Andrei-Constantin Braitor
email: andrei.braitor@centralesupelec.fr

Alessio Iovine
email: alessio.iovine@centralesupelec.fr

Houria Siguerdidjane
email: houria.siguerdidjane@centralesupelec.fr

A power consensus controller with overvoltage protection for meshed DC microgrids

Keywords: power consensus-based control, overvoltage protection, DC microgrids, CPLs

A novel distributed power consensus control approach with overvoltage protection is proposed and analysed for meshed direct current (DC) microgrids (MGs) with constant power loads (CPLs). The DC MG considered herein consists of source and load nodes connected over an undirected weighted graph induced by the electrical circuit network, namely the conductance matrix. When deploying, the proposed controller features a second graph, that models the communication network over which the source nodes exchange information such as the instantaneous powers, and which is used to adjust the power injection accordingly to achieve power sharing. Additionally, one aims to maintain the voltage at each source below operator-set limits. This feature is critical given the power and voltage dependency. By addressing the occurrence of abnormal voltage values at different nodes in the network, one would guarantee a relatively safer power consensus policy and microgrid operation. To accommodate both objectives, we developed a nonlinear power consensus-based control system, with a voltage-limiting component, by means of Lyapunov analysis and ultimate boundedness theory. Asymptotic closed-loop stability is also established around a set of equilibria. Finally, numerical simulations align with and validate our theoretical findings.

INTRODUCTION

The integration of renewable energy sources and storage systems, that are intrinsically of DC nature, drives the interest forward and maintains the focus on the design, control and operation of DC MG networks [START_REF] Braitor | Advanced hierarchical control and stability analysis of DC microgrids[END_REF]. This is owed mainly to their unparalleled advantages such as higher efficiency and reliability, reduced energy conversion steps, no synchronisation issues, simpler control structure and expandability [START_REF] Zolfaghari | Comprehensive review on the strategies for controlling the interconnection of ac and dc microgrids[END_REF], and the prospect that they could be a future solution in replacing the existing grid to satisfy the local energy demand in remote areas through arrays of distributed generation units (DGUs).

From a standalone small-scale DC microgrid having a simple photovoltaic (PV) array installation, DC MGs can evolve into complex mesh topologies with DGUs that require autonomous control to increase reliability and improve power quality, whilst avoiding centralisation [START_REF] Braitor | Stability analysis of dc microgrids with cpls under novel decentralized primary and distributed secondary control[END_REF]. The current applications are ranging from road, air and maritime transportation, smart industry concepts and data centres, to household and community deployments (see [START_REF] Ahmed | Stability and control aspects of microgrid architectures-a comprehensive review[END_REF]). Moreover, the potential for upscaling has no ceiling.

Given the DC nature of renewable energy generation and with the number of DC end-consumers on the rise, we need to develop a deeper understanding of this class of dynamical networked systems. In this paper, we introduce and investigate a power consensus-based approach with an overvoltage protection for standalone small-scale DC MGs with CPLs, that imposes power sharing among source nodes and ensures output voltage limitation.

Literature review

Consensus, or the state in which all agents in a network agree on a common state-dependent value, of multi-agent systems has been studied at large, in both static and dynamic form; see for instance [START_REF] Tuna | Conditions for synchronizability in arrays of coupled linear systems[END_REF][START_REF] Zhang | Optimal design for synchronization of cooperative systems: State feedback, observer and output feedback[END_REF][START_REF] Bingqiang | Open-loop and closed-loop dα-type iterative learning control for fractional-order linear multi-agent systems with state-delays[END_REF][START_REF] Axelson-Fisk | A graph theoretic approach to ensure a scalable performance measure in multi-agent systems with mimo agents[END_REF]. Implementing a similar policy in DC MG networks seemed a natural choice in attaining power sharing.

In retrospect, numerous research works have explored consensus-based strategies to achieve power sharing in DC networks to avoid the overusage of their sources, with decent results. A distributed control strategy to enforce power sharing in a cluster of DC MGs has been introduced by [START_REF] Moayedi | Distributed tertiary control of dc microgrid clusters[END_REF]. A power consensus algorithm has been developed by [START_REF] De Persis | A power consensus algorithm for dc microgrids[END_REF] for DC microgrids with ZIP loads. Secondary consensus-based approaches to guarantee accurate power sharing have been reported in [START_REF] Tucci | Plug-and-play control and consensus algorithms for current sharing in dc microgrids[END_REF]; [START_REF] Liu | Stability analysis of dc microgrids with constant power load under distributed control methods[END_REF]; [START_REF] Braitor | Stability analysis of dc microgrids with cpls under novel decentralized primary and distributed secondary control[END_REF]. A plethora of research works have aimed to tackle the challenges that consensusbased methods in DC microgrids impose, owed to the interaction between the cyber and physical networks. Moreover, the instabilities introduced into the DC MG systems by constant power loads that could eventually lead to voltage collapse have been also extensively characterised in [START_REF] Simpson-Porco | Voltage collapse in complex power grids[END_REF] and [START_REF] Liu | A comprehensive study on the existence and stability of equilibria of dc-distribution networks with constant power loads[END_REF]. The conditioning at the load side is typically hard to overcome without proper control in place. Above all, achieving power sharing remains a sought-after result as it eliminates the overusage instances of identical sources, and enforces the sources to inject power into the network based on their power ratings. [START_REF] Andreasson | Distributed voltage and current control of multiterminal high-voltage direct current transmission systems[END_REF] proposes a distributed control approach to achieve decent voltage regulation and power sharing; a tight voltage regulation and accurate power sharing has been attained in the secondary distributed controller proposed by [START_REF] Braitor | Stability analysis of dc microgrids with cpls under novel decentralized primary and distributed secondary control[END_REF]. A passivity-based strategy has been employed in [START_REF] Zonetti | Modeling and control of hvdc transmission systems from theory to practice and back[END_REF] for HVDC systems to reach global asymptotic stability, while in [START_REF] Zonetti | A tool for stability and power-sharing analysis of a generalized class of droop controllers for high-voltage direct-current transmission systems[END_REF] the authors study the feasibility and power sharing under decentralised droop control. Stability and power sharing under decentralised droop control has also been pursued in [START_REF] Su | Stability analysis and stabilization methods of DC microgrid with multiple parallel-connected DC-DC converters loaded by CPLs[END_REF]). An array of other schemes can achieve power sharing, but at the moment, most are lacking formal theoretical analysis.

Droop controllers to ensure power sharing, with an overvoltage protection for both parallel and mesh configurations with CPLs, have been proposed in [START_REF] Braitor | Novel droop control design for overvoltage protection of dc microgrids with a constant power load[END_REF][START_REF] Braitor | Enhanced primary droop controller for meshed dc micro-grids with overvoltage protection[END_REF]. However, when employing droop controllers, power sharing becomes inaccurate particularly in high loading conditions.

Main contributions

The objective of this paper is to develop a novel consensus approach that achieves critical objectives. They can be briefly summarised as follows:

• enforce power injection at each source node based on operator-set ratios; • simultaneously ensure an overvoltage protection regardless of the system parameters, network configuration, or loading conditions; • additionally, the proposed method must stabilise the CPLs negative impedance, well-known to introduce instabilities into the system.

Compared to the power consensus developed in De Persis et al. ( 2018) that can also guarantee the voltages staying within a compact set around an operating point, the proposed method can rigorously prove an inherent overvoltage protection at all times, even during transients. Also, unlike [START_REF] Braitor | Enhanced primary droop controller for meshed dc micro-grids with overvoltage protection[END_REF], the proposed method can achieve accurate power sharing regardless of the load power demand.

Although both use a resistive DC MG network, the present approach considers a different network model.

Paper organisation

The rest of the paper is organised as follows. The remainder of this section briefly revisits necessary notations and relevant preliminaries. Section 2 presents the meshed DC microgrid configuration and dynamics to be subjected to further investigation. In Section 3, the proposed power consensus method with overvoltage protection is developed and analysed. Herein, one provides the methodology to attain both power consensus control and voltage limitation. In Section 4, one investigates the closed-loop stability

i i V i i i V i + - Load Source Line u i Fig. 1. Meshed DC microgrid network featuring load (•)
and source (•) nodes of the overall system. For testing purposes, a standalone small-scale microgrid example is then numerically simulated in Section 5 to prove the concept. Closing remarks and conclusions are drawn in Section 6.

Notation and preliminaries

Notations. Let 0 n be the zero vector of size n. For an ntuple sequence (x 1 , . . . , x n ), let x ∈ R n be the associated vector, and [x] ∈ R n×n the diagonal matrix whose diagonal entries are the elements of vector x. For A and B matrices with the same number of columns, then col

(A B) denotes the matrix [A B] ′ .
Definition 1. (Synchronisation). The network system ẋ = Ax + Bu, with u = Lx is said to achieve asymptotic synchronisation1 if and only if lim t→∞ (x i (t) -x j (t)) = 0, i, j : (ν i , ν j ) ∈ E.

DC MICROGRID MODEL AND CONFIGURATION

The DC microgrid portrayed in Fig. 1 induces an undirected connected graph G = (V, E), with V representing the set of vertices (bus nodes), and E ⊆ V × V the set of edges, representing the resistive interconnection lines in the network. The set of nodes V is divided in two subsets; the sources subset V S , and the loads subset V L , such that V = V S + V L . Then, let the current and voltage vectors be denoted as

i = col (i S i L ) ∈ R |V S +V L | and V = col (V S V L ) ∈ R |V S +V L | , with i S = {i i : i ∈ V S }, i L = {i i : i ∈ V L } and V S = {V i : i ∈ V S }, V L = {V i : i ∈ V L }.
The current-voltage relation will be given by the expression i = Y V , where Y represents the conductance matrix, as follows

i S i L = Y SS Y SL Y LS Y LL V S V L . (1)
Note that the diagonal entries Y SS and Y LL are positive definite matrices since they are principal submatrices of the Laplacian of a connected undirected graph G. Remark 1. As shown previously in [START_REF] Braitor | Enhanced primary droop controller for meshed dc micro-grids with overvoltage protection[END_REF], matrix Y LL , when having CPLs, can be expressed as a sum between a positive semi-definite and a positive-definite matrix. However, the positive-definiteness property of both matrices Y SS and Y LL is more or less obvious. Nonetheless, one can trivially prove this property using Cauchy's interlacing theorem.

Based on this fact, one is allowed to eliminate the load voltages as

V L = Y -1 LL (i L -Y LS V S )
and reduce the network to the source nodes V S with balance equations

i S -Y SL Y -1 LL i L = Y red V S (2)
where

Y red = Y SS -Y SL Y -1
LL Y LS is known as the Kronreduced conductance matrix [START_REF] Dorfler | Kron reduction of graphs with applications to electrical networks[END_REF], and -Y SL Y -1 LL i L is the mapping of the load current injections to the sources.

By applying Kirchhoff's laws for the source nodes in Fig. 1, one can write the voltage dynamics, at each source, as described below

C i dV i dt = -i i + u i , i ∈ V S (3)
where V i and i i represent the capacitor voltage and line current, respectively, while u i is the converter current, also utilised as the control input.

POWER CONSENSUS CONTROL DESIGN

One assumes that all sources V S are controlled as a function of the measured local current i i and network power injections P i , as well as the injected power P j at neighbouring sources that need to be communicated among their respective neighbours.

Objective 1. The proposed power consensus control design must achieve weighted proportional power sharing proportional to operator-set gains m i > 0. That is, given

P i = i i V i , ∀ i ∈ V S
, the first objective is to guarantee that at steady state the following identities hold

m j P j = m i P i , i, j ∈ V S , j ∈ N i . ( 4
)
Objective 2. At the same time, one seeks to enforce an upper limit for the output voltage at each source, i.e.

V i ≤ V max,i , i ∈ V S .
(5) A unified approach that incorporates the weighted power consensus-based control with the voltage limitation is being proposed in this section. In achieving the set dualobjective, that is to guarantee identity (4) and satisfy inequality (5), the control input u i takes the following expression

u i = -g i (V i -σ i ) , i ∈ V S , (6
) where g i is a positive constant, and σ i follows the nonlinear dynamics σi = 1 -

(2σ i -V max,i ) 2 V 2 max,i j∈Ni (m j P j -m i P i ) (7)
with i, j ∈ V S , that incorporates a control state-dependent bounded nonlinear gain and the power consensus. Remark 2. (Physical implementation). The controller deployment is straightforward as it can be implemented at each source node by measuring the local voltage and current injection. The computed power is then shared on the cyber network to the neighbouring source nodes.

To better understand the dynamics in equation ( 7), consider the following proposition.

σ i 0 1 V max V max V max V max 1 2 Fig. 2. Graphical representation of the set W i0
Proposition 1. The set W i0 defined as

W i0 = σ i ∈ R : 1 - (2σ i -V max,i ) 2 V 2 max,i
> 0 is a positive invariant set for any selection of the initial condition of the controller state σ i0 in the set W i0 .

Proof. Consider the following continuously differentiable Lyapunov function candidate

W = σ 2 i 2V 2 max,i , i ∈ V S . (8)
Then by calculating the time derivative, and using the controller expression in (7), one gets

Ẇ = σ i V 2 max,i σi = σ i V 2 max,i 1 - (2σ i -V max,i ) 2 V 2 max,i j∈Ni (m j P j -m i P i )
(9) with i, j ∈ V S . From equation ( 9), one notices that excluding synchronisation (as described in Definition 1) when consensus is reached (i.e. m j P j = m i P i ), or at the origin where σ i = 0, Ẇi becomes zero at the roots of the parabola 1 -

(σi-Vmax,i) 2 V 2 max,i
. This indicates that if the initial condition of the controller state, σ i0 , is selected in the set W i0 then, intuitively from equation ( 9), it becomes clear that Ẇi will eventually become zero as it travels on the described parabola, i.e. Ẇi → 0, ∀t ≥ 0.

That essentially means that σ i will start and remain in the set W io for all t ≥ 0. In other words, the set W i0 is a positive invariant set. Hence, the proof is complete. 2

Therefore, by virtue of the above proof, a sensible choice for the initial condition σ i could be anywhere within 0 < σ i < V max,i . For instance, by considering a typical initial condition of the integral state σ i , i.e. σ i (0) = 1 2 V max,i , then the controller state remains following the equilibria of equation ( 7), within the interval σ i (t) ∈ [0, V max ], for all t ≥ 0. Remark 3. The motivation to keep the control state on well-defined curves stemmed from existing bounded control methods. More details and further insights are found in [START_REF] Konstantopoulos | Bounded integral control of input-to-state practically stable nonlinear systems to guarantee closedloop stability[END_REF]; [START_REF] Konstantopoulos | Enhanced bounded integral control of input-to-state stable nonlinear systems[END_REF]; [START_REF] Konstantopoulos | State-limiting PID controller for a class of nonlinear systems with constant uncertainties[END_REF].

It must be highlighted that the control variable σi becomes zero i) at asymptotic synchronisation where one has j∈Ni (m j P j -m i P i ) = 0 which ensures accurate power consensus among all source nodes, or ii) when σ i = 0 and σ i = V max,i , the latter corresponding to the overvoltage protection as it shall be explained in Proposition 2. Remark 4. (A similar power consensus). With a virtually similar closed-loop system, but a potentially simpler method inspired by [START_REF] Zhao | Distributed control and optimization in dc microgrids[END_REF] and based on a distributed averaging integral control, one has

C i Vi = -i i + p i D i ṗi = i i -p i + j∈Ni K -1 j V j p j -K -1 i V i p i .
with k i,j being positive gains. However, numerical results show that [START_REF] Zhao | Distributed control and optimization in dc microgrids[END_REF] performs similarly to [START_REF] De Persis | A power consensus algorithm for dc microgrids[END_REF], based on tests carried out in the latter. Additionally, [START_REF] De Persis | A power consensus algorithm for dc microgrids[END_REF] guarantees that all voltages stay within a compact set around an operating point. However, the strategy has not incorporated an analytic proof for the overvoltage capability.

The present strategy aims to fill that gap in the following subsection, by formalising a proof.

Overvoltage protection

By replacing the control input u i from ( 6) into the openloop current dynamics (3), one obtains the following closed-loop current dynamics

C i dV i dt = -i i -g i V i + g i σ i , i ∈ V S . (10)
Now, let us define the following proposition that ensures voltage limitation at each source node. Proposition 2. The solution V i (t) of ( 10) with the initial condition V i (0) ≤ V max,i is uniformly ultimately bounded, i.e. |V i (t) | < V max,i , at all future times t ≥ 0.

Proof. Consider the following continuously differentiable Lyaponov function candidate

E i = 1 2 C i V 2 i , i ∈ V S . (11)
The time derivative of

E yields Ėi = C i V i Vi = -i i V i -g i V 2 i + g i σ i V i , i ∈ V S (12) and provided the bounded state σ i ∈ [0, V max,i ] from Proposition 1, one has Ėi ≤ -i i |V i | -g i V 2 i + g i V max,i |V i |, i ∈ V S .
(13) Given the direction of the power-flow, i.e. from source nodes to load nodes, the current i i > 0, which then implies Ėi

≤ -i i |V i |, ∀ |V i | ≥ V max , i ∈ V S . (14)
By virtue of ( 14), the solution V i (t) is uniformly ultimately bounded. Therefore, if initially

|V i (0) | ≤ V max,i , then it holds that |V i (t) | ≤ V max,i , ∀ t > 0, i ∈ V S (15
) due to invariant set property. The proof is complete. 2 Notice that any selection of the positive constants V max,i results in the desired overvoltage protection (15). That is, an upper limit for the source nodes output voltage is ensured regardless of the network configuration or system parameters.

A key feature of the proposed controller is that it slows down near the imposed limits, therefore, it does not suffer from integrator wind-up which may introduce instability into the system. Remark 5. (Nonlinear consensus method). When comparing the present control strategy with related nonlinear consensus algorithms proposed previously in the literature, such as the work of [START_REF] Cortés | Distributed algorithms for reaching consensus on general functions[END_REF], one would firstly notice that the differentiation between sources and loads is ignored, leading to a modified closed-loop system (10). However, similar to others, the developed approach is different in the sense that it uses another layer of weighted averaging introduced by the cyber network, separate from the averaging induced by the physical network.

STABILITY ANALYSIS

In this section, local stability for the closed-loop system (7),( 10) is being studied around the equilibrium point V ie , σ ie . The equilibria of σ i are trivial to observe; there are two equilibrium points at 0 |V S | and V max,i , the latter being of interest as it corresponds to the maximum allowed voltage. Proposition 3. The system (7),( 10) is locally asymptotically stable around the equilibria set pair (V e , σ e ).

Proof. One should proceed by first looking at the corresponding Jacobian matrix J expressed below The standard eigenvalue problem (SEP) for J is Jv = λv, with λ being an eigenvalue and v the corresponding eigenvector. Note that matrix J can be rewritten as a multiplication of symmetric matrices

J = -C -1 (Y SS + g) g 0 |V S | -2 (2σ e -V max ) V -2 max LmP with C = diag{C i }, g = diag{g i }, σ e = diag{σ ie }, m = diag{m i }, P = diag{P i },
J = -C -1 0 |V S | 0 |V S | -2 (2σ e -V max ) (V max ) -2 X1 × Y SS + g 0 |V S | 0 |V S | L X2 I n 0 |V S | 0 |V S | mP Q , (16)
the SEP then becoming

X 1 X 2 Qv = λv. (17)
Given matrix Q > 0, let y = Qv resulting in

X 1 X 2 y = λQ -1 y. ( 18
)
The SEP becomes a generalised eigenvalue problem (GEP). Matrix X 2 is positive semidefinite with kernel spanned by [0 ′ n 1 ′ n ] ′ corresponding to the asymptotic synchronisation (as explained in Definition 1) or the states reaching consensus, while matrix X 1 is positive definite kernel spanned by 2n . Similarly to the proof of (Braitor et al., 2022, Th.2) and(Simpson-Porco et al., 2013, Th.8), by applying the Courant-Fischer Theorem to the eigenvalue problem, for asymptotic synchronisation, all eigenvalues of matrix J are real and negative since Im (L) = 1 ⊥ n , and Im (X 1 ) ∩ ker (X 2 ) = 0 2n , which means that X 2 y is never in the kernel of X 1 . Therefore, it is clear that ker (J) = ker (X 2 ). Since the image of matrix X 1 excludes span

[0 ′ n 1 ′ n ] ′ , it follows that Jy is the null vector if and only if y ∈ span [0 ′ n 1 ′ n ]
′ that essentially corresponds to the asymptotic synchronisation. Thus, matrix J is Hurwitz.

The system is locally asymptotically stable. This completes the proof 2

SIMULATION RESULTS

To test and highlight the capabilities of the proposed control approach on a small-scale MG concept, consider the low-power 7-node meshed DC microgrid concept depicted in Fig. 3, with the parameters specified in Table 1, being simulated for 0.2 s. All network nodes are interconnected with their respective neighbours via a resistive DC network, operating at a nominal voltage of 20 V . Notice that each source node shares information about instantaneous injected power with its respective neighbours via a diffusive-coupling connected communication network, as displayed in Fig. 3.

For the numerical validation of the proof of concept, the main task is to ensure power sharing among the 3 source nodes in a 1 : 2 : 1 ratio, that is at synchronisation one has m 1 P 1 = m 2 P 2 = m 3 P 3 , whilst ensuring that their output voltages remain below their specified limit, i.e. V i ≤ V max,i , ∀ i ∈ {1, 2, 3}. The dynamic response of the system states is displayed in Fig 4 .   Starting at t = 0 s, the sources are feeding the load power demand P L specified in Table 1, and accurately share their injected power in 1 : 2 : 1 manner, having P 1 = 15.35 W , P 2 = 30.7 W , and P 3 = 15.35 W (Fig 4c). Note that the output voltages remain below their maximum set limit V max,i . The proposed approach manages to successfully enforce accurate power sharing among source nodes, with an inherent overvoltage protection.

CONCLUSIONS

A power consensus algorithm with overvoltage protection has been presented in this paper aimed for meshed DC microgrids that include CPLs. Apart from the achievable desired power sharing, by using nonlinear analysis tools, an overvoltage protection can be analytically guaranteed at each source node, independently of the system states or parameters. The closed-loop stability of the DC system has been established around an equilibria set. For the proof of concept, a low-power meshed DC microgrid, with diffusivecoupling cyber network for the source nodes, has been tested to highlight the superiority of the strategy and its theoretical findings.

  while L represents the Laplacian matrix induced by the communication network and 0 |V S | is the zero matrix of suitable dimensions.

Fig. 3 .

 3 Fig. 3. Power (-----) and communication (---) network configurations considered for simulation testing, featuring 3 source (•) and 4 load (•) nodes

Fig. 4 .

 4 Fig. 4. Dynamic response of the system states The load power changes at t = 0.1 s, with the new load power demand vector being P L = [60 72 54 30] W . At node 1, the voltage forces the bound V max,1 = 20.5 V , but it is promptly limited (Fig 4a). The power consensus is kept accurate having P 1 = 87.4 W , P 2 = 174.8 W , and P 3 = 87.4 W as one can observe in (Fig 4c).

Table 1 .

 1 System and control parameters

	System Parameters	Numerical Values
	R 14	0.8 Ω
	R 27	0.3 Ω
	R 37	0.9 Ω
	R 45	0.7 Ω
	R 46	0.4 Ω
	R 56	0.5 Ω
	R 57	0.5 Ω
	g	[20 20 20]
	Vmax	[20.5 21 24] V
	m	[0.42 0.21 0.42]
	C	[250 230 220] µF
	P L	[10 12 9 1] W

Asymptotic synchronisation, as defined above, is the most intuitive case of synchronisation, and it corresponds to consensus among agents x i = x j , j ∈ N i .


Marc Visseaux

Michael Mainil

Michael Terrier

André Mortreux

Pascal Roussel

Thomas Mathivet

Mathias Destarac

Mickael Terrier

Cationic borohydrido-neodymium complex: Synthesis, characterization and its application as efficient pre-catalyst for isoprene polymerisation †

published or not. The documents may come

cis-stereocontrol. 2 Such compounds are generally prepared by the straightforward reaction of an alkylanilinium borate with a lanthanide alkyl, 3 allyl, 4 hydride, 5 amido, 6 or a chlorolanthanide/alkylaluminum intermediate. 7 However, the synthesis and isolation of these lanthanide initiators require 20 hard experimental work-up, owing to their great sensitivity towards moisture and oxygen, together with a relative thermal stability. 8 It is thus of interest to discover more simple precursors and procedures that could be utilized successfully in catalytic combinations, and enabling controlled 25 polymerisations.

We and other groups have demonstrated that the lanthanide trisborohydrides Ln(BH4)3(THF)3, considered as a true alternative to the trichlorides for organometallic syntheses since only recently, 9 could also initiate the polymerisation of a wide range of polar 10 and non polar 11 monomers. In particular, we established that combined with MgR2 co-catalysts, Nd(BH4)3(THF)3 affords the controlled polymerisation of isoprene in a trans-selective manner. 12 In this communication, we report that upon straightforward Ephritikhine and coll. reported a decade ago that the protonation of the monoborohydrido (COT)Nd(BH4)2(THF)2 derivative (COT = C8H8) with HNEt3BPh4 afforded the cationic (COT)Nd(THF)2 + compound. 9a Following this idea, we investigated by 1 H NMR monitoring the reaction of 50 Nd(BH4)3(THF)3 with HNEt3BPh4 in THF-D8. At room temperature, the consumption of the starting material was quite low but traces of released H2 (δ ppm = 4.4 ppm) were an indication of the expected protonation reaction. 13,[START_REF]The preparation of cationic 1 was preliminarily mentioned in M[END_REF] In the presence of one equivalent of [HNMe2Ph][B(C6F5)4] in THF-55 D8, Nd(BH4)3(THF)3 was this time immediately and completely consumed, along with unambiguous formation of H2. The experiment was then conducted at a bulk scale (Scheme 1), and after experimental work-up (see ESI), purple crystals of 1 could be isolated in good yield (68 %). Elemental The cationic moiety adopts a distorted heptahedral arrangement and BH4 ligands both exhibit an η 3 -H3BH terminal bonding mode. The molecular structure of the 75 cationic Nd(BH4)2(THF)5 + is fully comparable to the samarium one found in the recently described bimetallic compound [Sm(BH4)2(THF)5] + [Cp*'Sm(BH4)3] -, which exhibited an ionic structure in the solid state only. 15 The Nd-B (BH4) distances in 1 (average 2.618 Å) are comparable or 80 slightly shorter to those reported for monocyclopentadienyl bisborohydrido neodymium compounds. 9 The ability of 1 to polymerise isoprene was studied in the presence of Al(i-Bu)3, as described for typical polymerisation experiments involving a cationic lanthanide precursor. 16 At 20

85

°C and in the presence of 10 equivalents of Al(i-Bu)3, the monomer conversion was nearly complete (82 % recovered polymer), in only 30 min (entry 1; Table 1). The activity was high and the stereospecificity observed was fairly good (84 % -cis) but the GPC curve, albeit monomodal, was found somewhat broad, characteristic of a rather low initiation process (PDI 2.31). This was attributed to the poor solubility 5 of crystalline 1 in toluene. These observations prompted us to study the polymerisation of isoprene with a catalytic system in which the cationic Nd(BH4)2 + , formed in situ, would not be isolated. Preliminary while the activity remains high, whatever the quantity of toluene added subsequently (entry 3). In diluted conditions (entry 4: monomer/catalyst ratio = 1000, 1 mL toluene) the activity decreases to less than 2 kg/mol.h. Besides, the amount of co-catalyst seems to be directly related to the selectivity: in 35 the presence of 3.5 equiv. Al(i-Bu)3 the cis-rate decreases below 80 % (entry 5). It is however possible to increase the cis-selectivity up to 90 % for low monomer/catalyst ratios, by varying the quantity of borate activator (entries 6, 7); the highest activity (ca. 120 kg PI/mol Nd/h) is observed using 40 1.5 borate per Nd (entry 6). In heptane (entry 8): the system is less active and the cis-selectivity is lowered, in sharp contrast to what is generally observed in hydrocarbon solvents. 17 Raising the temperature allows to improve the monomer conversion, but to the detriment of the selectivity and the 45 control of macromolecular data (entries 9-12). Nevertheless, it is noteworthy that in such conditions, and in the presence of large excesses of co-catalyst, low molecular weight polyisoprene can be obtained, involving probably some transfer between Nd and Al (see further, transfer reactions 50 section). In all cases, the SEC traces show a monomodal character, typical of a single-site catalysis. The PDI values remain in a range typical of a rather controlled process (< 1.9), at temperatures not exceeding 75 °C. Figure 2 shows two typical

55

SEC traces, and one can observe the much narrower molecular weight distribution provided by the ternary catalytic system (right, entry 3) vs. isolated 1 (left, entry 1). As reported in general in the literature for Nd-based catalysts, a high degree of control of macromolecular data (including narrow PDI values), together with full initiation efficiency of the lanthanide metal (i.e. calculated for one 65 growing chain per metal; eff. = 100 x Mn,th/Mn,exp, Mn,th = ([I]/[Nd]) x yield %), is still hard to obtain, particularly in the specific case of isoprene. In our case, the efficiency of this new catalytic system, considering the protonation of one BH4 group per metal, is much higher than previously described: 70 from ca. 52 % (entry 4), to 100 % at 20 °C (entry 3). ¶ ‡

The mastering of transfer reactions in polymerisation catalysis, so called "catalysed chain growth polymerisation", is of interest because it allows the preparation of functionalised polymers and/or oligomers. 18 As far as we 75 know, the very few reports concerning this topic and involving lanthanide catalysts all refer specifically to butadiene. 1,19 In the presence of large excesses of Al co-catalyst at 50 °C (Table 2), we observed that Mn values strongly decrease when the Al(i-Bu)3 amount varies from 30 to 100 equivalents. We assume that a non negligible part of the Al co-catalyst acts as a transfer agent, allowing a number of growing chains per metal up to ca. 10 (eff % = 970, entry 15). Interestingly, the PDI values remain quite narrow (1.5-1.7), indicating a rapid exchange between Al and Nd, but to the detriment of both the selectivity, as already reported with butadiene, 20 and the activity (entry 10, Al/Nd = 50, vs. entry 9, Al/Nd = 10, Table 1). Nevertheless, increasing the 10 temperature to 75 °C allows to enhance the conversion, as well as the transfer process (eff. = 630 %, entry 11, Table 1). Combined with Al(i-Bu)3 this cationic compound polymerises isoprene with a good activity but a more controlled process is obtained when the cation is prepared in situ by using the ternary catalytic system Nd(BH4)3(THF)3/[HNMe2Ph][B(C6F5)4]/Al(i-Bu)3. This strongly supports the formation of the a cationic active species during the in situ polymerisation process. Depending on the experimental conditions, it is possible to reach up to 92 % of cis-selectivity, together with good control of Mn and PDI, and high initiation efficiency of the catalyst. In the presence of 30 large excesses of Al co-catalyst, transfer to aluminum is evidenced, which opens the possibility of regulation of the molecular weight of the polymer, as well as a convenient route to functionalized polymers, without the necessity to expand the quantity of Nd-based initiator. This study clearly confirms the high potential of borohydrido Ln-based catalysts toward polymerisation. Further studies are in due course aimed at the synthesis and application of similar cyclopentadienyl-supported and related complexes via the substitution of the BH4 moiety.

  BH4)2(THF)5][B(C6F5)4], 1, could be isolated and fully characterized, including its X-Ray structure. Combined with Al(i-Bu)3, this compound reveals to be highly active towards 40 the polymerisation of isoprene. The ternary catalytic system

1 THFScheme 1

 11 Scheme 1 Synthesis of complex 1

Fig. 1

 1 Fig. 1 ORTEP drawing of 1 (ellipsoid probability level 30 %). Hydrogen 70

a

  10 µmol Nd/1 mL toluene. b Pre-catalyst 1 (9.6 µmol), 0.05 mL toluene. c (100 µL + 0.4 mL) toluene. d (50 µL + 0.4 mL) toluene. e 5µmol Nd / 0.025 mL toluene. f 0.1 mL toluene. g solvent = heptane 0.5 mL. h Determined by 1 H and13 C NMR. i eff = 100 x Mn,th/Mn,exp, Mn,th = ([I]/[Nd]) x yield % x 68; efficiency factor calculated for one growing chain per metal.As expected, a better control of macromolecular data is observed at 20 °C (monomodal curves, PDI 1.34-1.91). In the 20 presence of 1 equiv. [HNMe2Ph][B(C6F5)4] per Nd, the results are comparable to those obtained from isolated 1. The activity is sensibly lower (184 vs. 350 kg/mol.h) but this result is balanced by a narrower PDI value, indicating that the process is more controlled (entry 2). The isoprene concentration has a strong effect on the course of the polymerisation: when the reaction between the pre-catalyst and the ionic activator is carried out in a minimum of toluene (25 to 100 µl) in a preliminary stage (during ca. 10 min), and for high [I]/[Nd] ratios (3000), the cis-percentage can reach the value of 92 % 30

Fig. 2

 2 Fig. 2 SEC curve of entries 1 (cationic precatalyst 1, left) and 3 (ternary 60

20 and[

 20 HNMe2Ph][B(C6F5)4].

Table 1

 1

	15	Polymerisation of isoprene with Nd(BH4)3(THF)3/[HNMe2Ph][B(C6F5)4]/Al(i-Bu)3
	Entry a Activator	Al(i-Bu)3	[I]/[Nd] T (°C) Time (h) Yield (%)	average	% cis h	% trans; % 3,4 h	Mn,exp	Mw/Mn	Eff. (%) i
		(equiv.)	(equiv.)					activity				(PDI)
								(kg/mol.h)
	1 b	-	10	3125	20	0.5	82	350	84	10; 6	85000	2.31	51
	2 c	1	7	3000	20	0.5	46	184	86	10; 4	121200	1.63	76
	3 d	1	10	3000	20	0.75	25	68	92	3.4; 4.6	55700	1.34	61
	4	1	10	1000	20	24	66	1.9	81	15; 4	47100	1.71	100
	5	1	3.5	1000	20	1.5	84	38	78	18; 4	109400	1.91	52
	6 e	1.5	10	1000	20	0.5	90	122	80	17; 3	62900	1.70	100
	7 f	2	20	1500	20	48	50	1	90	6; 4	56400	1.74	91
	8 g	1	8	3000	20	3.5	30	17.5	76	20; 4	99500	1.62	60
	9	1	10	1000	50	24	78	3.25	76	19; 5	37000	1.87	143
	10	1	50	1000	50	24	29	8	66	29; 5	10200	1.65	196
	11	1	50	1000	75	24	87	2.5	46	51; 4	9500	1.90	630
	12	1	10	1000	90	4	75	12.7	38	58; 4	36700	2.21	140

Table 2

 2 Effect of the [Al]/[Nd] ratio

		entry a Al(i-Bu)3	Yield	Time	% cis Mn,exp Mw/Mn	Eff. (%) c
			(equiv.)	(%)	(h)		(PDI)
		13	30	30	2	78	29800	1.68	200
		14	40	40	6	75	22300	1.74	360
		15	100 b	70	20	67	14400	1.55	970
	15	a 1 Nd(BH4)3(THF)3/1 [HNMe2Ph][B(C6F5)4]/1 mL toluene, [I]/[Nd] = 3000, 50 °C ; b addition of Al co-catalyst in two stages: Nd(BH4)3(THF)3
		+ [HNMe2Ph][B(C6F5)4] + 1 mL toluene + 40 equiv. Al + isoprene + 60
		equiv. Al. In	conclusion,	The	new	borohydrido	ionic
		[Nd(BH4)2(THF)5][B(C6F5)4]	can	be		prepared
		straightforwardly from the simple precursor Nd(BH4)3(THF)3

c Same as in Table

1

.

Nd(BH4)3(THF)3/[HNMe2Ph][B(C6F5)4]/Al(i-Bu)3, prepared in situ without isolation of 1, behaves very similarly but with better control in terms of macromolecular data, together with higher levels of cis-selectivity.

The authors are grateful for financial support from The Région Nord-Pas de Calais (NanoCat ARCIR Project), the "Fonds Européen de Développement Régional" (FEDER), and the CNRS, and wish to thank A. M. Caze for SEC analyses, M. Bria for 11 B NMR and Drs P. Zinck and F. Bonnet for

helpful discussions.

Notes and references

a Unité de Catalyse et de 1.663 gcm -3 for Z = 4. 59711 total reflections, 10233 independent reflections, Rint = 0.0362. final R values = 4.37 %, wR = 4.99 % [I>3.0σ(I)]; R = 6.28 %, wR = 5.32 % for (all reflections). CCDC 660039. ¶ Efficiency of the metal is here expressed as commonly reported in the literature for Nd-based catalysts, even in the presence of Al co-catalyst 65 excess, [1,18,20]


Mohammad Beyrouti
email: mohammad.beyrouti@hds.utc.fr

Ahmed Lounis
email: ahmed.lounis@hds.utc.fr

Benjamin Lussier
email: benjamin.lussier@hds.utc.fr

Abdelmadjid Bouadallah
email: madjid.bouabdallah@hds.utc.fr

Abed Ellatif Samhat
email: samhat@ul.edu.lb

Vulnerability and Threat Assessment Framework for Internet of Things Systems

Keywords: Vulnerability Assessment, Threat Assessment, MITRE Corporation, NVD database, CAPEC Attack Patterns OWASP IoT Weakness Categories CWE C1: Weak, Guessable, or Hard-coded Passwords Insecure Ecosystem Interfaces

published or not. The documents may come   L'archive ouverte pluridisciplinaire

I. INTRODUCTION

The idea behind the Internet of Things (IoT) is to connect everyday objects (e.g., sensors, actuators, control systems, machines, equipment, etc.) to collect, exchange, process, and access data or services over the internet. IoT networks can gather an enormous amount of data which can be used to have a more accurate representation of the current situations and allow the network or its human operators to take better decisions. This may improve the workspace productivity and avoid critical situations, or at least alleviate their consequences by allowing a faster and better-targeted response with lower costs. According to Gartner, there will be 25 billion IoT devices connected by 2025. Another study [?] shows that the growth of the Internet of Things devices should exceed 80 billion devices by 2030. The vast growth of IoT devices has not come without consequences, particularly security challenges. These challenges mainly arise from the ill-designed and incomplete security of wireless sensors and actuators [?]. Many IoT providers do not have the prerequisite cyber-security knowledge and thus their IoT products often come with different weaknesses. The IoT Security Foundation [?] revealed that only 10% from more than 300 IoT companies had policies to disclose vulnerabilities in their products and patch them. Another study by HP revealed that 70% of the IoT devices connected to the Internet are vulnerable to numerous attacks with an average of 25 vulnerabilities per device [?]. Moreover, considering the combination of technologies used and IoT devices limited resources in terms of memory, energy, computing power, and communication protocols, IoT systems cannot take advantage of the traditional security mechanisms that are used in critical IT systems, thus exposing the system to critical vulnerabilities [?]. For example, the sensor nodes can implement various lightweight wireless communication protocols such as Bluetooth, Zigbee, or SigFox rather than the traditional ones that is supported with high security mechanisms [?]. In addition, the taxonomy of attacks in IoT systems differs from traditional IT, as the definition of 'remote access attack' in IoT could be only a few meters away from the vulnerable device to compromise, that is already inside the local network and beyond the firewall protection [?]. As a result, a wide range of IoT devices presently remain vulnerable to attacks in any IoT system. One way to tackle these challenges is to conduct a cybersecurity risk management analysis to be aware of the weaknesses severity and threats of one's IoT network. Unfortunately, the existing security risk analysis techniques had not initially been designed to be compatible with IoT systems, and their constraints [?]. For instance, [?] conducted an OCTAVE risk assessment method in the context of IoT healthcare systems, which handle modules and scoring metrics originally designed to identify and assess threats in IT, leading to the identification of few threats and vulnerabilities inaccurate assessment. In this paper, we focus on assessing security in IoT networks, as previous works show that the number of IoT vulnerabilities is significant and there is no specific method that comprehensively identifies and assesses the severity of attack exploitation. We propose a novel method for identifying vulnerabilities with the highest risk and possible associated attack patterns in a specific IoT network. The method consists of three steps: the first step identifies significant weaknesses based on CWE and their severity. The second step identifies relevant CVE based on various IoT components and their associated CWE. The third step identifies attack patterns related to the CVE. This method could be used in security risk analysis as most methods require finding vulnerabilities in the system and possible attacks scenario, or in research work to confront new security methods in IoT networks with representative attacks.

The rest of the paper is organized as follows: Section II presents a background on the IoT architectures and security database resources used in our proposed method. Section III presents a state-of-the art of vulnerability databases and research work on IoT security. Section IV presents the design security assessment method that we suggest in IoT to evaluate vulnerabilities and attacks using OWASP1 , NVD2 , MITRE [START_REF] Foundation | Understanding the contemporary use of vulnerability disclosure in consumer internet of things product companies[END_REF] , and CAPEC [START_REF] Hp | Hp fortify[END_REF] . Finally, the paper ends with a case study example in Section V to validate our approach and conclusions with future work perspectives in Section VI.

II. CONCEPTS AND DEFINITIONS

In this section, we provide a background knowledge about concepts of the Internet of Things (IoT) and discuss various databases and standards for identifying and assessing security vulnerabilities and threats. In addition, we discuss different vulnerability and threat assessment approaches used by researchers to analyze security in the IoT domain. Finally, we highlight some weak points in addressing security based vulnerability in IoT and explain the motivation for our work.

A. IoT Architectures:

In general, the architecture of an IoT network is typically divided into three layers depicted in figure 1 : Fig. 1. Three Layers IoT Architecture

• The perception layer consists of physical objects, such as sensors and actuators that collect data and execute commands through the network.

• The network layer, also known as the transition layer, is responsible for transmitting information from the physical components to the information processing systems. We usually achieve communications with the physical objects with technologies, including ZigBee, or Bluetooth, while communications between the information processing systems are usually achieved with other wireless or wire technologies.

• The application layer manages information and provides decisions based on the data obtained from the physical components and the operator commands. Few works outlined more detailed architectures. In [?], a standard IoT ISO architecture used by the SerIoT project contains five layers (the physical layer, the object layer, the communication layer, the application layer, and the user layer).

[?] also discussed a five-layer architecture for IoT applications and services in several applications, such as smart homes, smart health care, smart city, etc. From the bottom to the top, these five layers are the device sensing layer, network management layer, service composition layer, application layer, and user interface layer.

B. Security Threat Taxonomy

The basic security terms are defined as follows [?], [?], [?], NIST5 :

• Vulnerability: the occurrence of one or more weaknesses that a party can use to cause harm on the system. • Security Weakness: faults in the software or hardware that, if not addressed, could possibly result in the system's assets being vulnerable to attacks. • Security Risk: the probability of a threat source's exploiting vulnerability along with the severity impact of the adverse event on the system. • Vulnerability Assessment: the process of identifying vulnerabilities relevant to system's assets followed by an estimation of the severity impact of exploitation. • Threat Assessment: the method that users can develop to identify their potential cyber-security threats and the likelihood in order to overcome and mitigate the possible harmful consequences of these threats.

C. Open Web Application Security Project (OWASP) IoT:

The Open Web Application Project (OWASP) is an online publication that gives insights into the security weaknesses discovered in computing systems. Security experts across the globe have collectively identified these weaknesses after a thorough review of the existing state of affairs. It aims at educating network developers and users about potential vulnerabilities which they should be aware of so that they can take corrective action. In particular, OWASP proposes a top ten list of types of weaknesses in IoT systems. They obtained this list after evaluating reported cyber-attacks based on ease of exploitability, detectability, and the severity of the potential impacts on human safety. The list in Table I shows the Top 10 IoT weaknesses by OWASP 2018 in descending order of criticality. A brief detail for each category could be found on the OWASP website.

D. NIST, CVE and CVSS vulnerability scoring

The American National Vulnerability Database (NVD) is a database of vulnerabilities maintained by the National Institute of Standards and Technology (NIST). The database, referred to as the CVE (Common Vulnerability Exposure), identifies software vulnerabilities on any computer systems according to standardized codes. Every individual CVE acquires a timestamp of the date of publication of the vulnerability and a unique sequential number separated by hyphens, e.g., CVE-2022-26891. Furthermore, the Common Vulnerability Scoring System (CVSS) is used as part of the NVD initiative to rate vulnerabilities. The CVSS ranges from 1 to 10 and reflects mainly the severity impact of exploiting a CVE vulnerability on the confidentiality, integrity, and availability attributes, the attack vector, and the attack complexity of exploiting a vulnerability. However, the CVSS score was originally designed to rate vulnerabilities in traditional systems, and it is not worth using it to assess CVE IoT vulnerabilities [?]. Additionally, the CVE details the vendors and products on which it was found. The CVE is a trusted source in the community and numerous other vulnerability databases depend on it.

E. MITRE, CWE, and CWSS Weakness Scoring System

The Common Weakness Enumeration (CWE) is a community-developed list of well known software and hardware weakness types managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) and operated by the MITRE Corporation. This list provides a baseline for the identification and classification of cyber weaknesses through well-defined codes and detailed lists for a universal type of weaknesses that concern the Information Technology (IT), Operational Technology (OT), and IoT systems. The CWE catalogs 1000 sorted entries that are identified using an ID number, e.g.: CWE-20. Each entry shares a piece of related information in a tree structure. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight into similar weaknesses that may exist at higher and lower levels of abstraction. In addition, PeerOf and CanBeAlso relationships are defined to show similar weaknesses that share common characteristics. There exists another relationship, defined as chains and composites. It illustrates how CWE weaknesses can be combined to involuntarily contribute to a vulnerability. The CanFollow and CanPrecede relationships are used in chains to identify whether the weakness is primary or resultant. A Composite is a mix of several weaknesses that can create a vulnerability, but only if they all occur at once. In composite relationships, a Require is used by a composite to identify its component weaknesses, and IsRequiredBy relationship is used by the components of that composite. The NVD team performs manual study analyses on CVE description entries to pinpoint the type and cause of a vulnerability and to categorize the CVE under a specific existing CWE weakness. In a similar manner to CVSS, the Common Weakness Scoring System (CWSS) provides a mechanism for assessing the severity impact of CWE weaknesses. It ranges from 1 to 100 and demonstrates the technical impact, and the likelihood of exploiting the CWE weakness.

F. Common Attack Pattern Enumeration and Classification (CAPEC)

The Common Attack Pattern Enumeration and Classification (CAPEC) was established by the U.S. Department of Homeland Security to provide a publicly available catalog of common attack patterns that would help users to understand how attackers exploit weaknesses in systems and other cyberenabled capabilities. Each attack pattern is assigned a number e.g.: CAPEC-34 and stores how specific parts of an attack are designed and executed, the attack steps that are taken to exploit a weakness, the likelihood, the typical severity impact, and the relationships with the CWE weaknesses. Additionally, it gives guidance on ways to mitigate the attack's effectiveness. CAPEC helps those developing applications, or administrating cyber-enabled capabilities, to better understand the elements of an attack and how to prevent them from succeeding. In addition, CAPEC attack patterns with their descriptions and characterizing context elements are a useful tool for threat assessment to be used in security analysis to build secure mechanisms.

III. RELATED WORKS

This section introduces databases that identify security vulnerabilities and are analogous to NVD, followed by a review of the literature on security assessment methods for IoT security.

A. Vulnerability databases

Various databases exist in the literature to describe and quantify vulnerabilities. For instance, the China National Vulnerability Database (CNVD [START_REF] Makhdoom | Anatomy of threats to the internet of things[END_REF] ) is a general vulnerability database similar to CVE and regulated by the Chinese national CERT and they are rated using the CVSS score. The United States Computer Emergency Readiness Team (US-CERT [START_REF] Ur-Rehman | Vulnerability modelling for hybrid it systems[END_REF] ) provides also a vulnerability database, which includes references to the corresponding CVE. In addition, the US-CERT released the ICS-CERT8 vulnerability advisories by product vendors related to the IoT industrial control systems and medical devices, respectively classified by the ICSA and ICSMA identifiers. Other vulnerability databases exist in the literature, such as Japan's vulnerability notes ipedia vulnerability database (JVNDB [START_REF] Ali | Risk assessment framework of mhealth system vulnerabilities: A multilayer analysis of the patient hub[END_REF] ), China's national vulnerability database of information security (CNNVD [START_REF] Gelenbe | Reference architecture for secure and safe internet of things by the seriot project, seriot project[END_REF] ), and the Chinese industrial internet security emergency response center (CN-ICS-CERT [START_REF] Pal | Security requirements for the internet of things: A systematic approach[END_REF] ). However, the majority of entries of these databases are based on information from the NVD, and use scoring systems based on CVSS. To sum up, in regard to IoT systems and devices, only the CN-ICS-CERT, US-CERT, and CNVD databases are at least partially focused on categorizing IoT vulnerabilities. The other databases do contain vulnerabilities affecting IoT products, but do not allow users to distinguish these vulnerabilities from the others. [?] presented a survey of various security threats and possible vulnerabilities in IoT. This survey is based on known defined threats in IoT architectures from the literature, focusing on the methods of IoT malware threat and DDoS attack strategy. In addition, they provided guidelines for security frameworks and best practices, highlighting the importance of risk and threat assessment, as well as the open security challenges. The aforementioned surveys constitute significant and useful efforts to study and improve the security of IoT systems by providing valuable information and taxonomies. Specifically, great work took place regarding analyzing the threats, vulnerabilities, and security requirements. However, they do not offer a means to rate these threats and vulnerabilities in terms of severity and likelihood of attacks, which is a necessary step in our work to know where to focus efforts to improve the system's security.

B. Research Work on Security in

2) Security assessment in IoT systems: Diaz Lopez et al.

[?] proposed an IoT security solution based on Security Information and Event Management (SIEM) to identify and detect security threats. The authors proposed a vulnerability and threat assessment method through a mapping between security events category, weakness types, and attack surfaces model by OWASP to define security events. In addition, they assigned the possible CAPEC attack patterns to the mapping criteria. Meneghello et al. [?] analyzed in a survey possible security risks and their countermeasures. The analysis explored security vulnerabilities, attacks, and implemented security mechanisms in the most popular IoT communication technologies. However, the authors provided risks without detailing their severity impact and likelihood, which are fundamental in every risk analyses. Grammatikis et al. [?] proposed quantitative and qualitative risk analysis methods to assess threat targeting protocols in the context of IoT. Based on the probability of a threat, its impact on security attributes, and deployed countermeasures, they provide an evaluation of risk level using a fourlayer IoT architecture along with required countermeasures to mitigate the risks. However, the proposed method does not use a vulnerability assessment metric, which may cause the assessment to not be optimal for the considered system. Plenty of security assessment methods such as OCTAVE, PASTA, Trike, CRAMM, COBRA, CORAS, or STRIDE have been designed to identify and assess threats and vulnerabilities [?], [?]. However, most of these methods and tools do not target IoT systems specifically but are designed with scoring systems such as CVSS to assess threats and vulnerabilities in traditional systems. Qu et Chan [?] proposed to modify the base score equations of the CVSS scoring system to assess vulnerabilities in Bluetooth Low Energy (BLE) wireless communications in IoT networks. However, the modified scoring system remains limited to a specific IoT technology. Zahra et Abdelhamid [?] proposed a security risk analysis in IoT based on the EBIOS qualitative risk analysis method. The authors aimed to identify security risks based on the three layers of IoT architecture and provided severity impact and likelihood scoring metrics to evaluate risks. However, the authors neither present a complete adaptation of the EBIOS risk analysis steps nor a basic approach to identify and evaluate risks. In addition, the analysis lacked identification and assessment of weaknesses and vulnerabilities, and the method was originally designed for traditional IT systems [?]. Automatic tools, such as OVAL, are also used to identify and assess risks. For instance, Bronwyn et al. [?] designed an automatic risk assessment framework known as MedDecRisk for medical devices. The model combines the OVAL tool that reports whether a device is vulnerable or not based on assets, the STRIDE model defining threats, CVE/CVSS pairs, CWE, and CAPEC attack patterns to assess risks. However, as the databases provide few details on attacks and vulnerabilities and due to the uncertainty of machine learning algorithms to make decision classifications, automated identification and assessment may have insufficient data to produce all the possible vulnerabilities and attack patterns. In [?], Georgescu et al. proposed a machine learning method based on named entity recognition (NER) to detect vulnerabilities in IoT devices. The proposed model was trained using CVE training set vulnerabilities grouped by a search on keywords relevant to the domain. However, this search turned up certain training inputs that did not match the given IoT category which, according to our analysis, resulted in a precision mistake of more than 20%.

For instance, some CVE (e.g., CVE-2014-9877) are associated to the key term actuator, but in fact focus on vulnerabilities targeting the driver actuators in the Qualcomm components of Nexus Android smart phones rather than on vulnerabilities related to smart actuators in IoT.

As previously discussed, IoT systems face several security challenges that raise specific vulnerabilities. By proposing a vulnerability and threat assessment method to identify the vulnerabilities with the highest risk and possible associated attack patterns for IoT systems, we aim for security risk analyses to better know where to focus on threat mitigation and for researchers to identify representative attacks in order to confront with and validate newly developed security methods in IoT networks.

IV. A NOVEL VULNERABILITY AND THREAT ASSESSMENT METHOD FOR IOT

In this section, we present our method for identifying and assessing the severity of realistic security vulnerabilities with their relevant attack patterns for IoT systems. This method is a novel approach that can be applied to any IoT architecture and uses external databases and severity assessment studies to identify a list of the most severe vulnerabilities and related attack patterns for a specific IoT system. Our method gives the following outputs:

• a list of CWE to be focused on, ranked from the most severe to the less severe for the targeted system, • for each CWE, a list of CVE that could target the system's components, • for each CVE, attack patterns on one or more of the system's components. The inputs of the method are the following:

• the Common Weakness Enumeration (CWE),

• the Common Vulnerability Enumeration (CVE),

• an attack pattern classification (for example CAPEC),

• one or several severity classification of security weaknesses for IoT systems (for example OWASP Top 10 for IoT), • the list of components in the targeted IoT system. Figure 2 represents a detailed block diagram of our proposed security assessment method, which consists of three steps:

• The first step is the CWE classification, which aims to select the particular CWE that are high threats to the targeted system. • The second step uses the identified CWE and references them with the system components to identify and select the most relevant CVE. • The third step uses the identified CVE to select specific attack patterns to the threatened components. We will detail each of these steps in the following section.

A. Step 1: CWE IoT Classification and Assessment

In this first step, we aim to rate CWE depending on their severity on IoT systems. This would allow us to select and focus on the most severe CWE, depending on the time and Fig. 2. IoT Vulnerability Assessment Model resources available for our assessment. To do so, we can use one or more classification studies from the literature, for example, OWASP Top 10 IoT, the top CWE based on frequency of CVE, and the dangerous weaknesses defined by MITRE. This step takes as an input the CWE and external studies classifying the severity of attacks on IoT networks. The output of this step is the list of CWE weaknesses that we will focus on. The complete information on each CWE can be found on the MITRE corporation website. In the following subsections, we present severity classification studies that can be used in this first step.

1) Top 10 CWE Based on OWASP Top 10 IoT Weakness Categories: The known categories of IoT weaknesses are well documented and evaluated in the OWASP Top 10 IoT 2018. The categories of OWASP are dedicated to the IoT context, and it serves as a useful tool for assessing CWE entries for such systems. In addition, OWASP currently working on a project called OWASP CWE Toolkit for automatic mapping between CWE to OWASP categories. In the meantime, we proposed to map manually the CWE weaknesses with the OWASP top 10 IoT categories, to provide a comprehensive and useful list of OWASP weaknesses. Table II shows the results of this manual mapping.

2) Top CWE based on the relevant frequency of CVE in IoT devices: Various research works conducted statistical studies on CWE weaknesses in the domain of IoT to classify them based on repeating frequency in IoT devices. We present in the following the top CWE entries by frequency of CVE using different study analyses from the literature. For all the following works, we investigated from the literature, possible approaches to identify and assess the CWE weaknesses based on the frequency of detectability in the IoT context: 3) Recent 2022 Dangerous Software and Hardware CWE by MITRE Corporation: The MITRE corporation released a list of the 25 top dangerous Software CWE weaknesses in IT systems. The list was created based on a scoring system that combines the frequency of CVE per CWE, the Known Exploited Vulnerabilities (KEV [START_REF] Kandasamy | Iot cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process[END_REF] ) count (CVE), and the average CVSS score related to each CWE. In addition, MITRE established an unranked list of the most important hardware weaknesses. They derived the list from many significant factors, mainly including the frequency of occurrence of the weakness. The tables of weakness can be found on the website of MITRE corporation. For instance, we can find in the list of software weaknesses the CWE-798 (Use of Hard-coded Credentials) as entry 15 from the Top 25 most dangerous software weaknesses. Note, however, that the OWASP Top 10 IoT analyzed this type of weakness as in the top 1 category. This confirms that the assessment analysis of traditional IT systems (including CVSS) is not adequate to assess vulnerabilities in IoT systems and need further analysis.

4) Top CWE based on Multi-Assessment Classifications:

There is no obligation to specifically use one of the previously presented classifications in our first step, one can use another classification, develop his own, or even combine several classifications to pinpoint the aspects according to the targeted system. For instance, if the target IoT system encompasses smart home applications, the IoT user can choose the OWASP top 10 classifications along with the top 4 CWE weaknesses targeting the smart home appliances to optimize their choice.

B. Step 2: CVE IoT Classification

In this subsection, we detail the second step of our method, which is based on a spread list [START_REF] Malamas | Risk assessment methodologies for the internet of medical things: A survey and comparative appraisal[END_REF] of CVE IoT vulnerabilities and their related CWE and target components. This step takes as input the selected CWE from step 1, our CVE spread list, and the target system's components. Its resulting output is the list of targeted IoT CVE vulnerabilities. The definition of each CVE can be found on the NVD database website. To produce this cross-referencing spreadsheet, we investigated more than 300 CVE concerning the Internet of Things vulnerabilities on devices from different vendors from the NVD database. These CVE cover the following hardware and software categories: sensors, actuators, gateways, printers, IP cameras, smart hub controllers, medical devices, IoT technologies and protocols, smart wearable devices, smart vehicles, and smartphones. For each CVE within a component category, we map its corresponding CWE. This approach will help the IoT users to identify the specific types of CVE vulnerabilities that they want to study and address in their system, depending on the CWE identified in the previous step and on the components in the targeted IoT system. Table IV This subsection presents the third step of our threat assessment method, aiming to identify the attack patterns by exploiting CVE vulnerabilities. It takes as input the identified CWE from step 1, identified CVE from step 2, and a list of attack patterns from a defined resource, such as CAPEC. It gives as output for each CVE possible IoT attack pattern targeting the system's components. As previously stated, the Common Attack Patterns Enumeration and Classification (CAPEC) is a reliable and useful attack threat assessment method for this step. It identifies techniques of how an attacker can exploit a vulnerability present in the system along with the likelihood and mitigation strategies of these threats. Once the CWE and the related CVE are identified, the CAPEC attack patterns can give a different kinds of attacks stressing and affecting the security requirements of the system. A further advantage of this approach is that the CAPEC attacks are directly mapped to CWE, which provides a way to link the common attack schemes to the set of selected CVE vulnerabilities. However, one can use other alternate attack patterns lists for this step. For instance, OWASP provided a list of attack surfaces so that manufacturers, developers, security researchers, and user who wants to install or utilize IoT technology may be aware of how an attacker can take advantage of possible attack surfaces to exploit vulnerabilities.

V. CASE STUDY OF OUR METHOD: IOT SMART HEALTHCARE APPLICATION

In this section, we present brief validation example of our system on a real IoT healthcare system [?]. We consider the implementation of a low-range wireless communication technology on a set of Body Sensor Networks (BSN) communicating with the IoT gateway device in the perception layer. To accomplish the first step, and to cover a comprehensive list of weaknesses in our system, we conduct two approaches targeting software weaknesses, which represent a majority concerning their number and criticality. We include the Top 10 IoT Weaknesses as defined by OWASP, which reflect the Top critical impact weaknesses on security and safety as defined in Table II as an input in addition to the Top 5 CWE weaknesses relevant to the medical devices. Table III classifies the top 5 CWE weaknesses in the domain of smart healthcare as analyzed by [?]. From these two studies, we identified as targets the CWE that are underlined in Table II.

In the second step, we give a classification (see tables) of CVE that targets the BSN nodes and the low-range wireless communication technologies to connect the sensor nodes to the IoT gateway. This step cross-references the chosen CWE from step 1 and the categories of the target system components on the CWE/CVE IoT spreadsheet. Table IV presents the resulting identified CVE.

In the third step, we trace the attack patterns relevant to the identified CVE. Based on the CAPEC database and the mapping criteria between CWE and CAPEC provided by MITRE, we investigated the possible attacks that could use the identified CVE vulnerabilities in wireless sensor nodes and

VI. CONCLUSION AND FUTURE WORK

In this paper, we proposed a vulnerability and threat assessment method that can be used to identify possible attacks by analyzing and rating important IoT vulnerabilities and threats. The method consists of three steps, the first of which identify significant weaknesses based on CWE. The second step identify relevant CVE through a thorough classification of real CVE vulnerabilities that have been identified in various IoT components and their associated CWE to help focus on vulnerabilities specific to the targeted system. The third step identifies attack patterns that exploit the identified CVE. We applied our proposed method to some components of an IoT healthcare system. This method acts as a helpful and flexible tool to be used in risk analyses to identify and assess security risks in IoT systems, or in research work to find realistic attacks to confront with or validate new security components or processes. For future perspectives, we expect to conduct a vulnerability and threat assessment on a complete IoT case study based on our approach to establish threat scenarios. We also aim to improve on taking into account the relationships between weaknesses and attack patterns to propose more elaborate and complex attacks. Finally, we intend to propose alternatives to select significant CAPEC from CVE that would require less work from the security experts.

IoT 1 )

 1 Security surveys in IoT: In the literature, various research works discussed the security vulnerabilities and threats in IoT systems. For instance, Mosenia et Jha [?] provided a survey of a comprehensive list of threats, vulnerabilities, and possible countermeasures that target the edge layer (perception layer) of IoT architecture. They summarized this list based on discussing and summarizing various IoT model architectures, the potential motivation of attackers in addition to the possible attacks and threats in the edge layer, and the possible countermeasures to overcome these threats.Alaba et al. [?] presented a survey about security threats, attacks, and vulnerabilities in IoT, where they focused on the study criteria for discussing the taxonomies of security threats in terms of security in domain applications, IoT architectures, and communication. In addition, they provided possible challenges to existing solutions and security remediation techniques to improve IoT security.Samaila et al. [?] examined in a survey the security in nine domain applications of IoT. The authors illustrated the system models, including components, protocols, and technologies suggested in the literature for the nine applications. They analyzed the security in each domain based on defining the security requirements and threat models proposed per domain. In addition, they discussed the existing security mechanisms and other security solutions.Makhdoom et al.

•

  Top 6 CWE vulnerabilities the mostly exploited by IoT malwares: The authors in [?], identify the top 6 CWE weaknesses, the one that is frequently exploited by IoT malicious malware codes. • Top 10 CWE weaknesses in most consumed IoT components: In [?], the authors summarize the classification of the top 10 CWE by CVE frequency of detectability in different IoT devices, including routers, modems, gateways, IP cameras, and printers. • Top 3 CWE which occurred most often in IoT Operating Systems (IoT OS): In [?], the authors outlines the Top 3 common weaknesses in IoT operating system source code. • Top 4 CWE which occurred most often in smart home applications: The authors in [?], outline the Top 4 weaknesses that target the most commonly smart home IoT products such as wearables, IP cameras, routers, smart TV, smart controller hubs etc.

  presents an excerpt of the CVE spread list that targets the Medical Sensor Nodes and Low-range Wireless Communication Technologies.

	C. Step 3: Tracing Attack Patterns From Selected CVE

  -range wireless communication technologies. However, the mapping process between CVE and CAPEC still requires significant work to be done as the number of CVE could be numerous in a system. Table V identifies the resulting possible attacks. The complete information on each CAPEC attack pattern can be found on the CAPEC website.

			TABLE IV
			CVE-IOT SELECTION
		CVE Vulnerability Identification and Assessment
	Device Technology	or	OWASP IoT Category: CWE-IoT	CVE-IoT
			C2: CWE-287	CVE-2020-15486
			C2: CWE-311	CVE-2018-10825
	Medical Sensor Nodes	C3: CWE-78 C3: CWE-319 C1: CWE-798	CVE-2020-27373 CVE-2020-11539 CVE-2018-8870
	Low-range Wireless Communica-tion Technology		C2: CWE-287 C2: CWE-120 C3: CWE-20 C1: CWE-345	CVE-2019-19194, CVE-2020-25183 CVE-2019-19196 CVE-2019-19192, CVE-2015-6244, CVE-2015-8732 CVE-2020-10137
			C6: CWE-311	CVE-2020-9058, CVE-2020-9057
			C2: CWE-285	CVE-2020-9061

low

https://owasp.org/

https://nvd.nist.gov/

https://cwe.mitre.org/

https://capec.mitre.org/

https://www.nist.gov/

http://www.cnvd.org.cn/

https://www.kb.cert.org/vuls/

https://www.cisa.gov/uscert/ics/advisories-by-vendor

https://jvndb.jvn.jp/en/

http://www.cnnvd.org.cn/

https://www.ics-cert.org.cn/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

https://github.com/lounisShield/SRSEMS/blob/main/CVE IoT.pdf

ACKNOWLEDGMENT

This work was funded by the International Research Project Adonis and the French region Hauts-de-France.