF] Raote | A physical mechanism of TANGO1-mediated bulky cargo export[END_REF]. A physical model of TANGO1-mediated ER export described how different physical properties, such as membrane tension, dynamically contribute to the formation of procollagen-containing transport intermediates commensurate with the cargo they shuttle [START_REF] Raote | A physical mechanism of TANGO1-mediated bulky cargo export[END_REF]. Fusion of ERGIC membranes to an ERES transiently decreases membrane tension, thereby facilitating the elongation of COPII-coated, TANGO1-capped, and procollagen-loaded transport intermediates. How dynamic the TANGO1 rings are and whether or how ERGIC membrane tethering and fusion to ERES is regulated still remain open questions. The proposal that the transmembrane helices of TANGO1 act as membrane shape sensors [START_REF] Raote | TANGO1 membrane helices create a lipid diffusion barrier at curved membranes[END_REF], let us entertain the possibility of a shape-mediated tethering regulation, in which the shape of the elongating membrane would control TANGO1 ring formation and ERGIC membrane tethering and fusion for procollagen export. Altogether, the dual role of TANGO1 as a regulator of ERES structure and export, highlights the important relationship between organelle structure and communication.

Notably, a comparable close contact between ERES and cis-Golgi elements exists in S. cerevisiae to control anterograde trafficking between these two organelles [START_REF] Kurokawa | Contact of cis-Golgi with ER exit sites executes cargo capture and delivery from the ER[END_REF] (Figure 1b). Nakano and co-workers proposed a hug-and-kiss model whereby cis-Golgi cisternae wrap around and tether ERES (hug), after which ER cargo is directionally transferred to the Golgi complex (kiss). This mechanism does not require the release of COPII vesicles in the cytoplasm for their subsequent Golgi capture [START_REF] Kurokawa | The ER exit sites are specialized ER zones for the transport of cargo proteins from the ER to the Golgi apparatus[END_REF][START_REF] Kurokawa | Contact of cis-Golgi with ER exit sites executes cargo capture and delivery from the ER[END_REF]. Whether such a process creates a transient continuity between these organelles still remains to be elucidated.

Biophysical considerations for transient ER-Golgi connections

The proposal of transient organelle connections poses a major challenge: how could these connections form without causing organelle mixing or collapse? Brefeldin A-induced fusion of Golgi membranes with the ER leads to the rapid and massive absorption of Golgi components to the ER [START_REF] Klausner | Brefeldin A: Insights into the control of membrane traffic and organelle structure[END_REF]. Early studies indicated that this is not simply mediated by passive diffusion but most likely by a tension-driven directional flow [START_REF] Sciaky | Golgi tubule traffic and the effects of brefeldin A visualized in living cells[END_REF]. These data, together with the evidence that the tension of the Golgi membranes is lower than that of the ER [START_REF] Upadhyaya | Tension in tubulovesicular networks of Golgi and endoplasmic reticulum membranes[END_REF], seemed to demur the existence of ER-Golgi connections. However, a step towards solving this conundrum arose from the finding that the transmembrane helix arrangement of TANGO1 can act as a lipid diffusion barrier [START_REF] Raote | TANGO1 membrane helices create a lipid diffusion barrier at curved membranes[END_REF]. Diffusion barriers permit minimal mixing of components and prevent a massive and quick absorption of membranes after transient organellar connections. This hypothesis that diffusion barriers help maintain organelle connections is further supported by the recent observations of thicker domains in yeast ER membranes that slow down the diffusion of short transmembrane proteins [START_REF] Prasad | Mapping bilayer thickness in the ER membrane[END_REF]. These domains are enriched at MCSs, underscoring the possible role of diffusion barriers in ER-Golgi communication.

Overall, there is mounting evidence that there is both direct and indirect functional communication between ERES and early Golgi elements. Such interactions play important regulatory roles in organelle homeostasis and ER export.

Inter-organelle communication for Golgi export

Golgi complex morphology and organization

The Golgi complex is the central organelle of the secretory pathway where cargo maturation and sorting for export take place. The Golgi complex is a polarized organelle, which in mammals is made of stacks of 4-8 cisternae that are laterally connected to form the Golgi ribbon [START_REF] Makhoul | Golgi Dynamics: The Morphology of the Mammalian Golgi Apparatus in Health and Disease[END_REF]. Golgi cisternae are sac-like structures made of two large parallel flattened membranes (cisternal size ~1 µm; inter-membrane distance ~30 nm), connected by swollen, highly-curved rims [START_REF] Bykov | The structure of the COPI coat determined within the cell[END_REF] (Figure 1a). Such a peculiar membrane morphology guarantees a very large surface-to-volume ratio, thereby presenting some functional benefits: (i) the large surface area of the membrane helps withstand the continuous cycles of transport carrier fusion and fission without a consequential alteration in the biochemical composition of the membrane [START_REF] Glick | Membrane Traffic Within the Golgi Apparatus[END_REF]; and (ii) the difference in curvature between the flat sheet-like part of a cisterna and its highly curved rim provides a morphological cue to organize in space and time the different Golgi functions. Physical modelling indicated that membrane budding effectors help maintain cisternae flat by stabilizing the highly curved rims [START_REF] Campelo | Sphingomyelin metabolism controls the shape and function of the golgi cisternae[END_REF], hence highlighting the connection between the export capabilities of the Golgi complex and its shape.

There is increasing evidence that Golgi-resident proteins (such as glycosylation enzymes) are enriched in the flat parts of the Golgi membranes, whereas export machinery localizes to the highly curved rims [START_REF] Campelo | Sphingomyelin metabolism controls the shape and function of the golgi cisternae[END_REF][START_REF] Patterson | Transport through the Golgi Apparatus by Rapid Partitioning within a Two-Phase Membrane System[END_REF][START_REF] Popoff | COPI budding within the Golgi stack[END_REF][START_REF] Van Galen | Sphingomyelin homeostasis is required to form functional enzymatic domains at the trans-Golgi network[END_REF][START_REF] Ernst | S-Palmitoylation Sorts Membrane Cargo for Anterograde Transport in the Golgi[END_REF]. Electron tomography showed the accumulation of S-palmitoylated cargoes at the rims of Golgi cisternae [START_REF] Ernst | S-Palmitoylation Sorts Membrane Cargo for Anterograde Transport in the Golgi[END_REF]. A separate study using super-resolution microscopy confirmed that glycosylation enzymes and the budding machinery segregate along the radial direction of the cisternae [START_REF] Tie | The spatial separation of processing and transport functions to the interior and periphery of the golgi stack[END_REF], backing the idea of a lateral segregation of Golgi functions. Various mechanisms contribute to dynamically organize the different reactions occurring in the Golgi membranes, including lipid-mediated, curvature-mediated, calcium-mediated, or receptormediated mechanisms (reviewed in [START_REF] Banfield | Mechanisms of protein retention in the Golgi[END_REF][START_REF] Von Blume | Lipid-dependent coupling of secretory cargo sorting and trafficking at the trans-Golgi network[END_REF][START_REF] Stalder | Direct trafficking pathways from the Golgi apparatus to the plasma membrane[END_REF][START_REF] Bassereau | The 2018 biomembrane curvature and remodeling roadmap[END_REF]). While these studies emphasize how Golgi morphology impacts its secretory function, we review below how morphology is also a key aspect of Golgi inter-organelle communication, focusing on ER-Golgi MCSs and their role in export from the trans-Golgi network (TGN).

ER-Golgi MCSs

MCSs enable lipid transfer for TGN export. Golgi lipid homeostasis is preserved by non-vesicular transfer of lipids, which takes place at ER-Golgi MCSs (Figure 1c). These contacts form by the tethering of ER-localized VAP-A/B to a number of TGN-anchored lipid transfer proteins, such as OSBP or CERT, which are recruited to the TGN by binding to PI(4)P by their pleckstrin homology domains [START_REF] Mesmin | Lipid exchange and signaling at ER-Golgi contact sites[END_REF][START_REF] Venditti | ER-Golgi membrane contact sites[END_REF]. Notably, this lipid-protein binding is sensitive to cytosolic pH, which can be for instance modulated in response to nutrient (glucose) availability, thus enabling signal-mediated communication at the Golgi membranes for efficient cargo sorting and export [START_REF] Shin | pH Biosensing by PI4P Regulates Cargo Sorting at the TGN[END_REF]. ER-Golgi MCSs directly control the levels of sterols, sphingolipids and PI/PI(4)P in these organelles [START_REF] Mesmin | Lipid exchange and signaling at ER-Golgi contact sites[END_REF][START_REF] Venditti | ER-Golgi membrane contact sites[END_REF], and these lipids are crucial for cargo export from the TGN [START_REF] Von Blume | Lipid-dependent coupling of secretory cargo sorting and trafficking at the trans-Golgi network[END_REF][START_REF] Deng | Sphingomyelin is sorted at the trans Golgi network into a distinct class of secretory vesicle[END_REF][START_REF] Duran | Sphingomyelin organization is required for vesicle biogenesis at the Golgi complex[END_REF][START_REF] Venditti | The activity of Sac1 across ER-TGN contact sites requires the four-phosphate-adaptor-protein-1[END_REF][START_REF] Rahajeng | Efficient Golgi Forward Trafficking Requires GOLPH3-Driven, PI4P-Dependent Membrane Curvature[END_REF]. In particular, altering the sphingolipid metabolism at the Golgi membranes causes a massive cisternal curling into shapes with little rim area [START_REF] Campelo | Sphingomyelin metabolism controls the shape and function of the golgi cisternae[END_REF][START_REF] Van Galen | Sphingomyelin homeostasis is required to form functional enzymatic domains at the trans-Golgi network[END_REF]. These shape changes are accompanied by global inhibition of cargo export from the Golgi complex [START_REF] Duran | Sphingomyelin organization is required for vesicle biogenesis at the Golgi complex[END_REF], glycosylation defects [START_REF] Van Galen | Sphingomyelin homeostasis is required to form functional enzymatic domains at the trans-Golgi network[END_REF], and mis-localization of Golgi proteins [START_REF] Campelo | Sphingomyelin metabolism controls the shape and function of the golgi cisternae[END_REF][START_REF] Van Galen | Sphingomyelin homeostasis is required to form functional enzymatic domains at the trans-Golgi network[END_REF][START_REF] Capasso | Sphingolipid metabolic flow controls phosphoinositide turnover at the trans-Golgi network[END_REF], highlighting the importance of MCS-regulated lipid homeostasis for organelle shaping and transport carrier biogenesis at the TGN.

MCSs contribute to transport carrier biogenesis. Dynamic ER-Golgi MCSs are needed for the export of a subset of cargoes from the TGN [START_REF] Wakana | CARTS biogenesis requires VAP-lipid transfer protein complexes functioning at the endoplasmic reticulum-Golgi interface[END_REF][START_REF] Wakana | The ER cholesterol sensor SCAP promotes CARTS biogenesis at ER-Golgi membrane contact sites[END_REF][START_REF] Casas | Sensing of nutrients by CPT1C controls SAC1 activity to regulate AMPA receptor trafficking[END_REF]. Both the depletion of ER-Golgi MCS components and contact site immobilization inhibit the formation of a specific class of transport carriers named carriers of the TGN to the cell surface (CARTS) [START_REF] Wakana | CARTS biogenesis requires VAP-lipid transfer protein complexes functioning at the endoplasmic reticulum-Golgi interface[END_REF][START_REF] Wakana | The ER cholesterol sensor SCAP promotes CARTS biogenesis at ER-Golgi membrane contact sites[END_REF]. Notably, super-resolution microscopy revealed that CARTS form at TGN regions that are adjacent to ER-Golgi MCSs, opening the possibility that ER-Golgi communication via MCSs could directly facilitate membrane budding and/or fission for CARTS formation [START_REF] Wakana | The ER cholesterol sensor SCAP promotes CARTS biogenesis at ER-Golgi membrane contact sites[END_REF] (Figure 1c). Interestingly, in yeast, peak-shaped ER membrane regions of very high curvature were observed at ER-plasma membrane MCSs and appear to enhance the lipid transfer rate [START_REF] Collado | Tricalbin-Mediated Contact Sites Control ER Curvature to Maintain Plasma Membrane Integrity[END_REF][START_REF] Hoffmann | Tricalbins Contribute to Cellular Lipid Flux and Form Curved ER-PM Contacts that Are Bridged by Rod-Shaped Structures[END_REF]. The formation of these membrane regions of high curvature is mediated by tricalbins (extended-synaptotagmins, in mammals), which can also localize at ER-Golgi MCSs where they contribute to ceramide transfer [START_REF] Ikeda | Tricalbins Are Required for Non-vesicular Ceramide Transport at ER-Golgi Contacts and Modulate Lipid Droplet Biogenesis[END_REF]. Whether similar high curvature membrane peaks are present at ER-Golgi MCSs for transport carrier formation at the TGN remains to be investigated (Figure 1c). Biophysical considerations of MCSs. MCSs play direct roles in determining organelle fission sites and initiating membrane constriction [START_REF] Friedman | ER Tubules Mark Sites of Mitochondrial Division[END_REF][START_REF] Rowland | ER Contact Sites Define the Position and Timing of Endosome Fission[END_REF][START_REF] Abrisch | Fission and fusion machineries converge at ER contact sites to regulate mitochondrial morphology[END_REF]. Short distances between membranes impose a series of mechanical effects and constraints, such as the limitation in the amplitude of membrane fluctuations/movements (e.g. membrane pinning [START_REF] Kandy | Emergent membrane morphologies in relaxed and tense membranes in presence of reversible adhesive pinning interactions[END_REF]), or steric hindrance that prevents proteins with large cytosolic domains to enter the contacts [START_REF] Schmid | Size-dependent protein segregation at membrane interfaces[END_REF][START_REF] Jamecna | An Intrinsically Disordered Region in OSBP Acts as an Entropic Barrier to Control Protein Dynamics and Orientation at Membrane Contact Sites[END_REF]. It is therefore becoming increasingly clear that MCSs have a pleiotropic effect in the way they regulate organelle dynamics and function.

Summary and future perspectives

Since the pioneering discoveries by George Palade and colleagues, we have learned how the ER and the Golgi complex are intimately linked by their shared function in intracellular trafficking and protein secretion. Beyond that, new interaction modes in the early secretory pathway are just beginning to be uncovered. Some examples, which we highlighted in this review, are the close contacts between ERES and early Golgi elements as well as ER-Golgi MCSs. These investigations herald a whole new wave of research in inter-organelle communication, further establishing its often unexpected but central role in cell homeostasis.

Defining the molecular and biophysical basis of inter-organelle communication will pave our way to better understand the secretory pathway in health and disease. Combining novel approaches in fluorescence microscopy [START_REF] Nixon-Abell | Increased spatiotemporal resolution reveals highly dynamic dense tubular matrices in the peripheral ER[END_REF][START_REF] Holcman | Single particle trajectories reveal active endoplasmic reticulum luminal flow[END_REF][START_REF] Valm | Applying systems-level spectral imaging and analysis to reveal the organelle interactome[END_REF], and/or cryo-electron tomography [START_REF] Collado | Tricalbin-Mediated Contact Sites Control ER Curvature to Maintain Plasma Membrane Integrity[END_REF][START_REF] Hoffmann | Tricalbins Contribute to Cellular Lipid Flux and Form Curved ER-PM Contacts that Are Bridged by Rod-Shaped Structures[END_REF], with tools to specifically monitor organelle contactssuch as fluorescence complementation [START_REF] Wakana | The ER cholesterol sensor SCAP promotes CARTS biogenesis at ER-Golgi membrane contact sites[END_REF][START_REF] Abrisch | Fission and fusion machineries converge at ER contact sites to regulate mitochondrial morphology[END_REF] or FRET-FLIM-based tools [START_REF] Venditti | Molecular determinants of ER-Golgi[END_REF] will help to obtain ultra-highly resolved spatio-temporal maps of organelle connections. Moreover, in vitro reconstitution of inter-organelle contacts is a promising approach to study the fundamentals of these structures [79]. Pooled CRISPR/Cas9-mediated loss of function genetic screens provide unbiased ways of finding novel components involved in these processes both in 2D cell cultures [80] and in 3D tissue organoids [81]. Finally, a physical understanding of the principles governing how inter-organelle communication affects organelle shape and identity will be an added value to improve our holistic understanding of the early secretory pathway.

* This study uses correlative light-electron microscopy to visualize ERES and COPII budding events in the yeast

• Heterotypic fusion between

Golgi cisternae [START_REF] Trucco | Secretory traffic triggers the formation of tubular continuities across Golgi sub-compartments[END_REF][START_REF] Beznoussenko | Transport of soluble proteins through the Golgi occurs by diffusion via continuities across cisternae[END_REF] • ER-ERGIC tunnels for procollagen export [START_REF] Raote | Protein transport by vesicles and tunnels[END_REF]

FIGURE 1 Figure 1 .

 11 FIGURE 1

  can enhance protein mobility, Niu et al. proposed that Atlastin facilitates cargo loading in COPII carriers by maintaining the tension of the ER network [27]. This example underscores the importance of ER network morphology for its export functions.

High- curvature domains of the ER are important for the organization of ER exit sites in Saccharomyces cerevisiae

  Saccharomyces cerevisiae. A mechanism for ER export where secretory cargoes constrain COPII carrier formation is proposed, in which selective cargo enrichment in COPII-coated nascent vesicles generates a steric pressure that prevents nonspecific sorting and reduces bulk flow.25. Okamoto M, Kurokawa K, Matsuura-Tokita K, Saito C, Hirata R, Nakano A:

	. J Cell Sci 2012, 125:3412-3420.
	26. Hughes H, Budnik A, Schmidt K, Palmer KJ, Mantell J, Noakes C, Johnson A, Carter DA,
	Verkade P, Watson P, et al.: Organisation of human ER-exit sites: requirements for
	the localisation of Sec16 to transitional ER. J Cell Sci 2009, 122:2924-34.
	27. Niu L, Ma T, Yang F, Yan B, Tang X, Yin H, Wu Q, Huang Y, Yao ZP, Wang J, et al.:
	Atlastin-mediated

membrane tethering is critical for cargo mobility and exit from the endoplasmic reticulum

  Atlastin is a dynamin-like GTPase involved in membrane tethering and fusion that is required to form three-way junctions in the ER. This study revealed that Atlastin-mediated membrane

	contacts identified through a new FRET-FLIM system. J Cell Biol 2019, 218:1055-
	1065.
	* This study presented a novel approach based on fluorescence lifetime imaging microscopy
	and fluorescence resonance energy transfer (FRET-FLIM) microscopy to visualize ER-
	Golgi MCSs. The combination of this new tool with electron microscopy approaches
	provides a systematic way to screen for components of the ER-Golgi MCSs, hence
	opening a new avenue to investigate this cellular structure.
	79. de la Mora E, Dezi M, Di Cicco A, Bigay J, Gautier R, Polidori J, Castaño Díez D, Mesmin
	B, Antonny B, Lévy D: Nanoscale architecture of a VAP-A-OSBP tethering complex
	at membrane contact site 1 2. bioRxiv 2020, doi:10.1101/2020.10.13.337493.
	80. Bassaganyas L, Popa SJ, Horlbeck M, Puri C, Stewart SE, Campelo F, Ashok A, Butnaru
	CM, Brouwers N, Heydari K, et al.: New factors for protein transport identified by a
	genome-wide CRISPRi screen in mammalian cells. J Cell Biol 2019, 218:3861-3879.
	81. Esk C, Lindenhofer D, Haendeler S, Wester RA, Pflug F, Schroeder B, Bagley JA, Elling
	U, Zuber J, von Haeseler A, et al.: A

. Proc Natl Acad Sci U S A 2019, 116:14029-14038. **

human tissue screen identifies a regulator of ER secretion as a brain size determinant

. Science (80-) 2020, 370:eabb5390.

TABLE 1 . Inter-organelle communication in the early secretory pathway.

 1

	Inter-organelle	Contact between	Membrane	Examples
	communication	organelles?	fusion?
	mode
	Inter-organelle	No	No	• Cell-matrix adhesions control
	signaling			Golgi function and organization
				by Arf1 activation [1]
				• Mechanotransduction at the
				Golgi complex mediated by
				Lipin-1 and SREBP [2]
	Intracellular	No (mediated by	Yes (of	• COPI-and COPII-coated
	trafficking	organelle-derived	membrane-bound	transport carriers
		membrane-bound	intermediates, but
		transport carriers)	not of organelles)
	Membrane	Yes	No	• ER-Golgi MCS mediate Golgi
	contact sites			lipid homeostasis [8] and
				CARTS formation [19,20]
	Inter-organelle	Yes	Yes	Not well established.
	transient
	connections

Acknowledgements

We thank Yuichi Wakana, Ishier Raote, Julia von Blume, and Maria F. Garcia-Parajo for critical reading of the manuscript. We acknowledge support from the Government of Spain (FIS2017-89560-R, RYC-2017-22227, and PID2019-106232RB-I00 / 10.13039/501100011033; Severo Ochoa CEX2019-000910-S), Fundació Cellex, Fundació Mir-Puig, and Generalitat de Catalunya (CERCA, AGAUR).

Conflict of interest

The authors declare no conflict of interest.


Keywords: P2P networks, DHT, Sybil attack, honeypot, KAD, monitoring réseaux P2P, DHT, attaque Sybil, honeypot, KAD, supervision

In this paper, we propose a new P2P Honeynet architecture called HAMACK that bypasses the Sybil attack protection mechanisms introduced recently in KAD. HAMACK is composed of distributed Honeypeers in charge of monitoring and acting on specific malicious contents in KAD by controlling the indexation of keywords and files. Our architecture allows to: (1) transparently monitor all the requests sent to the targeted contents in the network, (2) eclipse malicious entries of the DHT, and (3) attract the download requests of peers searching for malicious contents towards the Honeypeers by poisoning the DHT references with fake files and sources. Early results on the KAD network demonstrate the applicability and the efficiency of our approach.

Introduction

Peer-to-peer (P2P) networks are now commonly used to share files within the Internet. They offer lots of advantages compared to the client-server scheme by giving possibility to gather and share a large amount of resources with the collaboration of many individual peers. However, peer-to-peer networks also provide support for harmful and malicious activities that can voluntarily propagate strongly undesirable contents 1 . As peer-to-peer systems are self-organized, dynamic and do not have a centralized infrastructure, it is not obvious to collect information to measure them and to observe the behavior of malicious users.

With passive monitoring we can observe, from one point, the P2P traffic without sending additional data into the network. [START_REF] Le-Blond | Clustering in p2p exchanges and consequences on performances[END_REF] collected 24 hours traces from an eDonkey server and pointed out the correlation between the set of peers active for some given data. [START_REF] Sen | Analyzing peer-to-peer traffic across large networks[END_REF] used passive monitoring at several routers to monitor flows in FastTrack, Gnutella and Direct-Connect. However, these approaches do not allow to study specific contents at the network scale. Active monitoring removes this drawback but is more intrusive in the sense that some traffic (queries, files) is injected in the network to gather more information concerning the P2P system. Many crawlers have been used to study the different P2P protocols like Gnutella [START_REF] Stutzbach | Capturing accurate snapshots of the gnutella network[END_REF], Napster [START_REF] Saroiu | A measurement study of peer-to-peer file sharing systems[END_REF], e-Donkey [START_REF] Le Fessant | Clustering in peer-topeer file sharing workloads[END_REF] [START_REF] Yang | Crawling the edonkey network[END_REF] and KAD [15] [11]. Alone, a crawler can just observe the network without acting on it. In the case of KAD, a crawler just discovers the peers but not the shared contents.

To have a better view of the network and to control it, [START_REF] Steiner | Exploiting KAD: possible uses and misuses[END_REF] associated to the crawler a Sybil attack which consists in creating a very large number (∼ 2 16 ) of fake peers, controlled by one computer, and placing them actively in the part of the DHT to observe. Recent protection mechanisms have however been introduced [START_REF] Cholez | Evaluation of sybil attacks protection schemes in kad[END_REF] in KAD to make this intrusive approach inefficient.

In this paper, we propose to apply the concept of honeypot in the context of the KAD network, to monitor and act on specific malicious contents 2 and users in a widely deployed P2P system. A honeypot is classically used to attract malicious users trying to penetrate illegally in an unauthorized system. In the existing research works related to P2P honeypots [START_REF] Latapy | Measurement of edonkey activity with distributed honeypots[END_REF] [1] [START_REF] Lee | P2p honeypot to prevent illegal or harmful contents from spreading in p2p network[END_REF], the solutions consist in advertising fake files as normal users in order to log the download queries received for these files, but without any guaranty to attract all peers looking for the studied content. Our solution surpasses classical honeypots because it allows to attract absolutely all the users searching for a given content, and also to control these malicious contents. Our approach is based on a P2P honeynet architecture composed of fully distributed honeypots we defined as Honeypeers. Its originality with regards to active monitoring is that we can transparently monitor all the requests sent to the targeted contents in the network, eclipse malicious entries of the DHT, and attract the download requests of malicious peers towards our Honeypeers by poisoning the DHT references with fake files and sources. Our strategy to take the control over DHT entries does not rely on Sybils injection and bypasses all the protection mechanisms introduced recently in KAD to fight against Sybil attacks. This document is structured as follows. Section 2 describes the background of KAD, the Sybil attacks and the last inserted protections. We then present, in Section 3, the approach to design HAMACK and its features allowing to monitor, eclipse and poison malicious contents of the network. The section 4 assesses the efficiency of our architecture by modeling the KAD search process. Section 5 and 6 respectively present the implemented architecture of HAMACK and the results of experiments done on the real KAD network. Finally, Section 7 concludes the paper and outlines our future works.

KAD and the Sybil attack 2.1 Overview of KAD

KAD is a structured P2P network based on the Kademlia distributed hash table routing protocol [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the xor metric[END_REF]. KAD is implemented by the eMule and aMule open source clients, allowing users to share files on this network. Mainly used in European countries and in China [START_REF] Steiner | A global view of KAD[END_REF], the estimated number of concurrent online users is around 2.5 millions, which makes KAD the widest deployed structured P2P network today.

Each node of KAD has a 128bits "KADID" setting its position in the DHT. All the routing tasks are based on the XOR metric used to evaluate the distance in the DHT between two peers, or between a peer and a content. Two types of requests are used to discover the network: the Hello REQ is used by a peer to announce itself, and the Kademlia REQ is used to discover new peers close to a specific address. Some contacts are selected to fill the routing table following a specific scheme. The routing table is composed of groups of K-contacts (called a K-bucket), organised like a tree so that the group at level i has contacts at a distance between 2 128-i and 2 127-i from the current peer, regarding the XOR metric. In other words, the deeper the contact is in the tree, the closer it is to the current node and the better is its knowledge of this part of the DHT (knowing the same number of contacts for a zone always smaller). Routing is done in an iterative way and with parallel lookups, and will be described in detail further.

As a file sharing application, the purpose of the KAD DHT is to index files and keywords. When a new file is shared, the raw data and all the keywords composing its name are hashed separately with a MD5 function generating a KADID for each piece of information. Those KADIDs are then published in the DHT. The peers able to index a file or a keyword are all those that are close enough to the published hash. This distance is called the "tolerance zone" of a KADID, and is set to the first common 8bits (most significant). The double indexing allows the retrieval of a file, being given a set of keywords. To publish a file, two types of requests are sent: ❼ KADEMLIA2 PUBLISH KEY REQ requests are sent towards the hash of the keyword to associate a keyword with a file ❼ KADEMLIA2 PUBLISH SOURCE REQ requests are sent towards the hash of the file to associate a file with a source (a peer sharing the file)

After accepting a publication request for a given resource, a peer is in charge of indexing this specific content, and to answer to the related Search requests.

INRIA

The Sybil attack

The Sybil Attack, as described by Douceur [START_REF] Douceur | The sybil attack[END_REF], consists in creating a large number of fake peers called the "Sybils", and placing them in a strategic way in the DHT to take control over a part of it.The efficiency of the Sybil attack is tight to the number of successfully injected Sybils, in spite of possible protective mechanisms of the P2P network. We will show that, in the case of KAD, another strategy can achieve the same results as a Sybil attack without triggering any protection.

Recent investigations showed that KAD was highly affected by the Sybil attack, resulting in important outages in the network by using few resources. Steiner et al [START_REF] Steiner | Exploiting KAD: possible uses and misuses[END_REF] were the first to successfully launch a real Sybil attack on KAD, resulting in the full control of a part of the DHT. The attack is divided in two steps. The first step consisted in crawling the P2P network thanks to many route requests (Kademlia REQ), to progressively discover more and more peers in the network. When almost all nodes of a zone are known by the crawler, the second step consisted in polluting the routing table of each node discovered with Sybils. Steiner et al injected 2 16 Sybils from a single computer in a small zone of KAD. They were able to catch most of the Publish and Search requests within this zone. They achieved an eclipse attack making some keywords indexed on the Sybils disappear from the DHT.

Since, the latest versions of the major KAD clients have introduced new protection mechanisms based on local detection of suspicious behaviors, in order to limit the efficiency of the attacks. We described and evaluated these mechanisms in our previous work [START_REF] Cholez | Evaluation of sybil attacks protection schemes in kad[END_REF]. First, sending many requests from a single source is now detected and considered as flooding, which reduces the crawler efficiency. Second, it is no longer possible to infect a peer's routing table with Sybils showing the same IP address or very close IP addresses (same /24 subnetwork). Finally, the identity of a peer is now checked before being added or updated in the routing table. The IP address of a new peer is checked by a threeway handshake to avoid Sybils to use spoofed IP addresses. Moreover, KADID spoofing is also prevented by associating a public key to each KADID newly announced. KADID spoofing exploited in a large scale allowed to partition the DHT [START_REF] Wang | Attacking the kad network[END_REF].

The new protection mechanisms avoid the injection of several Sybils from a single IP address. Doing a massive Sybil attack on KAD becomes extremely expensive regarding the number of IP addresses involved. Even the more localized attacks described in [START_REF] Steiner | Exploiting KAD: possible uses and misuses[END_REF], which used a limited number of Sybils (32 Sybils to eclipse the particular keyword "the") is no longer possible. Indeed, the Sybils were directly injected in the routing table, which is now protected. Moreover, the crawler used to discover the network is now limited by the flooding protection. To design HAMACK, we had to adopt a novel strategy, neither relying on a crawler, nor on Sybils injection in routing tables.

We will show that localized attacks can still be effective with a reasonable amount of distributed resources. In fact, the main weakness allowing localized attacks to be performed is the possibility left to the peers to freely choose their KADID, which remains possible. Our assumption is that if a few numbers of modified clients choose their KADIDs very close to a given targeted hash (i.e. closer than any other peer randomly chosing its KADID), and considering the

HAMACK features

This part aims to describe our honeynet architecture and its features. As they are distributed and autonomous, we prefer to call our modified clients "Honeypeers" rather than Sybils.

Our approach to design an attractive Honeypot

When designing HAMACK, our objective was to make the most attractive Honeypot for malicious users in KAD. A naive honeynet approach would contain several clients that announce fake contents. But expecting a good visibility for the files promoted by such honeynet would involve a huge amount of resources.

In fact, when a user searches for a given content, several different pieces of information are returned to help him find the right file. Table 1 shows an example of a search results for a typical shared content. The name of the file and its size are important data that can be controlled by a classical Honeynet, whereas the number of sources can not be handled easily. Unfortunately, this information is capital because it allows to sort the search results, the best files being those with the highest number of sources. Files with a high number of sources are very popular, and consequently, more trustworthy and downloaded faster than the others. Typically, the last result of the search shown in table 1 should be discarded by users. While in eDonkey the number of sources is returned by the server, in KAD, it is computed by the peers in charge of indexing this file.

Previously, the easiest solution to increase the estimated number of sources displayed for a given file was to publish it with many Sybils; but it has become really resource consuming since IP address limitations have been set in KAD. Another solution consists in taking control over the indexing scheme of KAD to control all the information returned about the file, including the estimated number of sources.

Finally, by controlling the indexation mechanism, many more applications are possible. The features of HAMACK are the following, all appearing transparent for the final user: ❼ Passive monitoring: monitoring all the Search and Publish requests for malicious keywords and files

INRIA

Passive monitoring and eclipsing contents

The simpliest and quietest behavior consists in transparently monitoring the network by logging all the requests passing through the Honeypeers, particularly those concerning the targetID. Then, the Honeypeers answer to each request like a normal client, not disturbing the network. When a KADEM-LIA2 PUBLISH KEY REQ message is received, HAMACK stores the following information from the request message: the sender IP address and port, the keywordID, the list of fileIDs and for each fileID the list of tags containing the file properties (full name, size). A KADEMLIA2 PUBLISH SOURCE REQ message contains fewer fields: the sender IP address and port, the fileID, the KADID, IP address and port of the source. This feature allows HAMACK to monitor the activity of malicious files (what peers are sharing them) and of malicious keywords (what are the new published files).

The second behavior aims to eclipse a target ID from the network as described in figure 1. To eclipse a keyword or a file, the Honeypeers have to behave differently. First, the Honeypeers have to bypass two constraints concerning the maximum number of references that a peer can store. The first constraint limits the total number of references that any peer can store in order to limit the weight of a single peer in the network. The second constraint limits the maximum number of references stored for a particular KADID (either keyword or file) to avoid that too popular entries become over-referenced against the others. Our Honeypeers bypass these limitations in order to always answer positively to any Publish request. Otherwise, if these limits were reached, denied requests can be sent to normal peers and escape to HAMACK. Second, the Honeypeers have to deny all the incoming Search requests for the target ID. As HAMACK manages to acknowledge all the Publish requests, denying the Search requests simply removes the contents of the DHT. This feature is interesting because it allows HAMACK to remove malicious contents from the network, and by doing so, to prevent users from accessing it.

Index poisoning and promoting Honeypots

The index poisoning is the most interesting feature of HAMACK. It makes possible to capure all requests emitted by a malicious peer from the beginning, with the keyword search, to the end, with the final download request. The first step is the same as eclipsing a keyword by attracting all the Publish requests for the targeted keyword. Then, instead of denying the Search requests, all the Honeypeers composing HAMACK will answer with a list of fake files when requested. Because HAMACK has a total control of the responses, each fake file will appear to be very attractive, with a high number of sources. We can choose whether all the list is composed of fakes, or only a part of it. In the first case, setting properly the parameters of the list of fake files is important in order not to be detected, as all the good references will be eclipsed.

Then, when a malicious user selects a fake file, HAMACK must receive the Search sources requests to finally answer with the KADIDs of the Honeypeers, as shown in figure 2. To capture easily the Search Source requests for all the fake files, the fake FileIDs are generated to be extremely close (96bits) to the targeted keyword. With this optimization, every Search Source request will be attracted in the same way than the initial search of keyword, the Honeypeers staying in the same place of the DHT. When sending the Search Source responses, HAMACK provides the list of the Honeypeers (KADID,IP,port) in order to attract the final Download request of the malicious user. The relevancy of this feature is to assess the intention of the malicious user. HAMACK does not only assume that a user is malicious based on the initial search of keywords, but proposes fake files characterised by full malicious names, and checks the malicious behaviour with the final Download request.

HAMACK exploiting the KAD search procedure

The key point of our architecture is the control of the indexation mechanism. This part aims to demonstrate how efficient our architecture is against KAD publication and search functions. We will analyse in the forthcoming section the overall publish and search procedures in KAD, and describe in details how our Honeypeers take advantage of it. In opposite to [START_REF] Steiner | Exploiting KAD: possible uses and misuses[END_REF], we do not consider the INRIA direct injection of Sybils in routing tables, but we focus our study on controlling the sequence of events and messages happening during the search process, without abnormally affecting the routing tables.

Positioning the Honeypeers

The first step to settle our honeynet is to position precisely the Honeypeers according to the keyword or the file over which we want to take the control. So, the main parameter to consider is the targeted KADID. To compute it and get the 128bits address, we need to apply the same MD5 hash function as the one used in a KAD client to the keyword or the file. When this KADID is known, it is given as a parameter to each Honeypeer which can then derivate its own KADID from it. This derivation function simply copies the first 96bits from the targeted KADID and chooses the remaining 32bits randomly.

Even if the Honeypeers do not synchronise themselves when choosing their KADID, the risk of collision for few Honeypeers on 32bits is insignificant. Let N be the mean number of peers closer to the target than one of the Honeypeers. N is given by the probability for a peer to randomly choose a KADID with the same 96bits than the Honeypeers multiplied by the number of peers in the network. According to the latest estimations, the number of peers participating in KAD remains by much under 5 millions. The result in [START_REF] Badonnel | A management platform for tracking cyber predators in peer-to-peer networks[END_REF] shows that 96bits is a sufficient prefix to be sure that no other peer will be placed closer to the target that our Honeypeers.

N = 2 32
2 128 × 5 × 10 6 = 6.31 × 10 -23 (1)

Attracting the requests during the search procedure

As our Honeypeers are the closest to the targeted content, the critical point is to be sure that they will be able to attract all the requests, given the publish and search functions of KAD. We will show in this subsection that KAD is very efficient in routing, and that is its great weakness when considering localized attacks.

All services in KAD involving lookups in the DHT are achieved thanks to the "Search" object. Every keyword or file that has to be published, or every search done by a user, will generate an autonomous "Search" object in charge of all the process until its ending. Several Search objects can be managed by a client at the same time for different purpose, but all are distinct and autonomous.

The search process can be divided in two separate parts. The first part consists in finding online peers in the tolerance zone of the target to fill the array of "possible" contacts in the Search object. This array contains all the suitable contacts found and ordered by distance. This part is done by sending several KADEMLIA REQ in parallel with the target ID as parameter. Routing is done in an iterative way with parallel lookups, as described in figure 3: asking at first the 3 closest contacts of the routing table for even closer nodes toward the target ID, waiting for their responses and then reiterating by asking the best of the newly received contacts. Only the contacts that have successfuly answered to a KADEMLIA REQ are considered as available and can be used for the next step. While closer contacts can be found in the last responses, Figure 3: Message exchange in the search procedure the Search keeps looking for even closer contacts, without sending the specific service requests. In the last version of the KAD clients (eMule 0.49c and aMule 2.2.4), the contacts received from a KADEMLIA RES are now verified in the same way than contacts added in the routing table, in particular: only one KADID is allowed per IP address, and no more than 2 IP addresses are allowed from the same /24 subnet. These new constraints also motivate our distributed architecture.

The second part consists in sending specific service messages to the "possible" peers, regarding the type set for the search object (for example KADEM-LIA2 PUBLISH KEY REQ to publish a keyword), and then analysing the responses to continue or stop the Search. The effective starting condition of the function sending service requests is important. In fact, this function is executed when the Search has not received any new contact within the 3 last seconds, which means that the last found peers fail to provide any closer contacts to keep the Search going on. Then, the service requests are sent to the closest peers discovered. The stop conditions of the Search are the following: if it got more positive responses for the service than the replication rate, or if it triggers a timeout. To protect from churn, a publication is considered as successful when at least 10 peers have acknowledged it.

When a KADEMLIA REQ arrives on a Honeypeer for the targeted hash, it answers with the list of all the other Honeypeers composing HAMACK and activated for this content. As the list of contacts managed by the Search object is always sorted by distance, all the Honeypeers are placed in the best positions to receive service requests. So, as soon as a publishing peer gets one of the Honeypeers among the routing responses, all the following specific requests emitted by this peer will be sent to HAMACK. Therefore, the probability to attract all the requests emitted by a peer is approximated by the probability to find at least one of the Honeypeers before the Search object begins the transmission of service requests, we calculate this probability in the following paragraph.

INRIA

Analysis of HAMACK efficiency

Since the first study on the KAD routing scheme [START_REF] Stutzbach | Improving lookup performance over a widelydeployed dht[END_REF], it has been confirmed [START_REF] Wang | Attacking the kad network[END_REF] [2] that the routing table of KAD is slightly different from the proper binary tree defined in Kademlia [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the xor metric[END_REF]. Figure 3 compares the two trees. Basically, the routing table of KAD is far more efficient because more contacts are stored at each level. With the knowledge of the routing table and of the search procedure, we are able to estimate the probability to attract the first service request for a target of HAMACK, considering the distance of the source.

We assume that the initial peer and each intermediate step have a full routing table filled according to their respective place in the DHT. Moreover, we consider that the initial peer is far from the tolerance zone of the target so that it will need more hops before finding the Honeypeers. We also make the assumption that there is no partition in the P2P network and that the Honeypeers are well referenced by the other peers.

So, let H be the number of Honeypeers returned at a given step of the Search, and (1 -P n (H = 0)) or P n (H ≥ 1) be the probability to find at least one Honeypeer at the n th step of the Search. As the Honeypeers know each others and collaborate through KADEMLIA RES, we consider that the fact to find at least one Honeypeer leads to the capture of all following requets by HAMACK. Let N H be the number of Honeypeers used by HAMACK and N P n the number of potential peers that can be chosen at step n of the Search. At the begining of the lookup, the peer has to bootstrap the Search by requesting the 3 closest contacts of its routing table (equation 2). Then at each step (equation 3), 3 routing requests are sent towards the closest contacts and each will return 4 responses among a choice of N P n closer contacts, so that the Honeypeers have to be found among the 12 responses. To find P n (H), we can compute the probabilities to choose i Honeypeers among N H at each step, which is represented by the hypergeometric law with parameters (12, N H, N P n +N H) and to sum all the positive values of i.

P 0 (H ≥ 1) = i=3 i=1 C i N H × C 3-i N P0 C 3 N P0+N H
(2)

P n (H ≥ 1) = i=12 i=1 C i N H × C 12-i N Pn C 12 N Pn+N H (3)
Let N P be the total number of peers in the network. Looking at the real KAD routing table, the initial peer has at least one 10-bucket to cover 1/16 of the network. So, the first 3 contacts used to bootstrap the Search are chosen among N P/2 4 peers. Within a 10-bucket, the contacts are not ordered but we have to translate the fact to pick up the 3 closest contacts in probability. We assume that the KADIDs within a 10-bucket are uniformly distributed, so that choosing the 3 closest contacts among 10 improves, in average, 2 more bits of the target. So a more realistic value is:

N P 0 = N P 2 6 (4)
Then, looking at the figure 3, the contacts requested for the next step have a view of the zone considered for the target at least 3 times better. In fact, the inital peer, being far away from the target, picked up the contacts to bootstrap the Search from one of its top 10-bucket with an index between 5 and 15. These bootstrap contacts, when requested, will then look in their bucket with index 0 to find closer contacts. In the worst case, the targetID will hit the following 10-buckets with the indexes 1'-3"-7"' to find the next contacts. That means that in the worst case, considering the routing table of KAD, the Search will move forward by 3bits. As the structure of the routing table does not change with the depth, this reasoning is true for every step. Finally, if we want the worst case to be realistic by adding 2 more bits when choosing the best 3 contacts in a bucket, each step improves the Search of 5 bits in our model.

N P n = N P 2 6 × 2 5×n (5)
The numerical application of these probabilities with the parameters (N P = 5 × 10 6 ,N H = 20) are displayed in table 2. We see that at least one Honeypeer will be returned with nearly 10% of probability after the first step, and with 93% after the second. This result demonstrates that the routing in KAD ensures that the Honeypeers will be discovered during the Search process and attract all the next service requests. Practical experiments will confirm these results.

Implementation

This part describes how HAMACK is implemented to achieve its purpose.

Honeypeers

The main constraint to be addressed by HAMACK comes from the IP address limitation inserted in the lastest version of the major KAD clients. So, all the Table 2: Probability to find at least 1 honeypeer at the n th step of the search Honeypeers running for a specific target ID must have different IP addresses in order not to be denied. Moreover, no more that 2 Honeypeers can belong to the same subnet. To fit with these constraints, we chose to run HAMACK from a slice of PlanetLab Europe, as described by figure 5.

The Honeypeers execute a modified aMule client in its daemon version (aMuled) which is light and remotely manageable. This client has been modified in order to achieve the features described in section 3. Basically, many functions processing the incoming packets and many parameters of KAD were adapted. The behavior to adopt for a Honeypeer (spying, eclipsing, poisoning), the target ID and other parameters are set in a specific configuration file read by the modified client.

Several Perl scripts were written to easily deploy HAMACK on PlanetLab and change the behavior of the Honeypeers when needed. They are gathered and executed from a separate computer called the Manager. Writing these scripts was facilitated by the homogenous architecture of PlanetLab, so that each Honeypeer runs the same task in the same environment. The first version of HAMACK only manages one target ID but the scalability is not an issue. Given the very low resource consumption of aMuled, a single node can easily handle dozens of clients on different ports, so that HAMACK will investigate many contents at the same time in the next release.

Database

The second major component of HAMACK is the database that stores the information captured by the Honeypeers. The database is implemented in a Post-greSQL server and secured by an additional SSL module to avoid unauthorised connections. Most of the access to the database are writing but the Honeypeers can also read the different tables if needed: for example to get the KADID,IP and port of the other Honeypeers in charge of the same target ID to collaborate. We designed the different tables to easily anonymize the IP address of the peers if needed. When a new IP address is seen by HAMACK, the database attributes a new index to it and remembers this reference for a whole execution. Finally, the IP address field can be dropped without loosing too much information.

Measurements

To develop and evaluate HAMACK, we made several experiments on the real KAD network. As we absolutely wanted to not disturb the network, we chose the keyword "document" as our test target ID because it is quite well indexed but insignificant when doing a research on KAD. In a first time, we study

Setting the parameters

The execution time needed for an experiment was the first parameter to study for two reasons. On one hand the uptime of a peer is a classical parameter used to distinguish which peer should remain in the routing table to improve its stability, so that peers staying for a long time in the network are better known. On the other hand, our Honeypeers implement a function that makes them periodicaly announce themselves in the network. Graph 6 shows, for every interval of six hours, the number of Publish requests received by HAMACK over 4 days. We waited two hours before counting the requests to have the Honeypeers known in the network. We can clearly see that on the medium and long run, the time has absolutely no impact on HAMACK efficiency. We also see that every day, the number of requests received during the afternoon (∼ 40000) between 12h-18h or 18h-00h (GMT+1), is higher that in the morning (∼ 30000) between 00h-06h or 06h-12h. This result is coherent with the fact that KAD is mainly used in European countries, as presented in [START_REF] Steiner | A global view of KAD[END_REF]. According to this result, the next experiments are based on a full day capture.

The number of Honeypeers is also an important parameter to be able to efficiently use our resources. The minimum number of Honeypeers to involve should be 10, like the replication factor to publish a content. But usually, more than 10 service requests can be sent and all have to be captured. The reasonable minimum number of Honeypeers tried in our experiment is 15. Graph 7 shows the evolution of HAMACK efficiency when the number of Honeypeers After studying the environment parameters, we investigated three parameters related to the Honeypeers behavior. Firstly, we condidered the impact of the collaboration among Honeypeers. In the first case, the Honeypeers do not have a priori knowledge of the others and simply discover themselves through KAD mechanisms that fill their routing table. In the second case, the Honeypeers explicitely know each other and always promote themselves in KADEMLIA RES. Figure 8 shows how this modification performs. We can see that the collaboration of Honeypeers increases the efficiency of HAMACK (∼ 22%). This means that, by default, few normal peers were announced in the KADEMLIA RES returned by the Honeypeers for the target ID, decreasing the performance of HAMACK. Secondly, we defined the strategy of collaboration to use. Two strategies are possible. The first is compliant with the very last version of the KAD clients (eMule 0.49c ans aMule 2.2.4) which drops any KADEMLIA RES containing more that 4 contacts. The second uses the full list of Honeypeers in the KADEMLIA RES which should give better results with oldest clients. This protection being very recent (less than 2 months), we thought that most of clients would not have been updated. Figure 9 shows how many Publish requests are received in one day with both strategies. When fitting the protection against the flooding of contacts in KADEMLIA RES, the number of Publish requests received increases a lot (∼ 45%). This means that clients are quickly updated by the users after a new release and that this new constraint has already to be considered.

Finally, we measured the impact of active announcements. The result of figure 10 does not show a significative improvement of HAMACK efficiency when forcing the Honeypeers to announce themselves actively in the network, to gain visibility. The basic KAD behavior is sufficient to be assured that a peer is well known in the network.

INRIA

Evaluation of HAMACK efficiency

Evaluating the efficiency of our architecture is a real challenge. How to be sure that HAMACK effectively attracts all the emitted Publish requests? As we can not have a probe behind each peer of the KAD network during our experiments, we designed two experiments to give us a good indication of the efficiency of the architecture.

The first experiment consisted in publishing a keyword managed by HAMACK from 6 different sources that we monitored. Each source had a different place in the DHT and was bootstraped from a different set of contacts, in order to avoid any misleaded measurements due to unproper initial conditions. Then, we can compare for every publication, how many sent requests were captured by HAMACK and if the distance of the publishing peer affects the performance of the architecture. Figure 11 shows that all the Publish requests sent by our monitored clients are captured by the Honeypeers. Moreover, these very good results were confirmed by several search attempts performed on the targeted keyword "document" when eclipsed by HAMACK: all the Search requests were captured by the Honeypeers, and the global search finished without finding a single result.

The second experiment was to consider how many Publish resquests are seen by HAMACK from the same peer in a short period of time. We know that the publication process waits for 10 positive responses before stopping to send Publish requests. Given that, each time that HAMACK sees less than 10 times the same request from a peer during the short period of time of a publication process, it means that the other requests have been received by normal peers. As our architecture also attracts the Search requests, HAMACK can still control the content even if few Publish requests are missed. This experiment is a good indicator of how HAMACK performs. The results displayed in figure 12 are extremely encouraging. Very few distinct publications are seen with less than 8 requests (509/5669). As expected, a very high number of distinct publications are seen around 10. The high number of publications for which more that 10 requests are captured can seem to be strange. In fact, during the publish process, many KADEMLIA2 PUBLISH KEY REQ messages can be sent when the peer has almost finished the publication (for example 9 acknowledgments When receiving the 10 th response, the Search will stop but all the previously sent requests will still be considered and processed.

We also evaluated how well HAMACK is distributed on the Honeypeers. To do so, we counted the number of Publish requests captured by each Honeypeer in one day. We found out that the load distribution between Honeypeers is related to the distance between each Honeypeer and the target. Figure 13 shows the load on every Honeypeers ordered by their distance to the target. Even if the Honeypeers share 96bits with the target, the freedom to choose their KADID in the left 32bits is sufficient to see the efficiency of the KAD search algorithm trying to find the closest contacts. We can clearly see in the results that the Honeypeers with IDs (1-13) chose the same 97th bit than the target, while the Honeypeers (14-22) chose the other value, resulting in a sensible decrease of their attractivity compared to the others.

Finally, we evaluated the attractivity of fake files announced by HAMACK. In this last experiment, HAMACK poisoned the keyword 'spiderman' with 4 files, 2 well shared and 2 with a low number of sources, while eclipsing the other references for this keyword during one day. The search results returned by a KAD client during our test are displayed in figure 15. We can see that our attack succeeds to eclipse the real entries and to replace them with our 4 fake files. Figure 14 shows for each of these fake files, the proportion of first Search Source requests received from a distinct peer. The results show that the well shared files are chosen in first by 96% of the users, which confirms the great importance of the number of sources. This experiment also illustrates how malicious users will be cheated by HAMACK in future real applications.

Conclusion

We have described HAMACK, an efficient honeynet that bypasses the most recent protections of KAD against the Sybil attack. HAMACK uses several Honeypeers set very close to malicious references of the DHT and these Honeypeers are able to take control over them. Our appproach does not rely in the injection of Sybils and is absolutely non intrusive for the network besides the targeted contents. Quiet monitoring of all the incoming requests and eclipsing the malicious contents are some interesting features of HAMACK, to study and protect the network. But the most accomplished feature is the possibility to announce many files for a given keyword with realistic and attractive attributes, in particular the number of sources. Through the announcement of fake files, HAMACK is able to attract and capture all the requests of a malicious peer: from the search of a keyword, to the final download request, assessing the actions of malicious users.

To achieve these features, HAMACK exploits the weakness of KAD allowing to freely choose the KADID of a peer and relies on the very efficient search process of the KAD DHT. As described in our model, a search launched on a target of HAMACK will be captured by the Honeypeers with a very high probability (≥ 93%). Our work highlights a new dilemna of KAD which has to choose between its routing efficiency and the safety of its indexed contents. HAMACK is implemented by a lightweight architecture and fully fonctionnal. It uses modified aMuled clients deployed on PlanetLab nodes, and coupled with a secured database. The first experiments run on the real KAD network helped to set the parameters of the architecture. They showed 3 important results: 1-the coordination between Honeypeers increases the efficiency of HAMACK, 2-the architecture has to fit with the latest constraints inserted in KAD and 3-a low upper bound of needed Honeypeers. Then, several experiments were run and showed that HAMACK is extremely efficient to attract all the requests INRIA of the target IDs, resulting in the total control of the contents. Finally, our final experiment poisoning a real content confirmed the great importance of controlling the number of sources to make an efficient honeypot.

Our future work will consist in enabling HAMACK to target many IDs at the same time, by running several Honeypeers by node. Then, we will use HAMACK to study and fight against different types of malicious contents spreading in P2P networks, like viruses, or more generaly to study any phenomenon related to contents in P2P networks. To close the loop, we work on a revocation mechanism to protect the network against malicious users detected by HAMACK.

Figure 1 :Figure 2 :

 12 Figure 1: Message exchange when eclipsing content

Figure 4 :

 4 Figure 4: KAD routing table scheme

  INRIAn N P n + N H P n (H ≥ 1)

Figure 5 :

 5 Figure 5: Network architecute of HAMACK

INRIA

Figure 6 :Figure 7 :

 67 Figure 6: Impact of the execution time on HAMACK efficiency

Figure 8 :

 8 Figure 8: Impact of the collaboration between Honeypeers

Figure 9 :

 9 Figure 9: Impact of the size of Kademlia RES

Figure 10 :

 10 Figure 10: Impact of active announcement on HAMACK efficiency

Figure 11 :

 11 Figure 11: Number of Publish requests sent and captured considering the distance of the publishing peer

Figure 12 :

 12 Figure 12: Number of Publish requests received for each replication rate

INRIA

Figure 13 :

 13 Figure 13: Distribution of the load on the Honeypeers composing HAMACK

Figure 14 :Figure 15 :

 1415 Figure 14: Proportion of first Search Source requests received for each fake file announced by HAMACK

RR n➦ 6994

Acknowledgment: This work is partially supported by the French Ministry of Research project, MAPE, under contract ANR-07-TLCOM-24 and by the EC IST-EMANICS Network of Excellence (#26854).

 [START_REF] Badonnel | A management platform for tracking cyber predators in peer-to-peer networks[END_REF]This work is funded by the French ANR Rechearch Project MAPE (Measurement and Analysis of Peer-to-peer Exchanges for pedocriminality fighting and traffic profiling) 2 given by a law enforcement agency RR n➦ 6994