Keywords: Trust, Trust Management, Internet of Things, Industrial Internet of Things, Game theory, Signaling game, Markov chain, Digital certificate management, Short-Lived

The Internet of Things (IoT) is a new paradigm where any device of everyday life can become part of the Internet. The device just needs to be equipped with a microcontroller, a transceiver and appropriate protocol stacks that make it able to communicate. IoT makes everyday devices intelligent and able to interact in a collaborative way in order to provide intelligent services in different fields such as: agriculture, industry, healthcare and many others. To achieve these objectives, IoT devices must manage confidential and privacy-related data of their users, which makes them very vulnerable to security threats. However, IoT devices do not have the necessary resources (energy, memory, processing, etc.) to implement strong security or to apply the traditional security measures based on cryptographic techniques usually deployed in traditional Internet. Moreover, the traditional security measures cannot ensure the reliability of the IoT networks, especially in the presence of internal attacks. Hence, our work consists in proposing a dynamic analytical trust management model where each IoT device in the network evaluates the trust level of its neighbors using a trust metric, before interacting with them. This allows the device to predict the future behavior of its neighbors and avoid probable security threats. The trust metric of a device can change state depending on the cooperation, reputation and honesty of that device. It can increase, decrease, remain unchanged or tend to zero if the device is untrusted. We model these state changes by using a discrete-time Markov chain, an effective mathematical method that relies on the previous state of a process to predict its future state. Secondly, we focus our research on trust management in industrial IoT networks (IIoT). Indeed, IIoT networks refer to industrial devices (production machines, robots, etc.) connected to wireless networks, and which collect and share data on their environments. IIoT makes companies more reactive, but at the same time it opens the company's infrastructure to security risks. In order to address this issue, we propose three contributions: To facilitate the trust management process, the first contribution is to change the traditional architecture of IIoT networks into new hierarchical architecture by creating v a new concept called the industrial relationships between IIoT nodes. The second contribution proposes a dynamic trust management model, adapted to the requirements of industrial environments. And lastly, the third contribution is to evaluate the ability and the dynamism of our proposed trust management model to detect behavioral changes of malicious and selfish nodes, by using the contiki/cooja simulator. We subsequently exploit the results of these contributions and the strength of the Signaling game theory to propose a certificate revocation mechanism for IIoT networks. The main purpose of this mechanism is to effectively and accurately isolate malicious IIoT devices from further contributing to network activities. When a certificate is revoked, the other nodes in the network must be informed immediately. The most important issue is how to efficiently distribute certificate revocation information among IIoT devices? Therefore, we propose, in the last part of this thesis, a new efficient certificate verification scheme, based on short-lived certificates (SLC), and suitable for IIoT network requirements. The validity period of each SLC, in the proposed scheme, is proportional to the trust level of its owner. This makes a good trade-off between certificate life and overheads resulting from certificate renewal process, while keeping a high security level. The performance evaluation we conducted proves the effectiveness of our proposed certificate verification scheme to reduce the time needed to obtain the revocation information as well as the resulting storage and communication overhead to achieve this goal.

I would like first of all to express my gratitude and my deep thanks to my thesis director Mr. Abderahim BENSLIMANE, Professor at the University of Avignon, for his support, his precious advice and his scientific contribution along these years of thesis.

I would also like to thank my supervisor, Mr. Abdellatif KOBBANE, Professor at Mohammed V university, for his pragmatic and efficient advice, which allowed me to progress and to achieve this work. I had the honor to have been one of his PhD students. I would also like to express my gratitude and my deep respect to Prof. Valeria LOSCRI, Prof. Nicolas MONTAVONT and Prof. Mohammed BOUL-MALF who accepted to judge this work and to be the reporters. I would like to thank all the members of the jury for the great attention they have given to my work. I can never thank enough my dear parents, my sister, my brother, and all my family for their support throughout this long term work. My dear husband, thank you for being here! No words can ever be enough to tell you all that I have in my heart, far beyond these pages. To all my family, thank you and i love you! I will not finish without thanking all the staff of the Avignon computer laboratory and of the Mohammed V university for their welcome and their support throughout these years. i Résumé L'internet des objets (IoT) est un nouveau paradigme dans lequel tout objet de la vie quotidienne peut faire partie de l'internet. L'objet doit simplement être équipé d'un microcontrôleur, d'un émetteur-récepteur et de piles de protocoles appropriées qui le rendent capable de communiquer. L'IoT rend les objets du quotidien intelligents et capables d'interagir de manière collaborative afin de fournir des services intelligents dans différents domaines tels que: l'agriculture, l'industrie, la santé et bien d'autres. Pour atteindre ces objectifs, les objets IoT sont amenés à gérer les données confidentielles et privées de leurs utilisateurs, ce qui les rend très vulnérables aux menaces de sécurité. Cependant, les objets IoT ne disposent pas des ressources nécessaires (énergie, mémoire, puissance de traitement, etc.) pour mettre en oeuvre une sécurité robuste ou pour appliquer les mesures de sécurité traditionnelles basées sur les techniques de cryptographie habituellement déployées dans l'Internet traditionnel. En outre, les mesures de sécurité traditionnelles ne peuvent pas garantir la fiabilité des réseaux IoT, notamment en présence d'attaques internes. Ainsi, notre travail consiste à proposer un modèle de gestion de la confiance dynamique où chaque objet IoT du réseau évalue le niveau de confiance de ses voisins à l'aide d'une métrique de confiance, avant d'interagir avec eux. Cela permet à l'objet de prédire le comportement futur de ses voisins et d'éviter les menaces de sécurité probables. La métrique de confiance d'un objet peut changer d'état en fonction de la coopération, de la réputation et de l'honnêteté de cet objet. Elle peut augmenter, diminuer, rester inchangée ou tendre vers zéro si l'objet est malveillant. Nous modélisons ces changements d'état en utilisant une chaîne de Markov à temps discret, une méthode mathématique efficace qui s'appuie sur l'état précédent d'un processus pour prédire son état futur. Deuxièmement, nous orientons nos recherches vers la gestion de la confiance dans les réseaux IoT industriels (IIoT). En effet, les réseaux IIoT désignent les dispositifs industriels (machines de production, robots, etc.) connectés à des réseaux sans fil, et qui collectent et partagent des données sur leurs environnements. L'IIoT rend les entreprises plus réactives, mais en même temps, elle ouvre l'infrastructure de l'entreprise à des risques de sécurité. Afin de remédier à ce problème, nous proposons trois contributions: Pour faciliter le processus de gestion de la confiance, la première contribution consiste à changer l'architecture traditionnelle des réseaux IIoT en une nouvelle architecture hiérarchique en proposant un nouveau concept basé les relations industrielles entre les dispositifs IIoT. La deuxième contribution propose un modèle de gestion de confiance dynamique, adapté aux exigences des environnements industriels. Et enfin, la troisième contribution consiste à évaluer la capacité et le dynamisme de notre modèle de confiance proposé pour détecter les changements de comportement des noeuds non confiants en utilisant le simulateur contiki/cooja. Nous exploitons ensuite les résultats de ces contributions et la force de la théorie des jeux de signalisation pour proposer un mécanisme de révocation de certificats pour les réseaux IIoT. L'objectif principal de ce mécanisme est d'isoler efficacement et précisément les dispositifs IIoT non fiables pour qu'ils ne contribuent plus aux activités du réseau. Lorsqu'un certificat est révoqué, les autres noeuds du réseau doivent en être informés immédiatement. La question la plus importante est de savoir comment distribuer efficacement les informations de révocation de certificat parmi les dispositifs IIoT. Pour cela, nous proposons dans la dernière partie de cette thèse un nouveau schéma de vérification de certificats efficace, basé sur des certificats à courte durée de vie (SLC), et adapté aux exigences des réseaux IIoT. La période de validité de chaque SLC, dans le schéma proposé, est proportionnelle au niveau de confiance de son propriétaire. Cela permet de trouver un bon compromis entre la durée de vie du certificat et le trafic lié au renouvellement du certificat, tout en conservant un niveau de sécurité élevé. L'évaluation des performances que nous avons réalisée montre l'efficacité de notre schéma de vérification des certificats. En effet, le schéma proposé permet de réduire le temps nécessaire pour l'obtention des informations de révocation ainsi que les frais de stockage et de communication qui en résultent.

Mots-clés:

Confiance, Gestion de la confiance, Internet des objets, Internet industriel des objets, Theorie des jeux, Jeu de signalisation, Chaîne de Markov, Gestion des certificats numériques, Certificats à courte durée de vie.

Chapter 1 Introduction

Context

In the last decade, Internet of Things (IoT) approached our lives silently and gradually due to the availability of wireless communication systems (e.g., Radio-frequency identification, WiFi, 4G, IEEE 802.15.x), which have been increasingly employed as technology driver for crucial smart monitoring and control applications.

IoT finds application in many different areas, such as home automation, industrial automation, smart cities, healthcare, and many others as shown in Fig. 1.1. For example, in agriculture, IoT allows a permanent monitoring of the state of the soil, the rate of humidity, the rate of mineral salts, etc. This information is transmitted to the farmer in real time to take the necessary measures and ensure proper production. The healthcare sector has also seen a huge number of IoT-based applications that monitor the physical activity of patients and eventually inform their doctors if irregular and abnormal signs are detected. In smart cities, IoT enables the collection of a broad spectrum of demographic data (e.g., carbon footprint, noise level, etc.) to prevent excessive emission of CO 2 , better organize available resources (e.g., smart waste management), and better deploy human resources at the disposal of the city.

According to the analysis conducted in 2020 by IoT ANALYTICS1 , a leading provider of strategic information to the IoT market, on the main application areas of IoT, 22 % of the IoT projects of public companies identified concern the Manufacturing/Industrial area. Followed by the transportation area (15 %) and the energy area (14 %). The integration of IoT in the industrial area offers a potential economic impact of $1.2 trillion to $3.7 trillion a year in Figure 1.1: Applications of IoT 2025 2 . Indeed, the application of IoT technology in an industrial setting and its integration into industrial processes is designated by a new concept called Industrial Internet of Things (IIoT). IIoT technology is a fundamental element of the transition to Industry 4.0, it brings many benefits to manufacturers such as smart production, predictive maintenance and remote control.

Problematic and objectives of the thesis

Since the emergence of the IoT in the late 1990s, security experts have always warned about the potential risks to connect a large number of things, often not sufficiently secured, to the Internet. Several reasons may explain why IoT is highly vulnerable to cyberattacks. First, IoT devices manage sensitive information related to the privacy of their users. Second, many manufacturers of IoT devices have not considered security as a top priority in the conception phase of their products. Third, the high level of heterogeneity, coupled with the large scale of IoT systems and the shared nature of the medium in wireless networks, makes IoT networks highly vulnerable to cyberattacks. Finally, the most important reason is that IoT devices do not have the necessary resources (energy, memory, processing) to implement strong security or to apply the traditional security mechanisms based on cryptographic techniques usually deployed in traditional Internet as explained in [5].

Several researches consider trust management as a potential solution to security issues related to IoT. Indeed, trust management can improve the security of IoT networks by using the notion of belief and by continuously analyzing the behavior of devices in the network. Since they do not rely on cryptographic techniques that are very costly in terms of resources, security mechanisms based on trust management are well adapted to the constraints of IoT networks. They detect accurately internal attacks which traditional security mechanisms are unable to detect. A thorough analysis of the literature reveals that a large majority of trust management models proposed for IoT networks are not resilient to trust distortion attacks, which weakens the security of IoT networks instead of strengthening it. Also, these trust management models did not consider the inherent characteristics of IoT networks, such as limited resources, heterogeneity, context awareness, etc. Thus, by highlighting research gaps and open challenges, our work consists in proposing an effective distributed trust management model considering the requirements and constraints of IoT networks. The proposed trust management model uses a Markov Chain to formalize the variation of trust metrics of IoT devices according to their dynamic behaviors in the network.

Currently, many companies rely on IIoT to support the Industrial Revolution 4.0. For this purpose, these companies deploy IIoT devices in all their industrial services and processes, which make these devices increasingly attractive targets for security threats. Indeed, IIoT networks require continuous monitoring to detect unwanted behaviors conducted by compromised and malicious devices. To deal with this issue, our research has been oriented towards the trust management in IIoT networks. In this context, we define a new concept called industrial relationships where IIoT devices are able to establish industrial relations between them. We use these industrial relationships to change the traditional architecture of IIoT networks into new hierarchical architecture constituted of clusters called industrial communities. Each community is monitored by a leader who evaluates the trust of member nodes and supports the trust management process in the IIoT network. We emphasize that the leader is a specific node with high trust and sufficient resources to perform monitoring tasks. The trust is evaluated according to three parameters namely, cooperation, honesty related to the direct interactions and honesty related to the indirect interactions. These parameters are used later to propose a dynamic trust management model suitable for IIoT networks. To the best of our knowledge, at the time we started our research on trust management in IIoT, there was no proposed trust management model specifically for IIoT networks that considers the requirements and constraints of these networks.

According to an analysis provided by the cybersecurity company Barracuda Chapter 1. Introduction3 , 94% of industrial organizations have experienced a "security incident" in the past 12 months. The majority of these attacks are conducted by malicious IIoT devices that have successfully passed the authentication phase and are part of the network. We notice that the main purpose of malicious IIoT devices is to disclose data related to the industrial processes and damage the basic functionalities of the network. Hence, in the proposed hierarchical architecture, the leader of each community uses the result of the monitoring process to manage the certificates of the member nodes belonging to its community. The leader renews the certificates of legitimate member nodes after expiration and revokes the certificate of malicious nodes to prevent their owner from launching internal attacks in the network. However, the type of member nodes (legitimate or malicious) is hidden information for the leader. Therefore, the leader lets the member node act first in order to observe its behavior and act accordingly. For this purpose, we model the interactions between a member IIoT node and its leader by using signaling game theory, in which players can use the actions of their adversary to make deductions about hidden information. The leader can obtain its best response strategy based on its belief on the member IIoT node, updated by using the Bayesian rules. We subsequently design a certificate revocation mechanism for IIoT networks that outperforms other existing mechanisms in the literature in terms of revocation rate and revocation time, even in the presence of a large percentage of malicious devices in the network.

When a malicious device is revoked, it is crucial to quickly notify other IIoT devices in the network to avoid any transaction with it. Indeed, the information about revoked certificates allows IIoT devices to verify the status of their peers' certificates before establishing a connection with them. However, the distribution of this information in the IIoT network in a resource efficient manner and without latency is a difficult task. Conventional schemes for distribution of information about revoked certificates including certificate revocation list (CRL), online certificate status protocol (OCSP) and Bloom filter are not appropriate to be applicable in IIoT networks because they are subject to some issues like communication overhead, storage overhead and latency. Hence, as alternative to these conventional schemes, we propose a new efficient certificate verification scheme, based on short-lived certificates (SLCs) and suitable for IIoT network requirements. SLC operates as an ordinary certificate, except that its validity period is a short span of time which can be few hours or few days. With this shortened validity period, the certificates of mali-cious devices would expire before their status could be verified by conventional schemes, and before a major attack could be properly conducted. The SLCs in our proposal do not have the same validity period. In fact, the validity period of each SLC is proportional to the trust level of its owner. We assign a larger validity period to the legitimate devices and a shorter to the less trusted ones. This makes a good trade-off between certificate life and overheads resulting from certificate renewal process, while keeping a high security level.

Organization of the manuscript

This manuscript is divided into eight chapters. In chapter 2, we give a detailed introduction of the trust concept in the field of communication and networking, based on definitions from several disciplines including sociology, economics, philosophy and many others. Afterwards, we present the different modules, components, and related attacks that can be considered during the trust management process. We present also the significant applications of trust management identified for wireless networks.

In chapter 3, we provide an extensive analysis of the most widely used trust modeling methods in wireless networks. Indeed, we consider four classes of trust modeling methods including, Basic Methods, Bayesian Methods, Graph methods and Machine learning methods. We define the mathematical theories available for each method and how they can be applied to modeling trust. The main purpose of this chapter is to provide the readers a clear vision towards the design of an effective trust management model.

In chapter 4, we propose a distributed trust management model for IoT networks [START_REF]Proposed H-IIoT architecture[END_REF] where each node monitors its neighbor and assigns it a local trust metric according to its behavior in the network. The proposed trust management model considers not only the variation of the trust metric according to the dynamic behavior of the devices, but also the constraints related to the monitoring process in wireless environments.

In chapter 5, we propose three contributions: In the first contribution, we use the industrial relationships between devices to construct a new hierarchical architecture for IIoT networks instead of their traditional centralized architecture [2]. The purpose of the proposed architecture is to strengthen the trust management process in IIoT networks. In the second contribution, we propose a dynamic trust management model, adapted to the requirements of industrial environments. In the third contribution, we use the simulator contiki/cooja to evaluate the performance of the proposed hierarchical architecture and the trust management model proposed for the IIoT network.

Chapter 1. Introduction

In chapter 6, we rely on the properties of signaling game theory to design a certificate revocation mechanism as well as its corresponding algorithm [3]. The proposed revocation mechanism improves the security of the IIoT network, it deals with malicious devices and detects accurately the behavior changes of devices that exhibit honest behavior up to achieving a high level of trust and then behave in an untrusted manner.

In chapter 7, we improve the hierarchical architecture proposed in chapter 5 to support the management of certificates in IIoT networks, by using the blockchain concept. We also propose an efficient certificate verification scheme for IoT network, based on SLC [4]. In this chapter, we study also the time needed to obtain the revocation information as well as the resulting storage and communication overhead to achieve this goal in our proposed scheme. We choose these two parameters because they are very important for the validation of any certificate verification scheme.

In chapter 8, we close this document by evoking a summary of our work as well as the perspectives concerning the various works realized.

Chapter 2 Towards the notion of trust in communication and networking

Introduction

The significant advances in wireless networks including IoT, Mobile Ad-hoc Networks (MANETs), Vehicular ad-hoc networks (VANETs), etc., have a direct and positive impact on our daily lives. But to have a wide acceptance by the large public, these networks must meet high security requirements because they manage sensitive data related to the daily and private lives of their users. Indeed, it is important to ensure that every cooperating entity in the network is honest and does not represent a failure point for the entire network. Traditional security measures proposed for the Internet do not ensure the reliability of the wireless networks, especially in the presence of internal attacks. These measures must be reinforced by trust management. Indeed, trust management introduces a general perception of the risk and uncertainty related to entities to maintain their legitimacy. It also allows continuous analysis and monitoring of the behavior of entities based on the notion of belief. This chapter is organized as follows. To understand the proposed trust management approaches in the literature for wireless networks, we start by providing a comprehensive definition of the concept of trust and introduce its main properties in section 2.2. We also provide a clear distinction between trust, reputation and security to differentiate them, as these three concepts are often used interchangeably. In section 2.3, we describe the different trust management modules, trust management components, and related attacks that can be considered during the trust management process. Thereafter, we present the significant applications of trust management, identified for wireless networks. These applications are developed for specific purposes; they allow to enhance the security of routing, composition and management of trusted services, collaboration, intrusion detection, access control and authentication in wireless networks.

Towards the notion of trust in communication and networking

Definition of trust in communication and networking:

According to Cambridge dictionary1 , trust is "to believe that someone is good and honest and will not harm you, or that something is safe and reliable [6]". At first glance, it seems that trust is easy to define and understand, as we experience and use it in our daily life. However, in communications and net-2.2. Towards the notion of trust in communication and networking working field there is no single definition of trust, each research paper defines it according to its use, which makes the definition of trust very fuzzy and confusing. Trust is a multidisciplinary subject [7], it belongs to many disciplines such as: sociology, economics, philosophy and many others. Each of these disciplines has produced its own definition and concept of trust. Therefore, these definitions can be exploited to better define and model the trust in communications and networking field. 2In sociology : Trust is considered as a subjective probability [7] that allows an individual to believe that the other will accomplish what he expects of him, knowing that the individual is unaware of the other's future actions and has only expectations. Thus, in sociology, trust involves an inevitable element of risk and potential doubt.

In economics : Trust is also closely linked to the economic activity since the economic exchanges cannot take place if there is too much mistrust between economic agents. We don't exchange anything without trusting the value of what we get in return, just as we don't accept to work for someone if we suspect that he won't pay us. Hence, Trust in economy is based on the assumption that human is rational [7], it aims to maximize its gain, which sometimes turns into selfish behavior when the only goal becomes to serve its own interests.

In philosophy : According to Stanford's Encyclopedia of Philosophy3 , trust is depending on the other but at the same time being vulnerable to the other, especially to treason. It is a relationship involving three parts: the trustor (the individual trusting [START_REF] Jameel | A trust model for ubiquitous systems based on vectors of trust values[END_REF], also called the monitor), the trustee (the individual being trusted [START_REF] Jameel | A trust model for ubiquitous systems based on vectors of trust values[END_REF], also called the monitored) and the context. We rarely trust people entirely (i.e., Alice simply trusts Bob), but rather, Alice trusts Bob to do task D [START_REF] Hardin | Trust and Trustworthiness[END_REF] or Alice trusts Bob in domain C [START_REF] Cruz | Humble Trust[END_REF]. This leads us to say that trust between two individuals is based on the moral relationship and depends on the context.

In psychology : Trust emphasizes the cognitive process centered on individual reflection by which human beings learn trust from their past experiences. Indeed, past experiences affect significantly the ability to trust in the future. The concept of trust defined by the other disciplines can be applied to modeling trust in communications and networking [7] In autonomic computing and human-machine interactions : The complexity of the technology makes trust in autonomic computing and humanmachine interaction increasingly critical, especially when the responses of automated systems can be unexpected. Several works in autonomic computing and human-machine interactions field link trust with reliability where operators will use an automated system only if they believe it is reliable and trustworthy, so the trust specifies the amount of acceptance and use of automation.

Based on the definitions of trust from different disciplines, reviewed above and summarized in Fig. 2.1, we define trust in communications and networking as the degree of subjective belief towards the behavior of a given node. It describes the expectations of a trustor node towards a trustee node, in terms of honesty, quality of service, reliability, integrity, capacity and availability of the activity, and future behavior. Trust depends on context and past experiences, it always involves potential risk and doubt caused by treason and selfish behavior of nodes.

Properties of Trust in communication and networking:

There are several properties that need to be considered when evaluating the trust in communication and networking: 2.2. Towards the notion of trust in communication and networking

• Subjectivity: Trust depends on the evaluation criteria of the trustor node resulting from its opinions and experiences. Two trustors may have different opinions about the same trustee, each influenced by its own beliefs.

• Transitivity: Trust is not transitive, i.e. although node A trusts node B and node B trusts node C, this does not mean that node A will trust node C. However, sometimes to evaluate the trust, the trustor uses the recommendations received from other nodes in the network. In such a case, the trust is assumed to be transitive. Thus, for this assumption to be acceptable, the trust must be evaluated in the same context.

• Dynamism: In wireless networks, information change rapidly over time due to the dynamic topology of networks and the dynamic behavior of nodes. For this purpose, the measurement of trust must also be dynamic in order to be current.

• Asymmetry: Trust is considered asymmetric. Indeed, even if node A trusts node B, this does not involve that node B also trusts node A.

• Composite: To evaluate trust, one or more metrics can be considered for this purpose. We classify trust metrics (also called trust parameters or trust factors) into two categories, social trust metrics and Quality of Service (QoS) trust metrics [START_REF] Aalibagi | A Matrix Factorization Model for Hellinger-Based Trust Management in Social Internet of Things[END_REF]. The social trust metrics rely on the social relationships, community interest and honesty of a node to assess its level of selfishness and lack of cooperation and competence. Whereas, the QoS trust metrics assess the reliability of the trustee node according to its capacity, its successful transactions, its resources consumed, its execution time, and the quality of its peer-to-peer communications.

• Context-dependent: The definition and calculation of the trust depends on the context of its use [START_REF] Guo | A Survey of Trust Computation Models for Service Management in Internet of Things Systems[END_REF]. For example, node A cannot simply trust node B, but node A trusts the node B in a well-defined context. Hence, the properties and the composition of trust change with the change of the context. As well, the selection of the trust modeling method depends on the application context of trust.

Trust vs Reputation:

Trust and reputation are two words that are often confused because many academic papers use them in an interchangeably manner. A given node is trusted if its behavior corresponds always to what the system expects from an Chapter 2. Towards the notion of trust in communication and networking ideal node, whereas an untrustworthy node will frequently deviate from the system's expectations. Hence, trust allows a trustor to accurately predict the behavior of the trustee in the network. In contrast to trust, reputation is not a prediction of the future, but a knowledge of the past. It is a collectively agreed version of how history unfolded. The reputation of the trustee reflects its history, the way it has behaved in all its previous transactions. The trustor is more susceptible to predict the future performance of the trustee if it has information about the past and history of the trustee, reflected by its reputation. Therefore, strong reputation builds strong trust [START_REF] Ramya | A Review on Various Applications of Reputation Based Trust Management A Review on Various Applications of Reputation Based Trust Management[END_REF].

Trust vs Security:

Security consists of protecting the wireless networks against any violation, intrusion, degradation or theft of data. A good security approach must offer high quality services in terms of availability, confidentiality, authentication, integrity and non-repudiation [START_REF] Lu | A Survey on Recent Advances in Vehicular Network Security, Trust, and Privacy[END_REF]. Users trust a system if they have guarantees that the system is properly secured. At the same time, the trust allows to strengthen the security of distributed systems. In fact, security and trust each influence the other. The security mechanisms usually deployed in traditional Internet, also called hard security mechanisms, are not suitable to be reused and applicable in wireless networks, because they do not meet the requirements of these networks. Indeed, these mechanisms cannot protect against internal attacks and can not detect the change of behavior of the nodes. Also, they are expensive in terms of computational resources for nodes with limited resources as they are based on pre-existing shared secret and on cryptographic techniques. To address these limitations, traditional hard security mechanisms can be replaced by trust to enhance security and privacy in wireless networks.

Trust can be seen as a soft security mechanism.

Trust management in wireless networks

The development of strategies [START_REF] Sharma | Towards trustworthy Internet of Things: A survey on Trust Management applications and schemes[END_REF] for estimating and maintaining trust in different entities or systems is called trust management. Trust management is mainly important in wireless networks, whose functionality relies on the collaborative behavior of network nodes. Trust management enhances the traditional security measures of wireless networks by relying on the notion of belief, it also ensures that only legitimate nodes participate in network activities.

Trust Management modules:

According to [START_REF] Movahedi | Trust-Distortion Resistant Trust Management Frameworks on Mobile Ad Hoc Networks: A Survey[END_REF], trust management consists of four main modules: trust composition, trust propagation, trust aggregation and trust update. Trust composition allows the collection of knowledge and information about the behavior of a trustee node. The collection can be done locally by the trustor through direct observation, or remotely through recommendations from neighboring nodes. Trust aggregation allows to combine the collected behavioral observations obtained through trust composition to get a unique trust value for each entity. The Trust aggregation is achieved by using modelling methods such as Basic methods, Bayesian methods, Graph methods, etc. The widely used methods for trust modeling are detailed in chapter 3. Trust propagation defines the method of propagating observations and trust values between entities. Propagation is centralized if it needs a centralized entity and structures like Distributed Hash Table . When the propagation is done through encounters between entities or during interactions between them, it is considered distributed. Trust update is Event-Driven when the update of trust values depends on an event such as an encounter or transaction between entities, and, it is Time-Driven when the update of the trust values takes place in defined time periods. We illustrate, in Fig. 2.2, the relationships and interactions between the four trust management modules.

Direct and indirect Trust management:

The trust computation process is achieved either based on the direct trust, or based on the indirect trust, or by combining these two components as follows:

Direct Trust : reflects the individual opinion of a trustor towards a trustee [START_REF] Siddiqui | Trust in Vehicles Towards Context-aware Trust and Attack Resistance for the Internet of Vehicles[END_REF], in a well defined context, without the intervention and involvement of a third party. This opinion is derived from past experience based on direct observation and interactions between the trustor and the trustee. It provides the trustor an overview of the future intentions and behavior of the trustee. Indeed, if past interactions with a trustee are successful, the trustor assigns a high trust value to that trustee, which will increase the chances of future interactions between them. However, if the trustee is known to be deficient in previous interactions (e.g. packet drop, packet flood leading to excessive consumption of resources in the network, denial of service attacks, etc.), the trustor will assign to it a low trust value to indicate that it does not wish to deal with this trustee in the future. The direct trust can also be deduced from the knowledge that refers to the features of the trustee such as its community, its capacity, its direct relationships, its profile, etc. Authors of [START_REF] Nitti | Trustworthiness Management in the Social Internet of Things[END_REF] estimated the direct trust of devices by considering their social attributes (centrality, Community of interest, friendship, etc.). Indeed, according to [START_REF] Nitti | Trustworthiness Management in the Social Internet of Things[END_REF], a trustor can trust a trustee if they are directly linked by one or several social relations or they have common interests between them. Authors of [START_REF] Nitti | A subjective model for trustworthiness evaluation in the social Internet of Things[END_REF] considered the features of the devices such as their computational capabilities, when evaluating their direct trust. It is important to know that the choice of features needed for knowledge inference differs from one work to another in the literature. This choice depends mainly on the context of the trust application. Direct trust is the best source of decision-making support. However, in some cases, the trustor is led to interact with a trustee with which it has neither direct past experience nor sufficient knowledge. Therefore, the trustor must take into account an additional perspective to evaluate the trust level of the trustee, called indirect trust.

Indirect Trust : Indirect trust, also called indirect observation, relies on opinions propagated to the trustor from different nodes in the network having past experiences with the target trustee. These opinions are called recommendations, and the aggregation of all collected recommendations constitutes the global reputation of the trustee. The global reputation will be considered as a 2.3. Trust management in wireless networks general belief on the trustee in the network. However, recommenders can be dishonest, they may give false recommendations to the trustor to bias the final trust calculation of a target trustee [START_REF] Ud Din | Trust Management Techniques for the Internet of Things: A Survey[END_REF]. For example, dishonest recommender can give a good recommendation to a malicious trustee to improve its trust score and to prevent it from being revoked from the network, also it can give a bad recommendation to a legitimate trustee to decrease its trust score and prevent it from being selected as a service provider in the future. To deal with false recommendations, several works consider the trustworthiness of the recommenders [START_REF] Nitti | A subjective model for trustworthiness evaluation in the social Internet of Things[END_REF] and the quality of the collected recommendations [START_REF] Che | A lightweight trust management based on Bayesian and Entropy for wireless sensor networks[END_REF] in their calculation of the indirect trust.

The majority of research in the literature such as [START_REF] Alnasser | Global Roaming Trust-based Model for V2X Communications[END_REF], [START_REF] Zhong | DSOR: A Traffic-Differentiated Secure opportunistic Routing with Game Theoretic Approach in MANETs[END_REF], [START_REF] Djedjig | New trust metric for the RPL routing protocol[END_REF], [START_REF] Mirsadeghi | A trust infrastructure based authentication method for clustered vehicular ad hoc networks[END_REF] and [START_REF] Zhang | A deep reinforcement learning-based trust management scheme for softwaredefined vehicular networks[END_REF] combined the two components of trust, the direct and the indirect trust, in order to enhance the accuracy and performance of their trust calculations.

Trust-related attacks:

Trust management is used to enhance the security of wireless networks by monitoring continuously the behavior of nodes in these networks. However, this process can be disrupted by malicious nodes that may conduct trustrelated attacks whose goal is to distort trust assessments and degrade trust management performance. To take full advantage of the security-enhancing contributions of trust to wireless networks, trust management in these networks must be resilient to the following attacks:

• Bad-mouthing attack: Malicious node can give a wrong bad recommendation to a well-behaved node to decrease its trust value and therefore revoke it from the network or decrease its chances of being chosen as a service provider [START_REF] Abdelghani | Trust Management in Social Internet of Things: A Survey[END_REF].

• Ballot stuffing attack: Malicious node can give a good recommendation to another misbehaved node to increase its trust value and to allow it to continue its malicious activities in the network [START_REF] Abdelghani | Trust Management in Social Internet of Things: A Survey[END_REF].

• Self-promoting attack: Occur when a malicious node promotes itself by good recommendations to increase its trust value and avoid revocation.

• Honesty attacks: Occur when a malicious node gains the trust of the system by exhibiting correct behavior for non-critical transactions and changes its behavior for critical and important ones.

• Selfish attacks: Selfish nodes do not carry out attacks in the network; their objective is not to damage the basic functionality of the network Chapter 2. Towards the notion of trust in communication and networking but to conserve their resources to serve their own interests.

• Coalition attacks: Happen when a cluster of devices mobilizes to perform a Bad-mouthing attack against an honest node, or a Ballot stuffing attack to promote a malicious node.

• Whitewashing attacks: Occur when a misbehaving node leaves and rejoins the network each time after a series of untrusted behaviors, to wash away its bad reputation. Afterwards, the node recovers its untrusted behavior as soon as it recovers its trust value.

• On-off attacks: Occur when a malicious node behaves honestly for a period of time to gain the trust of other nodes in the network and then changes its honest behavior to untrusted behavior. The node recovers its honest behavior once the network detects its untrusted behavior, and so on.

• Discriminatory attack: This type of attack is very frequent in social Internet of Things (SIoT) [START_REF] Atzori | The Social Internet of Things (SIoT) -When social networks meet the Internet of Things: Concept, architecture and network characterization[END_REF] where IoT merges with Social Networks. Thus, devices may inherit human nature and favor devices with which they have more common friends or experiences and behave selfishly with other devices.

Applications of Trust management

The integration of trust management in wireless networks allows to reach various security and confidentiality objectives required to maintain reliable functionality of these networks. The significant applications of trust management, identified for wireless networks, are the following:

Secure Routing In wireless networks, when a node wants to transmit a packet to other nodes that are outside its transmission range, the packet must be forwarded through one or more intermediate nodes without any modification or violation of the information contained in this packet. Routing methods based on routing tables, used in traditional networks, are not appropriate for application in wireless networks because the topology of these networks is dynamic, it can change randomly at unpredictable times.

Also, routing protocols based on pre-existing shared secret and on cryptographic techniques [START_REF] Aparna | SQMAA: Security, QoS and Mobility Aware ACO Based Opportunistic Routing Protocol for MANET[END_REF], [START_REF] Nikravan | A lightweight signcryption scheme for defense against fragment duplication attack in the 6LoWPAN networks[END_REF], [START_REF] Hema Kumar | Trust aware localized routing and class based dynamic block chain encryption scheme for improved security in WSN[END_REF] are not recommended to be applied in wireless networks because the distributed and dynamic nature of these environments does not allow to have prerequisites and because cryptographic 2.3. Trust management in wireless networks techniques are considered computationally expensive on resource-constrained nodes. For all these reasons, several researches in the literature proposed routing protocols based on trust. Indeed, Trust Management allows selecting the reliable path between a source and a destination by calculating the trust value of each forwarding node. Conventional routing protocols as Routing Protocol for Low-Power and Lossy Networks (RPL) proposed for IoT [START_REF] Airehrour | SecTrust-RPL: A secure trust-aware RPL routing protocol for Internet of Things[END_REF], Dynamic Source Routing (DSR) [START_REF] Charles E Perkins | Performance comparison of two on-demand routing protocols for ad hoc networks[END_REF] and Ad-hoc On Demand Distance Vector protocol (AODV) proposed for distributed wireless networks do not have routing disruption prevention mechanisms. Therefore, several works such as [START_REF] Khalid Riaz | A Multidimensional Trust Inference Model for the Mobile Ad-Hoc Networks[END_REF], [START_REF] Ruo | An Evolutionary Self-Cooperative Trust Scheme Against Routing Disruptions in MANETs[END_REF], [START_REF] Arya | Detecting and avoiding of worm hole attack and collaborative blackhole attack on MANET using trusted AODV routing algorithm[END_REF], [START_REF] Gayathri | Pltrust AODV: Physical logical factor estimated trust embedded AODV for optimised routing in Manets[END_REF], [START_REF] Airehrour | SecTrust-RPL: A secure trust-aware RPL routing protocol for Internet of Things[END_REF], [START_REF] Djedjig | New trust metric for the RPL routing protocol[END_REF] and [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF] have integrated the trust into these protocols in order to strengthen their performance and help them to establish reliable paths based only on legitimate nodes. The established paths do not include selfish and malicious nodes that can disrupt the packet routing process.

Reliable Service Composition and Management

In a service-oriented network like IoT, devices process the collected data to provide users with intelligent services and advanced applications such as health monitoring, traffic detection, meteorological reporting, etc. Effective use of these services requires a secure system in which users can trust the service providers. In IoT, nodes can be both providers and requesters of services, in both cases the nodes are able at any time to launch attacks into the network. Hence, choosing a reliable service provider is a serious concern for service Composition. Random service composition, in which a node randomly selects service providers, misleads the decision-making of that node and imperils its security. To this end, several works such as [START_REF] Chen | Trust management for service composition in SOA-based IoT systems[END_REF], [START_REF] Xiao | Guarantor and reputation based trust model for Social Internet of Things[END_REF], [START_REF] Bao | Trust management for the internet of things and its application to service composition[END_REF] and [START_REF] Jayasinghe | Machine Learning Based Trust Computational Model for IoT Services[END_REF] have chosen to integrate trust management into their service composition applications to allow nodes to select service providers based on their trust levels. Authors of [START_REF] Chen | Trust management for service composition in SOA-based IoT systems[END_REF] provided an adaptive trust management model to support reliable service composition applications in IoT networks. In the proposed model, each device evaluates the trust value of other devices based on the history of its experiences with them and based on the trust feedback of devices sharing social interests with it. The calculated trust value could be an indicator and predictor of a provider's service quality. Hence, only devices with a high level of trust can be chosen as service providers. Authors of [START_REF] Xiao | Guarantor and reputation based trust model for Social Internet of Things[END_REF] proposed a trust management model based on guarantor and reputation, in which devices use credits to obtain services. Indeed, if a device gets a correct service then the device must pay the service provider some credits as a commission. However, if the service received is malicious and incorrect, then the service provider must pay credits to the device requesting the service as a forfeit. The commission and forfeit rates serve as Chapter 2. Towards the notion of trust in communication and networking a guarantee for the behavior of a node. The node requesting the service sends feedback to the reputation server to describe its satisfaction towards the provided service. The received feedback is used then by the reputation server to update the reputation of the service provider.

Collaboration

In Ad-hoc networks, several tasks such as decision-making, key-distribution, service composition, forwarding packets are generally decentralized, and rely on the cooperative participation of all nodes in the network. For example, if a node wants to transmit a packet to a destination that is outside its transmission range, the node needs the collaboration of several intermediate nodes. Nodes can also collaborate to remove a suspicious node from the network by sending accusations against that node whenever it behaves maliciously [START_REF] Narani Aravinthan | Certificate Revocation Scheme Based on Weighted Voting Game and Rational Secure Multiparty Computing[END_REF]. The success of these cooperation-based tasks involves complex aspects such as the evaluation of the cooperativeness and honesty of the participating nodes. Indeed, the participating nodes must be carefully selected to avoid those that are selfish and malicious. Trust management provides continuous monitoring of network nodes to predict their future behavior in terms of honesty, cooperativeness, quality of service, integrity and availability of the activity. For this reason several works as [START_REF] Chen | TRM-IoT: A Trust Management Model Based on Fuzzy Reputation for Internet of Things[END_REF], [START_REF] Ruo | An Evolutionary Self-Cooperative Trust Scheme Against Routing Disruptions in MANETs[END_REF], [START_REF] Chen | Trust management for service composition in SOA-based IoT systems[END_REF], [START_REF] Mirsadeghi | A trust infrastructure based authentication method for clustered vehicular ad hoc networks[END_REF] and [START_REF] Fortino | A Trust-Based Team Formation Framework for Mobile Intelligence in Smart Factories[END_REF] have relied on trust to support cooperation-based tasks and maintain cooperation between nodes. Authors of [START_REF] Chen | TRM-IoT: A Trust Management Model Based on Fuzzy Reputation for Internet of Things[END_REF] proposed a trust management model based on fuzzy logic to enhance collaboration and decision making among IoT devices. In the proposed model, each device establishes a direct trust on the other node by considering three trust evaluation metrics namely: end to end packet forwarding ratio, packet delivery ratio, and energy consumed. The indirect trust between devices is calculated based on the recommendations obtained from the neighbor nodes. The final trust value is calculated by applying the fuzzy theory on the direct and indirect trust. Devices with a low final trust value will be isolated from the network. This allows honest devices to avoid possible collaboration and cooperation with selfish and malicious nodes. To evaluate the indirect trust of a trustee, the trustor uses the recommendations sent by the collaborative nodes in the network having past experiences with the trustee. The trustor must keep only the recommendations obtained from honest nodes. Recommendations obtained from malicious nodes must be filtered to enhance the accuracy of trust computations. For this aim, in [START_REF] Chen | Trust management for service composition in SOA-based IoT systems[END_REF], the trustor first measures its "social similarity" with the recommenders in terms of friendship, social contact and community of interest, then it decides if the recommendations received are trustworthy. Indeed, [START_REF] Chen | Trust management for service composition in SOA-based IoT systems[END_REF] assumed that nodes are more likely to trust each other and collaborate effectively when they are 2.3. Trust management in wireless networks socially connected and have common interests.

Intrusion detection

Wireless networks are subject to several security attacks that can mainly classified in two types: external attacks and internal attacks. External attacks, also known as outsider attacks, are conducted by nodes that do not have direct access to authorized network resources [START_REF] Siddiqui | A Survey of Trust Management in the Internet of Vehicles[END_REF]. These attacks are relatively less harmful because the external attackers have no prior knowledge of the network. In contrast to external attacks, internal attacks, also known as insider attacks, are conducted by legitimate nodes that have successfully passed the authentication phase and are member of the network. Insider attackers can easily launch attacks thanks to their prior knowledge of the network. External attacks may be avoided by many existing methods [START_REF] Wang | IDMTM: A Novel Intrusion Detection Mechanism Based on Trust Model for Ad Hoc Networks[END_REF] such as encryption and signature. However, no effective method has been introduced for internal attacks. To detect and isolate internal malicious nodes from the network, it is important to design an intrusion detection system that is capable of periodically collecting information about the operation of the network and investigating the existence of internal malicious nodes. To this aim, several works in the literature introduced trust management into their intrusion detection systems to enhance the security of their networks. Trust allows continuous monitoring of the network and its components to detect unusual, suspicious and malicious behavior and activities that may jeopardize the reliability of network operations. Trust Management is used for the revocation of internal malicious nodes from the network to avoid each transaction with them and prevent them from making attacks. The integration of trust in the security of transactions reduces the uncertainty and the risk in exchanges between entities. Authors of [START_REF] Medjek | A Trust-Based Intrusion Detection System for Mobile RPL Based Networks[END_REF] proposed a cooperative trust-based Intrusion Detection System (T-IDS) to detect internal misbehaving nodes in the network. In T-IDS, each node periodically monitors the behavior of its one-hop neighbors and collaboratively calculates their trust values. Nodes whose trust value is below a certain threshold are reported to a 6LoWPAN Border Router to put their identities in the list of potential malicious nodes. The list is then shared with all nodes.

Access control

In wireless networks, some information managed by network entities may be publicly available, such as weather reports, while other information must remain confidential, such as patient records. Indeed, it is necessary to prohibit the exposure of sensitive resources to undesirable adversaries to avoid the disclosure of confidential data. Access control prevents unauthorized users (i.e., humans and devices) from accessing devices and network resources to maintain the confidentiality of data. However, sometimes nodes that are considered legitimate and have access permissions to resources can change their behavior over time and become malicious. The issue is that traditional access control mechanisms cannot detect such dynamic behavior. As a result, malicious nodes will continue to access network resources and get access to confidential and sensitive data [6]. Conventional access control must be adapted to meet the specific requirements of wireless networks. To this aim, trust management can be used to support traditional access control mechanisms by setting some limits on the calculated trust values of nodes that request access. Trust management provides nodes with a natural way to assess the behavior of other nodes. It can be considered as an additional attribute for validating access requests in such a way that only nodes with a high level of trust can access resources, while nodes with an insufficient level of trust will be denied. Authors of [START_REF] Dharma Putra | Trust Management in Decentralized IoT Access Control System[END_REF] incorporated trust and reputation in the access control policy to reach dynamic, decentralized and trustworthy access control between IoT devices. By combining trust and reputation with the attributes of IoT devices such as sensor types and hardware specifications, the authors of [START_REF] Dharma Putra | Trust Management in Decentralized IoT Access Control System[END_REF] prevented malicious nodes from gaining access to protected resources. Authors of [START_REF] Mahalle | A fuzzy approach to trust based access control in internet of things[END_REF] proposed a Fuzzy Approach to Trust Based Access Control in IoT. The approach considers three parameters for trust computation, namely experience, knowledge and recommendation, collected from device communications. The computed trust is then mapped to access permissions in order to perform access control.

Authentication Authentication is essential to validating the identity of nodes and ensuring the integrity of data. Without proper authentication practices, an adversary could potentially access confidential network resources. The adversary could even send false commands to endpoints monitoring sensitive processes of the network and cause critical failures leading to significant downtime, financial damages, and disclosure of nodes' private information. Because the wireless communication medium is accessible to any entity, there are no restrictions on access to the channel as long as the entity has the appropriate equipment and resources. The open and distributed nature of wireless networks and the lack of computing resources on nodes require existing authentication techniques to be adapted to these environments to better meet their security requirements. Since trust management provides a lightweight solution to monitor and judge nodes, it was used by several works to adapt and enforce existing authentication techniques. Authors of [START_REF] Hellaoui | TAS-IoT: Trust-Based Adaptive Security in the IoT[END_REF] proposed an ef- The proposed model reduces authentication overhead by authenticating packets only when needed. The purpose of this model is to significantly reduce the energy consumption of nodes due to the message authentication process and to remain secure. Indeed, each node decides locally to authenticate or not the received message according to the level of trust that it assigns to the message sender.

In Fig. 2.3, we give the percentage of efforts made on different trust management applications from the year 2017 to 2022. This figure is based on 1215 papers found from theses, journals, books and conference proceedings. We notice that 31% of the trust management-based models in the literature, from the year 2017 to 2022, have been used to secure routing, followed by Reliable Service Composition and Management (23 %) and Authentication (16 %).

Categories of Trust Management Models:

Trust management models are classified into three categories, namely entitycentric, data-centric and hybrid trust management models: Entity-centric Trust Management Models : This category of models is concerned by the legitimacy and reliability of the nodes participating in the various activities of the network. Indeed, when evaluating the trust, this category considers the behavior of the trustee in the network, its reputation and the recommendations of the neighbors towards it. However, this requires suffi-Chapter 2. Towards the notion of trust in communication and networking cient information about the trustee and its neighbors for an accurate evaluation of the trust. This can be challenging in dynamic networks such as IoT and VANET networks where nodes change locations frequently. Models in this category do not consider the authenticity of messages exchanged because they assume that there is no guarantee that messages sent by honest entities are not corrupted, which may induce the model to incorrectly judge these honest nodes. Several entity-based trust management models have been proposed in the existing research works such as [START_REF] Zhong | DSOR: A Traffic-Differentiated Secure opportunistic Routing with Game Theoretic Approach in MANETs[END_REF], [START_REF] Ruo | An Evolutionary Self-Cooperative Trust Scheme Against Routing Disruptions in MANETs[END_REF] and [START_REF] Dahmane | WeiSTARS: A weighted trust-aware relay selection scheme for VANET[END_REF]. These works computed the trust of a node based on its cooperation rate and its reputation in the network. Consequently, only legitimate nodes are chosen as relay nodes for data dissemination [START_REF] Siddiqui | A Survey of Trust Management in the Internet of Vehicles[END_REF].

Data-centric Trust Management Models :

In the evaluation of trust, this category of models focuses on the reliability, legitimacy, accuracy, and quality of the data collected and shared with other nodes in the network. This data mainly includes reports, information related to user privacy, event warnings, etc. Data-Centric Trust Management Models aim to verify the authenticity of the data produced, that can be modified and distorted by the malicious nodes to attack the network. The falsification of data can have significant consequences especially in critical environments like IIoT networks where nodes are led to handle critical data and a simple change in this data can lead companies to great financial and human damages. The major limitation of these trust management models is that they do not operate adequately in cases of information scarcity due to the lack of sufficient evidence. Several Data-Centric Models such as [START_REF] Jayasinghe | Data centric trust evaluation and prediction framework for IOT[END_REF], [START_REF] Han | Data driven quantitative trust model for the Internet of Agricultural Things[END_REF] and [START_REF] Kchaou | Towards the performance evaluation of a clustering and trust based security mechanism for VANET[END_REF] have been proposed in the literature. For example, [START_REF] Kchaou | Towards the performance evaluation of a clustering and trust based security mechanism for VANET[END_REF] measures the credibility of a vehicle in VANETs by comparing the alerts shared by this vehicle (concerning an incident) with the alerts shared by vehicles that are close to the incident. If the vehicles confirm the correctness of the alert, the data shared by the vehicle will be considered honest and will be taken into consideration. Otherwise, this data will be ignored. However, this may result in delays and data loss in heavy traffic scenarios.

Hybrid Trust Management Models :

This type of model combines both the reliability of the node and the exchanged data for a more efficient trust computation. Indeed, these models consider the authenticity of the data collected and exchanged, the behavior of the trustee in the network, its reputation as well as the recommendations of the neighbors towards it. Several Hybrid Trust Management models have been presented in the literature such as [START_REF] Oubabas | Secure and Stable Vehicular Ad Hoc Network Clustering Algorithm based on Hybrid Mobility Similarities and Trust Management Scheme[END_REF].

Conclusion

In this chapter, we provided a detailed introduction of the trust concept in the field of communication and networking, based on definitions from several disciplines. We also highlighted the crucial role that the trust plays in enhancing security and reliability in wireless networks. Trust ensures the effective use of wireless network services and applications by providing a continuous monitoring of the network and its components. It allows to detect unusual, suspicious and malicious behaviors that may compromise the security of the network. However, trust modeling is not an obvious task, especially since there is no single and standard methodology for modeling and evaluating trust. Indeed, each work in the literature models and evaluates trust according to its own definition and perception of trust, also according to the needs of its application. Hence, to understand how trust can be modeled, in the next chapter we give an overview on the most used modeling methods identified for wireless networks in the literature.

Chapter 3 Trust Modelling methods

Introduction

Trust management is composed of four modules including trust composition, trust propagation, trust aggregation and trust update. In this chapter, we focus on the trust aggregation module, more specifically on the trust modeling methods that constitute this module and allow to have a final trust value from the observations collected by the composition module. The final trust value of an entity reflects its reliability.

As explained in 2.3.4, trust management allows to reach various security and confidentiality objectives required to maintain a reliable functionality of wireless networks. These objectives can be achieved by employing the appropriate trust modeling methods. However, there is no single and standard methodology for modeling and evaluating trust; each work in the literature models and evaluates trust according to its own definition and perception of trust, also according to the needs of its application. Hence, in this chapter, we give a comprehensive review of the literature on the widely used methods for modeling the trust in wireless networks. We classify the trust modeling methods according to the mathematical field to which they belong. We also discuss for each method its theories and how it was applied to trust modeling.

Basic Methods

Basic Methods are simple methods that use basic mathematical constructs for modeling trust. The mathematical models used by these methods are based on equations derived from known and common basic constructs because there is no fixed manner to construct these equations.

Weight function

The weight function is the simplest and most used technique for calculating the trust. Indeed, it is a mathematical tool for calculating sums, integrals or averages in which some elements will have more importance or influence than others in the same set. The result is called a weighted sum or a weighted average.

The weighted sum : consists to overlay several elements by multiplying each of them by its weight and adding them together. Several models use the weighted sum to combine multiple trust factors [START_REF] Djedjig | New trust metric for the RPL routing protocol[END_REF] or to have a single trust score (T ) from the direct trust value and the indirect trust value [START_REF] Zhong | DSOR: A Traffic-Differentiated Secure opportunistic Routing with Game Theoretic Approach in MANETs[END_REF] as follows:

3.2. Basic Methods

T = N i=1 w i f i or T = w d T d + w ind T ind (3.1)
Where: N is the number of elements considered in the average, w i is the weight of the i th trust factor f i [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF], w d and w ind are the weights of the direct trust (T d ) and the indirect trust (T ind ), respectively [START_REF] Wang | A Trust Management Method Against Abnormal Behavior of Industrial Control Networks Under Active Defense Architecture[END_REF].

The Weighted averages as arithmetic averages, combine the values of a set and normalize this sum by the number of elements, to obtain a representation of the set that takes into account all its elements. The difference in weighted averages is that the values are not weighted the same, which provides a more relevant combination. The weighted average is widely used in trust modeling because it allows the aggregation of experiences and evidence (x i ), extracted from direct interactions or issued from recommendations, into a single value that quantifies the whole as in the equation (3.2). This resulting value can be used later in a more complex trust calculation models.

X = N i=1 w i x i n i=1 w i (3.2)
Most models assign to the trustors the choice of defining the weight of each factor constituting the trust metric of the trustee. This allows the trustor to customize the trust model according to its own requirements which perfectly reflects the subjectivity of trust. Some models propose a dynamic adjustment of the weights to better meet the needs of the digital environments. For example in [START_REF] Kang | A Trust-based Pollution Attack Prevention Scheme in Peer-to-Peer Streaming Networks[END_REF], the weight depends on the number of direct interactions between two nodes. Indeed, the more this number is important the higher the weight given to the direct trust value. Other works, considered the number of time intervals that have elapsed since the experiences (interactions or recommendations) were received. Indeed, authors of [START_REF] Khalid Riaz | A Multidimensional Trust Inference Model for the Mobile Ad-Hoc Networks[END_REF], [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF], [START_REF] Jameel | A trust model for ubiquitous systems based on vectors of trust values[END_REF], [START_REF] Zhang | Evaluating the trustworthiness of advice about seller agents in e-marketplaces: A personalized approach[END_REF] and [START_REF] Huynh | Developing an Integrated Trust and Reputation Model for Open Multi-Agent Systems[END_REF] considered that the weight of newer and recent experiences is more important than older ones.

Relational measurement

This method uses similarity, correlation and variance measures to determine the link and the relationship between two variables. The measurement results of this method predict whether the trustor and the trustee are susceptible to trust each other in their future interactions.

Chapter 3. Trust Modelling methods Similarity measures: assess the extent to which two nodes are similar in terms of interest, opinions and ability to judge. The more similar the trustor and trustee are, the more they are able to trust each other and cooperate together in the network. For example, when a trustor wants to measure the indirect trust of a trustee, it only considers recommendations from nodes that have a high similarity with it i.e. recommender nodes that have the same ability to evaluate the trust as it does and the same opinions about the previous trustee nodes. To quantify the similarity of the assessments of two nodes i and k, several works as [START_REF] Zolfaghar | Evolution of trust networks in social web applications using supervised learning[END_REF], [START_REF] Wang | Exploring the Combination of Dempster-Shafer Theory and Neural Network for Predicting Trust and Distrust[END_REF] and [START_REF] Mirsadeghi | A trust infrastructure based authentication method for clustered vehicular ad hoc networks[END_REF] used the Cosine similarity metric defined as follows:

s(i,k) = cos(θ) = V i . V k || V i || . || V k || (3.3)
Where V i and V k are the vectors that gather the evaluations performed by nodes i and k, respectively. In these evaluations, the two nodes rate the behavior of their common neighboring nodes. Cosine similarity metric allows a relative comparison of the evaluations provided by the two nodes i and K, rather than an absolute comparison. Even though the two nodes provide different ratings to their common neighboring nodes, for example Vi=[0.4, 0.2, 0.1] , Vk =[0.8, 0.4, 0.2], their opinions remain similar. Indeed, for both nodes the common node number 1 is the highest rated and the common node number 3 is the lowest rated.

Deviation measures: allow to evaluate the deviation of a variable relatively to its normal and usual behavior (results). These measures are used in trust modeling because the degree to which a device's variable deviates from a certain norm can be an indicator of the change in behavior of that device, and a signal about the abnormality and unreliability of its responses and actions in the network. To measure the deviation of a variable X(i) for node i, [START_REF] Xu Chen | A Multidimensional Trust Evaluation Framework for Online Social Networks Based on Machine Learning[END_REF] used the ln-deviation as follows:

DEV (i) = -ln X(i) + 1 max j∈N (X(j)) + 1 (3.4)
Where N is the number of devices in the network.

The trustworthiness of a recommender node is measured by its ability to provide good and reliable recommendations. This trustworthiness is measured by [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF] as the distance between the value provided by the recommender R to the trustor node A in relation to the trustee node B, (Re A,B,R ), and the direct 3.2. Basic Methods trust value given by the trustor node A to the trustee node B, DT A,B , as follows:

d = |Re A,B,R -DT A,B | (3.5)
The distance d reflects the deviation of the reliability of the recommender's assessments from that of the trustor. It also determines the ability of the node R to provide accurate recommendations.

Fuzzy Logic

Instead of Boolean logic, where the only permitted values are "true" and "false", fuzzy logic allows for intermediate values, which take the form of fuzzy sets such as "not very true" and "rather false". This provides a better representation of the situations where a statement cannot be identified as completely false or true. A fuzzy inference system is a system composed of three main blocks: fuzzification, inference engine and defuzzification.

• Fuzzification: allows to interpret the input variables of a decision model. Therefore, it is needed to make explicit, for each variable in its value interval, the different states it can take; i.e. the subsets to which this variable can belong. The fuzzification is done through membership functions. These functions are specified for each subset, their role is to define the degree of membership of a variable to a given subset.

• Inference engine: In this block, the user can parameter the logical operators and the decision rules as " If...AND/OR ...., then... " according to its own experiences and requirements. Thanks to the inference engine, the user applies the rules that it have fixed to the fuzzy input variables. This allows to have the membership degree of the output variable to the different subsets to which it can belong.

• Defuzzification: This block consists of translating the fuzzy set of output variable obtained through the inference engine into a crisp numerical value. Defuzzification can be performed by several methods, the most widely used are the average of maxima method and the center of gravity method.

Several works as [START_REF] Mahalle | A fuzzy approach to trust based access control in internet of things[END_REF], [START_REF] Airehrour | SecTrust-RPL: A secure trust-aware RPL routing protocol for Internet of Things[END_REF], [START_REF] Kchaou | Towards the performance evaluation of a clustering and trust based security mechanism for VANET[END_REF] and [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF] used the fuzzy logic to apply uncertainty in trust decisions. The process described above was implemented in [START_REF] Mahalle | A fuzzy approach to trust based access control in internet of things[END_REF] to assess the trust of IoT devices according to three variables: Experience (EX), Knowledge (KN) and Recommendation (RC) [START_REF] Guo | A Survey of Trust Computation Models for Service Management in Internet of Things Systems[END_REF]. For each linguistic input variable (i.e. EX, KN and RC), three linguistic terms (i.e. Good, Average, Bad, etc.) were associated using membership functions. Authors of [START_REF] Mahalle | A fuzzy approach to trust based access control in internet of things[END_REF] defined fuzzy rules and logical operators for two reasons. The first reason is to map the values of the fuzzy sets to the values of the possible fuzzy sets (Average, Low, good) describing the trust. The second reason is to measure the membership degrees for the trust value in each of these possible fuzzy sets. Lastly, [START_REF] Mahalle | A fuzzy approach to trust based access control in internet of things[END_REF] used the Center-of-Gravity method to convert the fuzzy value of trust into a crisp value.

Game Theory

Game theory is a sub field of economics and applied mathematics [START_REF] Sarhad Arisdakessian | A Survey on IoT Intrusion Detection: Federated Learning, Game Theory, Social Psychology and Explainable AI as Future Directions[END_REF]. It is used to study situations where individuals named players make decisions knowing that the outcome of their own choices depends on that of others. By definition, trust is dynamic, it changes over time. Specifically, history and past experiences significantly affect the ability to trust in the future. This dynamic aspect of trust can be modeled by game theory using dynamic games where players change their strategies according to their past experiences and history. In wireless networks, trust is based on the assumption that nodes are rational in the sense that they make appropriate choices to maximize their gains and minimize their losses. Game theory can be applied to model the rational behavior of nodes using non-cooperative games when these nodes selfishly pursue their own interests, or using cooperative games when the nodes cooperate with each other to reach a specific objective. For all the reasons explained before, game theory is widely applied for trust modeling [START_REF] Chin | On application of game theory for understanding trust in networks[END_REF]. It enhances the trust-based recommendation systems by rejecting suspected fake scores [START_REF] Esposito | Robust Decentralised Trust Management for the Internet of Things by Using Game Theory[END_REF] [START_REF] Mahdi | Application of game theory techniques for improving trust based recommender systems in social networks[END_REF]. Also, it helps the trustor to define the best strategy for launching its anomaly detection technique to mitigate dishonest activities [START_REF] Rani | Trust Evaluation for Light Weight Security in Sensor Enabled Internet of Things: Game Theory Oriented Approach[END_REF].

Authors of [START_REF] Esposito | Robust Decentralised Trust Management for the Internet of Things by Using Game Theory[END_REF] proposed to use game theory to reach robust trust management in IoT networks. For this purpose, the proposed model classifies IoT devices into two categories, trusted devices called TN and To-Be TrustedNodes called TBTN. The TN computes the trust value of the TBTN and sends this value with the id of the TBTN as a message to the edge node. The TN can be honest, i.e., it always sends correct and truthful information, or malicious, i.e., it attempts to deceive the edge node by providing fake information about the reputation score of some TBTN. At the reception of the message, the edge node, not aware of the specific type of TN, must define its strategy: Either accept the message and pass it to the blockchain participants to update the 3.2. Basic Methods TBTN reputation, or reject the message. Since each strategy (accept or reject) is characterized by a payoff, the edge node will choose the strategy that will maximize its payoff. The interactions among a TN and an edge node are modeled in [START_REF] Esposito | Robust Decentralised Trust Management for the Internet of Things by Using Game Theory[END_REF] as a game, where the payoff structure of this game is presented as follows:

• The edge node receives a positive reward when it accepts a message sent by an honest TN.

• The edge node receives a penalty when it accepts a message sent by a malicious TN.

• The edge node does not receive any reward or penalty when it rejects a message.

• The TN receives a reward when its message is accepted. Otherwise, it gets a punishment.

As the interactions among the two nodes are repeated over the time, the edge node can build its belief on the TN. Thus, based on the payoff structure and the belief, the edge node can define the best strategy to adopt when receiving a message, so that suspected fake trust values are rejected when computing the reputation score of the TBTN.

Entropy Theory

The purpose of entropy theory is to quantify and measure the expected uncertainty associated with a random variable according to the knowledge of all outcomes and the probabilities of these outcomes. If X is a discrete random variable, its entropy will be defined as follows:

H(X) = n i=1 P (x i )log b P (x i ) (3.6)
In trust modeling, the base of the logarithm is generally chosen equal to 2.

Several works used entropy in trust modeling as a trust value [68] [69] or as a tool to calculate the similarity between two recommenders [START_REF] Jiang | A Personalized Recommendation Algorithm Based on Weighted Information Entropy and Particle Swarm Optimization[END_REF]. Other works such as [START_REF] Jayasinghe | Machine Learning Based Trust Computational Model for IoT Services[END_REF] [71], [START_REF] Gong | A Trust Model for Evaluating Trust and Centrality Based on Entropy Weight Method in Social Commerce[END_REF] and [START_REF] Che | A lightweight trust management based on Bayesian and Entropy for wireless sensor networks[END_REF] used entropy in trust modeling as a weight. In [START_REF] Lindsay Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF], trust is defined as the probability that a node cooperates in the network. Then, the trust of a node in [START_REF] Lindsay Sun | Information theoretic framework of trust modeling and evaluation for ad hoc networks[END_REF] is measured by the uncertainty based on the Chapter 3. Trust Modelling methods cooperation probability p of that node as follows:

T (p) =      H(p) -1 if 0 ≤ p < 0.5 1 -H(p) if 0.5 ≤ p ≤ 1 (3.7)
Where the entropy H(p) reflects the level of uncertainty on the cooperation behavior of the node, it is calculated based on equation (3.8) as follows:

H(p) = -plog 2 p -(1 -p)log 2 (1 -p) (3.8)
When the probability of cooperation is in the two extremes, the amount H(p) according to equation (3.8) decreases rapidly, as the certainty about the behavior of the node increases. When the probability of cooperation is too low (too high), the trustor is no longer uncertain about the node's cooperative behavior but has certainty, which leads to a fast decrease (increase) in the trust of the node according to the equation (3.7). On the other hand, when the probability is far from the extremes, around 0.5, the trust evolves slowly because the trustor is uncertain of the node's cooperative behavior. To evaluate the indirect trust and for a node A accept the recommendations of node B, A and B must be similar. Indeed, they must have the same ability to judge and assess the trust of the nodes in the network. To this aim, the authors of [START_REF] Jiang | A Personalized Recommendation Algorithm Based on Weighted Information Entropy and Particle Swarm Optimization[END_REF] relied on entropy to measure the similarity of nodes in a recommender system.

H(A, B) = n i=1 p(d i )log 2 p(d i ) (3.9)
Where, d i is the difference between the trust scores measured by the two nodes A and B for their common nodes. p(d i ) is the probability that the difference d i occurs. Afterwards, [START_REF] Jiang | A Personalized Recommendation Algorithm Based on Weighted Information Entropy and Particle Swarm Optimization[END_REF] used the entropy calculated in equation (3.9) to quantify the similarity between two nodes A and B as follows:

Sim = 1 1 + H(A, B) (3.10)
The entropy measures the degree of confusion of a dataset. Indeed, the larger the entropy, the more confused the data are and the smaller the similarity between A and B. The smaller the entropy, the more concentrated the data and the greater the similarity between A and B.

Bayesian Methods

Bayesian Methods

Bayesian interference model

The outcome of any interaction can be seen as a random variable, so the decision to initiate an interaction with a node depends on the trust given to that node. Indeed, trust can be assessed by the subjective probability [START_REF] Lim | On the Trust and Trust Modeling for the Future Fully-Connected Digital World: A Comprehensive Study[END_REF] that the desired interaction will result in an estimated positive outcome. This interpretation has inspired several researchers to use probability theory and inference for modeling trust. Bayesian inference consists in evaluating the distribution of a random variable ′ X ′ given by some observations from a prior knowledge, (p(X)), corrected by the likelihood of the observed data, (p(observation|X)). This can be expressed by the following proportionality relation:

p(X|observation) ∝ p(observation|X)p(X)
The probability obtained can in turn be used as a prior probability that will be corrected if new data are available. By doing this in an iterative manner, the probability of the hypotheses will converge towards "the truth".

Bayesian inference is widely applied for trust modeling [START_REF] Kurniawan | A trust model-based Bayesian decision theory in large scale Internet of Things[END_REF], [START_REF] Che | A lightweight trust management based on Bayesian and Entropy for wireless sensor networks[END_REF], [START_REF] Ben Abdessalem | An efficient likelihood-free Bayesian computation for model selection and parameter estimation applied to structural dynamics[END_REF]. Assuming a trustee node j that has already performed "c" successful cooperation and "u" non-cooperation with a trustor node i. The belief of node i that node j is legitimate, considering its past cooperative behavior as evidence, can be determined by Bayes rule as:

P (T |c,u) = P (T )P (c,u|T ) N ormalization (3.11)
T is a random variable that denotes the trust of node j, it reflects the proportion of successful cooperation of this node with node i over the total of c + u cooperation performed. According to statistics, a proportional random variable can be modeled as a Beta distribution. Hence, the prior knowledge P(T) towards node j can be represented by distribution Beta(α, β), where α and β are the parameters of the distribution. These parameters represent the prior expectation of the number of successful cooperation and the prior expectation of the number of non-cooperation, respectively. P (c,u|T ) describes the probability that successful cooperation would be the outcome of our study if we knew that T was true. This probability is represented in several works such as [START_REF] Che | A lightweight trust management based on Bayesian and Entropy for wireless sensor networks[END_REF] and [START_REF] Ganeriwal | Reputationbased framework for high integrity sensor networks[END_REF] by the binomial distribution as Binomial(c + u, T ). Therefore, Chapter 3. Trust Modelling methods the posterior belief described in equation (3.11) becomes:

P (T |c,u) = Beta(α, β)Binomial(c + u, T ) N ormalization (3.12) = Beta(α + c, β + u) (3.13)
The steps of the derivation from equation (3.12) to equation (3.13) are detailed in [START_REF] Mui | Bayesian Ratings in Distributed Systems: Theories, Models, and Simulations[END_REF]. Then, the expected trust value toward node j from node i is the statistical expectation of Beta(α + c, β + u) which is:

E[T |c,u] = c + α c + α + u + β (3.14)

Dempster-Shafer (DS) theory

DS theory is a well-developed evidence theory [START_REF] Vijender | Communication and Data Trust for Wireless Sensor Networks Using D-S Theory[END_REF], it allows to combine evidence from different independent sources in order to achieve a degree of belief that considers all available evidence. Let X be the set of all possible states of a considered system and 2 X the power set which gathers all the subsets of X, including the empty set ∅. These subsets represent the propositions regarding the real state of the system, and contain all and only the states in which the proposition is true. DS theory attributes a belief mass m to each element in the power set, via the basic probability assignment function (bpa) [START_REF] Karami | A robust trust establishment framework using Dempster-Shafer theory for MANETs[END_REF] formally defined as follows:

m : 2 X → [0,1] (3.15)
This function has two properties, first the mass of the empty set is zero

m(∅) = 0 (3.16)
Second, the masses of all members of the power set is 1:

Aϵ2 X m(A) = 1 (3.17)
The mass m(A) is a measure of the belief that is attributed to the set A exactly. To combine two mass functions m 1 and m 2 over X, the Dempster's combination rule [START_REF] Vijender | Communication and Data Trust for Wireless Sensor Networks Using D-S Theory[END_REF] is used in the following way:

m 1,2 (A) = (m 1 ⊕ m 2 ) (3.18) 3.3. Bayesian Methods m 1,2 (A) =      1 K B∩C=A m 1 (B)m 2 (C) whenA ̸ = ∅ 0 whenA = ∅ (3.19)
Where:

K = B∩C=∅ m 1 (B)m 2 (C) (3.20)
K measures the level of conflict between the two masses. The normalization factor K -1 allows to ignore these conflicts and to attribute any mass involved in the conflict to the null set. The contribution of DS theory compared to probability theory is that it allows a joint evaluation of any set of possible states belonging to X. Several works have been based on the DS theory as a decision-making tool [77] [34] in their trust process or as an aggregation tool for recommendation scores [78] [58]. For example, [START_REF] Vijender | Communication and Data Trust for Wireless Sensor Networks Using D-S Theory[END_REF] applied this theory to calculate the indirect trust by aggregating recommendations from different neighboring nodes. For this purpose, [START_REF] Vijender | Communication and Data Trust for Wireless Sensor Networks Using D-S Theory[END_REF] considered the set X={Legitimate, Malicious} where Hypothesis H = {Legitimate}, ¬ H = {Malicious} and U = {H, ¬ H}. Each node xϵN , where N is the set of common neighbours between the monitoring node A and the monitored node B, computes three masses m(H), m(¬ H) and m(U) that reflects its belief on node B as follows:

m B x (H) = R x A T B x xϵN -{A} R x A (3.21) m B x (¬H) = 0 (3.22) m B x (U ) = 1 - R x A T B x xϵN -{A} R x A (3.23)
Where: The recommendation credibility R x A is used as a weight to differentiate legitimate and malicious recommendations. T B

x is the direct trust computed by x for node B. To calculate the indirect trust IT B A of node B, A uses the Dempster's combination rule described in equation (3.18) to combine all the masses sent by the neighboring nodes belonging to N.

IT B A = m B x ⊕ m B y ... ⊕ m B z (3.24)

Graph methods

Graph methods allows to model a wide variety of problems by reducing them to a study of vertices and edges. Since most wireless networks can be represented as graphs with nodes and edges, the properties and characteristics of graphs can be used to model the trust between the nodes of the network.

Network features

Graph methods allow to represent the structural features of the network, which can model the trust of a node based on its structural position in the network as well as on its relations with the other nodes of the network.

a) Networks overlap: Based on the modeling of trust in human networks and especially in social networks, the overlap of the networks of two users can be an indicator of the mutual trust between them. Indeed, this overlap evaluates the role of each user in the other's network. In this direction, several works model the trust between two nodes by using the number of common friends between them as an indicator of the overlap of their two networks. Indeed, nodes tend to trust their friends or nodes with strong social ties (with many mutual friends). The more friends two nodes have in common, the more these nodes are likely to trust each other because they are indirectly linked.

For node 'i' to trust node 'j', 'i' should measure the degree of centrality of node "j" in its network. This centrality is measured in [START_REF] Nitti | Trustworthiness Management in the Social Internet of Things[END_REF] and [START_REF] Nitti | A subjective model for trustworthiness evaluation in the social Internet of Things[END_REF] as follows:

C(i,j) = N i,j N i (3.25)
Where N i is the friends of node 'i' and N i,j is the set of common friends between 'i' and 'j'. According to equation (3.25), the larger N i,j is, the more the two nodes are indirectly linked. Jaccard's index has also been used by several works as [START_REF] Wang | Exploring the Combination of Dempster-Shafer Theory and Neural Network for Predicting Trust and Distrust[END_REF] and [START_REF] Chen | Trust-Based Service Management for Social Internet of Things Systems[END_REF] to measure the overlap of the networks of two nodes 'i' and 'j' as follows:

J(i,j) = N i ∩ N j N i ∪ N j (3.26)
Where N i and N i are the set of friends of node 'i' and 'j', respectively.

Graph methods

b) PageRank: PageRank has proven to be a useful tool for ranking nodes in a graph in many contexts [START_REF] Chung | Dirichlet PageRank and Trust-Based Ranking Algorithms[END_REF]. The original PageRank algorithm was designed for web search, but many researchers as in [START_REF] Gao | Info-Trust: A Multi-Criteria and Adaptive Trustworthiness Calculation Mechanism for Information Sources[END_REF] and [START_REF] Zolfaghar | Evolution of trust networks in social web applications using supervised learning[END_REF], have proposed an adaptation of this algorithm to use it for trust modeling. In trust modeling context, PageRank algorithm allows to rank the nodes in the network according to their popularity and importance measured as their global reputation in the network. The Pagerank score reflecting the global reputation of node 'i' in the network can be calculated as follows:

RP (i) = 1 -α N + α jϵM (i) RP (j) L(j) (3.27)
Where N is the total number of nodes, M (i) is the number of nodes that trust node 'i' and L(j) corresponds to the number of nodes that node 'j' trusts. As L(j) increases, the score RP (j) reflecting the overall reputation of node j becomes less important and less considerable in computing the reputations of other nodes according to the equation (3.27). Indeed, a node that trusts a large number of nodes in the network is considered to be undemanding in its trust judgments. c) Adjacency matrix: Let G = (X, E) be a finite and directed graph, where X = {x 1 , x 2 ,..., x n } is the set of vertices of the graph and E is the set of edges which links each two vertices. The adjacency matrix of graph G is the matrix M (G) ∈ R n×n whose coefficients m i,j are defined by :

m i,j =      1 if (x i , x j ) ∈ E 0 if x i , x j ) / ∈ E (3.28)
M (G) is a square matrix, its dimension is n × n. m i,j = 1 if the vertices x i and x j have a relationship between them in the graph. Otherwise, m i,j = 0.

In trust modeling, the trust network was presented by several works [START_REF] Aalibagi | A Matrix Factorization Model for Hellinger-Based Trust Management in Social Internet of Things[END_REF], [START_REF] Hang | Trust-based recommendation based on graph similarity[END_REF], [START_REF] Tang | mTrust: Discerning Multi-Faceted Trust in a Connected World[END_REF] and [START_REF] Ezhei | GTrust: a group based trust model[END_REF] as a finite, directed and weighted graph which has trust values as a weight of its edges instead of 0 and 1. Indeed, the input m i,j ∈ [0,1] represents the trust value of node x j evaluated by node x i . The adjacency matrix is used to represent and visualize the trust relationships that link the different nodes in the network. d) Katz centrality Katz centrality quantifies the relative influence and importance of a node within a network by measuring the number of direct neigh-Chapter 3. Trust Modelling methods bors (first-degree nodes) and also all other nodes in the network that connect to the node via these direct neighbors. Several works apply Katz centrality on trust networks for finding the most similar users as in [START_REF] Duricic | Trust-based collaborative filtering: tackling the cold start problem using regular equivalence[END_REF], and for computing the indirect trust of a node using recommendations from direct and indirect neighbors [START_REF] Frank E Walter | Personalised and dynamic trust in social networks[END_REF].

The Katz centrality of a node 'i' is given mathematically as follows:

C Katz (i) = ∞ l=1 n j=1 α l (M l ) ji (3.29)
Where M is the adjacency matrix of the graph, the powers of M indicate the presence (or absence) of links between two nodes via intermediate nodes. For example, in the matrix M 3 , if m 3,8 = 1, this indicates that nodes x 3 and x 8 are connected via first and second degree neighbors of node x 3 . α is the attenuation factor, it penalizes connections established with distant neighbors via intermediate nodes. Hence, the longer the path, the lower the weight assigned to it. This reflects an important behavior of the trust in recommendation systems; trust becomes increasingly dispersed, as the number of intermediate recommenders in a path increases. For equation (3.29) to converge, the attenuation factor α must satisfy [START_REF] Duricic | Trust-based collaborative filtering: tackling the cold start problem using regular equivalence[END_REF] the following condition:

α < 1 λ M (3.30)
Where λ M is the largest eigenvalue [START_REF] Duricic | Trust-based collaborative filtering: tackling the cold start problem using regular equivalence[END_REF] of M .

Semiring

A semiring is an algebraic structure (S, ⊕ ,⊗) that, for all elements x, y, z ∈ S, the binary operators ⊕ and ⊗ have the following properties:

• ⊕ is associative, commutative, with 0 as a neutral element:

(x ⊕ y) ⊕ z = x ⊕ (y ⊕ z) (3.31) x ⊕ y = y ⊕ x (3.32) x ⊕ 0 = x (3.33)
• ⊗ is associative, with 0 and 1 as an absorbing element and neutral element, respectively:

3.4. Graph methods (x ⊗ y) ⊗ z = x ⊗ (y ⊗ z) (3.34) x ⊗ 0 = 0 (3.35) x ⊗ 1 = x (3.36)
• ⊗ is distributive over ⊕:

(x ⊕ y) ⊗ z = (x ⊗ z) ⊕ (x ⊗ y) (3.37) x ⊗ (y ⊕ z) = (x ⊗ y) ⊕ (x ⊗ z) (3.38)
These properties have been exploited by several research works as [START_REF] Theodorakopoulos | On trust models and trust evaluation metrics for ad hoc networks[END_REF], [START_REF] Yu | Semiring Trust Model Based on Adaptive Forgetting Scheme[END_REF] and [START_REF] Somasundaram | Path Optimization and Trusted Routing in MANET: An Interplay between Ordered Semirings[END_REF] to interpret and model trust in wireless networks. The authors of [START_REF] Theodorakopoulos | On trust models and trust evaluation metrics for ad hoc networks[END_REF] used semirings to find the trusted path between two nodes. This is formulated as a path problem on a weighted graph, where the edge from vertex i to vertex k represents the direct trust relationship between nodes i and k. This edge is weighted by the opinion (T ik , c ik ) that node i has about k. T ik corresponds to the trust value of node k provided by i and the confidence, c ik , denotes the accuracy of T ik . In [START_REF] Theodorakopoulos | On trust models and trust evaluation metrics for ad hoc networks[END_REF], the problem of trusted path is addressed by using a path semiring (S = [0, 1] × [0, 1], ⊕, ⊗) where T ik and c ik has a value in [0,1], and operators ⊕, ⊗ are defined as:

(t ik , c ik ) ⊗ (t kj , c kj ) = ((t ik t kj , c ik c kj ) (3.39) (t p1 ij , c p1 ij ) ⊕ (t p2 ij , c p2 ij )            (t p1 ij , c p1 ij ) if c p1 ij > c p2 ij (t p2 ij , c p2 ij ) if c p1 ij < c p2 ij (t * ij , c p2 ij ) if c p1 ij = c p2 ij (3.40)
Where pk is the k th path and

t * ij = max(t p1 ij , t p2 ij )
The operator ⊗ combines opinions along a path, while the operator ⊕ aggregate opinions across multiple paths. To take into account the properties of trust, authors of [START_REF] Theodorakopoulos | On trust models and trust evaluation metrics for ad hoc networks[END_REF] required that the operators ⊗ and ⊕ have each an additional property to those already defined by the semiring structure as follow:

• For ⊗: x ⊗ y ≤ x,y to express the deterioration of trust along a path.

• For ⊕: x ⊕ y ≥ x,y it concerns the aggregation through multiple paths, it reflects the improvement of the quality of opinions with the abundance Chapter 3. Trust Modelling methods of opinions.

As long as the path contains more than two nodes, the operator ⊗ can be extended to iterative computation. Therefore, the trust value between a source node S and a destination node D is evaluated as follows:

(t pk SD , c pk SD ) = E ij ∈pk (t ij , c ij ) (3.41)
Where i and j are the intermediate nodes in the path pk linking the source node S to the destination node D, and E ij is the edge between nodes i and j. Also, given more than two paths, the aggregate trust value of the trusted path between the source node S and the destination node D is:

(t SD , c SD ) = pk∈paths (t pk ij , c pk ij ) (3.42)

Machine learning methods

Machine learning is a type of artificial intelligence, it aims to give machines the ability to "learn" from data, via mathematical models. These machines improve their performance over time. In trust modeling, Machine learning methods have been used to build trust models based on historical data rather than on human perception of trust, which may be unrepresentative and difficult to model.

Support Vector Machine (SVM)

SVM belongs to the category of linear classifiers, which use a linear separation of the data. SVM is based on the principle of margin maximization to find the border between categories. For the SVM to find this border, it is necessary to give it training data. Indeed, we give the SVM a set of input data, of which we already know their output and to which category they belong. From this data, the SVM estimates the most plausible location of the border: this is the training phase necessary for any machine learning algorithm. Once the training phase is achieved, the SVM will be able to predict to which category an entry that it had never seen before belongs, without human intervention.

In trust modeling, SVM is a widely applied method for classifying nodes in a network into two main categories: legitimate and malicious. Assuming a vector x ∈ R k composed of k features of the trust for each node.

Authors of [START_REF] Jayasinghe | Machine Learning Based Trust Computational Model for IoT Services[END_REF] use five trust features to train their model namely Co-work

Machine learning methods

Relationship, Cooperativeness, Frequency and Duration, Reward System, Mutuality and Centrality, and Community of Interest. In [START_REF] Li | SAT: an SVM-based automated trust management system for Mobile Ad-hoc Networks[END_REF], packet drop rate, packet modification rate and RTS flooding rate are used as trust features to train the model. If we also assume that the decision is d ∈ {-1, 1}, where d = 1 represents the trust category and d = -1 represents the untrust category, the set of n trust data points allowing learning will be:

(x 1 , d 1 ), (x 2 , d 2 ),...,(x n , d n ) (3.43)
The purpose of the SVM algorithm during training is to find an optimal hyperplane h(x)

= w 1 x 1 + ... + w n x n + b = n i=1 w i x i + b = w T
x + b that correctly divides the n trust data points into trusted and untrusted with a maximum margin between the two categories. W is the weight vector, b is the bias and the margin is the distance between the two support vectors of each category. The formula of the margin is given by:

2 ||w|| (3.44)
Then:

M ax 2 ||w|| ←→ M in ||w|| 2 2 (3.45)
Finding the optimal hyperplane can be formulated by :

Optimization P roblem      M in ||w|| 2 2 S.c. y i (w T x i + b) ≥ 1 ∀i = 1..n (3.46)
This kind of problem is called a convex single-objective quadratic optimization problem under linear constraints. There are many methods to solve it, the most famous is the method of Lagrange multipliers. Once training is achieved and the parameters w and b of the optimal hyperplane are found, the SVM can classify a new input x by looking at the sign of h(x) as follows:

     h(x) ≥ 0 ⇒ x ∈ trust category h(x) < 0 ⇒ x ∈ untrust category (3.47)
When there is no hyperplane capable of correctly separating the two categories, it is because the training data are non-linearly separable. Indeed, this is what happens almost all the time in practice. To circumvent the problem, several Chapter 3. Trust Modelling methods works as [START_REF] Jayasinghe | Machine Learning Based Trust Computational Model for IoT Services[END_REF] and [START_REF] Nirav | Detecting Packet Dropping Misbehaving Nodes using Support Vector Machine (SVM) in MANET[END_REF] have used the kernel trick as a solution.

K-Means Clustering

K-Means Clustering is an Unsupervised Learning algorithm, which groups the unlabeled dataset into k different clusters, in such a way that each dataset belongs only one group that has similar properties. Each cluster is represented by its centroid; the data point that represents the center of the cluster. It is calculated as a weighted average of all the points within the cluster. The k-means clustering algorithm mainly performs two tasks called expectationmaximization. The expectation task attributes each data point to its most proximate centroid. Followed by the maximization task that determines the new centroid for each cluster by computing the average of all points in the cluster. The functioning of the algorithm is detailed as follows:

Algorithm 1 K-Means Clustering algorithm 1.
Select the number K to decide the number of clusters; 2.

Select randomly k centroids; 4.

Repeat 5.

Expectation: Attribute each data point to its closest centroid; 6.

Maximization: For each cluster, calculate the new centroid.

7.

Until The position of the centroids does not change;

In trust modeling, to train a supervised learning algorithm, the training dataset given as input to this algorithm in the training phase must be labeled. Each training set must be identified as (xi, yi) according to what we have explained previously. However, training labels are not readily available, hence the need for a method for labeling. In order to overcome the problem of unavailability of a labeled training set based on trustworthiness relationships, authors of [START_REF] Jayasinghe | Machine Learning Based Trust Computational Model for IoT Services[END_REF] use the k-means clustering algorithm to identify two different clusters. Each cluster groups similar interactions based on the extracted trust features, also each cluster represents a label y = [0,1] where y=1 is the label of trustworthy interactions and y=0 is the label of untrustworthy interactions between two IoT devices.

K-means clustering is also one of the methods used in trust-based recommender systems [START_REF] Shahabi | A New Strategy in Trust-Based Recommender System using K-Means Clustering[END_REF] to allow a trustor to find the recommender nodes most similar to it, and therefore predict the trust level of nodes with which it has no previous experience. Indeed, k-means clustering allows to gather in k groups the nodes that have similar rating towards the same trustee nodes.

In Table 3.1, we compared the different methods proposed for modeling trust in the literature. We highlighted the advantages and disadvantages of 3.5. Machine learning methods each proposed method. -Aggregation of experiences.

Table 3.1: Comparison between the Trust Modelling methods

Methods

Approaches

-Support the subjectivity of trust. -Gather nodes that have similar rating.

Relational

Conclusion

The effectiveness of the trust management models, proposed to improve security systems of wireless networks by using the notion of belief, depends on how these models manage the trust. Indeed, the most difficult step in the trust management process is the trust modeling, because there is no single standardized method for this purpose. Each model proposes a trust modeling method according to the perception that its designers have of the notion of trust. Hence, the main challenge is to effectively aggregate all the data collected about an entity, during the monitoring process, in order to evaluate its trust level.

To clarify the readers on the trust modeling methods existing in the literature, in this chapter we provided a classification and deep analysis of the different methods used for trust modeling in wireless networks. We considered four classes of trust modeling methods including, Basic Methods, Bayesian Methods, Graph methods and Machine learning methods. We defined the mathematical theories available for each methods and how they can be applied to modeling trust. The purpose of analyzing the trust modeling process is to provide a clear vision towards the design of an effective trust management model for future researchers.

Chapter 4 Trust Management in IoT networks

Introduction

To provide advanced and intelligent services, IoT devices have to manage data related to the privacy of their users which makes these devices vulnerable to security threats. The openness and the large scale of IoT networks coupled with the limited resources of IoT devices, make the traditional security measures usually deployed in traditional Internet inappropriate to be applied in IoT networks. For this purpose, several researches rely on trust management as a solution to improve the reliability of IoT networks, especially in the presence of internal malicious devices. Indeed, trust management provides continuous monitoring of IoT devices to predict their future behavior and detect any suspicious activity that could jeopardize the security of the network. This ensures that only legitimate devices participate in network activities such as routing, collaboration, service Composition, etc. Certainly, there are several works in the literature that propose trust management models for IoT. However, a deep analysis of these models reveals that a large majority do not consider the inherent characteristics of IoT networks, such as limited resources, heterogeneity, scalability, etc. Further, these trust management models are vulnerable to trust-related attacks, which weakens the security of IoT networks instead of enhancing it.

Based on the research gaps and open challenges, in this chapter, we propose a dynamic analytical trust management model where each IoT device in the network evaluates the trust level of its neighbors using a local trust metric, before interacting with them. This allows the device to predict the future behavior of its neighbors and avoid probable security threats. In our proposed trust management model, the trust metric of a monitored device can change state depending on two principal aspects:

Cooperation: The monitored device cooperates correctly in the network if it forwards data and provides recommendations [START_REF] Xiao | Guarantor and reputation based trust model for Social Internet of Things[END_REF].

Honesty: we define two types of honesty:

• Honesty related to the direct interactions: reflects the reliability of the direct interactions executed by the monitored device. To evaluate this honesty, the monitor device observes the honest interactions and suspicious untrusted interactions performed by the monitored device such as untrusted recommendations, untrusted forwarding, etc.

• Honesty related to the indirect interactions: reflects the reputation of the monitored device in the network. It is calculated on the basis of recommendations given to the monitored device by devices in the network that have already had experiences with it.

Hence, the trust metric of a monitored device can increase, decrease, remain unchanged or tend to zero according to its behavior. We formalized the state 4.2. Requirements and constraints of IoT networks changes of the trust metric by using a discrete-time Markov chain, which is an effective mathematical method that relies on the previous state of a process to predict its future state.

The rest of this chapter is structured as follows. In section 4.2, we give an overview of the requirements and constraints that need to be considered to manage the trust in IoT networks. In section 4.3, we review some related trust management models designed for IoT networks. In section 4.4, we describe and detail the distributed analytical trust management model proposed for IoT. In section 4.5, we discuss the numerical results. Finally, we conclude the chapter in section 4.6.

Requirements and constraints of IoT networks

IoT networks are characterized by many requirements and constraints that need to be considered when designing and deploying trust management in these networks. The main requirements and constraints of IoT networks are:

• Heterogeneity of devices: The evolution of communication protocols and applications has enabled the IoT to interconnect heterogeneous devices with different operating (e.g., operating platforms) and hardware (e.g., processing power, storage capacity, battery) characteristics. These different characteristics must be considered when deploying trust management in IoT networks.

• Scalability: IoT is evolving rapidly; according to statistics made by the IoT ANALYTICS Research1 , the number of connected devices is increasing significantly to reach 21.5 billion by 2025. Indeed, this significant increase raises scalability issues and affects the ability to properly manage and monitor IoT devices. To operate optimally and efficiently, trust management must take into account the rapid evolution of IoT networks.

• Resource-constrained devices and communication cost: IoT devices are limited in terms of processing power and storage capacity. Indeed, operations requiring high computational and storage costs directly affect the performance of IoT devices. As well, costly communication operations affect network performance in terms of bandwidth and availability. The cost of computation and communication is one of the main concerns of IoT networks, therefore, trust management must involve op-Chapter 4. Trust Management in IoT networks erations that are adapted for resource-constrained devices, and that do not consume the available resources of the network.

• High dynamism The topology of IoT networks is very dynamic; it can change randomly at unpredictable times. This is due to the mobility of IoT devices and the fact that these devices can leave or join the network at any time. Also, IoT devices can have a dynamic behavior, e.g., a device may behave honestly at the beginning of its deployment to gain the trust of the network and then change its behavior to become malicious in order to perform internal attacks. Therefore, trust management must be able to adapt to the dynamic topology of the IoT network and be sensitive to the dynamic behavior of devices.

• Energy consumption One of the most crucial challenges of IoT devices is energy consumption, as most of these devices run on batteries.

During the trust management process, IoT devices should not handle a large amount of information. Indeed, this will lead to a rapid drain of their batteries and a reduction in the life of the IoT network. Thus, trust management must provide a good compromise to ensure network monitoring while conserving the energy of devices.

In this section, we have provided an overview of the requirements and constraints that can be considered when designing and deploying trust management in IoT networks. It is well known that these constraints are related to the context of IoT deployment. For this reason, we focus only on the resilience to trust-related attacks whose purpose is to distort trust assessments. A trust management model that is vulnerable to these attacks will more weaken the security of IoT networks instead of strengthening it. To this end, the last section of this chapter is focused on evaluating the resilience of our proposed model to trust-related attacks.

Related work

In this section, we present a concise overview of the trust management models proposed in the literature to solve some security issues related to IoT networks.

Authors of [START_REF] Airehrour | SecTrust-RPL: A secure trust-aware RPL routing protocol for Internet of Things[END_REF] embedded the secure Trust (SecTrust) framework proposed in [START_REF] Airehrour | A Lightweight Trust Design for IoT Routing[END_REF] into the RPL protocol [START_REF] Winter | RPL: IPv6 routing protocol for low-power and lossy networks[END_REF] to provide protection against Rank and Sybil attacks. Indeed, the SecTrust framework supports secure communication, detects and isolates malicious and selfish nodes in IoT networks. For this purpose, every IoT node computes the trustworthiness of its direct neighbors 4.3. Related work based on the computed direct trust value and the recommended trust value. The direct trust of a node is given as the probability of that node to have successful interactions with its direct neighbors. This reflects the reliability and the ability of the node to safely transmit packets to their appropriate destination. Recommended trust value is obtained by gathering the opinions collected from indirectly linked neighbors. SecTrust framework uses the concept of fuzzy threshold to define the trust level of an IoT node ["V1= no trust"," V2= poor trust", "V3= fair trust"," V4= good trust", "V5= complete trust"]. Hence, only nodes belonging to level V5 and V4, with a high level of trust are chosen for secure routing. Devices belonging to V3 are used just in the absence of V4 and V5 node categories. However, nodes belonging to V1 and V2 are considered as malicious or selfish nodes. The authors have proven the effectiveness of integrating SecTrust framework into RPL. This integration allows to make secure routing decisions and to cope with Sybil and rank attacks. However, the SecTrust framework does not deal with attacks launched by selective nodes that gain trust by transmitting a certain type of flow without another.

Authors of [START_REF] Djedjig | New trust metric for the RPL routing protocol[END_REF] proposed a Metric-based RPL Trustworthiness Scheme (MR-TS) to address the trust issue in the building and the maintenance of routing paths from each node to the Border Router. MRTS integrates in the Objective function F0 a new trust-based metric ERNT (Extended RPL Node Trustworthiness). ERNT is employed to compute paths costs, and to choose the preferred parent. It is calculated as an average of the direct trust evaluation computed using three trust components: honesty, energy and unselfishness of the direct neighbor node, and the indirect trust evaluation given by the collaboration of the other nodes in the network. When calculating the direct trust, the authors of [START_REF] Djedjig | New trust metric for the RPL routing protocol[END_REF] assigned a different weight to recent and older experiences to differentiate them. This proposed trust management scheme addresses Rank falsification attacks in RPL and secures exchange of routing path between nodes. It also deals with different attacks such as Self-promotion, Bad-mouthing, and Ballot-stuffing attacks. However, this proposed trust management scheme suffers from coalition attacks and from the overhead costs of communication and energy consumption due to the increased computation. Moreover, authors of [START_REF] Djedjig | New trust metric for the RPL routing protocol[END_REF] have not validated their trust management scheme with simulations and numerical results to evaluate its performance.

To make proper and secure routing decisions in IoT networks, authors of [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF] proposed to integrate a multi-fuzzy trust model (FDTM-IoT) into the RPL protocol as an objective function. In the FDTM-IoT, trust between two nodes is calculated based on a multi-stage fuzzy model that in the first stage calculates the trust of three dimensions, namely Peer to peer communication quality (QPC), service quality (QOS) and contextual information. In the second stage, the outputs of the fuzzy inference systems of the three dimensions, calculated in the first stage, are entered as an input to the final fuzzy inference system. The output of the second stage is the final trust between two nodes. Each of the three dimensions used for the calculation of the final trust consists of sub-dimensions. The QPC dimension is evaluated based on the Last direct QPC observation, historical QPC information and indirect QPC information. The last direct QPC observation is evaluated by using the packets forwarding indication of the monitored node. In the calculation of the historical QPC, authors attributed a high weight to recent communications. And lastly, the indirect QPC is the trust level gained from recommendations received from neighbors. The untrusted recommendations in this model are filtered to avoid the Bad mouthing and Ballot-stuffing attacks. Indeed, the monitor node calculates the difference between its last direct QPC observation and the received recommendation value. If this difference exceeds a threshold of 0.2, the monitor node excludes this recommendation. However, this filtering requires that the monitor node already has a last QPC observation of the monitored node, otherwise it cannot be performed. To evaluate the trust of the "QOS" dimension, the authors used HETX and Delay criteria. The last dimension "Contextual information" depends on the context of the trust calculation. Since the trust in [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF] is computed for routing context, the authors have set three criteria for the computation of the contextual information dimension: mobility of nodes, stability of link and remaining energy. The final trust obtained by the second fuzzy stage can belong to one of the fives trust levels T0, T1, T2, T3 or T4, where T0 is the level that contains the malicious nodes and T4 is the level that contains the complete trusted nodes. Only nodes belonging to T3 and T4 are suitable for secure communication. The trust model proposed in [START_REF] Seyyed | Fuzzy, Dynamic and Trust Based Routing Protocol for IoT[END_REF] is flexible; the criteria used to calculate the contextual information dimension can be changed according to the context of the application and the characteristics of the network.

Authors of [START_REF] Alqahtani | TBM: A trust-based monitoring security scheme to improve the service authentication in the Internet of Things communications[END_REF] proposed a trust-based monitoring (TBM) scheme for protecting against illegal user access and media access control (MAC) spoofing in IoT communications. The intelligent agent evaluates the trust metric of each node in the network based on the number of acceptable and malicious messages the node requests or transmits during a communication period, and based on the physical attributes of its signal (Received signal strength (RSS)). The trust metric calculated for each node allows building a neural network.

Related work

Indeed, the trust metrics are the input of the learning process that takes a final decision about the legitimacy of a giving node. Only nodes present in the legitimate record of the access list are given ECC-based message authentication. This model proposed the integration between trust management and machine learning to make decisions concerning the authentication of IoT nodes and to minimize the detection time of MAC spoofing attacks. Performance analysis proved that the model allows a lower response and detection time. It also allows a reduced energy consumption, which improves the lifetime of the network. However, the proposed trust management model do not consider the mobility of nodes. Indeed, the mobility may wrong the estimation of the position and velocity vector of the nodes calculated by the RSS that allow the detection of spoofing attacks.

Authors of [START_REF] Kowshalya | Trust Management for Reliable Decision Making among Social Objects in the Social Internet of Things[END_REF] proposed a trust management scheme to build a reliable SIoT network and improve decision making among the cooperative nodes in this environment. The trustworthiness of SIoT nodes is calculated by using social trust metrics, including direct trust, centrality, cooperativeness, community interest and service score. The direct trust of the trustee node is calculated based on the transactions made with the trustor node during their direct contact. Each transaction is weighted by a factor to differentiate between relevant and irrelevant transactions. Indeed, only relevant transactions will be taken into account when calculating the direct trust. Therefore, nodes that behave well during irrelevant transactions and change their behavior when the transactions are more relevant are considered as untrusted. Centrality represents the importance of the trustee for the trustor, it is proportional to the number of common friends between the two nodes. Cooperation is also calculated based on the number of common friends between the two nodes. Indeed, the authors assumed that the more the nodes have friends in common, the more they are susceptible to communicate with each other. However, this measure is subjective and does not really reflect the willingness of the devices to cooperate with each other. An additional limitation of this trust management scheme is during the trust update process, malicious nodes have the ability to recover their trust value if they behave well in the network. This enables On-off attacks, as nodes can recover their untrusted behavior as soon as they rebuild their trust values.

Authors of [START_REF] Atzori | SIoT: Giving a Social Structure to the Internet of Things[END_REF] proposed a distributed trust management protocol for a reliable service composition in IoT networks. Indeed, the proposed protocol evaluates the trust of IoT devices to detect misbehavior in service composition. In [START_REF] Atzori | SIoT: Giving a Social Structure to the Internet of Things[END_REF], the trust towards a trustee is built on the basis of three social attributes including honesty, cooperativeness, and community-interest. Honesty is calculated by counting the number of suspected dishonest experiences of the trustee observed by the trustor in a period of time. The cooperativeness determines whether or not the trustee is cooperative with the trustor, this trust attribute is calculated by using the social friendship relationship among nodes. Authors of [START_REF] Atzori | SIoT: Giving a Social Structure to the Internet of Things[END_REF] are the first to consider social relationships in trust management for IoT networks. Indeed, the authors consider that friendly nodes are more likely to cooperate with each other. The community-interest attribute reflects whether or not the trustee and the trustor have similar capacity or common interests. This trust attribute is calculated by using the social relationship among nodes like co-location, co-work relationship and parental relationship. Each of these three trust attributes can be computed based on direct observations in the case where the trustee and trustor interact directly. Otherwise, on the basis of recommendations from neighboring nodes in the case where the two nodes do not interact directly. The proposed trust management protocol measures for the trustee the value of each trust attribute separately, but there is no aggregation of the three attributes to have a single trust value for the trustee. Also, the protocol deals with several trust-related attacks such as Self-promotion, Bad-mouthing, and Ballot-stuffing attacks. However, it is vulnerable to selfish attacks because the measure of cooperativeness in this work is not reliable.

Authors of [START_REF] Fang | FETMS: Fast and Efficient Trust Management Scheme for Information-Centric Networking in Internet of Things[END_REF] proposed a trust management scheme to cope with on-off attacks in IoT networks. In the proposed scheme, each node evaluates the communication trust and data trust of its neighbor. Indeed, the communication trust is evaluated based on the number of cooperation and non-cooperation performed by the monitored node. Trust in the data is evaluated based on the number of interactions containing normal data and the number of interactions containing erroneous data performed by the monitored node. Afterwards, the monitor node combines the result of its observations with those sent by the recommender nodes to evaluate the amount of good and bad experiences had with the monitored node. This combination is obtained by using the DS belief theory, and the final trust value of the monitored node is computed by using Bayes Probability distribution over the good and bad experiences. The interactions of the monitored node are weighted by an aging factor that gives more importance to the recent interactions and allows the scheme to detect the changing behavior of IoT nodes. The proposed scheme allows also the detection of on-off attacks by considering the time duration between the lower and higher trust value. However, the scheme is ineffective to address dishonest recommendation attacks such as Bad mouthing attack, ballot stuffing attacks 4.4. The proposed trust management model analysis and coalition attacks.

The deeper analysis of the reviewed works shows that the trust management models proposed for IoT networks are vulnerable to trust-related attacks, which weakens the security of IoT networks instead of strengthening it. Also, these models did not consider the inherent characteristics of IoT networks. In this chapter, we propose an effective and distributed trust management model for IoT networks, while taking into account the requirements and constraints of these networks.

The proposed trust management model analysis

We use a discrete-time Markov chain to model the management process of the trust metric T m of a monitored IoT node at the monitor node. Indeed, Markov chain is an effective mathematical method that relies on the previous state of a process to predict its future state. Hence, in this section we introduce the states transitions diagram corresponding to our proposed Markov chain, we also detail the calculation of the trust parameters allowing to compute the different transition probabilities from one state to another in the Markov chain.

Trust management Model Overview

In this section, we propose a dynamic and distributed trust management model for IoT networks, where each IoT node is monitored by its neighbors. The monitor node is one hop away from the monitored node. Indeed, the monitor node assigns to the monitored node a local T m according to its cooperativeness and according to the honesty related to its direct and indirect interactions. Each node that joins the network is assigned an initial trust metric T 0. The metrics T m and T 0 have a values in [0, 1]. Therefore, depending on the result of the monitoring process, the T m of the monitored node may increase, decrease, remain unchanged or goes down to zero as shown in Fig. 4.1.

We assume that the change of states of the T m depends on its previous state, on the cooperation of the monitored node, and on the honesty of the monitored node during its direct and indirect interactions. We formalize these state changes by using a discrete-time Markov chain with M + 1 states, state 0 corresponds to the lowest level of trust where T m = 0 and state M represents the uppermost level of trust where T m= 1. We divide the interval [0, 1] of the In our trust management model, the number of transitions needed to reach T m= 1 and the trust interval ϕ can be customized according to the requirements of the monitoring process and according to the level of security we want to ensure in the network. This makes our model flexible and adaptable.

The transition matrix corresponding to the proposed discrete-time Markov chain is:

P = (P s,s ′ (t)) 0≤s,s ′ ≤M (4.1)
The current local T m attributed by the monitor node is represented by a random variable (Y t ) t≥0 . Indeed, (Y t ) refers to a given state of the monitored node. The probability to transit from state s to state s ′ is:

P s,s ′ (t) = P (Y t = s ′ | Y t-1 = s) (4.2)

Trust parameters

Before detailing the calculation of the different transition probabilities allowing the update of T m, we will calculate three trust parameters related to the behavior of the monitored node as follows:

1) Honesty related to the direct interactions: This parameter is evaluated The rate D j is the number of honest interactions (packet successfully transmitted and trusted recommendation) between the monitored node and its DN j , weighted by an interaction factor E tr and divided by the total number of interactions (T N V j ) between these two nodes. The factor E tr represents the relevance of each interaction tr between two nodes. Indeed, this factor differentiates critical interactions from non critical ones [START_REF] Nitti | A subjective model for trustworthiness evaluation in the social Internet of Things[END_REF], its value is in [0,1].

D j =   T N V j tr=1 (V tr * E tr ) T N V j   (4.
3)

The parameter V tr has a value of 1 if tr is a honest interaction or 0 if tr is Chapter 4. Trust Management in IoT networks an untrusted interaction.

Then, the probability p d that the monitored node makes honest interactions with the monitor node DN j is calculated as follows:

p d = D j * p net (4.4)
The probability p net depends on the transmission conditions in the network, it is specific to each pair of nodes. It depends on the state of the network including congestion, retransmission, obstacles, quality of links between the sender and the receiver, which induce at the same time false positives and false negatives during the monitoring process. The purpose of introducing this probability is to consider the constraints of the monitoring environment in trust management.

2) Honesty related to the indirect interactions: To assess this honesty, the monitor node DN j relies on the recommendations propagated from different nodes having past experiences with the monitored node. Recommendations are not distributed among all nodes in the network otherwise they will consume network resources. Indeed, in our proposed model, the monitor node DN j requests recommendations just from its direct neighbors and not from all nodes in the network. For this purpose, first, each DN j with its neighbors organize themselves into a set of groups. The groups formed have not necessarily the same size. Let M D i |i ∈ {1,2,. . . ,k} represents the set of member nodes contained in the group formed by the DN j . Each DN j calculates the rate I j of honesty related to the indirect interactions as shown in Fig. 4.3.

The rate I j is the value of recommendations (R M D i ) from each member M D i belonging to the group and that have already experiences with the monitored node, divided by the total number (k ′ ) of recommendations.

I j = k ′ M D i=1 (T m (M D i ) * R M D i ) k ′ (4.5)
To calculate the rate I j , DN j only considers the values of R M D i which are close to each other, extreme recommendations (too high or too low) are considered as spam. The M D i that provides spam values will be classified as a malicious node that intends to perform Bad-mouthing attack or Ballot stuffing attack. The spam elimination process is performed by the estimation algorithm 2. This algorithm is detailed in the next subsection.

k ′ is the number of recommendations after removing the spam values. Secondly, the probability p I that the monitored node has a good reputation in the network is evaluated as follows:

p I = I j * pnet (4.6)
3) Cooperation: A node cooperates correctly in the network if it agrees to forward data and provide recommendations. To assess the cooperation of the monitored node, the monitor node DN j calculates a cooperation rate C j . The C j is the number (nc) of the good replies of cooperation (c + i ) done by the monitored node, divided by the total number (TNC) of recommendation requests and data forwarding requests sent by the DN j to the monitored node:

C j = nc i=1 (c + i ) T N C (4.7)
We assume that the monitoring application of the DN j generates cooperation requests from the monitored node according to a Poisson process with a rate λ1.

Chapter 4. Trust Management in IoT networks

The probability p c that the monitored node cooperates in the network is:

p c = C j * p net (4.8)

Pseudo code of the estimation algorithm

The pseudo code of the estimation algorithm begins with computing the average avr of a set of values Var={var1,var2,...,varN} given as an argument to its estimate function (lines 3-6). Afterwards, the algorithm calculates the difference d between each value var h ϵ V ar and the average avr (lines 7-8). If this difference is greater than a threshold T H determined by the monitoring process, var h will be considered as spam and will be deleted (lines [START_REF] Hardin | Trust and Trustworthiness[END_REF][START_REF] Cruz | Humble Trust[END_REF][START_REF] Aalibagi | A Matrix Factorization Model for Hellinger-Based Trust Management in Social Internet of Things[END_REF][START_REF] Guo | A Survey of Trust Computation Models for Service Management in Internet of Things Systems[END_REF][START_REF] Ramya | A Review on Various Applications of Reputation Based Trust Management A Review on Various Applications of Reputation Based Trust Management[END_REF][START_REF] Lu | A Survey on Recent Advances in Vehicular Network Security, Trust, and Privacy[END_REF][START_REF] Sharma | Towards trustworthy Internet of Things: A survey on Trust Management applications and schemes[END_REF]. This operation avoids the spam values of V ar that can distort the final estimation of trust. The algorithm then returns the number of values retained after eliminating spam.

Algorithm 2

The estimation algorithm

P s,s-1 (t) = p s (t -1) * (1 -p c ) * (1 -p d ) * p I ; 0 < s ≤ M (4.10)
Where p s (t -1) is the probability that the monitored node is in state s at time t -1, p c expresses the probability that the monitored node cooperate positively in the network, p d expresses the probability that the monitored node is honest during its direct interactions, and p I is the probability that defines the reputation of the monitored node in the IoT network. The computation of p c , p d and p I was detailed in section 4.4.2.

2) Probability to remain in the same state s with s ̸ = M : If the monitored node doesn't have any interaction or cooperation to do, its T m will maintain the same state and the same value for some time. We assume that the monitoring application of the monitored node generates interactions or requests for cooperation according to a Poisson process with a rate λ1, and receives interactions or requests for cooperation from other nodes according to a Poisson process with a rate λ2 (λ1 ≤ λ2). We also assume that an interaction or cooperation request requires a delay ts to be processed in the upper layer before being executed or sent. We consider that the values of λ1, λ2 and ts are the same for all nodes in the network. Hence, according to [START_REF] Iyer | Secure V2V communications: Performance impact of computational overheads[END_REF], the probability that the transmission queue is empty can be expressed as follows:

p q = 1 - 1 -(1 -θ) * θ γ 1 -θ (γ+1) (4.11)
Where γ is the size of the transmission queue, and:

θ = (λ1 + λ2) * ts (4.12)
Then, the probability that the T m of the monitored node remains in the same state s is defined as follows:

P s,s (t) = p s (t -1) * p q (4.13)
3) Probability to sojourn in the trusted state M : The T m of the monitored node remains in the state M , where its value is equal to 1, either because it still shows trusted behavior in the network or it has no interactions or cooperation to do after reaching the higher trust state. Hence, the probability P M,M to maintain the trusted state M is:

P M,M (t) = p M (t -1) * (p c * p d * p I + p q ) (4.14)
4) Transition to state 0: State 0 corresponds to the untrusted state where the T m of the monitored node is equal to 0 (T m= 0). The T m reaches this state if the monitored node act dishonestly in the network according to the following probability:

P s,0 (t) = p s (t -1) * (1 -p d ) * p I (4.15)
Assuming that the initial state of the T m of a node is Y 0 = 1, the probability for the Markov process to reach state z at time t z > 0 is P z (t z ) = P 1,z (t z ). Furthermore, the probability to reach state s at time t > t z given that Y tz = z is P z,s (t). To compute the probability to be in state s at time t, P s (t), from the transition matrix P expressed in the equation. (4.1) , we use the Chapman-Kolmogorov equation [START_REF] Hachtel | Markovian analysis of large finite state machines[END_REF] as follows:

P s (t) = z∈[1...M ] P 1,z (t z ) * P z,s (t) (4.16)

Performance evaluation

In this section, we use MATLAB R2015a to evaluate the resilience of our proposed trust management model to the dynamic behaviors of IoT nodes and to several trust-related attacks:

1) Bad-mouthing and ballot stuffing attacks: In bad-mouthing attacks, the malicious node destroys the reputation of a well-behaved node to isolate it from the network. In ballot stuffing attacks, the malicious node increases the reputation of another malicious node by providing it with good recommendations to increase its T m.

Scenario:

We suppose that the neighbor nodes of the monitor node gave respectively the following R ij values: [0.5, 0.55, 0.1, 0.45, 0.55, 1]. By using the proposed estimation algorithm 2, the two extreme values 0.1 and 1 provided respectively by nodes 3 and 6 will be considered as spams. Indeed, these two values will not be taken into account in the calculation of the final rate I j to avoid distorting the final value of the T m. Afterwards, nodes 3 and 6 will be reported to the system as malicious nodes that aim to make bad-mouthing attack (for node 3) and ballot stuffing attack (for node 6). They will be the next monitored nodes. 2) Attacks of honesty: In IoT networks, some nodes increase their T m by doing too much cooperation, while many of their cooperation are dishonest. These malicious nodes only cooperate honestly for non-critical interactions and change their behavior for critical and important cooperation. Indeed, they cooperate just to send untrusted services or bad recommendations, to redirect nodes to malicious service providers, or to disclose the sensitive data received from other nodes.

Scenario:

To prove the resilience of our trust management model to the attacks of honesty, we use the Markov chain defined in Fig. 4.1 with M = 10 states, each state refers to a step ϕ= 0.1. We set T 0 for each node to 0.1 and p q to 0.25 as computed in [START_REF] Gazdar | A distributed advanced analytical trust model for VANETs[END_REF]. p net is specific to each pair of nodes, to simplify we assume that it is equal to 0.95 in all network. We notice from Fig. 4.4, Fig. 4.5 and Fig. 4.6 that the probability to reach T m = 1 noted by P (T m = 1) is equal to 0 for the first 10 time units. This is due to the fact that the T m of the monitored node is initialized to 0.1 and it has to pass by all states from 1 to M = 10 to get 1. Afterwards, this probability constantly increases up to obtaining its maximum in the 14 th time unit.

In Fig. 4.4, for C=1, p d =0.8 and p I =0.95, the monitored node fully cooperates in the network but just 80 % of its cooperation are honest. According to Fig. 4.4, we notice that once P (T m = 1) reaches its maximum, it begins to be attenuated. This attenuation is due to the cumulative effect of p d . Indeed, despite the fact that the monitored node cooperates fully in the network, 20 % of its cooperation are untrusted and can harm the basic functionality of the IoT network. ) is more significant compared to small values of C (0.3, 0.4 and 0.45). Therefore, when the monitored node reaches the trusted state and continues to behave correctly in the network, it remains in this higher state.

In Fig. 4.6, we suppose that the monitored node changes the honesty related to its indirect interactions from 0.95 to 0.6. According to Fig. 4.6, we notice that the values of P (T m = 1) decrease compared to the previous case in Fig. 4.4 where p I =0. [START_REF] Alqahtani | TBM: A trust-based monitoring security scheme to improve the service authentication in the Internet of Things communications[END_REF]. We deduce that the evaluation of the trust in our model is sensitive to both parameters p d and p I .

We compare our proposed trust management model with the trust management model proposed for VANETs in [START_REF] Gazdar | A distributed advanced analytical trust model for VANETs[END_REF], in which the variation of T m is also modeled by a discrete-time Markov chain with 10 states. The trust management model proposed in [START_REF] Gazdar | A distributed advanced analytical trust model for VANETs[END_REF] only evaluates the honesty related to the direct interactions of vehicles when forwarding data. However, this model is insensitive to the variations of the honesty related to indirect interactions of vehicles. According to the results of Fig. 4.6, despite the fact that the p I of the monitored vehicle decreases, the P (T m = 1) keeps its old value already obtained in Fig. 4.4. The results obtained show that our trust management model is more robust to the attacks of honesty than the model proposed for VANETs in [START_REF] Gazdar | A distributed advanced analytical trust model for VANETs[END_REF].

3) Selfish attacks: These attacks are launched by uncooperative nodes that preserve their resources and energy only to perform their own tasks. Indeed, a selfish node is not intended to carry out malicious attacks in the network, but rather is a node that acts solely for its own interest.

Scenario:

We assume that once the monitored node achieves the maximum level of trust, it will behave selfishly in the network by degrading its cooperation rate C. During the first 20 time units, the node behaves positively in the network (p d =0.95, p I =0.95 and C=1) to increase its T m. Afterwards, the monitored node changes its behavior where it reduces its cooperation rate C during 10 time units followed by a positive behavior during 10 time units and so forth, as shown in Fig. 4.7.

When the monitored node reduces its cooperation rate in the 21 th time unit, the P (T m = 1) decreases severely as shown is Fig. 4.7. This probability returns to its previous value once the node resumes its normal behavior. P (T m = 1) increases slowly during the phase when the node reduces its cooperation rate, because selfish nodes do not act maliciously in the network p d = 0.95 and p I = 0.95. We notice that our proposed trust management model is robust to the dynamic behaviors of IoT nodes.

Conclusion

In this chapter, we proposed a distributed analytical trust management model in order to enhance the security and reliability of IoT networks. The proposed model is hybrid, it relies on the cooperative behavior of IoT devices and the legitimacy of the information they provide. The number of transitions to achieve the high level of trust as well as the trust interval in the proposed model can be adapted according to the monitoring process and network characteristics. This makes our trust management model flexible and adaptable. The numerical results illustrated the strong resilience of our trust management model to the dynamic behaviors of IoT nodes and to various popular trust-related attacks.

In the next chapter, we focus on trust management in IIoT networks; considered as the result of the integration of IoT in industrial processes.

Chapter 5 Trust Management in IIoT networks

Introduction

To accompany the industrial revolution 4.0 ( [START_REF] Hofmann | Industry 4.0 and the current status as well as future prospects on logistics[END_REF], [START_REF] Cheng | Industry 4.0 Development and Application of Intelligent Manufacturing[END_REF], [105]), all automobile manufacturers will rely heavily on the IIoT in order to change the traditional architecture of their plants into a fully automated and highly connected architecture. IIoT networks [START_REF] Boyes | The industrial internet of things (IIoT): An analysis framework[END_REF] refer to industrial devices (sensors, production machines, robots, etc.) connected to wireless networks, and which collect and share data on their environments. IIoT devices will be deployed in all industrial services and processes: manufacturing, maintenance, monitoring and other tasks, which makes them increasingly attractive targets for security threats. The integration of security measures [START_REF] Soumya | Securing IoT Platforms[END_REF] [107] into IIoT devices is very important but it needs to be reinforced by securing the entire IIoT network of the plant. Indeed, an IIoT network can behave in untrustworthy manner even after implementing all necessary security and confidentiality measures in its IIoT devices ( [START_REF] Pouraghily | Poster Abstract: Privacy in Blockchain-Enabled IoT Devices[END_REF], [START_REF] Li | Privacy in Internet of Things: From Principles to Technologies[END_REF], [START_REF] Abbas | Urban Transition in the Era of the Internet of Things: Social Implications and Privacy Challenges[END_REF]) as the Stuxnet worm attack [START_REF] Fidler | Was Stuxnet an Act of War? Decoding a Cyberattack[END_REF] on Iran's nuclear installations showed in 2010. This attack destroyed a large number of centrifuges in the Natanz power station by slightly disrupting their operations. Hence, behavior-based analysis of IIoT devices is required to predict their performances over time. Trust management can provide behavior-based analysis of IIoT devices by using their past behavior and their reputation in the network. Usually, trust is managed either in a distributed manner, where each device evaluates the trust metrics T m of its neighbors, or in a centralized manner, where a single entity manages the trust of the entire IIoT network. However, a single centralized trust management entity is not able to continuously and accurately manage the trust in the plant's IIoT network composed of a large number of heterogeneous and sensitive devices. Admittedly, distributed trust management models are the most widely used in the composition of services in IoT, but, they are not appropriate to manage the trust in industrial environments. The ultimate solution is to change the traditional architecture of the plant's IIoT network by organizing IIoT devices into clusters in order to support and enhance the trust management process. In SIoT [START_REF] Atzori | The Social Internet of Things (SIoT) -When social networks meet the Internet of Things: Concept, architecture and network characterization[END_REF], devices build their clusters according to their common social relationships [START_REF] Bao | Dynamic trust management for internet of things applications[END_REF]. However, social relationships cannot be established between IIoT devices. Hence, new specific relationships more appropriate for industrial environments must be defined. Inspired from SIoT, our contribution in this chapter is three fold. In the first contribution, we define a new concept called industrial relationships where IIoT devices are able to establish industrial relations between them. Instead of traditional architecture of the plant's IIoT networks, the industrial relation-5.2. Related work ships define a new hierarchical architecture called H-IIoT. Indeed, the H-IIoT architecture is constituted of clusters called industrial communities. Within the same community, the evaluation of trust becomes more accurate because it is calculated and defined in the same context. Each community is monitored by a trusted leader which evaluates the trust of the member devices and returns the results to the IIoT server to record them. The trust is evaluated according to three parameters namely, cooperation, honesty related to direct interactions and honesty related to indirect interactions. In the second contribution of this chapter, we use the three parameters to propose a dynamic trust management model called Tm-IIoT model suitable for IIoT networks. In the last contribution, we implement our proposed H-IIoT architecture by using contiki/cooja simulator to compare its efficiency with that of the traditional architecture of the plant's IIoT network. We also demonstrate the sensitivity, responsiveness and resiliency of our proposed trust management model to trust-related attacks launched by malicious IIoT devices.

The rest of this chapter is structured as follows. To the best of our knowledge, at the time we started our research on trust management in IIoT, the related work does not exist in this research area. Hence, in section 5.2, we discuss some related trust management models proposed for IoT to prove that these models are not appropriate for IIoT networks. The purpose of this discussion is to justify the need for a new trust management model that considers the requirements and the constraints of IIoT networks. In section 5.3, we describe the applications of IIoT in the future connected factories. This defines the need for IIoT networks in terms of security and trust management. In section 5.4, we rely on a new concept called industrial relationships to propose new hierarchical architecture for IIoT networks. Indeed, the proposed architecture supports the trust management in IIoT networks. In section 5.4, we propose a dynamic trust management model that considers the requirements and constraints of IIoT networks. We present the performance evaluation, the comparisons and the simulation results in section 5.5. Finally, in section 5.6, we conclude the chapter.

Related work

The use of trust management to monitor the behavior of IIoT devices in factories was not considered as a main concern by researchers. To the best of our knowledge, there existed no trust management model proposed specifically for IIoT networks. Thus, in this section we analyze the trust management mod-els proposed for IoT and SIoT networks to investigate the possibility of their applications in an IIoT context. To make decision about the trustworthiness of an IIoT device, the IIoT server must have the global T m of that device. In distributed trust management models such as [START_REF] Chen | Trust-Based Service Management for Social Internet of Things Systems[END_REF], [START_REF] Djedjig | Trust-based RPL for the Internet of Things[END_REF], [START_REF] Karkazis | Design of primary and composite routing metrics for RPLcompliant Wireless Sensor Networks[END_REF], [START_REF] Karkazis | Evaluation of RPL with a transmission count-efficient and trust-aware routing metric[END_REF], [START_REF] Chen | Trust Management for SOA-Based IoT and Its Application to Service Composition[END_REF], [START_REF] Guo | A Survey of Trust Computation Models for Service Management in Internet of Things Systems[END_REF] and [START_REF] Nitti | Trustworthiness Management in the Social Internet of Things[END_REF] each IoT node calculates the trust metrics of its neighbors and stores them locally in order to use them for its own interests: service composition [START_REF] Chen | Trust Management for SOA-Based IoT and Its Application to Service Composition[END_REF], decision making [START_REF] Al | Trust-Based Decision Making for Health IoT Systems[END_REF] or access control [START_REF] Neto | Demo Abstract: Attributed-Based Authentication and Access Control for IoT Home Devices[END_REF]. In order to have the global trust metric of a node, it is necessary to gather all local trust metrics calculated for that node. This process is very demanding in terms of energy consumption and also in terms of time wasted to have the final convergence trust metrics. In centralized trust management models such as [START_REF] Chen | Trust-Based Service Management for Social Internet of Things Systems[END_REF], [START_REF] Guo | A Survey of Trust Computation Models for Service Management in Internet of Things Systems[END_REF] and [START_REF] Saied | Trust management system design for the Internet of Things: A context-aware and multi-service approach[END_REF], just one trust management entity must monitor, alone, the trust of all IIoT nodes in the network. These models are very difficult to apply especially when the IIoT network evolves. Therefore, given the above discussion, whether centralized or distributed trust management models cannot be applied to manage the trust in IIoT networks. The ultimate solution is to combine the two types of models in order to have a hierarchical trust management model based on clustering. Authors of [START_REF] Alshehri | Clustering-Driven Intelligent Trust Management Methodology for the Internet of Things (CITM-IoT)[END_REF] proposed a scalable hierarchical trust management solution for IoT environments based on clustering. The trust metric of each cluster node is managed by a master node and collected from the peer cluster nodes. The work in [START_REF] Alshehri | Clustering-Driven Intelligent Trust Management Methodology for the Internet of Things (CITM-IoT)[END_REF] proposed an algorithm to eliminate outliers, hence, the resulting trust metric is calculated as the average of the remaining evaluations. However, this work is vulnerable to coalition attacks because the proposed algorithm makes its decisions based on the evaluations given by the majority of cluster nodes. If the proposed algorithm has as a majority the evaluations given by malicious cluster nodes, then it eliminates the evaluations given by legitimate and fair nodes. Another limitation of [START_REF] Alshehri | Clustering-Driven Intelligent Trust Management Methodology for the Internet of Things (CITM-IoT)[END_REF], is the lack of accuracy in the calculation of trust values as the evaluations are not carried out in a well-defined context. In fact, it is required to have a context between the monitored and the monitor nodes in order to have a high accuracy when managing the trust. Authors of [START_REF] Ben Abderrahim | TMCoI-SIOT: A trust management system based on communities of interest for the social Internet of Things[END_REF] proposed a clustering architecture based on the similarity of interest and the relationships between devices to create a trust management context. By analyzing this work, in order to construct the communities of interest, authors considered the social relationship between owners instead of considering the social relationships between devices. Indeed, the choice of belonging to a particular community is made by human. Therefore the devices are not considered autonomous, which contradicts the objectives of SIoT con-5.2. Related work cept. To elect the leader of a community, the authors of [START_REF] Ben Abderrahim | TMCoI-SIOT: A trust management system based on communities of interest for the social Internet of Things[END_REF] considered the following metrics: trust level, capability and scalability. Scalability promotes nodes with a large number of friends to be elected as a leader. This makes the model highly vulnerable to coalition attacks where a set of malicious nodes can meet between them and elect an untrusted leader. Authors of [START_REF] Chen | Trust Management for SOA-Based IoT and Its Application to Service Composition[END_REF] proposed a trust management protocol to support service composition in SOA-based IoT systems. They developed a technique based on distributed collaborative filtering to select feedback from owners of IoT nodes sharing similar social interests. To measuring social similarity, the authors relied on three social relationships, i.e., friendship, social contact and community of interest. To compute similarity rates, nodes exchange their profiles containing the friend list and the location list of their owners in clear text, which does not preserve the privacy of users and allows their traceability. Authors of [START_REF] Bao | Dynamic trust management for internet of things applications[END_REF] proposed a new protocol based on three trust factors: honesty, cooperativeness and community interest. The authors of [START_REF] Bao | Dynamic trust management for internet of things applications[END_REF] calculated the cooperativeness as the ration of the number of common friends over the total number of friends between two nodes. The calculation of the cooperativeness factor in this work is very subjective and the fact that two nodes are friends does not really reflect their willingness to cooperate together [START_REF] Abdelghani | Trust Management in Social Internet of Things: A Survey[END_REF]. The biggest limitations of this work are the energy efficiency and the adaptability of the protocol. To improve this work, authors of [START_REF] Bao | Scalable, adaptive and survivable trust management for community of interest based Internet of Things systems[END_REF] reused the same trust factors as [START_REF] Bao | Dynamic trust management for internet of things applications[END_REF] and take into consideration other aspects such as scalability and adaptability of the protocol. As in [START_REF] Bao | Dynamic trust management for internet of things applications[END_REF], the update of trust metrics is always events-driven and the trust metrics are computed only for a limited set of nodes to minimize computation and to ensure scalability. However, the proposed trust management protocol in [START_REF] Bao | Scalable, adaptive and survivable trust management for community of interest based Internet of Things systems[END_REF] does not detect On-off attacks. The proposed work in [START_REF] Nitti | A subjective model for trustworthiness evaluation in the social Internet of Things[END_REF] builds a reliable trust management model based on the behavior of IoT nodes. Hence, each node in the network computes the trust metrics of its friends based on its own experience and on the opinion of its common friends. The basic trust parameters used for calculating the trust metric in this work are: Feedback system, transaction factor, total number of transactions, relationship factor, computation capability, credibility and centrality. This work is scalable and resilient against self promoting, bad-mouthing and ballot-stuffing attacks but it does not ensure the power efficiency and survivability [START_REF] Abdelghani | Trust Management in Social Internet of Things: A Survey[END_REF]. The trust management protocols proposed in [START_REF] Bao | Dynamic trust management for internet of things applications[END_REF], [START_REF] Bao | Scalable, adaptive and survivable trust management for community of interest based Internet of Things systems[END_REF] and [START_REF] Nitti | A subjective model for trustworthiness evaluation in the social Internet of Things[END_REF] are very greedy in terms of energy consumption. They are based on the change of state of IoT nodes (monitored monitor and vice versa) which can cause a fast drainage of their battery. In these works, there is no differentiation between nodes i.e. any node can be a monitor even small sensors with constrained resources. Furthermore, the evaluation of trust metrics in these works is very subjective. Indeed, each node calculates the trust metric of its neighbors according to its own context, stores them locally and uses them in case it needs to interact with other nodes in the network. Several works used blockchain technology [START_REF] Lahbib | Blockchain based trust management mechanism for IoT[END_REF] [START_REF] Moinet | Blockchain based trust authentication for decentralized sensor networks[END_REF] to propose secure trust management models for IoT. Indeed, this technology concerns distributed trust management models that need to securely store and exchange trust scores between nodes within the network. Blockchain technology cannot be used to manage trust in the plant's IIoT network because distributed trust management models are not appropriate to manage the trust in industrial environments for all the reasons explained above. In the previous chapter 4, we proposed a distributed trust management model for IoT networks based on three trust metrics namely, cooperation, honesty related to direct interactions and honesty related to indirect interactions. However, distributed models cannot be used to properly manage the trust in IIoT networks. In the light of the existing trust management models, we propose in this chapter an appropriate trust management model for IIoT networks, which is based on a hierarchical architecture. We use the same trust parameters as in chapter 4, but these trust parameters will be evaluated differently according to the IIoT context as shown in section 5.4. What differentiates IIoT from IoT is first of all the application context. Therefore, trust management in IIoT networks must take into consideration the industrial context. Also, IIoT devices are more heterogeneous. Indeed, in IoT networks any node can manage another, however in IIoT the monitor node must prove at least the same technological capabilities as the monitored node in order to predict its behavior correctly over time. Moreover, some IIoT devices manage sensitive data related to industrial secrecy, which requires customized trust management for each node depending on the sensitivity of the data it manages. For all these reasons, we would like to mention that the core idea of the two chapters is totally different.

Future automotive factory architecture based on IIoT

Many automobile manufacturers 1 aim to make everything in their future plants smart, autonomous and connected. For example, manufacturers will 5.3. Future automotive factory architecture based on IIoT rely on IIoT to better manage the plant's inventory. Indeed, smart devices will monitor the stock availability and will send a report to the inventory management system, which will automatically communicate with suppliers to order necessary parts. If there is complicated maintenance to be done, operators can easily contact the experts by using their smart devices (i.e. connected tablets, watches, etc) to intervene remotely. They can also use their connected glasses to follow the expert's constructions in order to update the production machines in the plant. The connected glasses can also allow the expert to follow all the manipulations of the operators and to intervene if necessary. IIoT devices can provide detailed information about their functioning (i.e. unusual operations, alerts, potential problems, etc.), to predict failures earlier and more accurately. This IIoT-based predictive maintenance allows the manufacturers to reduce downtime and increase their efficiency. In the plant, there are also connected robots that support smart production and send report about the number of vehicles produced per time period. Even after its delivery, the vehicle remains connected with the after-sales service to send periodic reports about the technical condition of engine and parts. In case of problem, the customer will be notified to do the necessary maintenance. This will allow the automobile manufacturer to improve both its after-sales service and its choice of suppliers. The smoke sensors of the plant will be connected to the fire department, once the temperature exceeds the limits, the water-filled pipes will be made available throughout the plant and a report will be sent back to the fire department to intervene. In the automotive plant, connected meters will be installed everywhere to measure the energy consumed by machines, production lines and installations in real time. Thanks to these measures, managers can improve their understanding of energy consumption in the plant, determine what is consuming the most energy and identify inefficient machines. As explained above, automotive manufacturers intend to rely on IIoT in all industrial services and processes. Indeed, IIoT devices will lead to manage sensitive data, which will make them a very attractive target for hackers that aim to compromise the reliability of the IIoT network. Hence, it is necessary to monitor the plant's IIoT network continuously by using trust management. To support trust management in the IIoT network, we organize the plant's IIoT network by defining a new concept called industrial relationships where devices can establish industrial relations between them. The industrial relationships used in our contribution are defined as follows:

• Parental relationship (PR): exists between devices which have the same technological characteristics and capabilities in the network.

• Co-worker relationship (CWR): binds devices that perform the same tasks or that always collaborate together to provide intelligent services.

• Ownership relationship (OR): exists between devices belonging to the same employee or the same production line.

• Social relationship (SR): is defined by the social relationship (i.e. hierarchy relations, collaboration relations, etc.) that exist between the owners of the IIoT devices.

The monitor node easily detects the behavior changes and the untrusted behavior of a monitored node when they are linked by the CW R relationship since they work together to achieve the same objective. In order to have more accurate T m and more homogeneous clusters, the CW R relationship can be strengthened by OR and SR relationships. The evaluation of trust becomes more accurate when the monitor and the monitored nodes are linked by several industrial relationships.

The proposed trust management model analysis

As discussed above, we aim to change the traditional architecture of IIoT networks in automotive plants in order to support trust management. Hence, we organize the IIoT network as a set of clusters called industrial communities. Clusters are not necessarily the same size.

As depicted in Fig. 5.1, the IIoT network is composed of K community leaders and L member nodes. L is not the number of member nodes in each community, but rather the total number of member nodes in the network. Let CL j |j ∈ {1,2,. . . ,K} and M N i |i ∈ {1,2,. . . ,L} represent the set of community leaders and member nodes in the network, respectively.

The leader CL j manages the T m of each M N i belonging to its community by calculating three trust parameters: cooperation, honesty related to direct interactions and honesty related to indirect interactions. CL is a specific node that must have high level of trust, sufficient computing power, storage and energy resources to perform monitoring tasks. Each node that wants to join the network must send a request to the IIoT server. IIoT server assigns to nodes a unique identifier "ID" and creates a Figure 5.1: Proposed H-IIoT architecture profile for them. The profile is stored in both the IIoT node and the IIoT server. Indeed, the profile sets the tasks that can be performed by the IIoT node (such as measurements, transactions, operations, etc.) and the data that can be shared by each node in the network. It determines also the types of the industrial relationships that can be established between two nodes. Based on these defined rules, each node can allow to start, update or terminate any relationships with another node. Each node that wants to be a CL must request authorization grant from the IIoT server. According to the conditions explained below in phase 5.4.1, the server gives or not the permission to a specific node to be leader. Once a node becomes a CL, it establishes its community. The following section is organized into three phases. The first phase concerns the designation of CLs based on several conditions. The second phase describes the establishment of communities around the designated CLs based on the industrial relationships. The last phase concerns the monitoring process where CL j manages the T m of its community members in order to detect suspicious and untrusted behaviors.

Phase I: Designation process of CL

CL contacts the IIoT server either to send the results of its monitoring or to retrieve data needed to evaluate the T m of its community members. CL evaluates the T ms of its M N s according to their behaviors in the network and according to the monitoring frequency defined for each M N . The monitoring frequency is customized depending on the sensitivity of the data managed by the monitored M N . Indeed, IIoT nodes containing critical and production-sensitive data must be continuously monitored with a higher frequency compared to nodes containing less critical and less sensitive data. The monitoring frequency of a M N i does not only depend on its nature (critical or not critical) but also on the community parameters: the number Ds of nodes which must be monitored by the same trust management entity and the period T r for which T ms of all IIoT nodes in the community must be updated and registered in the IIoT server.

The monitoring frequency for each M N i will be calculated as follows:

f i = κf i r + (1 -κ)f i N (5.1)
Where: f i r is the recommended frequency for each node according to the sensitivity of the data it manages. f i N is the recommended frequency by the network and the community parameters. It is the frequency that must be respected to ensure that the T m of all nodes in the IIoT network will be managed within a fixed period T r. It is calculated as follows:

f i N = Ds T r (5.
2)

The selection of (0 ≤ κ ≤ 1) is important for setting the order of monitoring.

κ is used to weigh the importance of the sensitive data relative to the network parameters in the evaluation of the monitoring frequency. The monitoring process sets the parameter κ to a high value in order to ensure continuous monitoring of critical nodes and to have a better accuracy when calculating the T ms. The parameter κ is set to a smaller value when the monitoring process aims to monitor all nodes in a very specific time period "Tr", regardless of their sensitivity.

Each CL j will have to continuously monitor the behavior of the M N i in its community. For this purpose, it compares the current behavior of its member nodes with their profiling stored in the IIoT server. As discussed above, the CL is a specific node, it must have a high level of trust to manage its members, it must have also a sufficient reserved energy to perform monitoring operations and to communicate with the server, and it must have a sufficient computing power to calculate cooperation and honesty rates necessary for the evaluation of T ms.

Before the implementation of our proposed hierarchical architecture (designation of CLs and construction of communities), the plant's IIoT network will be deployed to allow nodes to acquire knowledge about their neighbors. In this deployment phase, we adopt a centralized trust management architecture where the IIoT server is the only entity in the network responsible for managing the T ms of all nodes. Each node has an initial trust metric T 0. When the T m of a node reaches a high level of trust, the server asks that node to calculate its designation indicator DI according to equation ( 5.3) and return the result of this calculation to it. None of these queried nodes can report false data (e.g., a high DI value), since they are legitimate nodes. These nodes will probably be designated as a leader if their designation indicator DI checks some conditions explained later in this first phase. Only nodes with high T m will be contacted by the server to calculate and send their DI. Indeed, the CL before any other condition, it must be a legitimate node. If a node does not send its designation indicator DI, it will be penalized and judged by the server as a selfish node because it does not participate in the monitoring process. The designation indicator DI is calculated as a follows:

DI = ζT m + βEr + ϱP m + ωCm (5.3)
Where Er is the energy reserved for monitoring, we assume that each node has a reserved energy just for monitoring. P m is the computing power level specific for each node and Cm designates the centrality of a node in the network. The weight ζ + β + ϱ + ω = 1 and 0 ≤ ζ, β, ϱ, ω ≤ 1. In practice, the monitoring process determined by the IIoT server gives weight (ζ, β, ϱ, ω) to each component (T m, Er, P m, Cm) according to its importance and according to the network conditions. Indeed, a CL must always have a high level of trust since it must monitor the T ms of other nodes in the network. Hence, the weight ζ must always be higher than the other parameters. If the IIoT network is very dense, in addition to the high level of T m, the CL must also prove a high computing capacity P m and sufficient monitoring energy Er to perform the monitoring tasks. Otherwise, if the IIoT network is less dense with isolated nodes, the CL must be chosen based on its T m and also based on its centrality to avoid being placed in the extremities of the network and building empty communities.

The server checks all received DI and decides for each node whether to give it the authorization to be a CL. Only nodes with a DI greater than a threshold set by the monitoring process take the authorization to announce Chapter 5. Trust Management in IIoT networks themselves as CLs. The threshold value reflects the type of nodes deployed in the network. Indeed, if the network contains critical, sensitive and very heterogeneous nodes, the threshold value should be set to a high value in order to require more selectivity in the designation and the choice of CLs. Once approved by the server, the designated CL broadcast beacons to all other nodes within its transmission range to announce itself as a leader. If two CLs are close to each other, it is better to eliminate one of them to optimize the number of CLs and the number of communities formed, especially if the network is not dense as explained in Algorithm 3.

Algorithm 3 The designation algorithm

CL j is a designated leader; CL j ′ is a new designated or an already designated leader, where j ̸ = j ′ when CL j receives a beacon from CL j ′ ; begin 1. if DI(CL j ′ ) < Threshold then 2.

Reject beacon; 3.

Send the feedback to the server; GO TO (End) 4. else 5.

if (dij < D) then 6.

if (DI(CL j )>DI(CL j ′ )) 7.

Status(CL j )=CL; 8.

Status(CL j ′ )=MN; 9.

Send the feedback to the server; 10.

CL j ′ stops broadcasting beacons to other nodes and CL j continues to send them; 11.

else if (DI(CL j )<DI(CL j ′ )) then 12.

Status(CL j ′ )=CL; 13.

Status(CL j )=MN; 14.

Send the feedback to the server; 15.

CL j stops broadcasting beacons to other nodes and CL j ′ continues to send them; 16.

End if 17.

else if (dij > D) then 18.

Status(CL j ′ )=CL; 19.

Status(CL j )=CL; 20.

Send the feedback to the server; 21. The two nodes continue to send beacons to their communities respectively; 22. End if 23. End if

End

The value of D is chosen according to the density of the IIoT network. D is chosen small when the network is dense to increase the number of CLs. If the network is dense and the value of D chosen is large, it will cause congestion at the CL nodes and a quick drainage of their batteries. When the network is not dense, the distance D must be large to optimize the number of CLs in the network. Choosing a small D while the network is not dense will constitute communities with very few member nodes or even empty. Each CL j sends 5.4. The proposed trust management model analysis a periodic beacons to its community members. As soon as a member does not receive any more beacons, it will consult its CL preference list to choose another CL. When an M N i receives a beacon from a new CL, it runs the community establishment algorithm that will be introduced later in the next phase, either to join the community of this new CL or to add this CL to its preference list.

Phase II: The community establishment method

The purpose of this phase is to form communities around the designated CL j based on the industrial relationships. Therefore, it is assumed that each M N i will choose to join community of one and only one CL j and each CL j will monitor one and only one community.

M N i computes the selection indicator SI CL j for each CL j from which it has received beacons and it chooses the CL j having the maximum SI CL j . SI CL j is calculated based on the physical distance, the quality of link and the industrial relationships between the two nodes as follows:

SI CL j =δ(1 - d(M N i ,CL j ) max CL j (d(M N i ,CL j )) ) + ξ(1 -BER CL j ) + η(RI CL j ) (5.4)
Where δ+ξ+η = 1 and 0 ≤ δ, ξ, η ≤ 1, d(M N i ,CL j ) is the physical distance between M N i and CL j . When a node receives a signal from its adjacent node, it uses the power of this received signal to calculate the distance between them. In our work we calculate the distance between two nodes based on the number of hops between them. It is assumed that IIoT nodes already have an appropriate identity management system. M N i has an interest to choose a leader close to it in order to save its energy and to avoid retransmissions and data losses. SI CL j is unitless, its value ranges from 0 to 1. max CL j (d(M N i ,CL j )) is the maximum physical distance that can be between M N i and CL j nodes, it is used to normalize the SI CL j . The bit error rate (BER) is the number of bit errors divided by the total number of transferred bits during a studied time interval. BER is a unitless, it is defined as following:

BER CL j =
T he number of bit errors T he total number of transf erred bits (5.5)

The relationship indicator RI CL j evaluates the industrial proximity of M N i with CL j based on the industrial relationships between the two nodes. It is defined as follows:

RI CL j =Γ(P R(M N i ,CL j )) + Θ(CW R(M N i ,CL j )) + ρ(OR(M N i ,CL j )) + ν(SR(M N i ,CL j )) (5.6)
Where Γ + Θ + ρ + ν = 1 and 0 ≤ Γ, Θ, ρ, ν ≤ 1, each node sets its own weights conforming to its profile.

Once a node is designated as a leader, it starts sending beacons to nodes in its transmission range to announce its presence. The clustering is done at one hop. M N i can receive periodic beacons from one or more CL j nodes. The beacons contain a set of information about the CL j sending them such as the manufacturer code (that reflects the technological capabilities of the node), owner code (the code of the production line or the user who owns the node), task list (that contains all the tasks that a node must perform in the network) and social friend list (defined according to the social relations of the user of the node (i.e. hierarchical relations, collaborative relations, etc.)). These information are already predefined in the profile of each node. They are sent hashed to M N i nodes by the CL j nodes, because they contain the technological and industrial data of the CL j that sends them. M N i uses the received beacons to evaluate its industrial relationships with the CL j as a follows:

-Parental relationship P R(M N i ,CL j ) : In the heterogeneous IIoT network, there are nodes that require specific abilities from their monitor nodes to accurately monitor their behavior and assess their T m. For example, a connected production robot cannot be monitored by a simple sensor. Indeed, the sensor does not have sufficient technical resources to accurately evaluate the T m of the connected production robot. Hence, M N i will privilege parental relationship in order to have approximately the same technological capabilities as its leader. To evaluate this relationship, M N i compares its manufacturer code, that designates its technical capacity, with the manufacturer code sent in the beacon of the CL j . If the two codes are similar or the code of the leader is larger, the value of P R(M N i ,CL j ) takes 1 otherwise it takes 0.

-Ownership relationship OR(M N i ,CL j ): During the monitoring process, CL j asks the M N j nodes for a set of information about their operations. In automotive plants, IIoT nodes contain critical and production-sensitive data.

The proposed trust management model analysis

Hence, critical M N i chooses its leader based on this relationship to restrict the circulation of its monitoring data just between the nodes belonging to the same production line or user as it. To evaluate this relationship, M N i compares its owner code with the owner code sent in the beacon of the CL j . If the two codes are similar, the value of OR(M N i ,CL j ) takes 1 otherwise it takes 0.

-Co-worker relationship CW R(M N i ,CL j ): This relationship makes the calculation of trust more accurate because the T m of M N i will be evaluated by a leader that performs the same tasks. To evaluate this relationship, M N i calculates the similarity between its task list A(M N i ) and the list A(CL j ) that contains the set of hashed tasks of node CL j as follows:

CW R(M N i ,CL j ) = A(M N i ) ∩ A(CL j ) A(M N i ) ∪ A(CL i ) (5.7)
-Social relationship SR(M N i ,CL j ): is chosen when the M N i nodes are based on the social relations of their users (i.e. hierarchy relations, collaboration relations, etc.) to choose their leaders. To evaluate this relationship, M N i calculates the similarity between the list of its social friends S(M N i ) and the list S(CL j ) that contains the set of hashed social friends of the CL j as follows:

SR(M N i ,CL j ) = S(M N i ) ∩ S(CL j ) S(M N i ) ∪ S(CL j ) (5.8)
We propose the algorithm 4 to establish communities between nodes CL j and M N i as follows:

Each M N i has a preference list where it stores the identities of its favorite leaders. When M N i receives beacon from a CL j ′ other than its leader, M N i calculates the selection indicator SI CL j ′ of CL j ′ and stores its identity in the preference list. CL j ′ nodes are ranked in the list in descending order of their selection indicators. The leader with the largest selection indicator will be placed at the top of the preference list. If the list is full, the M N i compares the calculated SI CL j ′ with the selection indicator of the last node in the preference list. If the calculated SI CL j ′ is greater, M N i removes the last leader from the list and adds the CL j ′ which will be ranked in the list according to its selection indicator value. M N i can join the community of leaders stored in its preference list in case it no longer receives beacons from its own leader.

CLs monitor the M N s belongings to their communities and return the results to the IIoT server. The IIoT server ensures that all nodes in the network are monitored. When a set of nodes does not exist among the monitored nodes,

Algorithm 4 The community establishment Algorithm

Input: CL j |j ∈ {1,2,. . . ,K} and M N i |i ∈ {1,2,. . . ,L}; Output: Industrial Communities; Begin 1.

FOR each M N i 2.

Set the coefficients δ, ξ, η, Γ, Θ, ρ, ν; 3.

END FOR 4.

FOR each CL j 5.

Compute the initial community CM j = {M N i , d(M N i ,CL j ) ≤ transmission range }; 6.

END FOR 7.

FOR each M N i 8.

FOR each CL j 9.

if

M N i ∈ CM j 10. Compute d(M N i ,CL j ), BER CLj , P R(M N i ,CL j ), CW R(M N i ,CL j ), OR(M N i ,CL j ), SR(M N i ,CL j ); 11.
Compute SI CLj ; 12.

END If 13.

END FOR 14.

Choose CL j with max SI CLj ; 15. END FOR 16. FOR each CL j 17.

Form the Industrial community CM j ; 18. END FOR 19. Return the Industrial Communities CM j |j ∈ {1,2,. . . ,K}; End it means that these nodes are isolated and do not have a CL to manage them. Therefore, the IIoT server gives permission to a node among these isolated nodes to be a CL.

Phase III: The proposed trust management model

In this phase, we propose the Tm-IIoT trust model for IIoT networks, based on the H-IIoT architecture described in the previous phases 5.4.1 and 5.4.2.

The IIoT server sends to each CL j all necessary information to evaluate the T m of its members. Indeed, CL j relay on these information to calculate three trust parameters called cooperation, honesty related to direct interactions and honesty related to indirect interactions, needed to evaluate the T m. We remind that each node integrates the network by having an initial trust metric T 0. The value of T m and T 0 varies within the interval [0, 1]. The T m of a monitored M N i can increase, decrease, remain unchanged or go down to zero as described in the previous chapter 4. Hence, to formalize the transitions of T m, we use the state transition diagram at M + 1 states depicted in Fig. 4.1 of the chapter 4. We remind that each state corresponds to a specific value of T m. The state 0 corresponds to T m = 0, and state M corresponds to a high level of trust where T m = 1. The interval [0, 1] of the T m is divided into M + 1 states, each state represents a step ϕ [START_REF] Gazdar | A distributed advanced analytical trust model for VANETs[END_REF]. As expressed in equations (4.9), (4.10), (4.13), (4.14) and (4.15), the transition of T m from one state to another depend on the current state of the monitored M N i and on the trust parameters namely, cooperation, honesty related to direct interactions and honesty related to indirect interactions. The Tm-IIoT model relies on the same trust parameters as in chapter 4, but evaluates these metrics differently according to the IIoT context.

To evaluate the different transition probabilities allowing to update the T m of a M N i , CL uses the information received from the IIoT server to calculate first the three trust parameters describing the behavior of this monitored M N i over time.

-The cooperation rate : evaluates the behavior of the monitored M N i related to its cooperation in the network. The cooperation rate C M N i of M N i is the number of the successful forwarded messages divided by the total number N F of the messages transmitted to it by its CL j . The cooperation rate of the monitored M N i is calculated as follows:

C M N i = N F i=1 (C mi ) N F (5.9)
Where C mi has a value of 1 if the message mi is forwarded correctly or 0 if the message mi is not forwarded. Then, the probability p c that the M N i cooperates in the network is expressed as follows:

p c = C M N i * p net (5.10)
As explained in chapter 4, the probability p net depends on the transmission conditions in the network. We would like to remind the reader that the purpose of introducing this probability is to consider the constraints of the monitoring environment in the final calculation of trust.

-The rate of honesty related to direct interactions : measures the compatibility between the tasks performed by the M N i in the network and the tasks that M N i must perform and predefined in its profile. The node that monitors a production machine in order to send reports every hour to the production system is considered as a dishonest node when it does this task every four hours. Hence, this node must be isolated from the network in order to define the causes of its suspicious behavior. The rate of honesty related to direct interactions allows to detect this type of untrusted tasks, it also allows to detect behavior changes produced by M N i nodes.

The IIoT server sends to the CL j , in a list A(M N i ), the set of hashed tasks, that the monitored M N i must perform in the network, i.e. the monitoring to carry out, the reports to produce, the recommendations to issue, etc. The tasks are sent hashed to CL j nodes in order to prevent data leakage due to probable interception of monitoring messages by malicious nodes and in order to ensure that in the event of CL j intrusion, the tasks will not be disclosed. To evaluate the rate D M N i of honesty related to direct interactions of M N i , CL j compares the set of hashes contained in the two lists A(M N i ) and AF (M N i ) by calculating their similarity ratio as follows:

D M N i = A(M N i ) ∩ AF (M N i ) A(M N i ) ∪ AF (M N i ) (5.11)
p d is the probability that the monitored M N i is honest, it is calculated as follows:

p d = D M N i * p net (5.
12)

The list AF (M N i ) contains the set of feedback tasks and behaviors of M N i . After the comparisons, AF (M N i ) will be deleted automatically by the CL j to optimize its memory space.

Untrusted tasks and behaviors are defined in our work as behavior changes and non-cooperation of IIoT nodes in the network. In the SIoT concept [START_REF] Atzori | The Social Internet of Things (SIoT) -When social networks meet the Internet of Things: Concept, architecture and network characterization[END_REF], nodes have an infinite number of tasks to perform because they are related to the unlikely activities of the human being. But in a factory the number of tasks defined for each IIoT node is finite, each node has a finite number of tasks to perform previously defined by the IIoT server. Hence, when an IIoT node changes behavior, its leader easily detects the changes by calculating the rate D M N i . Behavior changes of IIoT nodes are dangerous, simple disruptions can disclose the company's trade secret or can cause plant failure and major material damage as the Stuxnet worm attack [START_REF] Fidler | Was Stuxnet an Act of War? Decoding a Cyberattack[END_REF] on Iran's nuclear installations showed in 2010.

-The rate of honesty related to indirect interactions: reflects the reputation of the monitored M N i inside its community. The nodes in the community that already have experiences with M N i must give it a recommendation according to its behavior in the network. The nodes that will give extreme recommendations, i.e. too big or too small recommendations than the other member nodes, will be reported as malicious nodes that aim to perform ballot stuffing attacks or bad-mouthing attacks. CL j uses routing to collect recommendations from the M N s belonging to its community. Afterward, CL j removes spams by using the estimation algorithm 2, proposed in chapter 4, and sends to the IIoT server the list of nodes that generate spams to sanction them. CL j calculates the rate of honesty related to indirect interactions of M N i as an average of the recommendations given by the community members as follows:

I M N i =   N M N i ′ =1 R M N i ′ ,M N i N   (5.13)
Where R M N i ′ ,M N i is the reputation given by the

M N i ′ to the M N i , M N i ̸ = M N i ′ . M N i
does not give a score for itself to avoid self-promotion attacks. N is the total number of recommendations towards M N i after removing spam.

The probability p I that the monitored M N i has a good reputation is calculated as follows:

p I = I M N i * p net (5.14)
Based on the probabilities p c , p d and p I describing the behavior of the monitored M N i , CL j calculates the increasing and decreasing state probabilities (P s,s+1 (t) and P s,s-1 (t)), the state stay probability P s,s (t), the probability to sojourn in the trusted state M P M,M (t) and the probability to transit to state 0 P s,0 (t). The mathematical formulas of these probabilities are already detailed in chapter 4. According to the state transition diagram in Fig. 4.1 and the monitoring process, the CL j can evaluate the T m of its monitored M N i . Indeed, knowing the T m of the monitored M N i in time t -1, at time t the value of this T m can increase or decrease by 0.1, remain unchanged or take 0.

Performance evaluation

In order to prove the sensitivity, the responsiveness and the resiliency of our proposed Tm-IIoT model, we use the InstantContiki 2.7 platform2 . The various simulation parameters are listed in Table . 5.1. We run the simulation experiments within an automotive plant of 100 heterogeneous nodes that are able to establish industrial relationships between them based on their profile previously defined by the IIoT server.

The performance evaluation in this chapter is done in two main parts. In the first part, we compare the energy efficiency of our proposed H-IIoT architecture with the energy efficiency of the traditional architecture of the plant's IIoT network. In the second part, we evaluate the sensitivity, the responsiveness and the resiliency of our trust management model compared to other trust management models proposed in the literature, including the TMCoi-SIoT model [START_REF] Ben Abderrahim | TMCoI-SIOT: A trust management system based on communities of interest for the social Internet of Things[END_REF], the Adaptive IoT Trust model [START_REF] Chen | Trust Management for SOA-Based IoT and Its Application to Service Composition[END_REF] and the CITM-IoT model [START_REF] Alshehri | Clustering-Driven Intelligent Trust Management Methodology for the Internet of Things (CITM-IoT)[END_REF].

Part 1: Comparative energy study

In this part, the topology of the plant's IIoT network is represented according to two architectures: traditional architecture in Fig. 5.2 and H-IIoT architecture in Fig. 5.3. The H-IIoT architecture is the result of the application of equation ( 5.3), equation (5.4), Algorithm 3 and Algorithm 4 to the traditional architecture represented in Fig. 5.2. The clustering is done at one hop. CLs use routing to collect monitoring data from the MNs belonging to their communities. This monitoring data is related to the behavior of MNs. It also contains the recommendations provided by the MNs.

IIoT nodes contribute to the trust management process by sending monitoring packets to their trust entities. The monitoring packets contain cooperation and transaction histories, they also contain recommendations for other nodes in the network. We apply the Tm-IIoT model on both architectures, and we evaluate for each one, in a time period T r, the average power consumption of IIoT nodes during their contributions to the trust management process. The According to the histograms in Fig. 5.4 and Fig. 5.5, the central processing unit (CPU) of nodes belonging to the same architecture consumes on average the same amount of power because all of these nodes generate the same type and quantity of monitoring data. The average power consumed by the CPU of nodes in Fig. 5.4 is more significant than the average consumed by CPU of nodes in Fig. 5.5. Indeed, this is explained by the fact that nodes in traditional architecture generate more recommendations. They must give recommendations for all other nodes in the network which is impossible to achieve because nodes do not have a total knowledge of all network, they can give ratings just for nodes with which they have already had experiences. While in H-IIoT architecture, each M N i provides recommendations just for the members of its community.

According to Fig. 5.4 and Fig. 5.5, we notice that the overall power consumption of IIoT nodes during their contributions to the monitoring process is impacted by their radio operations. Indeed, in the traditional architecture, The obtained results in Fig. 5.6 estimate the average energy consumption of IIoT nodes according to the evolution of the network (from 100 nodes to 1600 nodes) and according to the level of accuracy that we want to achieve in the evaluation of trust. As shown in Fig. 5.6, the average energy consumption increases with the increase of the accuracy. The consumption increases even more when the number of nodes in the network increases, especially in the traditional centralized architecture Fig. 5.6a. As shown in Fig. 5.6a, nodes can consume on average until 75% of their energy just in order to relay monitoring We justify these results by the fact that the more the network evolves and the accuracy increases, the more the generation of monitoring packets increases and the more radio operations become more important and consume more energy. In Fig. 5.6a and Fig. 5.6b, with a network of 1600 nodes and a maximum accuracy κ = 1, M N s in the H-IIoT architecture consume on average until 30% of their energy compared to 75% of energy in the traditional architecture. This is due to the fact that in the H-IIoT architecture, the network is managed in communities so each M N i relays the monitoring packets of its community and not of the whole network. Furthermore, in the H-IIoT architecture, the number of CLs is proportional to the density of the nodes in the network. To manage the T m of 1600 nodes with an accuracy κ = 1, CLs consume on average until 60% of their energy reserved for monitoring as shown in Fig. 5.7b. While for the traditional architecture as seen in Fig. 5.7a and for the same conditions, the trust management entity consumes on average until 100% of its energy reserved for monitoring.

According to Fig. 5.8, the average number of lost monitoring packets is more significant when the accuracy and the density of the IIoT network increase. The losses are higher in the centralized architecture Fig. 5.8a compared to the H-IIoT architecture in Fig. 5.8a. The lost packets contain monitoring data that will allow the trust entity (CLs in our architecture) to manage the In this part, we analyze the trust convergence properties of an M N i belonging to a community of 20 nodes, in an environment containing varying percentage of malicious nodes P m ranging from 20% to 50%. For this purpose, we use the simulation parameters listed in table. 5.1. We observe in Fig. 5.9 that the convergence time and the trust bias increase with the increase of malicious nodes. However, even with a malicious nodes population of 50%, the trust bias remains small. This proves the resilience of the proposed Tm-IIoT model in the most unfavorable environments.

We demonstrate the effectiveness of our proposed Tm-IIoT model with a comparative performance analysis against the TMCoi-SIoT model proposed in [START_REF] Ben Abderrahim | TMCoI-SIOT: A trust management system based on communities of interest for the social Internet of Things[END_REF], Adaptive IoT Trust model proposed in [START_REF] Chen | Trust Management for SOA-Based IoT and Its Application to Service Composition[END_REF] and CITM-IoT model proposed in [START_REF] Alshehri | Clustering-Driven Intelligent Trust Management Methodology for the Internet of Things (CITM-IoT)[END_REF]. The TMCoi-SIoT model is applied directly to the industrial context without modification, but the Adaptive IoT Trust model and Figure 5.9: Tm of a Good node with Pm ranging from 20% to 50% the CITM-IoT model require some modifications and adaptations; we have replaced social relations with industrial relations. As shown in Fig. 5.10, with a malicious nodes population of 20%, the convergence time in CITM-IoT model is faster compared to that of our model. This is due to the non-complexity of the calculations performed in the CITM-IoT model; T m of a cluster node is the average of the evaluations collected from peer cluster nodes after removing outliers. We notice also that in CITM-IoT model, the T m never reaches the exact value 0.8. This is justified by the lack of trust management context, the authors do not specify on which basis the nodes manage the peers of their cluster. The trust bias in CITM-IoT model increases brutally even more when the number of malicious nodes reaches 50% as shown in Fig. 5.11, this is due to the lack of context and also to the vulnerability of the model to coalition attacks. The spam algorithm used in this model is unable to detect coalition attacks when the number of malicious nodes increases. Indeed, the algorithm makes its decision based on the evaluation given by the majority of cluster nodes. It has as a majority the evaluations given by untrusted cluster nodes and it eliminates the evaluations of legitimate nodes. When the number of malicious nodes reaches 20%, the Adaptive IoT Trust model reaches convergence at 13 time units as shown in Fig. 5.10. This is due to the distributed type of the model. Indeed, in order to have the final T m of a monitored node, we have to do an aggregation of the all local T ms given to the monitored node by its neighbors. When the number of malicious nodes reaches 50%, the trust bias increases brutally because there is no spam value extraction before calculation of the final T m value. We notice that the T m Chapter 5. Trust Management in IIoT networks In order to prove the resiliency of our proposed Tm-IIoT model to the dynamic behavior of IIoT nodes, we evaluate the behavior change detection of two nodes: a normal node containing non-sensitive data in Fig. 5.12 and a critical node containing more sensitive data in Fig. 5.13. Hence, we assume that during the first 20 time units, both nodes behave positively in the network to increase their T m. Thereafter, the nodes change their trusted behavior to an untrusted behavior following an attack for 30 units of time followed by a trusted behavior for 30 units of time and so on as shown by Fig. 5.12 and Fig. 5.13.

According to the obtained results, for the less critical node in Fig. 5.12, As shown in Fig. 5.14, with the variation of κ, the behavior change detection will not maintain the same accuracy. The Tm-IIoT model detects behavior changes of critical nodes after 6 time units when κ = 0.1 and after 4 time units when κ = 0.5 compared to 2 time units when κ = 0.8. Despite this variation, our model shows a high resiliency against behavioral changes compared to other models which regardless of the sensitivity of nodes they keep the same treatment.

Coalition attacks: we would like to remind the reader that Coalition attacks occur when a group of malicious nodes:

• Mobilize against a good node in order to reduce its T m by sending it bad recommendations. In this case, the coalition attack is called badmouthing attack [START_REF] Abdelghani | Trust Management in Social Internet of Things: A Survey[END_REF].

• Increase the T m of a malicious node. In this case the coalition attack is called ballot-stuffing attack [START_REF] Abdelghani | Trust Management in Social Internet of Things: A Survey[END_REF].

To evaluate the resiliency of our trust management model to coalition attacks, we propose the following two scenarios: In Fig. 5.15, we assume a badmouthing attack against a legitimate M N 1 with T m=1 and in Fig. 5.16 we assume a ballot stuffing attack performed to increase the T m of a malicious IIoT members. The evaluation is conducted in an environment that initially contains 20% of malicious nodes and then 50%, to properly evaluate our model in the most unfavorable environments.

It is assumed for both scenarios that malicious nodes perform coalition attacks at the 21 th time unit. We notice that for 20% of malicious nodes, the T m in the proposed Tm-IIoT model does not vary as shown in Fig. 5.15a and Fig. 5.16a. However, when the percentage of malicious nodes reaches 50%, the T m in our model varies briefly until reaches the maximum value of 0.9 in Fig. 5.15b and 0.5 in Fig. 5.16b. The T m disruptions in the two scenarios will not affect the security of M N 1 and M N 2 because their T m vary slightly and quickly return to their previous values.

When the percentage of malicious nodes reaches 50%, we notice that the T m in our model takes time to converge to its previous value. This is due to the estimation algorithm described in chapter. 4, it needs more time to detect spams. The estimation algorithm must be reinforced by the rate of honesty related to direct interactions that compares the current behavior of IIoT nodes with their profiles described in the IIoT server. In comparison with the TMCoi-SIoT model and Adaptive IoT Trust model, we clearly notice that the T m strictly diverges and never recovers its previous value in both models. This is due to the fact that these models do not use a mechanism to detect spam recommendations from malicious nodes. Indeed, these two trust management model take spam into account when calculating and updating the T ms. Fig. 5.15b and Fig. 5.16b show that the CITM-IoT model is also vulnerable to coalition attacks when the percentage of malicious nodes reaches 50%. Indeed, the proposed algorithm to eliminate outliers in this work is based on the evaluation given by the majority of cluster nodes.

Conclusion

In the first part of this chapter, our purpose was to change the traditional architecture of IIoT networks in the automotive plants into a hierarchical architecture called H-IIoT in order to manage the trust of the IIoT nodes. The H-IIoT architecture is based on a new concept called industrial relationship between IIoT nodes. In the second part of this chapter, we proposed the Tm-IIoT model to manage the T m of IIoT nodes in the proposed H-IIoT architecture. The simulation results have proven the energy efficiency of our proposed H-IIoT architecture compared to the traditional IIoT network architecture. They have also proven the sensitivity, responsiveness and resiliency of the Tm-IIoT model to trust-related attacks launched by malicious IIoT nodes. Finally, we focused on designing a trust management model appropriate for IIoT networks to detect the untrusted and suspicious behavior of nodes in these environments. However, we have not proposed an effective method to isolate malicious nodes from the network in order to prevent them from launching internal attacks. This is foreseen for the next chapter 6.

Introduction

The malicious M N s may disclose data related to the industrial processes and damage the basic functionalities of the network through internal attacks. For this purpose, it is necessary to isolate these nodes from further contributing to network activities by revoking their certificates. However, malicious M N s are difficult to detect because they are considered to be internal attackers who have successfully passed the authentication phase and are member of the network. As detailed in the previous chapter, each CL continuously monitored the behavior of M N s belonging to its community. In this chapter, the CL uses the result of these monitoring to manage effectively the certificates of M N s and enhance the security of the IIoT network. Hence, we assume that each CL hosts an agent, named CL-UR agent, that renews the certificate of legitimate M N s and revokes the certificate of nodes that show untrusted behavior in order to isolate them from the network and prevent them from launching internal attacks. In the hierarchical architecture illustrated in Fig. 5.1, each M N knows the type of its CL, i.e. the legitimate node that contains an agent responsible for the revocation. However, the type of the M N (trusted or untrusted) is hidden information for the CL-UR agent. Indeed, the CL-UR agent has no information on the type of M N , which can impact its revocation decision. Hence, the CL-UR agent lets the M N move first to observe its behavior and then act; it renews the MN's certificate or revokes it according to its observations. Indeed, the behavior sent by the M N can be a signal about its type. To analyze the interactions between the CL-UR agent and a M N , and model the certificate revocation process in the IIoT network, we use Signaling game theory in which players can use the actions of their adversary to make deductions about hidden information. The Signaling game modeling the interactions between the two players, CL-UR agent and M N , is called "Certificate Revocation Game". The remainder of this chapter is organized as follows. In section 6.2, we present a concise summary of the literature review on certificate revocation strategies used in wireless networks. The critical analysis of advantages and limitations of each strategy provides a clear vision of how to design an effective certificate revocation mechanism for IIoT networks. In section 6.3, we study a stage Certificate Revocation Game considered at an individual time slot between the CL-UR agent and a M N . In section 6.4, we look for the Bayesian Nash Equilibrium (BNE) that the stage Certificate Revocation Game can achieve in pure-strategy and in mixed-strategy respectively. In section 6.5, as the game 6.2. Related certificate revocation strategies evolves, we develop the stage Certificate Revocation Game into a Multi-stage game in which, the CL-UR agent can adjust its strategy based on its belief updated dynamically according to the new behaviors of the monitored M N . Based on the Perfect Bayesian equilibrium (PBE) of the Multi-stage Certificate Revocation Game obtained in section 6.6, we propose an effective Certificate revocation mechanism for IIoT networks in section 6.7. We present the performance evaluation and the comparisons results in section 6.8. Finally, in section 6.9, we conclude the chapter.

Related certificate revocation strategies

In this section, we present a concise summary of the literature review on certificate revocation strategies used in wireless networks. We also discuss the advantages and limitations of each strategy. In the literature, several works rely on trust management [START_REF] Ud Din | Trust Management Techniques for the Internet of Things: A Survey[END_REF] to deal with malicious nodes. Indeed, trust management provides continuous analysis of the behavior of nodes to predict their performance over time, which improves the revocation decision process and enhances the security of the networks. To make a revocation decision, trust-based revocation mechanisms use either non-voting strategy or voting strategy.

In the non-voting strategy, each node in the network monitors the behavior of its neighbor and sends an accusation against it if suspicious behavior is detected. Indeed, only one accusation is able to launch the revocation process, which reduces the time required to revoke a certificate and the communication overhead resultant from the revocation process. Authors of [START_REF] Clulow | Suicide for the common good: a new strategy for credential revocation in self-organizing systems[END_REF] assumed that revocation can be much simpler and faster if it is entrusted to a single node. For this aim, [START_REF] Clulow | Suicide for the common good: a new strategy for credential revocation in self-organizing systems[END_REF] proposed a revocation mechanism founded on the suicide for the common good where the accusing node sacrificing itself to prove to its neighbors the sincerity of its accusations. Indeed, when a node B with a valid certificate detects an untrusted behavior issued by a node A, B puts its own identity as well as the identity of A in a signed suicide note and broadcasts the note to other nodes in the network. Each node receiving the note verifies its validity by using the signature of B, and revokes both B and A by putting them in a blacklist. The proposed mechanism is vulnerable to false accusations because the accusing nodes may be malicious. Moreover, the mechanism is effective only under the condition that the benefit to the attacker of revoking an innocent node is less than the benefit of having a malicious node placed in the network, which is not always the case in IIoT networks. Chapter 6. Certificate revocation in IIoT networks using Signaling game To address false accusations, several works such as [START_REF] Dipti | Cluster-based certificate revocation in mobile ad-hoc network using fuzzy logic[END_REF], [START_REF] Park | Certificate Revocation to Cope with False Accusations in Mobile Ad Hoc Networks[END_REF], and [START_REF] Santhana | Enhanced Certificate Revocation Scheme with Justification Facility in Mobile Ad-hoc Networks[END_REF] included a certificate recovery module in their revocation mechanisms. In [START_REF] Santhana | Enhanced Certificate Revocation Scheme with Justification Facility in Mobile Ad-hoc Networks[END_REF], when the Certificate authority (CA) receives an accusation, it puts the accusing node in a warning list and the accused node in a blacklist and it broadcasts both lists to other nodes in the network. Upon receiving the two lists, the leader (CH) of each cluster evaluates the trust of the accused nodes present in its cluster by using fuzzy logic. When the CH does not identify any suspicious behavior, it sends a request to the CA to recover the falsely accused nodes. However, the designation of CHs in [START_REF] Santhana | Enhanced Certificate Revocation Scheme with Justification Facility in Mobile Ad-hoc Networks[END_REF] is not based on their trust level. Hence, a malicious CH may judge an accused node as innocent when it is malicious. Despite several attempts [START_REF] Jayanthi | A Novel Approach Certificate Revocation in MANET using Fuzzy logic[END_REF] to solve challenges of non-voting strategy, revocation mechanisms based on this strategy remain unsuitable for IIoT networks due to their low accuracy and low reliability.

The voting strategy revokes the certificate of a suspect node when the number of accusations against it exceeds a threshold. Authors of [START_REF] Luo | URSA: ubiquitous and robust access control for mobile ad hoc networks[END_REF] did not rely on a single node to make revocation decisions, as any individual node is subject to misbehavior. For this purpose, the revocation in [START_REF] Luo | URSA: ubiquitous and robust access control for mobile ad hoc networks[END_REF] was achieved through a consensus between several nodes. Indeed, each node is monitored by its neighbors at one or two hops distance. The neighbors use the result of their monitoring either to renew the certificate of the monitored node if it behaves well, or to send accusations against the monitored node if it shows untrusted behavior. When the number of accusations exceeds a threshold, the certificate of the monitored node will be revoked. Authors of [START_REF] Medjek | A Trust-Based Intrusion Detection System for Mobile RPL Based Networks[END_REF] proposed a cooperative Trust-based Intrusion Detection System (TIDS) to detect malicious nodes in the network. In TIDS, each node periodically monitors the behavior of its one-hop neighbors and collaboratively calculates their trust values. Nodes whose trust value is below a certain threshold will be reported to the Border Router to put their identities in the list of potential malicious nodes. The list is then shared with all nodes. The voting strategy overcomes false accusations and improves the accuracy and reliability of the revocation process. However, mechanisms based on voting strategy are vulnerable to coalition attacks, when a set of nodes falsely accuse honest devices to revoke their certificates. Despite all the attempts to improve mechanisms based on voting strategy [START_REF] Kim | Effective certificate revocation scheme based on weighted voting game approach[END_REF], [START_REF] Bhavyashree | Modified Cluster Based Certificate Blocking of Misbehaving Node In Manets[END_REF], [START_REF] Narani Aravinthan | Certificate Revocation Scheme Based on Weighted Voting Game and Rational Secure Multiparty Computing[END_REF], the voting strategy remains inappropriate for application to IIoT networks. Indeed, a malicious IIoT node may change its behavior without conducting attacks against its neighbors as explained in [START_REF] Fidler | Was Stuxnet an Act of War? Decoding a Cyberattack[END_REF]. In this scenario, the behavior of the malicious node cannot be detected by the votingbased mechanisms, because these mechanisms initiate the revocation process 6.3. Stage Certificate Revocation Game based on the neighbors' accusations. Moreover, the voting strategy is not able to instantly revoke a malicious node if there are not enough honest nodes around it, which increases the revocation time and affects the reliability of the network. These mechanisms also generate communication overhead resulting from the exchange of accusations. As discussed above and summarized in Table 6.1, mechanisms based either on voting or non-voting strategy suffer from several weaknesses that makes them inappropriate to be deployed in IIoT networks. By highlighting research gaps, we propose a hierarchical architecture where each CL hosts an agent that monitors the behavior of the nodes belonging to its community to manage their certificates. Indeed, the revocation process is made by CLs, nodes with very high level of trust, in order to avoid false accusations and coalition attacks.

To remove uncertainty about the type of a member node (trusted or untrusted), we model the interactions between the member node and its CL by using signaling game theory, in which players can use the actions of their adversary to make deductions about hidden information. As the game between the agent and the member IIoT node evolves, the agent can obtain its best response strategy based on its belief on the member node, updated by using the Bayesian rules. This allows the agent to make rational, accurate and fast decisions which increases the reliability of our proposed certificate revocation process.

Stage Certificate Revocation Game

The main gain of a malicious M N is when it successfully launches internal attacks and gradually causes the collapse of the IIoT network without being detected. The M N pays an energy consumption cost to accomplish the untrusted behavior. Hence, we introduce Gm and Cm to indicate the gain of the M N when it presents untrusted behavior in the network and the energy consumption cost it has to pay for this behavior, respectively. Sometimes a malicious M N may behave honestly in the network to disguise and whitewash its previous untrusted behavior. Thus, regardless of the type of M N (trusted or not), as long as it behaves honestly in the network, it will be rewarded for its honest behavior. On the other hand, the M N must pay a cost due to the energy consumption needed to perform an honest behavior. We introduce G G and C G to denote the gain of the M N when it behaves honestly in the network and the energy consumption cost that it must pay for an honest behavior, respectively. A M N shows honest behavior if:

• It behaves according to the requirements of its profile stored in the IIoT server.

• It cooperates positively within the network by forwarding packets from other nodes, and providing correct recommendations.

The certificates of M N s have a limited validity period, they are renewed if their validity period has expired, or revoked if the conditions for renewal are not met. Hence, when the CL-UR agent successfully detects the untrusted behavior of a M N and revokes its certificate, the agent obtains the gain G R as a reward and pays the cost C R due to the energy consumed during the revocation process. The CL-UR agent obtains the gain G U P when it renews the certificate of a M N that proves honest behavior, and obviously, it pays the cost C U P due to the energy consumed during the renewal process. It is assumed that each CL-UR agent is characterized by a detection rate, denoted by φ, and a false alarm rate, denoted by µ. These rates depend mainly on the technical and material characteristics of the agents. The loss of the CL-UR agent due to a false alarm is noted by I F . In our game, we assume that all CL-UR agents have the same detection rate and the same false alarm rate. We gather all the notations used by the proposed Certificate Revocation Game in the table 6.2.

We define the stage Certificate Revocation Game in the strategic form, also called the normal form, by five tuple (PL, χ, A, P, Uf) where:

• PL = {M N (Sender), CL-UR agent (Receiver)} is a set composed of two players. We designate the player M N by X S , where Loss of the CL-UR agent due to false alarm

X S = 1 if M N is malicious, X S = 0 if M N
• χ = χ S × χ R , χ S = {X S = 1, X S = 0}
is the set of type space of the X S , and χ R is the set of type space of the X R . Since the X R in our proposed game has one type, then χ R = {X R = CL -U R agent}.

• A = A S × A R , is the set of possible actions (or strategies) for the players. A S = {Untrusted behavior, Honest behavior} for the X S and A R = {Renew, Revoke} for the X R .

• P = (p, 1 -p) is a common prior probability distribution over available types of the χ S , i.e. P : χ S → [0, 1]. p is the probability that the M N is malicious i.e. X S = 1 and (1 -p) is the probability that the M N is legitimate i.e. X S = 0.

• U f = (U f S , U f R ), where U f S : A × χ → R is the utility function for the X S and U f R : A × χ → R is the utility function for the X R . Utility is the measure of each situation from the player's point of view; it is not a measure of material or monetary gain but rather a subjective measure of player satisfaction. We detail the calculation of U f S and U f R in Table . 6.3.

If the M N shows an untrusted behavior and the CL-UR agent detects it, the agent will revoke the certificate of the M N . Hence, the utility of the M N is the gain of being not revoked when it has performed untrusted behavior in the past while the CL-UR agent does not detect it, minus the loss of being revoked, and minus the cost of untrusted behavior. While the utility of the CL-UR agent is the gain of the revocation minus the cost resulting from the certificate revocation process. When the M N shows an untrusted behavior in Table 6.3: Utility functions of the Certificate Revocation Game

χ A S A R Renew Revoke X S = 0 Honest U f S = G G -C G U f S = G G -C G U f R = G U P -C U P U f R = -µI F -C R Honest U f S = G G -C G U f S = G G -C G X S = 1 U f R = G U P -C U P U f R = -µI F -C R Untrusted U f S = G M -C M U f S = (1 -φ)G M -φG R -C M U f R = -G M -C U P U f R = φG R -(1 -φ)G M -C R
the IIoT network and the CL-UR agent renews its certificate, the utility of the agent is the loss of being attacked and the cost resulting from the certificate renewal process. Whereas, the utility of the M N is the gain of the untrusted behavior minus the cost of this behavior.

When the M N (malicious or legitimate) acts correctly and honestly in the network, its utility is the gain of performing honest behavior minus the cost resulting from this behavior. When the CL-UR agent renews the certificate of a node that behaves honestly, its utility is the gain of certificate renewal minus the cost resulting from the certificate renewal process. However, when the agent revokes the certificate of an honest M N , its utility is the loss of false alarm minus the cost of the certificate revocation process.

Equilibria of the stage Certificate Revocation

Game

The proposed stage Certificate Revocation Game is with incomplete information because the CL-UR agent does not have any information about the type of M N s belonging to its community. Hence, as a game of incomplete information, it can reach the BNE. To analyze our game, we rely on the fundamental observation of Harsanyi [START_REF] Roger B Myerson | Comments on "Games with Incomplete Information Played by 'Bayesian'Players, I-III Harsanyi's Games with Incoplete Information[END_REF], where we introduce a virtual player called Nature, who makes the first move by selecting the type of the player X S as shown in the extensive form of the game illustrated in Fig. 6.1. Therefore, the game becomes complete with imperfect information. A S (X S = 1) = U ntrusted behavior) which signifies that the M N always shows an untrusted behavior when it is untrusted and always shows an honest behavior when it is trusted, the expected utility of the CL-UR agent if it chooses A R (X R ) = Revoke as a strategy can be expressed as follows:

EU R (Revoke) =p(φG R -(1 -φ)G M -C R )) + (1 -p)(-µI F -C R ) (6.1)
The expected utility of the CL-UR agent if it chooses A R (X R ) = Renew as a strategy can be expressed as follows:

EU R (Renew) =(1 -p)(G U P -C U P ) + p(-G M -C U P ) (6.2) If EU R (Renew) ≤ EU R (Revoke), i.e., (1 -p)(G U P -C U P ) + p(-G M -C U P ) ≤ p(φG R -(1 -φ)G M -C R )) + (1 - p)(-µI F -C R ) And, p ≥ G U P -C U P + µI F + C R φG R + φG M + µI F + G U P (6.3)
Therefore, (A R = Revoke) is the dominant strategy for the CL-UR agent.

Chapter 6. Certificate revocation in IIoT networks using Signaling game But if the CL-UR agent chooses Revoke as a strategy, (A S = U ntrusted behavior) will not be the dominant strategy for the malicious M N because:

(1 -φ)G M -φG R -C M < G G -C G (6.4)
A basic assumption of game theory is to consider that players are rational. Hence, the CL-UR agent and the M N are considered rational in our proposed game, i.e. they always aim to reach the best situation for them.

Consequently, the strategy profile {(A S (X S = 1) = U ntrusted behavior,

A S (X S = 0) = Honest behavior), A R = Revoke} is not a pure-strategy BNE. -If EU R (Renew) > EU R (Revoke), i.e., (1 -p)(G U P -C U P ) + p(-G M -C U P ) > p(φG R -(1 -φ)G M -C R )) + (1 - p)(-µI F -C R ) And, p < G U P -C U P + µI F + C R φG R + φG M + µI F + G U P (6.5)
Therefore, (A R = Renew) is the dominant strategy for the CL-UR agent. Since A S (X S = 1) = U ntrusted behavior is the pure-strategy of the malicious M N , considered also as its dominant strategy when the CL-UR agent plays Renew because:

G M -C M > G G -C G (6.6)
Then, the strategy profile {(A S (X S = 1) = U ntrusted behavior, A S (X S = 0) = Honest behavior), (A R = Renew)} is a pure-strategy BNE.

-When the M N chooses the pure-strategy (A S (X S = 1) = Honest behavior, A S (X S = 0) = Honest behavior) which signifies that regardless of its type, it chooses to always behave honestly. Logically, the best strategy response for the CL-UR agent is to Renew, but in this case the best strategy of the malicious M N is to present untrusted behavior and not to behave honestly which is in contradiction with its pure-strategy. Hence, the strategy profile {(A S (X S = 1) = Honest behavior, A S (X S = 0) = Honest behavior), (A R = Renew)} is not a pure-strategy BNE.

According to the analysis of the stage Certificate Revocation Game, we found a single pure-strategy BNE {A S (X S = 1) = U ntrusted behavior, A S (X S = 0) = Honest behavior, (A R = Renew)}. This pure-strategy BNE 6.4. Equilibria of the stage Certificate Revocation Game exists when:

p < G U P -C U P + µI F + C R φG R + φG M + µI F + G U P (6.7)
However, this strategy is not practical because the CL-UR agent must always choose "Renew" as a strategy which will make the network vulnerable to untrusted nodes. Indeed, reaching only the pure-strategy BNE is not sufficient for our stage Certificate Revocation Game, it is crucial to find a mixed-strategy BNE to revoke effectively the certificates of malicious M N from the IIoT network.

Mixed-strategy BNE of the stage Certificate Revocation Game

Let Ω S = (p u , 1 -p u ) and Ω R = (λ, 1 -λ) the mixed-strategies of the malicious M N and the CL-UR agent respectively. p u designates the probability of the X S = 1 playing A S (X S = 1) = untrusted behavior and λ designates the probability of the CL-UR agent playing A R (X R ) = Revoke.

Under the mixed-strategy Ω R of the CL-UR agent, the expected utility of the M N resulting from A S (X S = 1) = untrusted behavior as a strategy, EU S (U ntrusted), is the sum of paths corresponding to this strategy in Fig. 6.1. It is calculated as follows:

EU S (U ntrusted) =λp((1 -φ)G M -φG R -C M ) + p(1 -λ)(G M -C M ) (6.8)
Similarly, the expected utility of the M N resulting from A S (X S = 1) = honest behavior as a strategy, EU S (Honest), is calculated as follows:

EU S (Honest) =λp(G G -C G ) + p(1 -λ)(G G -C G ) + λ(1 -p)(G G -C G ) + (1 -p)(1 -λ)(G G -C G ) (6.9)
According to the indifference between untrusted and honest behavior under the mixed-strategy Ω R , the expected utilities EU S (Honest) and EU S (U ntrusted) are equal. Therefore, the equilibrium probability, λ * , to play revoke is calculated as follow: Chapter 6. Certificate revocation in IIoT networks using Signaling game

λ * = -G G + C G + p.G M -p.C M φ(G M + G R ) (6.10)
Under the mixed-strategy Ω S of the M N , the expected utility of the CL-UR agent resulting from A R (X R ) = Revoke as a strategy, EU R (Revoke) is calculated as follows:

EU R (Revoke) =pp u (φG R -(1 -φ)G M -C R ) + p(1 -p u )(-µI F -C R ) + (1 -p)(-µI F -C R ) (6.11)
Similarly, the expected utility of the CL-UR agent resulting from A R (X R ) = Renew as a strategy, EU R (Renew) is:

EU R (Renew) =pp u (-G M -C U P ) + p(1 -p u )(G U P -C U P ) + (1 -p)(G U P -C U P ) (6.12)
According to the indifference between Renew and Revoke under the mixedstrategy Ω S , the expected utilities EU R (Renew) and EU R (Revoke) are equal. Hence, the equilibrium probability, p * u , to play untrusted behavior is calculated as follow:

p * u = -µI F + C R + G U P -C U P p(φG R + φG M + µI F + G U P ) (6.13)
In the stage Certificate Revocation Game, there is a mixed-strategy BNE {Ω S (A S (X S = 1) = U ntrusted behavior), A S (X S = 0) = Honest behavior, Ω R (A R = Revoke)} which signifies that the malicious M N shows untrusted behavior with probability p * u and the legitimate M N always behaves honestly while the CL-UR agent plays Revoke with probability λ * . This Mixed-strategy BNE exists when:

p ≥ G U P -C U P + µI F + C R φG R + φG M + µI F + G U P (6.14)
As shown in 6.4.1 and 6.4.2, in the stage Certificate Revocation Game, players will choose their strategies to reach the BNE according to the value of the probability p. Since the Revocation gain and the untrusted behavior gain are very important, we expect the value of the probability p in the equation (6.7) 6.5. Multi-stage dynamic Certificate Revocation Game to be very small. We notice that as the value of p increases as shown in the equation (6.14), the players will be able to make better decisions and consequently reach the BNE in mixed-strategy.

p is the belief of the CL-UR agent on the untrusted type of the M N , the increase of this belief incites the untrusted M N to be less untrusted otherwise it will risk the revocation. The CL-UR agent needs to update its beliefs dynamically according to the real situation of the monitored M N , because determining a reasonable belief p at each individual stage is a challenging task. To address this challenge, in the next section we develop the stage Certificate Revocation Game into a multi-stage Game, in which the CL-UR agent dynamically updates its belief based on Bayesian rules.

Multi-stage dynamic Certificate Revocation

Game

As the game evolves, the stage Certificate Revocation Game will be played successively and repeatedly over time, at each continuous time slot {t j |j ∈ {1,2,...,t}}, where (t ∈ Z + ), and during the network monitoring process. Hence, the Certificate Revocation Game becomes a multi-stage game, where the players observe the results of each stage game before the next one starts. This enables the CL-UR agent to predict the type of the M N and condition its future strategies on previous results. The multi-stage certificate revocation Game is also defined by five tuple (PL, χ, A, P, Uf) where:

• PL, A, χ, and Uf are defined as for the Stage Certificate Revocation Game described in the previous section. We assume that the utilities of both players are the same in all stage games.

• P = (p(X S = 1|h(t j )), 1 -p(X S = 1|h(t j )) where p(X S = 1|h(t j )) is the probability that the M N is malicious considering the history of its behavior h(t j ). p(X S = 1|h(t j )) is updated by the posterior belief of the CL-UR agent, p(X S = 1|a S (t j ), h(t j )), calculated by the equation (6.15) at the end of the t j th stage game. The process of updating the belief of the CL-UR agent at the t j th stage game can be led from the (t j-1 )th stage game by using Bayes rules [START_REF] Fudenberg | Game theory[END_REF].

p(X S = 1|A S (t j ), h(t j )) = p(X S = 1|h(t j ))p(A S (t j )|X S = 1, h(t j )) Where A S (t j ) is the behavior of the M N at the t j th stage game, and p(A S (t j )|X S , h(t j )) is the probability that M N presents the behavior A S (t j ) at the t j th stage game under the history h(t j ). The different probabilities p(A S (t j )|X S , h(t j )) can be calculated as follows:

p(A S (t j ) = U ntrusted|X S = 1, h(t j )) = φ.p u + µ(1 -p u ) (6.16) p(A S (t j ) = Honest|X S = 1, h(t j )) = (1 -φ).p u + (1 -µ)(1 -p u ) (6.17) p(A S (t j ) = U ntrusted|X S = 0, h(t j )) = µ (6.18) p(A S (t j ) = Honest|X S = 0, h(t j )) = 1 -µ (6.19)
We consider the effect of the false negative rate, 1 -φ, and the true negative rate, 1-µ, respectively, when calculating the different probabilities p(A S (t j )|X S , h(t j )).

The CL-UR agent evaluates the probability p u that the monitored M N presents an untrusted behavior as a follows:

p u = 1 -(p c .p d .p I ) (6.20)
p c is the probability that the monitored M N cooperates in the network, p d is the probability that the monitored M N is honest and p I is the probability that the monitored M N has a good reputation in the network. The calculation of these three probabilities is detailed in chapter 5.

In the proposed multi-stage Certificate Revocation Game, players do not always adopt the same strategy at each stage. Indeed, players condition their future behaviors on previous results and current beliefs to produce the most utility and choose the best response strategy as the game evolves. Thus, we characterize our proposed multi-stage game by the PBE which provides each player with a complete system of beliefs about the type of its opponent in order to choose its best response strategy.

Before searching for the PBE of the multi-stage Certificate Revocation Game, we have to prove first that the proposed game satisfies the following Bayesian conditions [START_REF] Fudenberg | Game theory[END_REF]:

• C1: The beliefs are updated by the Bayesian rule.

• C2: The posterior beliefs are independent, and the different types of the same player must have the identical beliefs.

6.6. The PBE of the Certificate Revocation Game in mixed-strategy

• C3: The posterior belief is coherent with a common joint distribution [START_REF] Shen | Signaling game based strategy of intrusion detection in wireless sensor networks[END_REF] in χ.

• C4: The players signal just what they know and in no case they signal what they don't know.

Lemma. The proposed certificate revocation game satisfies the Bayesian conditions.

Proof. C1 is verified; the belief of the CL-UR agent on M N s is updated using the Bayesian rule as mentioned in the equation (6.15). C2 is verified since the CL-UR agent in our game has only one type, it will always have the same belief on a M N s. C3 is verified as the certificate revocation game consists of only 2 opponents, no other player can influence the belief of the CL-UR agent on the M N s. C4 is verified because the signal of M N is defined only by its behavior, p(A ′ S (t j )|X S = 1, h(t j )) = p(A S (t j )|X S = 1, h(t j )) when A ′ S (t j ) = A S (t j ).

The PBE of the Certificate Revocation Game in mixed-strategy

Theorem. The proposed multi-stage Certificate Revocation Game has a mixed-strategy PBE.

Proof. Let Ω Sj = (p uj , 1-p uj ) and Ω Rj = (λ j , 1-λ j ) the mixed-strategies of the M N and the CL-UR agent respectively at the t j th stage game. p uj designates the probability of the M N playing A Sj (X S = 1) = untrusted behavior at the t j th stage game and λ j designates the probability of the CL-UR agent playing A Rj (X R ) = Revoke at the t j th stage game.

The mixed-strategy PBE can be achieved in the multi-stage Certificate revocation game if the CL-UR agent and the M N play respectively with the equilibrium strategy profile Ω * Sj = (p * uj , 1 -p * uj ) and Ω * Rj = (λ * j , 1 -λ * j ) at the t j th stage game. The main purpose is to calculate the different equilibrium probabilities p * uj and λ * j that define the best response behavior of each player at the t j th stage game.

Under the mixed-strategy Ω Rj of the CL-UR agent, the expected utility, EU S (U ntrusted), of the M N resulting from the choice of A Sj (X S = 1) = untrusted behavior as a strategy at the t j th stage game is calculated as follows:

EU S (U ntrusted) =λ j p(X S = 1|h(t j ))((1 -φ)G M -φG R -C M ) + p(X S = 1|h(t j ))(1 -λ j ) (G M -C M ) (6.21)
Similarly, the expected utility, EU S (Honest), of the M N resulting from A Sj (X S = 1) = honest behavior as a strategy at the t j th stage game is calculated as follows:

EU S (Honest) =λ j p(X S = 1|h(t j ))(G G -C G ) + p(X S = 1|h(t j ))(1 -λ j )(G G -C G ) + λ j (1 -p(X S = 1|h(t j )))(G G -C G ) + (1 -p(X S = 1|h(t j )))(1 -λ j )(G G - C G ) (6.22)
According to the indifference of untrusted and honest behavior under the mixed-strategy Ω Rj , the expected utilities EU S (Honest) and EU S (U ntrusted) are equal. Therefore, the equilibrium probability, λ * j , to play revoke at the t j th stage game is calculated as follow:

λ * j = -G G + C G + p(X S = 1|h(t j ))G M -p(X S = 1|h(t j ))C M p(X S = 1|h(t j ))(φG M + φG R ) (6.23)
Under the mixed-strategy Ω Sj of the M N , the expected utility EU R (Revoke) of the CL-UR agent resulting from the choice of A Rj (X R ) = Revoke as a strategy at the t j th stage game is:

EU R (Revoke) =p uj p(X S = 1|h(t j ))(φG R -(1 -φ)G M -C R ) + p(X S = 1|h(t j ))(1 -p uj )(-µI F -C R ) + (1 -p(X S = 1|h(t j )))(-µI F -C R ) (6.24)
Similarly, the expected utility, EU R (Renew), of the CL-UR agent resulting from the choice of A Rj (X R ) = Renew as a strategy at the t j th stage game is calculated as follows: 6.7. The proposed certificate revocation mechanism based on the PBE of the multi-stage Game

EU R (Renew) =p uj p(X S = 1|h(t j ))(-G M -C U P ) + p(X S = 1|h(t j ))(1 -p uj ) (G U P -C U P ) + (1 -p(X S = 1|h(t j )))(G U P -C U P ) (6.25)
According to the indifference of Revoke and Renew under the mixed-strategy Ω Sj , the expected utilities EU R (Renew) and EU R (Revoke) are equal. Hence, the equilibrium probability, p * uj , to play untrusted behavior at the t j th stage game is calculated as follow:

p * uj = -µI F + C R + G U P -C U P p(X S = 1|h(t j ))(φG R + φG M + µI F + G U P ) (6.26)

The proposed certificate revocation mechanism based on the PBE of the multi-stage

Game

We propose an effective certificate revocation mechanism and its corresponding algorithm based on the PBE of the multi-stage game obtained in section 6.6. In Fig. 6.2, we detail in a modular way the proposed mechanism as well as the interactions between the CL-UR agent and the M N . Initially, the CL-UR agent performs the monitoring process in which it calculates the trust probability pu of the M N in order to define the type of its behavior, trusted or untrusted. Afterwards, to make a revocation decision, the agent enters into a game with the MN. As the game evolves, the belief of the CL-UR agent on the M N evolves as well. Based on this belief, the CL-UR agent can choose its best response strategy at the t j th stage game against the M N , according to the probability λ * j . At the end of each stage game, the CL-UR agent evaluates its posterior belief on the M N in order to update its prior belief for the next stage game. To illustrate this, the Algorithm 5 describes the whole certificate revocation process. Indeed, the CL-UR agent initiates its monitoring process according to lines 2-4. Thereafter, it gets the game parameters (lines 5-7), and the prior belief on the M N (line 8 ) from the IIoT server. Based on the results of the monitoring process, the prior belief and the game parameters, the CL-UR agent Figure 6.2: The certificate revocation mechanism defines its strategy ("renew certificate" or "revoke") according to the equilibrium probability λ * j (lines 8-10). If the strategy chosen by the CL-UR agent at the t j th stage game is to renew the certificate of the M N , the agent updates its prior belief on M N (line 19) by evaluating its posterior belief (line 18) for subsequent use in the next stage game (line 20).

Performance evaluation of the certificate revocation mechanism

In this section, we evaluate the performance of our proposed certificate revocation mechanism and we compare the results obtained, in the presence of a variable number of malicious nodes, with those of the voting and non-voting mechanisms. For this purpose, we use the InstantContiki 2.7 platform. The different simulation parameters used in this chapter are the same as those used in chapter 5, listed in Table . . Also, we assume that the initial prior belief of the CL-UR agent on all M N s is equal to 0.5. Fig. 6.3 evaluates the convergence speed of the posterior belief, p(X S = 1|A S (t j ), h(t j )), of the CL-UR agent on three M N nodes:

• In Fig. 6.3a, we consider a malicious node M N 1 , with p u =0.9, that 6.8. Performance evaluation of the certificate revocation mechanism Algorithm 5 Certificate revocation algorithm Begin 1.

WHILE t 2.

Monitor the behavior of the M N ; 3.

Calculate the probability pu from the probabilities p c , p d and p I ; 4.

Define the type of the monitored behavior; 5. IF the game is not existed THEN 6.

Get the game parameters :

G G , C G , G M , C M , µ, φ, C R , G U P , C U P , G

END WHILE End

presents only untrusted behavior.

• In Fig. 6.3b, we consider a node M N 2 that presents honest behavior until the 4 th stage game with p u = 0.1 and then it decides to change its behavior and become untrusted with p u = 0.9.

• In Fig. 6.3c, we consider a node M N 3 that performs an on-off attack.

M N 3 shows an honest behavior with p u = 0.1 during the first 5 stages of the game, then it changes its honest behavior into untrusted behavior with p u = 0.9 during the next 5 stages of the game followed by honest behavior during 5 stages of the game and so on.

As shown in Fig. 6.3a, the posterior belief allowing the CL-UR agent to decide if the M N 1 is untrusted converges quickly to 1, especially when the detection rate is high and the false alarm rate is low (φ=0.9, µ=0.05). This demonstrates the speed of our proposed model to detect and revoke malicious nodes from the network. Our model is also sensitive to behavior changes as shown in Fig. 6.3b and Fig. 6.3c, it promptly and accurately detects the behavior changes of nodes M N 2 and M N 3 at the 4 th and 5 th stage game respectively. Indeed, the posterior belief of the CL-UR agent converges quickly to 1 when nodes M N 2 and M N 3 begin to behave unreliably. We can see in Fig. 6.3c that even when the M N 3 returns to its previous honest behavior to disguise its untrusted behavior, the posterior belief of the CL-UR agent on it With a lower detection rate and a higher false alarm rate (φ=0.5, µ=0.1), the convergence speed of the posterior belief becomes slower. This is due to the fact that the CL-UR agent is not sufficiently sensitive in such a case. The CL-UR agent can improve its decision making by improving its detection rate and reducing its false alarm rate.

We assume that when φ= 0.6, the equilibrium probability of the M N choosing untrusted behavior as a strategy is 0.76 and the CL-UR agent choosing Revoke as a strategy is 0.3. In Fig. 6.4, we study the change trend of these equilibrium probabilities when the value of φ ranges from 0.6 to 1. According to Fig. 6.4, we notice that the increase of φ involves the decrease of the equilibrium probabilities p * uj and λ * j . With the increase of the detection rate, φ, the M N will no longer have interest to perform untrusted behaviors in the network because it will be detected and revoked, which explains the decrease of its equilibrium probability p * uj . When the malicious M N behaves honestly in the network and does not perform untrusted behavior, the posterior belief of the CL-UR on this node decreases which explains the decrease of the equilibrium probability λ * j . Hence, the CL-UR agent should always increase the rate φ to revoke malicious nodes and thus improve the performance of the IIoT network.

In Fig. 6.5, we compare the revocation rate of our proposed mechanism with that of the voting and non-voting revocation mechanisms, for different percentage of malicious nodes. As shown in Fig. 6.5, with the increase of malicious nodes, the revocation rate decreases significantly in the voting mechanism compared to our mechanism. Indeed, in the voting mechanism, the increase of Figure 6.5: Revocation rate vs malicious nodes malicious nodes increases the risk of coalition attacks. Malicious nodes form coalitions and do not vote against each other to protect themselves from revocation. The revocation rate decreases further in the non-voting revocation mechanism because the increase of malicious nodes in the network increases the false accusations against honest nodes. Malicious nodes can send false accusations against honest nodes to isolate them from the network, therefore there would not be enough honest nodes in the network to make accusations. Our proposed mechanism outperforms related mechanisms despite the increase of the malicious nodes in the network. This is due to the fact that our mechanism relies on the trusted CLs to make revocation decisions and not on normal nodes in the network that are susceptible to be untrusted.

Another crucial parameter for evaluating and validating the performance of revocation mechanisms is the revocation time. It is calculated as the average time required to revoke the certificate of a malicious node. For this purpose, in Fig. 6.6, we evaluate the revocation time of our proposed mechanism when the percentage of malicious nodes increases. We also compare the obtained results with those of voting and non-voting revocation mechanisms.

According to Fig. 6.6, we notice that non-voting mechanism is the fastest when the percentage of malicious nodes is low. This is because revoking a node's certificate in this mechanism requires only one accusation. Afterwards, the revocation time increases with the increase of malicious nodes that, thanks to Bad-mouthing attacks, they revoke the honest nodes responsible for the revocation. Voting mechanism needs more time to do revocations even if the percentage of malicious nodes does not exceed 30%. Indeed, to revoke the certificate of a malicious node, it must have a necessary number of votes against it. The revocation time becomes huger when the percentage of malicious nodes increases in the network. This is explained by the fact that voting mechanism Figure 6.6: Revocation time vs malicious nodes is not able to identify and revoke a malicious node instantly if there are not enough honest nodes around it, which affects the reliability of the network.

Conclusion

The proposed multi-stage Certificate Revocation Game allows the CL-UR agent to predict its strategy and make rational decisions based on the behavior of M N s in the network. Based on the PBE of the multi-stage game, the CL-UR agent can accurately revoke the certificate of malicious nodes to enhance the security of the IIoT network. When a certificate is revoked, it is important to inform other nodes in the network to ensure that they do not establish a connection with its owner. However, distributing the revocation information while considering the constraints and requirements of IIoT networks is a challenging task. This is the purpose of the next chapter.

Introduction

Currently, the role of IIoT is not only limited to sending to the cloud data collected with sensors located on industrial equipment, but much more than that. In fact, IIoT may applies artificial intelligence algorithms on the data collected during the monitoring process to reach a higher maturity layer allowing the IIoT devices to communicate1 and collaborate [START_REF] Mahmood | Digital Certificate Verification Scheme for Smart Grid using Fog Computing (FONICA)[END_REF] with each other in all stages of production, in real time and without human interventions. The automation and autonomy of IIoT devices increase significantly the risk of communication with malicious devices. Thus, IIoT devices must be informed immediately when the certificate [START_REF] Díaz-Sánchez | TLS/PKI Challenges and Certificate Pinning Techniques for IoT and M2M Secure Communications[END_REF] of a device is revoked from the network. Otherwise, they will risk establishing a communication with a malicious device that will pretend to be trusted. The information about revoked certificates allows IIoT devices to verify the revocation status of their peers' certificates before establishing a communication with them. However, the distribution of this information in the IIoT network in a resource efficient manner and without latency is a difficult task. Conventional techniques for distributing information about revoked certificates, also known as certificate verification schemes, are the Certificate Revocation List (CRL), the Online Certificate Status Protocol (OCSP), and the Bloom filter. These schemes are not appropriate to be applicable in IIoT networks because they are subject to some issues like communication overhead, storage overhead and latency. For this purpose, in this chapter, we propose a new efficient certificate verification scheme based on Short-Lived Certificates (SLCs), and adapted to the requirements of IIoT networks. With the shortened validity of SLCs, the user would not have to worry about verifying the revocation status of a certificate by using conventional schemes, but rather rely on the expiration date indicated on the certificate itself. This avoids the issues related to the use of conventional schemes and supports real-time communication in IIoT environments by eliminating the latency resulting from the verification process. The remainder of this chapter is organized as follows. In section 7.2, we review the existing certificate verification systems in the literature, we also provide a critical analysis of why these schemes are not suitable for deployment in IIoT networks. In section 7.3, we detail the improvements we apply to the hierarchical architecture proposed in chapter 5 to support the management of SLCs in IIoT networks. Based on the research gaps and open challenges discussed Chapter 7. Trust-based Certificate Management for IIoT networks nodes where even trusted nodes can become untrusted and selfish over time.

To solve the resource consumption issues of CRL-based schemes, researchers developed the OCSP protocol [START_REF] Santesson | X. 509 internet public key infrastructure online certificate status protocol-OCSP[END_REF]. Hence, to verify the revocation status of a certificate, the node must send a request to an OCSP server and wait for the response. This creates latency and communication overhead. To enhance the performance of OCSP, authors of [START_REF] Rescorla | The transport layer security (TLS) protocol version 1[END_REF] proposed the OCSP stapling protocol that allows each node to ask its peers during the handshake phase to send it valid OCSP responses with their certificates. However, this protocol does not guarantee that the peer node will always transmit a valid OCSP response. Authors of [START_REF] Papapanagiotou | Revising centralized certificate validation standards for mobile and wireless communications[END_REF] proposed a certificate validation scheme for Mobile Ad-hoc Networks called Ad-hoc Distributed OCSP (ADOPT). ADOPT adjusts the validity period of the OCSP response according to the trust level of the certificate owner. The proposed scheme uses the caching to provide certificate status information (CSI) even in the off-line states to the nodes. However, the CSI refreshing method used by [START_REF] Papapanagiotou | Revising centralized certificate validation standards for mobile and wireless communications[END_REF] to reduce the incoherence of CSI causes a significant overhead to the network.

To compress the size of the CRLs and solve the limitations of the OCSP, several works such as [START_REF] Duan | Flexible certificate revocation list for efficient authentication in IoT[END_REF], [START_REF] Jin | Bloom filter based certificate validation for VANET: poster[END_REF] and [START_REF] Rabieh | Scalable Certificate Revocation Schemes for Smart Grid AMI Networks Using Bloom Filters[END_REF] proposed certificate verification schemes based on Bloom filter [START_REF] Song | Fast Hash Table Lookup Using Extended Bloom Filter: An Aid to Network Processing[END_REF]. Bloom filter is a probabilistic data structure that allows to verify the presence of an element in a set. The limitation of Bloom filter is that the number of false positives is proportional to the number of elements in the structure. Authors of [START_REF] Hammi | A Blockchain-based Certificate Revocation Management and Status Verification System[END_REF] relied on the advantages of blockchain to propose a decentralized certificates revocation management and status verification system. In [START_REF] Hammi | A Blockchain-based Certificate Revocation Management and Status Verification System[END_REF], the CA combines in a data structure called Revocation Status Information (RSI) the identities of revoked certificates and the Bloom filter containing the revoked certificates. The certificate of each entity in the network contains a field indicating to which RSI its state will belong in case of its revocation. RSI structures are recorded by the CA in a public blockchain to be available to entities. During the handshake phase, the node receives not only the certificate of its peer but also the RSI allowing it to perform the verification. Thus, the node first ensures that it has the correct RSI that contains the revocation information of its peer, then it extracts the Bloom filter and verifies the belonging of the certificate to the filter. A negative response ensures that the certificate has not been revoked. However, when the response is positive, the node performs an additional investigation to ensure that the response is not a false positive. For this purpose, the node requests its peer to send it all the revocation information issued by the CA. Such a process generates additional communication costs and increases the latency of 7.3. Proposed architecture verification.

Several works ( [START_REF] Topalovic | Towards Short-Lived Certificates[END_REF], [START_REF] Pahl | Giving IoT Services an Identity and Changeable Attributes[END_REF], [START_REF] Ju | Certificate Management Scheme for IoT Services[END_REF], [START_REF] Hsu | Intranet security framework based on short-lived certificates[END_REF], and [START_REF] Mahmood | Digital Certificate Verification Scheme for Smart Grid using Fog Computing (FONICA)[END_REF]) relied on SLCs as an alternative to conventional certificate verification schemes. However, SLCs can convert the certificate management process into a bottleneck because they present performance and organizational challenges. They require sophisticated automation and frequent reissuance, making their use in IIoT networks constrained despite their support for automation. To address the challenges of SLCs, authors of [START_REF] Pahl | Giving IoT Services an Identity and Changeable Attributes[END_REF] shared the burden of SLCs management among a set of decentralized CAs. The work in [START_REF] Pahl | Giving IoT Services an Identity and Changeable Attributes[END_REF] used SLCs to address service integrity and metadata protection, but not for authentication between distributed nodes. Authors of [START_REF] Mahmood | Digital Certificate Verification Scheme for Smart Grid using Fog Computing (FONICA)[END_REF] used SLCs to support authentication between distributed devices. They rely on the strength of fog computing to make their solution scalable and meet the challenges related to the use of SLCs. However, the certificate validity period in [START_REF] Mahmood | Digital Certificate Verification Scheme for Smart Grid using Fog Computing (FONICA)[END_REF] is considered the same for all devices of the network, which can create a large workload if all devices synchronously request a new certificate at the same time.

Based on the weaknesses of the existing certificate verification schemes discussed above, we propose a new efficient SLC-based certificate verification scheme suitable for IIoT network requirements. The proposed solution addresses challenges due to the use of SLCs and supports automation in IIoT environments. We also introduce the notion of trust to determine the validity period of SLCs. Indeed, the validity period of each SLC is proportional to the trust level of its owner so that only the SLCs of less trusted nodes will be updated frequently. To the best of our knowledge, our work is the first to integrate the notion of trust in the calculation of the validity period of SLCs. This makes a good trade-off between certificate life and overheads resulting from certificate renewal process, while keeping a high security level.

Proposed architecture

In this section, we detail the improvements we apply to the hierarchical architecture proposed in chapter 5 to support and enhance the SLCs management in IIoT networks. A single network entity "CA" cannot manage alone the certificate of all IIoT devices in the network, as it is not able to accurately monitor the behavior of these devices. In an IIoT network, it is necessary to detect malicious devices promptly and accurately during the revocation phase. This was the purpose of the chapter 6 where we proposed an effective certificate revocation mecha-Chapter 7. Trust-based Certificate Management for IIoT networks nism for IIoT networks. It is also important to quickly inform other devices of revoked certificates to avoid establishing a communication with their owners, while considering the constraints and requirements of the IIoT network.This is the purpose of this chapter. For this purpose, we use the hierarchical architecture proposed in chapter 5 and illustrated in Fig. 5.1. We remind the reader that the hierarchical architecture organize the IIoT network as a set of clusters called industrial communities. Communities are dynamically formed on the basis of the industrial relationships between IIoT devices. Each community consists of a trusted and powerful CL and a set of M N s. The CL-UR agent, hosted in the CL, revokes the certificate of malicious M N s, renews those of legitimate nodes and shares the revocation result with the rest of the network. Indeed, the CL acts as a distributed CA. The hierarchical architecture makes our proposed verification scheme scalable and prevents bottleneck due to frequent reissuance of SLCs by sharing the burden of certificate management among all CLs.

To achieve continuous monitoring, the CL evaluates frequently the behavior and the trust of M N s belonging to its community. Hence, after each period of time, the CL records in a database hosted in the cloud the IDs of revoked M N s in its community as well as the behaviors of the non-revoked M N s to use them as a history for its next monitoring. These records must be shared with all other CLs in the network. Consequently, if a M N changes community, the new CL that has no information about the behavior of this M N can rely on the information shared by the old CL. Hence, the new CL provides the M N with a valid certificate whose validity period is proportional to its behavior, or refuses the integration of the M N to the community if it was already revoked by its old CL. This prevents several attacks such as the whitewashing attack that occurs when a M N leaves its community and joins another once its untrusted behavior is detected. To share the monitoring and revocation information with other CLs in the network, we propose to use a consortium blockchain [START_REF] Teslya | Blockchain-based platform architecture for industrial IoT[END_REF], where after each period of time, the CL writes a transaction as described in Fig. 7.1:

Each transaction encapsulates the following information:

• ID CL : The unique identifier of the CL.

• P b CL : The public key of the CL.

• U nif orm resource identif ier (U RI): points in the database the location where the CL has transcribed the last monitoring and revocation data related to its community. • Hash V alue: is the hash of the file containing the latest updated monitoring and revocation data related to the community. Since this file is stored outside the blockchain, in the database, it could be potentially modified by attackers. The Hash Value allows to verify the authenticity of the file.

We use the blockchain to secure exchanges between communities. Indeed, the blockchain allows a node to check the validity of certificates sent by nodes belonging to other communities before establishing communication with them, as detailed in section 7.4. The blockchain also keeps track of the behavior of nodes, even when they change communities. Indeed, CL j access the latest updated monitoring and revocation data of the community "C j ′ " by using the U RI mentioned by the leader of C j ′ in the blockchain. We use the U RI to avoid storing monitoring data at CLs and overloading the blockchain, hence, all records are made in the database hosted in the cloud. The IIoT server is the entity responsible for validating blocks in the blockchain.

SLC-based certificate verification scheme

Based on the research gaps and open challenges discussed in section 7.2, in this section we propose an efficient certificate verification scheme for IIoT networks, based on SLC.

SLC as an alternative to the conventional certificate verification schemes

IIoT devices are led to communicate and collaborate with each other at all stages of production, in real time and without human intervention. To prevent communication with malicious devices, each device must possess the information about the revoked certificates in the network to verify the certificate revocation status of its peer. IIoT networks are heterogeneous, thus, the revocation verification process in these environments should consider the processing power, storage, battery lifetime and bandwidth of resource-constrained devices such as sensors and must not waste the resources of powerful devices such as connected robots and machines. The revocation verification process must also be done without latency. Hence, to address these challenges, we propose a new efficient certificate verification scheme based on SLCs.

Indeed, SLC is similar to an ordinary certificate; it can be deployed and chained in the same way as the existing X.509 certificates, except that its validity period is a short span of time which can be few hours or few days. Despite the advantages of SLCs and their support for automation in IIoT networks, they still present performance and organizational challenges that make their use constrained. SLCs can transform the certificate distribution process into a bottleneck, as a high number of certificates must be issued each period of time. To enable our certificate verification scheme to meet these challenges and take full advantage of SLCs, we rely on the architecture described in section 7.3. The proposed architecture shares the burden of SLCs management among all CLs, instead of it being handled by a single entity in the network. It also brings the certificate verification process closer to M N s, which improves the real-time security services for the IIoT network.

SLCs allow to avoid the limitations of conventional certificate verification schemes. They eliminate storage, communication and processing overheads at M N s during the certificate verification process. Indeed, M N s don't need to store revocation lists which size increases with the number of revoked certificates in the network, they don't have to worry about the false positives and they don't have to contact a third party entity to check the revocation status of their peers' certificates. Further, with the shortened validity period of the SLCs, the certificates of malicious M N s would expire before their status could be verified by conventional schemes and before a major attack could be properly conducted. This reduces the risk of accepting the certificate of a malicious node before it expires. Indeed, M N s would not have to worry about using conventional schemes to verify the certificate revocation status of their peers, but rather rely on the expiration date indicated on the certificate itself. This enable real-time communications by reducing the latency at the time of communication establishment since M N s do not have to check the revocation status of their peers' certificates.

In several works as [START_REF] Mahmood | Digital Certificate Verification Scheme for Smart Grid using Fog Computing (FONICA)[END_REF], the certificate validity period V p of SLCs is considered the same for all devices of the network, which can create a large workload if all devices synchronously request a new certificate at a given time. The process of updating SLCs with a large V p value does not cause a high bandwidth consumption. However, a large value of V p increases the risk of communicating with malicious nodes that are revoked but their certificate is still valid. This will give the malicious M N s more time to make attacks in the network even after their revocation. A short V p enhances the security of the network by reducing the risk of accepting the certificates of malicious M N s before they expire, but it causes network congestion and bandwidth consumption due to the intensive certificate renewal process. In conclusion, a large V p reduces the bandwidth consumption but at the expense of the IIoT network security. The network security is better when the value of V p is short, however, this increases the consumption of the network bandwidth. To have a trade-off between bandwidth consumption and security, we consider that the validity period V p of each SLC is proportional to the behavior and trust level of its owner. Hence, CL assigns a larger V p to the legitimate M N s and a shorter V p to the less trusted ones as follows:

V p = (1 -p(X S = 1|h(t j ))).V p th (7.1)
Where: V p th is the maximum validity period of a SLC. The authors of [START_REF] Topalovic | Towards Short-Lived Certificates[END_REF] suggest that this period is 4 days, which corresponds to the average caching time of an OCSP response. Dynamic V p reduces bandwidth consumption, since only the SLC of less trusted nodes will be updated frequently. To revoke a malicious M N , the CL simply stops renewing its SLC. As a result, this M N will be unable to participate in future network activities because its old certificate must have expired, or will expire soon. Even in the case of a compromised CL, there will be no need to revoke the stolen certificates, since they have a short validity period.

Workflow of our Certificate verification scheme

As depicted in the flow chart in Fig. 7.2, when a M N wants to start communication with any other node "D" (M N or CL) in the network, first, it checks that the SLC of node D, received during the handshake phase is not expired. If the SLC is no longer valid, no communication will be established because D has already been revoked. In the case where D is the CL of the M N , the communication between the two nodes will be established directly without any verification process, because the M N knows in advance that its CL is a legitimate node. Otherwise, M N checks if the SLC of D is signed by the same CL as it, if it is the case, it means that the two M N s are in the same community. Thus, the communication between them can start immediately without checking the certificate revocation status. Each community is a trust area, i.e. the communications between nodes belonging to the same community are done directly without using certificate verification schemes as long as their V p is not expired. This improves real-time security services and supports automation within IIoT environments. If the SLC of "D" is signed by another entity than the CL of the M N , which means that the two nodes "D" and M N do not belong to the same community, then the M N must check the certificate revocation status of D as described in flow chart in Fig. 7.3 before establishing communication with it.

When M N wants to establish a communication with a node belonging to another community or another domain whose SLC provider is unknown, the M N sends a request to the CL of its community to verify the legitimacy of the SLC provider. The CL checks if the ID of the SLC provider exists in the blockchain and corresponds to the identity of a CL that periodically publishes transactions in the blockchain. If the ID exists, the CL sends to the M N a response containing the provider's public key downloaded from the blockchain. M N uses the public key of the provider to verify the integrity of its peer's certificate. However, if the ID of the SLC provider is unknown and does not exist in the blockchain, the CL warns the M N to not establish a communication with the owner of this SLC.

Performance Evaluation

To evaluate the performance of our proposed certificate verification scheme, we use the simulation parameters listed in Table . 7.1.

Performance Evaluation

Performance evaluation of the SLC management process

In this part, we conduct a comparative study between the management of SLCs using our proposed hierarchical architecture described in section 7.3, the management of SLCs using Fog Computing architecture proposed in FONICA [START_REF] Mahmood | Digital Certificate Verification Scheme for Smart Grid using Fog Computing (FONICA)[END_REF] and the management of SLCs using the Certificate Life-cycle Management (CLM) edge server proposed in [START_REF] Astorga | How to Survive Identity Management in the Industry 4.0 Era[END_REF]. In this comparison study, the percentage of energy saving and the central processing unit (CPU) usage saving over the entities responsible for SLCs management are evaluated for each architecture. If these architectures are not used, all SLCs will be managed by the traditional centralized architecture, where a single entity manages the SLCs for the entire network. Therefore, we normalize the saved energy and CPU usage against the centralized architecture consumption.

To save the energy consumption due to the management of SLCs in the centralized architecture, FONICA distribute the burden of SLCs management among a set of fog nodes, CLM distribute the burden among a set of CLM nodes and our proposed architecture distribute the burden among a set of CL nodes. In Fig. 7.4, we investigate the impact of the network density on the percentage of energy saving over the CL nodes during the SLCs management process. According to the results of Fig. 7.4, the percentage of energy saving over CLs in our architecture is much more significant than that saved over Fog nodes in FONICA and CLM nodes in [START_REF] Astorga | How to Survive Identity Management in the Industry 4.0 Era[END_REF], even when the density of the network increases. This is due to two main reasons: The first reason is that, unlike FONICA and CLM, the validity period of each SLC in our scheme is proportional to the trust level of its owner. Thus, only the SLC of less trusted nodes will be renewed and issued frequently. This reduces the workload on the CLs and allows them to conserve their energy. The second reason is that the number of CLs in our architecture is proportional to the density of the IIoT network. As explained in chapter 5, when the network evolves, the number of CLs increases to absorb the burden related to the SLCs management, which explains the stability of the energy saving corresponding to our scheme. In FONICA and CLM, all nodes synchronously request a SLC at the same time which causes a substantial stress to the CPU of fog and CLM nodes. The increase of the number of nodes in the network increases the demand for SLCs and consequently decreases the percentage of CPU usage saving in 7.5. Performance Evaluation these schemes. In contrast, the percentage of CPU usage saving over CL nodes in our architecture is more important than that of FONICA and CLM. This is explained by the fact that in our scheme only the SLCs of less trusted nodes are renewed frequently and not all the SLCs in the network, which decreases the pressure on the CPU of the CLs. As explained above, in our hierarchical architecture, the number of CLs is proportional to the network density. This reduces the load on the existing CLs, which explains that even with the increase of the network density, the percentage of CPU usage saving remains above 60%.

In this part, we also evaluate the impact of the choice of SLC validity period on the risk of accepting a revoked certificate before it expires. For this purpose, in Fig. 7.6 we evaluate the risk of a M N accepting a revoked certificate before it expires, according to the increasing percentage of untrusted nodes in the network. We notice from Fig. 7.6 that the longer the validity period of SLCs, the higher the risk of communicating with malicious nodes whose certificate is revoked but not yet expired. This risk decreases when the validity period of SLCs is set to a shorter duration. However, SLCs with a short validity period cause network congestion and bandwidth consumption due to the intensive certificate renewal process. To this aim, in our proposed scheme the validity period of each SLC is dynamic, it is proportional to the trust level of its owner according to equation (7.1). From Fig. 7.6, the dynamic validity period gives good results even with a large percentage of malicious nodes in the network. These results are almost the same as the one obtained by V p -Short, without having to frequently update the SLCs of all the nodes in the network. Only Chapter 7. Trust-based Certificate Management for IIoT networks the SLCs of less trusted nodes will be updated frequently.

Performance evaluation of the SLC-based certificate verification scheme

In this part, we study the time needed to obtain the revocation information as well as the resulting storage and communication overhead to achieve this aim in our proposed scheme. We also compare the obtained results with those of the related certificate verification schemes. Indeed, the time needed to obtain revocation information also called the verification time is responsible for the latency of communications between IIoT nodes. Furthermore, the resulting storage and communication overhead must be the most optimal to minimize the resource consumption of constrained devices.

-Verification Time : Fig. 7.7 shows the results obtained with our verification scheme regarding the average time required for a M N to verify the revocation status of its peer in two cases: 1) the peer belongs to the same community as it, and 2) the peer belongs to another community than it. We notice that in the first case, the time needed for the M N to do the verification is 0 ms. Indeed, in this case, the M N relies only on the expiration date of the peer's certificate and no further verification is required. However, when the peer belongs to another community, the M N must check the reliability of the certificate issuer from its CL by following the process described in Fig. 7.3. To allow IIoT nodes to have the majority of verification at 0 ms, we can gather in the same community the nodes that tend to communicate often with 7.5. Performance Evaluation each other. The Verification Time in our scheme does not increase with the variation of the number of revoked certificates. Fig. 7.7 shows that the verification process in our scheme is faster than that of the OCSP and the CRL-based scheme proposed in [START_REF] Sayad Haghighi | Intelligent Trust-Based Public-Key Management for IoT by Linking Edge Devices in a Fog Architecture[END_REF]. The verification time in the CRL-based scheme [START_REF] Sayad Haghighi | Intelligent Trust-Based Public-Key Management for IoT by Linking Edge Devices in a Fog Architecture[END_REF] increases with the increase of the number of revoked certificates. Indeed, each node in [START_REF] Sayad Haghighi | Intelligent Trust-Based Public-Key Management for IoT by Linking Edge Devices in a Fog Architecture[END_REF] approaches the trusted edge nodes to verify whether a certificate is in their CRLs. If the certificate revocation status is not found among the CRLs of the edge nodes, the verification must be done through the CA hosted in the cloud. This process incurs an additional cost and increases the verification time. In Fig. 7.7, we also compare our scheme with the work [START_REF] Hammi | A Blockchain-based Certificate Revocation Management and Status Verification System[END_REF] which proposes a verification scheme based on Bloom filter. According to the obtained results, we notice that the Bloom filter-based scheme [START_REF] Hammi | A Blockchain-based Certificate Revocation Management and Status Verification System[END_REF] (BF-based scheme) gives good results when the filter provides a negative response. However, when the filter provides a positive response, additional verification for false positives must be performed.

-Storage and communication overhead

In Fig. 7.8, we compare the storage consumption of our proposed scheme with that of the OCSP, the CRL-based scheme [START_REF] Sayad Haghighi | Intelligent Trust-Based Public-Key Management for IoT by Linking Edge Devices in a Fog Architecture[END_REF] and BF-based scheme [START_REF] Hammi | A Blockchain-based Certificate Revocation Management and Status Verification System[END_REF], when the number of revoked certificate ranges from 20 to 100. M N must store more records in its memory to perform the verification. On another hand, OCSP and our scheme do not consume the storage resources of IIoT nodes, even when the number of revoked certificates increases. Indeed, in our schemes there is no need to maintain records at M N s. To perform verification, nodes simply refer to the information indicated in the peer's certificate.

In Fig. 7.9, we measure the communication overhead representing the data amount needed to exchange in order to ensure the verification task. As shown in Fig. 7.9, the Bf-based scheme requires the most communication overhead than the other schemes. This is due to the 12 % of cases where the filter provides a positive response. Indeed, positive responses involve additional verification using RSI structures whose the size is proportional to the number of revoked certificates. The communication overhead in the CRL-based scheme results from the communications with the trusted edge nodes or with the CA. In our proposed scheme, the verification process performed inside the same community does not produce any communication overhead, since M N s do not need any third party to ensure the reliability of a certificate. Indeed, α = 0.8 means that 80 % of the M N ′ s communications are performed inside the community, so the verification process for 80 % of communications is eliminated. All that remains is the verification process resulting from the 20% of communications made outside the community. The resulting communication overhead in our scheme is due solely to the verification process of the certificates belonging to different communities as described in Fig. 7.3. Hence, in order to decrease the communication overhead in our proposed scheme, we need to act on the community establishment method detailed in section 5.4.2. In the hierarchical architecture, communities are formed based on the indus-7.6. Security Analysis trial relationships between IIoT nodes. Indeed, one of these industrial relationships is the coworker relationship that gathers in the same community the IIoT nodes that tend to collaborate together. By privileging this relationship in the community establishment method, we will have in the same community the nodes that often collaborate together. This will increase the number of communications inside the community, decrease the number of communications outside the community and therefore decrease the communication overhead related to the certificate verification process. The communication overhead in our proposed scheme does not change with the variation of the number of revoked certificates, it is affected by the total number of certificates requiring verification by the CL. Indeed, the communication overhead produced by each node becomes larger as the number of verification increases.

To prove the efficiency of our proposed scheme, Fig. 7.10 compares the overall communication and storage overhead in the different verification schemes when the number of revoked certificates varies from 20 to 100 and the number of verification varies from 0 to 10. It can be clearly depicted from Fig. 7.10d that our proposed scheme is much efficient in terms of storage consumption and communication overhead in comparison with the OCSP (Fig. 7.10a), the CRLbased scheme (Fig. 7.10b) and the BF-based scheme (Fig. 7.10c), even when the number of revoked certificates and the number of verification increase. This is because our scheme does not require storage operations or communication overhead when performing verification within communities. The only overhead comes from the verification performed outside the communities. As explained before, thanks to the involvement of the industrial relationships between IIoT nodes in the community establishment method, even the resulting communication overhead of external verification can be further reduced. Therefore, considering the above discussion, our proposed certificate verification scheme is the most appropriate for IIoT networks.

Security Analysis

In this section, we provide a security analysis of our proposed certificate verification scheme against a set of potential security threats and vulnerabilities.

Compromised CA: an attacker can compromise the CA and access its private key to sign its own certificate as well as the certificates of other malicious nodes. Upon the detection of this attack in our proposed scheme, the compromised CL will be isolated from the network immediately and replaced by another CL.

In the other verification schemes, the compromised CA must find all stolen certificates to revoke them, which is not always obvious. In our proposed scheme, it is not needed to search for stolen certificates to revoke them since they have a short validity period and after expiration they will be useless.

Denial-of-Service (DoS) attack: is the most significant threat to the online verification schemes like OCSP, where an attacker or group of attackers sends multiple requests at the same time to overwhelm the resources of the OCSP server and make it unavailable. In our proposed scheme, M N s do not need the CL to do verification inside the community. However, our scheme is vulnerable to DOS attacks during external verification where the M N needs to contact its CL. To solve this problem, the M N can simply join another reachable CL to perform the verification. In our scheme, M N will always be able to change community in case its CL is unreachable, which will allow it to have a backup system to verify the certificate revocation status of its peers. In other verification schemes like CRL and OCSP there is no backup system; disabling the CA or the OCSP server could cause a major network disruption.

Man in

The Middle (MiTM) attack: this attack can be deployed by intercepting the verification requests and responding with a fraudulent response, signed with random data before the legitimate response arrives. Indeed, this attack is popular for the OCSP protocol, where the attacker intercepts the communications between the nodes and the OCSP server. Our scheme excludes OCSP responses, which prevents MiTM attacks especially in the verification inside communities. However, the outside verification are still vulnerable to MiTM attacks. Problems related to MiTM can solved by Elliptic Curve Digital Signature Algorithm (ECDSA) validations. For OCSP, nodes have to do ECDSA validations for all their certificate status verification, which will lead to a consumption of their resources. ECDSA validations in our scheme are not needed for all verification as OCSP, but just for verification outside the community. Thanks to the involvement of the industrial relationships in the community establishment method, the majority of communications occur between nodes belonging to the same community, which does not require verification and minimizes the risks of MiTM.

Trust related attacks: some certificate verification schemes are vulnerable to trust related attacks; for example the work in [START_REF] Cebe | Efficient Certificate Revocation Management Schemes for IoT-based Advanced Metering Infrastructures in Smart Cities[END_REF] proposes to share the CRL file between all the nodes of the network instead of each node containing the whole file. Hence, before a node starts communication with its peer, first, 7.7. Conclusion it sends a request to the node having the status of the required certificate. However, a malicious node can confirm that a requested certificate is not revoked, which is completely false. This allows the malicious node to perform more attacks in the network. Our certificate verification scheme is not vulnerable to Trust related attacks because only the legitimate CLs can decide if a certificate is valid or not.

Whitewashing attacks: Occur when a node changes its community each time the CL detects its untrusted behavior. To deal with this behavior, the CL in our proposed scheme stops renewing the SLC of the detected malicious node to revoke it from the network. The CL also registers this revocation in the blockchain. Hence, when the malicious node aims to join another community, the new CL asks it to send the ID of its old CL to search in the blockchain for the URI pointing to the file containing the revocation information of the old community. If the certificate of the node is not revoked, the CL uses the trust evaluation of the old CL to define the validity period of the node's certificate according to equation (7.1).

Replay Attacks: an attacker can steal the private key of an IIoT node and at the same time request the certificate status of that node from the Validation Authority (VA). Therefore, the attacker will have all the means to impersonate the IIoT node even if its certificate is revoked. Each time a node wants to verify the revocation status of the victim node's certificate, the attacker replays the previously obtained VA response. OCSP and the proposed work in [START_REF] Rescorla | The transport layer security (TLS) protocol version 1[END_REF] are vulnerable to replay attacks, while our proposed verification scheme can cope with this kind of attacks by using SLCs. Indeed, once the validity period of a SLC expires, the CL does not renew it if its owner is untrusted or its private key is declared stolen. Hence, the attacker will not be able to use the stolen certificate after its expiration. It will also not be able to replay the VA response because the other nodes in the network will consider the SLC invalid since it is not renewed.

Conclusion

In this chapter, we based on trust management and SLCs to propose a certificate verification scheme suitable for IIoT network requirements. Our experiments showed the efficiency of our proposed certificate verification scheme compared to conventional ones, including centralized SLCs, CRL, Bloom filter and OCSP. We also compared our scheme with works that have proposed improvements to conventional verification schemes to prove that our scheme outperforms them. In the last section of this chapter, we provide a security analysis of our proposed certificate verification scheme against a set of potential security threats and vulnerabilities. In our future work, we will propose simulations to validate the resilience of our certificate verification scheme to attacks and threats discussed in the Section 7.6 of this chapter. In this chapter, we studied the time required to obtain the revocation information as well as the resulting storage and communication overhead to achieve this aim. The purpose was to prove the efficiency of our proposed certificate verification scheme. However, we have not evaluated the cost to renew an expired certificate of a legitimate M N . This is foreseen for the future works.

Conclusion and perspectives

Conclusion

In this thesis we were interested in trust management in IoT and IIoT networks in order to strengthen the security and improve the performance of these networks.

As trust is multidisciplinary concept, in a first step, we gave a detailed introduction of trust in wireless networks based on its definition in several disciplines including sociology, economics, philosophy, psychology, and autonomic computing and human-machine interactions. We also presented the different modules, components and related attacks that must be considered when designing an effective trust management model.

The effectiveness of the trust management in terms of security and confidentiality can be achieved by employing the appropriate trust modeling methods. However, there is no single and standard methodology for modeling and evaluating trust. In the literature, each work models and evaluates trust according to its own definition and perception of trust, also according to the needs of its application. Therefore, to give the reader a clearer vision on trust modeling in wireless networks, we provided an overview of the literature on the most used methods for modeling trust in these networks.

Afterwards, we proposed a distributed analytical trust management model for IoT networks where each node monitors the behavior of its neighbors and assigns them a local trust metric. Depending on the result of the monitoring process, the trust metric of the monitored node may increase, decrease, remain unchanged or goes down to zero. Indeed, we modeled the state changes of the trust metric by using a discrete-time Markov chain with M + 1 states. Each state corresponds to a trust level. The number of transitions to achieve the Chapter 8. Conclusion and perspectives high level of trust as well as the trust interval in the proposed model can be adapted according to the monitoring process and network characteristics. This makes our trust management model flexible and adaptable Subsequently, we oriented our research towards the trust management in IIoT networks where the security challenges are even greater. Indeed, IIoT devices manage sensitive data related to company trade secrets, which makes them a very attractive target for security threats that aim at compromising the reliability of the IIoT network. For this purpose, we proposed a trust management model for IIoT networks by using a new concept called industrial relationship between devices. To the best of our knowledge, at the time we started our research on trust management in IIoT, there was no proposed trust management model specifically for IIoT networks that considers the requirements and constraints of these networks.

In the proposed hierarchical architecture, to remove uncertainty about the type of a member node (legitimate or malicious), we modeled the interaction between the member node and its detection agent as a signaling game. Indeed, the detection agent uses the behavior of nodes in the network as a signal about their type. As the game between the agent and the member IIoT node evolves, the agent can obtain its best response strategy based on its belief on the member node. This allows the agent to make rational, accurate and fast decisions which increases the reliability of our proposed certificate revocation process.

When a node is revoked, all other nodes in the IIoT network must be notified to avoid any connection with it. This process must be done quickly, in a resource-efficient manner, and without latency. For this purpose, we proposed a new efficient SLC-based certificate verification scheme suitable for IIoT network requirements. The proposed solution addresses challenges due to the use of SLCs and supports automation in IIoT environments. We also introduced the notion of trust to determine the validity period of SLCs. Indeed, the validity period of each SLC is proportional to the trust level of its owner so that only the SLCs of less trusted nodes will be updated frequently. To the best of our knowledge, our work is the first to integrate the notion of trust in the calculation of the validity period of SLCs. This makes a good trade-off between certificate life and overheads resulting from certificate renewal process, while keeping a high security level.

Perspectives

The work done in this thesis opens many perspectives. About short-term perspectives, we intend to deploy our trust management model for IIoT network, our certificate revocation mechanism and our certificate verification scheme in a real IIoT environment. The objective is to perform a testbed and compare the results with those obtained by the contiki/cooja simulator. In section 7.6 of chapter 7, we provided a security analysis of our proposed certificate verification scheme against a set of potential security threats and vulnerabilities such as DOS attack, MiTM attack, whitewashing attacks, etc. In our future work, we intend to deepen this section. Indeed, we will consider simulations challenging the proposed certificate verification scheme with attack scenarios to prove its robustness.

In our future work, we will further improve our proposed analytical trust management model for IoT networks. We will also propose network simulations to prove that our trust management model addresses the main requirements and constraints of IoT networks, such as scalability, resource-constrained devices, energy consumption, etc. This thesis also opens many long term perspectives. One of the main aims of six generation (6G) is highly intelligent, fully autonomous, and ultra-dense heterogeneous Internet of Everything (IoE) system. The decentralized and dynamic nature of devices in IoE systems makes the implementation of a uniform security system very difficult, and raises security as one of the main concerns of the 6G network. Indeed, intelligent IoE devices require intelligent 6G security.

Trust management can be a potential method to ensure reliable, real-time communications in 6G wireless networks. However, how to improve the 6G security intelligence by integrating Artificial intelligence (AI) into the trust management system and ensure reliable end-to-end communication in the IoE system remains a challenging task that requires further investigation.

Due to the dynamic characteristics of 6G wireless networks, it is difficult to enrich the training dataset, which affects the effectiveness of traditional AI techniques. Finding a promising deep learning method is a very important issue that is still open and needs more investigation, because the lack of training data reduces the accuracy of trust assessment and decrease the reliability of 6G networks.

The development of 6G and artificial intelligence has accelerated the proliferation of robotic technology in the popular sphere. Currently, robots are not Chapter 8. Conclusion and perspectives only deployed in the industrial area, but they are increasingly present in public spaces, where they interact directly with humans. The main question is: are humans ready to accept these service robots at their side? This acceptance depends on the level of trust that humans place in robots. Trust in human-robot interactions is a very important issue that needs further research, as there is a growing need to understand and measure human trust in robots. Therefore, determining the factors that influence this trust is not an obvious task.

Which dimension to choose to measure the trust of humans in robots? Is it the QoS dimension that defines the capabilities of the robot, or the social dimension used in social networks and that defines the willingness of the user to be vulnerable?

In our thesis, the interactions between IIoT devices led us to define a new industrial dimension of trust. Will the understanding of human-robot interactions also lead researchers to the definition of a new dimension of trust?

Contents 2 . 1 2 . 2

 2122 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . Towards the notion of trust in communication and networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.1 Definition of trust in communication and networking: . . 2.2.2 Properties of Trust in communication and networking: .

2. 2 . 3

 23 Trust vs Reputation: . . . . . . . . . . . . . . . . . . . . 2.2.4 Trust vs Security: . . . . . . . . . . . . . . . . . . . . . . 2.3 Trust management in wireless networks . . . . . . . . . . . 2.3.1 Trust Management modules: . . . . . . . . . . . . . . . . 2.3.2 Direct and indirect Trust management: . . . . . . . . . . 2.3.3 Trust-related attacks: . . . . . . . . . . . . . . . . . . . . 2.3.4 Applications of Trust management . . . . . . . . . . . . 2.3.5 Categories of Trust Management Models: . . . . . . . . . 2.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 2 . 1 :

 21 Figure 2.1:The concept of trust defined by the other disciplines can be applied to modeling trust in communications and networking[7]

Chapter 2 .Figure 2 . 2 :

 222 Figure 2.2: Trust management modules.

Figure 2 .

 2 Figure 2.3: Percentage of efforts made in different trust management applications

-

  Measure the overall reputation of -Vulnerable to trust-related attacks.nodes in the network.-Each node must have a global view on the whole network which is not always possible.

Contents 4 . 1 4 . 2 4 . 4 4 . 5

 41424445 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . Requirements and constraints of IoT networks . . . . . . 4.3 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . The proposed trust management model analysis . . . . . 4.4.1 Trust management Model Overview . . . . . . . . . . . . 4.4.2 Trust parameters . . . . . . . . . . . . . . . . . . . . . . 4.4.3 Pseudo code of the estimation algorithm . . . . . . . . . 4.4.4 Probabilities of transition from one state to another . . . Performance evaluation . . . . . . . . . . . . . . . . . . . . . 4.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 4 . 1 :

 41 Figure 4.1: State transition diagram

Figure 4 . 2 :

 42 Figure 4.2: The honesty related to the direct interactions

4. 4 .

 4 Figure 4.3: The honesty related to the indirect interactions

4. 5 .

 5 Figure 4.4: p d = 0.80, p I = 0.95

Figure 4 . 5 :

 45 Figure 4.5: p d = 0.95, p I = 0.95

Figure 4 . 6 :

 46 Figure 4.6: p d = 0.8, p I = 0.6

Contents 5 . 1 5 . 2 5 . 4 5 . 5

 51525455 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3 Future automotive factory architecture based on IIoT . The proposed trust management model analysis . . . . . 5.4.1 Phase I: Designation process of CL . . . . . . . . . . . . 5.4.2 Phase II: The community establishment method . . . . . 5.4.3 Phase III: The proposed trust management model . . . . Performance evaluation . . . . . . . . . . . . . . . . . . . . . 5.5.1 Part 1: Comparative energy study . . . . . . . . . . . . 5.5.2 Part 2: The sensitivity, the responsiveness and the resiliency of our proposed trust management model to trustrelated attacks launched by malicious IIoT nodes. . . . . 5.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Figure 5 . 2 :

 52 Figure 5.2: The topology of the traditional centralized IIoT architecture

Figure 5 . 3 :

 53 Figure 5.3: The topology of the proposed H-IIoT architecture

Figure 5 . 4 :Figure 5 . 5 :

 5455 Figure 5.4: The average power consumption in the traditional IIoT architecture

Figure 5 . 6 :

 56 Figure 5.6: Average energy consumption of nodes with the evolution of the network population and the increase of κ

5. 5 .Figure 5 . 7 :

 557 Figure 5.7: Average energy consumption of trust management entities, with the evolution of the network population and the increase of κ

5. 5 . 2 Part 2 :

 522 The sensitivity, the responsiveness and the resiliency of our proposed trust management model to trust-related attacks launched by malicious IIoT nodes.

Figure 5 . 8 :

 58 Figure 5.8: Average number of lost monitoring packets, with the evolution of the network population and the increase of κ

Figure 5 . 10 :Figure 5 . 11 :

 510511 Figure 5.10: Tm of a good node, Pm=20%

Figure 5 . 12 :Figure 5 . 13 :Figure 5 . 14 :

 512513514 Figure 5.12: Behavior changes of a non-critical node, Pm=30%

Figure 5 . 15 :

 515 Figure 5.15: Coalition attack: Bad-mouthing attack

Figure 5 . 16 :

 516 Figure 5.16: Coalition attacks: Ballot-stuffing attack

6. 4 .Figure 6 . 1 :

 461 Figure 6.1: Extensive form of the stage Certificate Revocation Game

5 . 1 .

 51 We set the parameters of the Certificate Revocation Game as follows: G G = 15, C G = 5, G U P = 15, C U P = 10, G R = 150, C R = 20, G M = 200, C M = 20, I F = 15

Figure 6 . 3 :Figure 6 . 4 :

 6364 Figure 6.3: The convergence speed of the p(X S = 1|A S (t j ), h(t j )) according to φ and µ

Figure 7 . 1 :

 71 Figure 7.1: Transaction written by the CL in the blockchain after each monitoring or revocation.

Figure 7 . 4 :

 74 Figure 7.4: The impact of network density on the energy saving

Figure 7 . 5 :

 75 Figure 7.5: The impact of network density on the CPU usage saving

Figure 7 . 6 :

 76 Figure 7.6: The choice of SLC validity period VS the risk of accepting a revoked certificate before it expires

Figure 7 . 7 :

 77 Figure 7.7: Time needed to verify the revocation status of a certificate

Figure 7 . 8 :

 78 Figure 7.8: Storage consumption comparison under a varying number of revoked certificates

Figure 7 . 9 :

 79 Figure 7.9: Communication overhead comparison under a varying number of revoked certificates

Figure 7 . 2 :

 72 Figure 7.2: Workflow of the proposed certificate verification scheme

Figure 7 . 3 :

 73 Figure 7.3: Workflow of the process(1)

  (a) The overall overhead of OCSP (b) The overall overhead of the CRL-based scheme (c) The overall overhead of the BF-based scheme (d) The overall overhead of our scheme

Figure 7 . 10 :

 710 Figure 7.10: The overall communication and storage overhead according to the number of revoked certificates and the number of verification

6. 3

 3 The convergence speed of the p(X S = 1|A S (t j ), h(t j )) according to φ and µ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4 Change trend of p * uj and λ * j according to φ . . . . . . . . . . . . 6.5 Revocation rate vs malicious nodes . . . . . . . . . . . . . . . . 6.6 Revocation time vs malicious nodes . . . . . . . . . . . . . . . . 7.1 Transaction written by the CL in the blockchain after each monitoring or revocation. . . . . . . . . . . . . . . . . . . . . . . . . 7.4 The impact of network density on the energy saving . . . . . . . 7.5 The impact of network density on the CPU usage saving . . . . 7.6 The choice of SLC validity period VS the risk of accepting a revoked certificate before it expires . . . . . . . . . . . . . . . . 7.7 Time needed to verify the revocation status of a certificate . . . 7.8 Storage consumption comparison under a varying number of revoked certificates . . . . . . . . . . . . . . . . . . . . . . . . . 7.9 Communication overhead comparison under a varying number of revoked certificates . . . . . . . . . . . . . . . . . . . . . . . . 7.2 Workflow of the proposed certificate verification scheme . . . . . 7.3 Workflow of the process(1) . . . . . . . . . . . . . . . . . . . . . 7.10 The overall communication and storage overhead according to the number of revoked certificates and the number of verification . . . .

Contents 3.1 Introduction

  . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.2 Basic Methods

  . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.1 Weight function . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 Relational measurement . . . . . . . . . . . . . . . . . .

	3.2.3 Fuzzy Logic . . . . . . . . . . . . . . . . . . . . . . . . .
	3.2.4 Game Theory . . . . . . . . . . . . . . . . . . . . . . . .
	3.2.5 Entropy Theory . . . . . . . . . . . . . . . . . . . . . . .

3.3 Bayesian Methods .

  . . . . . . . . . . . . . . . . . . . . . . .

	3.3.1 Bayesian interference model . . . . . . . . . . . . . . . .
	3.3.2	Dempster-Shafer (DS) theory . . . . . . . . . . . . . . .
	3.4 Graph methods . . . . . . . . . . . . . . . . . . . . . . . . . .
	3.4.1 Network features . . . . . . . . . . . . . . . . . . . . . .
	3.4.2 Semiring . . . . . . . . . . . . . . . . . . . . . . . . . . .
	3.5 Machine learning methods . . . . . . . . . . . . . . . . . . .
	3.5.1	Support Vector Machine (SVM) . . . . . . . . . . . . .
	3.5.2	K-Means Clustering . . . . . . . . . . . . . . . . . . . .

3.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4 Probabilities of transition from one state to another 1)

  Probabilities related to increasing or decreasing the T m by one step: We assume that the state of the T m of the monitored node at time t -1 is s. If this node shows a trusted behavior in the network, its T m will transit from

	int Estimate(float var[ ], int N)
	1.	float som=0;
	2.	int cmp=0;
	3.	FOR (int h=0; h< N; h++) DO
	4.	som= som+ var[h];
	5.	END FOR
	6.	float avr=som/N;
	7.	FOR (int h=0; h< N; h++) DO
	8.	float d=abs(var[h]-avr);
	9.	IF d> T H THEN
	10.	var[h]=0;
	11.	cmp=cmp+1;
	12.	END IF
	13.	END FOR
	14.	FOR (int h=0; h< N; h++) DO
	15.	Remove var[h]=0;
	16.	END FOR
	17.	Return N -cmp;
	4.4.

state s to state s + 1 at t. Otherwise, its T m will transit to state s -1 at t according to the following equations:

P s,s+1 (t) = p s (t -1) * p c * p d * p I ; 0 ≤ s < M (4.9)

4.4. The proposed trust management model analysis

Table 5 .

 5

	1: Simulation parameters
	Simulation tool	contiki/cooja 2.7
	Mote type	Tmote Sky
	Nodes Distribution	Random
	Total number of node	100
	Deployment environment automotive sector
	Network Layer	IPV6 + 6loWPAN
	Transport protocol	UDP
	Mac layer	ContikiMAC
	Physical layer	IEEE 802.15.4
	Radio Medium	Unit Disk Graph Medium
	Transmission ranges Trg 100 m
	Interference ranges Irg	100 m
	Monitoring period	10 min
	Number of states M	10
	T0	0.5
	ϕ	0.1

Table 6 .

 6

	1: Non-voting strategy vs voting strategy
		Non-voting strategy Voting strategy
	Communication overhead low	high
	Revocation time	low	high
	False accusation	very very high	low
	Accuracy	very low	high (conditionally)
	Reliability	very low	high (conditionally)
	Unfavorable environment highly impacted	highly impacted
	Trust-related attacks	highly vulnerable	highly vulnerable

Table 6 .

 6 2: Notations used by the Certificate Revocation GameG GGain of M N when it behaves honestly in the network C G Energy consumption cost that M N pays for the honest behavior G M Gain of M N when it presents untrusted behavior in the network. C M Energy consumption cost that M N pays for the untrusted behavior G U P Gain of the CL-UR agent for renewing the certificate of a M N C U P Energy consumption cost resulting from the renewal of the

	6.3. Stage Certificate Revocation Game

is legitimate. We designate the player CL-UR agent by X R .

  S = 1|A S (t j ), h(t j )); 19. Update p(X S = 1|h(t j )) with p(X S = 1|A S (t j ), h(t j )); 20. Store p(X S = 1|h(t j )) for the next stage game; 21.

		R and I F ,
	from the IIoT server.
	7. ENDIF
	8.	Get the prior probability p(X S = 1|h(t j )) on the M N ;
	9. 10.	Calculate λ * j ; Choose the best strategy against the M N according to the probability λ * j ;
	11. IF Choose Revoke THEN
	12.	Revoke the M N ′ s certificate;
	14. ELSE IF Choose Renew AND time-out-certificate is expired THEN
	15.	Renew the M N ′ s certificate;
	16. ELSE keep the previous certificate;
	17. ENDIF
	18.	Calculate p(X

Table 7 .

 7 1: Simulation parameters of the certificate verification scheme

	Simulation tool	contiki/cooja 2.7
	Mote type	Tmote Sky
	Nodes Distribution	Random
	Certificate Size	1054 Bytes
	Certificate's serial number size	20 bytes
	CA's signature size	700 bytes
	The median OCSP response time	291 ms
	Size of OCSP	292 bytes
	Average communication delay between IoT and CA 100 ms
	Average Time of verification for each certificate	1ms
	Size of Bloom filter	350 bytes
	RSI structure	520 bytes
	Chosen probability of a false positive	0.1

https://iot-analytics.com/top-10-iot-applications-in-2020/

https://research.aimultiple.com/iot-applications/

https://blog.barracuda.com/2022/07/12/report-the-state-of-industrial-security-in-2022/

https://dictionary.cambridge.org/dictionary/english/trust

https://blog.barracuda.com/2022/07/12/report-the-state-of-industrial-security-in-2022/

3 https://plato.stanford.edu/entries/trust/

https://iot-analytics.com/lpwan-technologies-cellular-mnos/

https://volkswagen-newsroom.com/en/stories/industry-40-we-make-it-happen-4779

http://www.contiki-os.org/download.html

Data Captured by IoT Connections to Top 1.6 Zettabytes in

2020, As Analytics Evolve from Cloud to Edge

Acknowledgements

I would like to express my sincere gratitude to all those who, in their own manner, have helped me in this long adventure.

Acknowledgements

Contents

Related work

In this section, we provide a critical analysis of existing certificate verification schemes in the literature, their advantages, limitations and deployability in IIoT networks.

The well known certificate verification schemes in the literature are those based on the CRL. The CRL operates as a blacklist where the certificate authority (CA) periodically publishes certificates that are no longer trustworthy. Thus, each node must download this list and check if it contains the serial number of its peer's certificate before establishing a communication with it. The CRL-based schemes prevent communications with malicious nodes, however, they require huge processing and consume the storage of nodes because the size of the CRL increases as the number of revoked certificates in the network increases. Authors of [START_REF] Cebe | Efficient Certificate Revocation Management Schemes for IoT-based Advanced Metering Infrastructures in Smart Cities[END_REF] proposed a distributed CRL management scheme based on distributed hash trees. [START_REF] Cebe | Efficient Certificate Revocation Management Schemes for IoT-based Advanced Metering Infrastructures in Smart Cities[END_REF] enhanced the distribution and storage cost of conventional CRL-based schemes by sharing the burden of CRL storage among all nodes. If a node wants to check the revocation status of a certificate, first, it calculates the hash of the certificate's identity as a key. Afterwards, it uses this key to find the node in the network that contains the certificate status. This proposal is vulnerable to trust attacks because the requested node may indicate that a certificate is revoked when it is not, or the reverse. Authors of [START_REF] Sayad Haghighi | Intelligent Trust-Based Public-Key Management for IoT by Linking Edge Devices in a Fog Architecture[END_REF] proposed a semi decentralized public key management scheme for IoT systems, in which nodes decide whether to look for the revocation information locally at the edge or refer to the CA hosted in the cloud. The decision of each node is made intelligently by estimating the cost of each approach. In the first approach, each node uses its trust table to contact trusted nodes that can help it to make verification. If the estimations are incorrect, i.e. the revocation status of the certificate is not found among the CRL of nodes listed in the trust table, the node must pay an additional cost of verification through CA. Therefore, it is necessary to make the right estimation to avoid excess costs. In [START_REF] Sayad Haghighi | Intelligent Trust-Based Public-Key Management for IoT by Linking Edge Devices in a Fog Architecture[END_REF], trust tables are static, they do not consider the dynamic behavior of

List of Figures

List of Tables

Bibliography

Personal publications [START_REF]Proposed H-IIoT architecture[END_REF]