domain: info spi

text:
Abdelwahab Boualouache
email: aboualouache@usthb.dz

Sidi-Mohammed Mohammed Senouci
email: sidi-mohammed.senouci@u-bourgogne.fr

Samira Moussaoui
email: smoussaoui@usthb.dz

Towards an Efficient Pseudonym Management and Changing Scheme for Vehicular Ad-Hoc Networks

Keywords: VANETs, Security, Location privacy, Pseudonym Changing, Pseudonym Management

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

On of the keys of a success deployment of Vehicular Ad-Hoc Networks (VANETs) is to consider the location privacy protection of their users [1]. A common approach to avoid this problem is that vehicles use multiple identifiers, called pseudonyms, instead of static identifiers in broadcasting safety messages. Current security standards such as IEEE 1609.2 standard [START_REF] Ieee | Ieee standard for wireless access in vehicular environments security services for applications and management messages[END_REF] and ETSI 102941-v1.1.1 [START_REF] Etsi | [END_REF] are based on a public key infrastructure (PKI), where the pseudonyms represent a set of certified public keys stored in the vehicle's On-Board Unit (OBU). Vehicles can then periodically change their pseudonym to mitigate the tracking of their positions. The frequency of pseudonyms changing is then an important factor in the level of location privacy protection provided by this approach i.e. the higher frequency of pseudonyms changing is, the more level of location privacy protection is provided. However, this frequency should not exceed a certain threshold to do not affect the communication performances [START_REF] Schoch | Impact of pseudonym changes on geographic routing in vanets[END_REF]. In addition, the change of pseudonym should be accompanied by the change of the identifiers of all communication protocols stack layers such as the MAC and the IP addresses [START_REF] Papadimitratos | Architecture for secure and private vehicular communications[END_REF]. Although, this approach is adopted by both of the academia and the industry to be applied in the near future of VANETs' deployment, several challenges are still to be addressed [START_REF] Petit | Pseudonym schemes in vehicular networks: A survey[END_REF]. We cite for example that: (i) several works that have been conducted on the pseudonym changing approach efficiency (e.g. [START_REF] Wiedersheim | Privacy in inter-vehicular networks: why simple pseudonym change is not enough[END_REF]) demonstrated that, due to the pseudonym linking attacks, a simple changing of pseudonym is ineffective to provide the required level of location privacy protection for VANETs' users. For this reason, several pseudonym changing strategies have been proposed to provide an efficient pseudonym changing (e.g. [START_REF] Lu | Pseudonym changing at social spots: An effective strategy for location privacy in vanets[END_REF] [9] [START_REF] Ying | Motivation for protecting selfish vehicles' location privacy in vehicular networks[END_REF] [START_REF] Boualouache | S2si: A practical pseudonym changing strategy for location privacy in vanets[END_REF]). However, an effective strategy is still an open problem of the literature [START_REF] Eckhoff | Driving for big data? privacy concerns in vehicular networking[END_REF], (ii) due to their rationality behavior, vehicles refuse to cooperate by changing their pseudonyms simultaneously with other vehicles [START_REF] Freudiger | Non-cooperative location privacy[END_REF], which has a negative impact on the privacy protection level provided by the pseudonym changing approach, and last but not least (iii) the existing solutions to distribute the pseudonyms sets and the certificates (pseudonyms) revocation lists (CRLs) requires that the VANET area should totally be covered by Roadside Units (RSUs), which generates a high deployment costs and is hard to be achieved, especially in the first phase of the VANETs' deployment [START_REF] Ma | Pseudonym-on-demand: a new pseudonym refill strategy for vehicular communications[END_REF].

To address these issues and in contrast to the existing works that only focus on one (e.g. [START_REF] Lu | Pseudonym changing at social spots: An effective strategy for location privacy in vanets[END_REF] [13] [START_REF] Yan | Towards providing scalable and robust privacy in vehicular networks[END_REF]) or some issues (e.g. [START_REF] Artail | A pseudonym management system to achieve anonymity in vehicular ad hoc networks[END_REF][10]) of the pseudonym changing approach, this paper proposes a complete and efficient pseudonym changing and management scheme. This scheme is mainly based on the Vehicular Location Privacy Zone (VLPZ). We define the VLPZ as a roadside infrastructure designed not only for the changing of pseudonyms [START_REF] Boualouache | Vlpz: The vehicular location privacy zone[END_REF] but also for the management of them. VLPZ can easily be implemented in the existing roadside infrastructures such as gas stations, electric vehicles charging stations and toll booths or new independent roadside infrastructures deployed for VANETs. The proposed scheme supports a synchronized changing of all identifiers of the communication stack layers and the usercentric location privacy model. In addition, to well manage the pseudonyms, the proposed scheme considers that the vehicular geographic area is partitioned as a grid, where each cell contains one or many VLPZs. The location privacy protection depends on the capacity of the VLPZ and the number of vehicles that exist inside it at the same time. For this reason, we also propose a reputation mechanism to stimulate vehicles to enter to the VLPZ, and finally, evaluate the performance of the proposed scheme using Veins Framework that is based on OMNet++ simulator and SUMO mobility engine.

The remainder of this paper is organized as follows. Section 2 describes some related work. The proposed pseudonym changing and managing scheme is presented in Section 3. Section 4 describes the reputation mechanism that is used to stimulate vehicles to enter to the VLPZ. The performance evaluation results are presented in Section 5. Finally, the conclusion is given in Section 6.

II. RELATED WORK

Several conducted studies have been demonstrated that a simple pseudonym changing is inefficient to provide the required privacy protection [START_REF] Wiedersheim | Privacy in inter-vehicular networks: why simple pseudonym change is not enough[END_REF]. This is due to the pseudonyms linking attacks that can be classified into two categories [START_REF] Boualouache | Vlpz: The vehicular location privacy zone[END_REF]: (i) the syntactic linking of pseudonyms: this attack can be performed if there is no synchronization in changing the pseudonyms between vehicles. Indeed, if the target is the only vehicle that changes its pseudonym among the vehicles that are running on the road at time t, the adversary can easily link the old and the new pseudonyms used by the vehicle, (ii) the semantic linking of pseudonyms: this attack can be performed even if the vehicles change their pseudonyms simultaneously. Indeed, by exploiting the information included in safety messages and using some advanced tracking algorithms, the adversary can easily link the vehicle's pseudonyms. To prevent such attacks, several pseudonym changing strategies have been proposed, which can be sorted in terms of their efficiency to prevent the pseudonyms linking attacks into three categories: (i) strategies that rely only on a mechanism to synchronize the changing of pseudonym processes between vehicles (e.g. [8][9]). These strategies showed their weaknesses against a passive adversary that uses the contents of the safety messages to link the pseudonyms using the semantic linking attack, (ii) strategies that propose to encrypt the safety messages for some periods of time (e.g. [START_REF] Ying | Motivation for protecting selfish vehicles' location privacy in vehicular networks[END_REF]). These strategies are also broken since it may exist some internal passive adversaries that have the decryption keys. Hence, the contents of the safety messages are disclosed to these adversaries, which can also provide a clue to the external global passive adversary to perform the semantic linking of pseudonyms. In addition, decrypting these messages adds a processing latency, which may not meet with real-time requirements of safety-related applications [START_REF] Studer | Flexible, extensible, and efficient vanet authentication[END_REF], and finally (iii) strategies that use the radio silence technique (e.g. [START_REF] Boualouache | S2si: A practical pseudonym changing strategy for location privacy in vanets[END_REF] ). The strategies of this category are more effective than the previous ones since they can provide the protection against both external and internal passive adversaries. However, using the radio silence technique in VANETs is challenging since safety-related applications may get affected due of this [START_REF] Lefevre | Impact of v2x privacy strategies on intersection collision avoidance systems[END_REF].

Besides of this, the cooperation of vehicles is a key factor in a successful pseudonym changing strategy. Rational vehicles tend to do not change their pseudonyms if they achieved their desired location privacy levels. This is due to the cost generated by pseudonym changing like the impact on geographic routing protocols [START_REF] Schoch | Impact of pseudonym changes on geographic routing in vanets[END_REF]. [START_REF] Freudiger | Non-cooperative location privacy[END_REF] proposed a gametheoretic based solution to change the pseudonym in a noncooperative environment. The authors developed a usercentric privacy model, where vehicles change their pseudonyms if their payoffs will be maximized after pseudonyms changing. However, this solution motivates vehicles to not change their pseudonyms if they have achieved their desired location privacy levels, which has negative consequences on vehicles that do not have achieved their desired location privacy levels yet. In [START_REF] Ying | Motivation for protecting selfish vehicles' location privacy in vehicular networks[END_REF], the authors proposed DMPL (Dynamic Mix-Zone for Location Privacy) to dynamically create mix-zones: if a vehicle wants to create a mix zone, it sends a request to a strategy control server (CS); after receiving the request from the vehicle, the CS determines the length of the vehicle's DMPL area and sends a command to all vehicles found in this area in order cooperate in creating vehicle's DMPL. The authors also proposed a mechanism to stimulate rational vehicles to cooperate on creating DMPL. However, this strategy is vulnerable to the semantic linking of pseudonyms and has many other drawbacks like the huge generated overhead.

[16] pointed out that the existing solutions have only focused on how to provide an efficient pseudonym changing and ignore the implementation challenges of pseudonyms changing approach. For this purpose, they proposed RSUs-based scheme to generate and distribute pseudonym sets to the vehicles and an exchange of pseudonyms sets between RSUs mechanism to increase the anonymity. However, this scheme strongly depends on RSUs, which generates high deployment costs. In addition, it is still exposed to the semantic linking attack of pseudonyms.

III. PSEUDONYM CHANGING AND MANAGEMENT SCHEME DESIGN

In this section, we present the design of the proposed scheme. This section is structured as follows. We first describe the considered adversary model. We then present the system model, the VLPZ model, and the VLPZ-based pseudonym changing strategy. After that, we present the VLPZ-based pseudonyms sets and revocation lists distribution. Finally, we describe the used privacy evolution model and the mechanism of generating the communication layers identifiers from the pseudonym.

A. Adversary Model

In this paper, we are interested to study the location privacy protection against a strong passive adversary model. This adversary is composed of an external global passive adversary and few internal local passive attackers. It aims to track the target vehicle by eavesdropping all communications of any vehicle within a region of interest. The adversary model is well aware of the system model and the proposed scheme design. However, it has no control on the VLPZ. In addition, this adversary is not able to perform tracking using cameras, because the cost of the global eavesdropping with cameras is much higher than the radiobased eavesdropping. Therefore, camera-based global eavesdropping is beyond the scope of this paper.

B. System Model and assumptions

As illustrated in Figure 1, to facilitate the management of pseudonyms and CRLs, we consider that the vehicular geographic area is partitioned as a grid. The cells of the grid have a same predefined size. Each cell may comprise the entire downtown area of a small town or few city blocks. The VANET system is composed of vehicles and Road-Side Units (RSUs). Each vehicle has an OBU device that is equipped with a wireless technology based on the IEEE 802.11p/WAVE standard. The OBU allows the vehicle not only to communicate with other vehicles but also with RSUs. Each vehicle is also equipped with a map and a GPS receiver that allows obtaining the position and the current time. Each vehicle periodically broadcasts a safety message every t milliseconds, where each message includes information about the vehicle such as its position and its speed. We also assume the existence of a central trusted authority (TA) that provides public and private keys to vehicles and RSUs. Before joining the VANET, each vehicle registers with the TA with its vehicle identifier, denoted by IDv . During the registration, each vehicle Vi is equipped with a public and a private keys and sets of pseudonyms. Each set contains n pseudonyms K i,j , where j ∈ 1,..., n. For each pseudonym K i,j of vehicle Vi , the TA provides a certificate Cert i,j (K i,j ). The private key K corresponding to the pseudonym K i,j is used by the vehicle Vi to digitally sign messages. The pseudonym is attached to each message to enable other vehicles and RSUs to verify the sender's authenticity. Each vehicle changes its pseudonym each δ minutes. Each cell contains one trusted authority (TA R ), and one or more Vehicular Privacy Zones (VLPZs). TA R s act as intermediates between the TA and the VLPZs. They aim to manage the pseudonyms sets and the CRLs distribution and control the location privacy protection level provided the VLPZs within the cells. Indeed, all the TA R s are connected to the TA, and each TA R regional is contacted to the VLPZs within its cell via secure communication links.

C. VLPZ Model

We define the Vehicular Location Privacy Zone (VLPZ) as a roadside infrastructure managed by trusted regional authorities like municipalities or directly by the country transportation department. Each cell of the grid can contain one or more VLPZs. The VLPZ aims not only to increase the location privacy protection level of vehicles within the cell by providing an effective pseudonym changing [START_REF] Boualouache | Vlpz: The vehicular location privacy zone[END_REF], but also to distribute pseudonyms sets and CRLs to them. The design of VLPZ is seemingly similar to the existing roadside infrastructures like gas stations. As illustrated in the Figure 2, a basic VLPZ consists of one entry point called the router, one exit point called the aggregator and a limited number of lanes l where l > 1. Each VLPZ is equipped by an RSU denoted by RSUvz and used to: (i) periodically announce the existence of a VLPZ, (ii) stimulate vehicles passing through the VLPZ to enter, (iii) request pseudonyms sets from the TA R and distribute them to the vehicles inside the VLPZ according to their requests, (iv) request the CRLs from the TA R and distribute them to the vehicles inside the VPLZ, and finally (v) get information from vehicles, which helps the VLPZ to take certain decisions. The VLPZ can easily be implemented in the existing roadside infrastructures such as gas stations and toll booths. However, due to the increasing interest of users to protect their location privacy, we do not rule out that the VLPZ can be created as an independent roadside infrastructure in the future VANETs deployment. VLPZs emplacements should be shown on the map to help vehicles to enter them, when it is needed.

D. VLPZ-based Pseudonym Changing Strategy

The strategy of pseudonym changing is executed as follows [START_REF] Boualouache | Vlpz: The vehicular location privacy zone[END_REF].

The RSU vz periodically broadcasts notifications to inform the vehicles that are passing through a VLPZ its existence. If a vehicle wants to access to the VLPZ, it sends a request to the RSU vz . As Figure 2 shows vehicles arrive to a VLPZ, one after another, on a one-lane. They keep broadcasting safety messages until they enter the VLPZ. When a vehicle reaches the router, it stops broadcasting safety messages and heads for an assigned VLPZ's lane. The assigned lane is randomly and privately selected by the router. The vehicle can then reside inside a VLPZ for a random period of time. This period mainly depends on the service time. For example, if we assume that a VLPZ is implemented in a gas station, the service time is the time taken by the driver to fill the fuel tank of its vehicle. A vehicle must change its pseudonym before it exits the VLPZ and all vehicles exit a VLPZ through the aggregator. However, the exit order is different from the entering order since the residency periods of vehicles are random. We also assume that the aggregator can intervene to select a certain order in random and private way. As discussed in [START_REF] Boualouache | Vlpz: The vehicular location privacy zone[END_REF], this strategy provides the protection not only against both of the syntactic and the semantic linking of pseudonyms, but also against the FIFO attacks. In addition, differently from the strategies that rely on the radio silence technique, the road safety is preserved in this strategy.

E. Pseudonyms Sets and Revocation Lists Distribution

In contrast to the existing solutions that rely only on RSUs that are spread over roads to distribute pseudonyms sets (e.g. [START_REF] Artail | A pseudonym management system to achieve anonymity in vehicular ad hoc networks[END_REF]) and pseudonyms revocation lists (CRLs) (e.g. [START_REF] Papadimitratos | Certificate revocation list distribution in vehicular communication systems[END_REF]), we propose in this paper that the distribution of pseudonyms sets and CRLs is performed inside the VLPZ and the RSU vz s are the only roadside units that are used for this purpose. This helps to reduce the number of required RSUs to carry out these operations, which significantly reduces the deployment costs. However, on the one hand, the CRLs should quickly and widely be distributed in order to provide a reasonable revocation time. On the other hand, as the demand of vehicles in terms of pseudonyms is permanent, vehicles should be able to refill pseudonym sets each time they require them. For these reasons, we propose that vehicles: (i) can exchange small CRLs updates through V2V communications. A method like [START_REF] Papadimitratos | Certificate revocation list distribution in vehicular communication systems[END_REF] [START_REF] Boualouache | Hpdm: A hybrid pseudonym distribution method for vehicular ad-hoc networks[END_REF]. In order to request new pseudonyms sets, the vehicle sends a request, which includes its identifier (IDv ), to the RSU vz . This request will immediately be forwarded to the TA R . When a TA R receives such request, it first checks if it has enough number of pseudonym sets to satisfy the demand of the vehicle. If this is the case, TA R sends back the requested pseudonyms sets to the RSU vz . Else, the TA R forwards the request to the TA that will satisfy the demand as soon as it receives the request. In the same the way, the pseudonyms sets will be sent back to TA R and from it to the RSU vz . Finally, the RSU vz sends the requested pseudonyms sets to the vehicle as soon as receives them. All exchanges between vehicles and the RSU vz should be encrypted in order prevent the adversary to get access to these messages. We still mention that the pseudonyms sets are generated by the TA and distributed to the TA R s according to their estimations of the number of required pseudonyms sets in each cell.

can be used for this p u r p o s e , ( i i ) c a n b e i n v o l v e d i n t h e d i s t r i b u t i o n o f pseudonyms sets

F. Privacy Level Evolution

The location privacy level of a vehicle changes over the time. It can decrease due to the pseudonym linking attacks and increase each time that a vehicle enters to a VLPZ. To capture the evolution that occurs to the location privacy level of ma vehicle over time, we adapt the user-centric location privacy model introduced by [START_REF] Freudiger | Non-cooperative location privacy[END_REF]. The location privacy level of a vehicle i is modeled using a location privacy loss function ( , ): (ℝ , ℝ ) → ℝ where t is the current time and ≤ t is the time of the last pseudonym change of vehicle i inside a VLPZ. The privacy loss is set to 0, each time that i changes its pseudonym inside a VLPZ and increases with time according to a sensitivity parameter, 0 < λ < 1 until it reaches a maximum value ( ), which is the location privacy protection level achieved at last pseudonym change of vehicle i inside a VLPZ. The privacy loss function is defined as follows:

Where = ( )
is the time when the function reaches the maximal privacy loss. The location privacy level of vehicle i at time t is : Figure 3 illustrates the evolution of the location privacy level of a vehicle i. Its privacy level (A i (t)) is initially equal to 0 and its desired location privacy level is A d . The vehicle is then looking to enter to a VLPZ each time when its location privacy is below than its desired level. For this reason, it enters to a VLPZ at times t1, t2, and t3. However, at t4, i enters to a VLPZ, although its location privacy level is greater than the desired level. This is because the vehicle enters to cooperate with other vehicles to increase their location privacy levels. This is due the proposed reputation mechanism described in Section 4.

G. Generating The Communication Layers Identifiers

In order to prevent the pseudonyms linking attack, the change of pseudonym should be accompanied by the change of the identifiers of all communication stack layers such as the MAC and the IP addresses [START_REF] Papadimitratos | Architecture for secure and private vehicular communications[END_REF]. In this scheme, we propose that vehicles use the Cryptographically Generated Address (CGA) protocol [START_REF] Aura | Cryptographically generated addresses (CGA)[END_REF] to generate the IP addresses from the pseudonyms and to generate the MAC addresses from the generated IP addresses. As described in [START_REF] Qadir | Cryptographically generated addresses (cgas): A survey and an analysis of performance for use in mobile environment[END_REF], CGA uses a pseudonym (public key) and a random 128bit number to generate the interface identifier, which is concatenated with a subnet prefix to build an IPv6 address. The concept of CGA can also be used to generate a MAC address from the pseudonym. Indeed, [START_REF] Artail | A pseudonym management system to achieve anonymity in vehicular ad hoc networks[END_REF] proposed to generate the hash value of (Random 128-bit number || Subnet prefix || Collision count || Public Key || Extension fields). The collision count and the extension are described in [START_REF] Qadir | Cryptographically generated addresses (cgas): A survey and an analysis of performance for use in mobile environment[END_REF].

IV. MOTIVATING VEHICLES TO ENTER TO THE VLPZ

The location privacy protection level provided by a VLPZ mainly depends on its capacity and its occupancy i.e. the number of vehicles inside it at the same time. The capacity of the VLPZ, denoted by K, is a static parameter that can be set by the system designer. However, the occupancy of the VLPZ, denoted by |AS| t , can be impacted by several parameters. First, the number of vehicles that request to enter to the VLPZ definitively depends on the road traffic density i.e. more vehicles exist on the road, more vehicles enter to the VLPZ. In addition, in this paper, we assume that vehicles are rational. In other words, they look to ensure their location privacy protection with a minimum possible cost, which represents the cost taken by a vehicle to move to a VLPZ. This cost can be expressed by the time to reach the VLPZ and quantified by the lost of pseudonyms during this time. Therefore, if a vehicle have reached its desired location privacy protection level (Ad ), it will not look to enter a VLPZ again to cooperate with other vehicles to increase their location privacy protection levels, until its privacy protection level goes under A d . For this reason, we assume that the VLPZ uses a reputation system to increase its occupancy. The VLPZ then broadcasts invitation requests to motivate the vehicles to enter to the VLPZ. If a vehicle positively responds to enter to the VLPZ, its reputation value will then increase. However, if a vehicle refuses to enter to the VLPZ, its reputation value will decrease. The increase or the decrease of the reputation value depends on the VLPZ occupancy at tj, where t j is time when the vehicle exits the VLPZ, if the vehicle accepts the j th invitation of the VLPZ or the time when the vehicle receives the invitation, if the vehicle refuses the invitation. The reputation value ℝ of a given vehicle i after j th invitation is then given by following formula.

Where ℝ is the old reputation value of vehicle i. The reputation value of the vehicle increases as much as it cooperates. The accumulated reputation value is then used by the vehicle when it needs to access to the VLPZ. As described in Algorithm 1, when the VLPZ receives a request to access from a vehicle i, it first checks if the reputation value of i is above or equals to a certain threshold, denoted by ω. If this is the case, the VLPZ then accepts i to enter to the VLPZ. Else, the VLPZ checks if i has already refused an invitation from a VLPZ. The reason of this second check is to verify if the vehicle does not have already an opportunity of cooperation. Indeed, the VLPZ can get this information directly from the TA, which is connected to all VLPZs. If the VLPZ finds that i has already refused an invitation from a given VLPZ, i is detected as a selfish and the VLPZ refuses the access to i . Else, the VLPZ accepts the request of i. The vehicle then always tries to keep its reputation value above ω, which stimulates it to cooperate more when it receives an invitation from the VLPZ. We mention that if the VLPZ is implemented at an existing roadside infrastructure like a gas station, refusing access to the VLPZ means that the vehicle will enter to the infrastructure and will not execute the VLPZ-based strategy and request new pseudonyms sets. We also mention that during the registration, the TA gives to each vehicle a reputation value above to ω, which allows the vehicle to enter to the VLPZ at the beginning. In addition, each time that the vehicle exits a VLPZ, its reputation value will be set to 0.

V. PERFORMANCE EVALUATION

In order to evaluate the performances of the proposed scheme, we performed a set of simulations. These simulations are conducted using Veins Simulation Framework [START_REF] Sommer | Bidirectionally coupled network and road traffic simulation for improved ivc analysis[END_REF]. Veins is an inter-vehicular communication simulation framework based on OMNet++ bi-directionally coupled with SUMO road traffic simulation [START_REF] Krajzewicz | Recent development and applications of sumo -simulation of urban mobility[END_REF]. OMNet++ and SUMO run in parallel and communicate via a TCP socket. The reason of choosing Veins is its ability to simulation full 802.11p and IEEE 1609.4 DSRC/WAVE network layers. Table I summarizes the parameters considered in our simulations. The considered scenario represents a simple road course that has a rectangle shape of dimensions 3km x 1.5km. We have installed a VLPZ on one side of this road course. The vehicles were generated using SUMO to take repeated turns of 30 min duration on this road course. The privacy level values and the reputation values of vehicles are initialized according to a normal distribution N (µ,σ) with a mean equal to µ = 5 and with a standard deviation equals to σ = 5/3. In addition, as shown in Table I, the desired levels of all vehicles and their sensitivity parameters are assumed equals. In our evaluation, we run simulation several times with different random seeds and calculate the average value with 95% confidence interval. Figure 4 illustrates of the evolution of the location privacy protection levels of vehicles over time both when using the baseline version of the scheme and when using the scheme with the reputation mechanism. We can see in the Figure 4(a) that using the baseline version, the average of privacy protection levels still stable over time and more that 30% of vehicles still have privacy protection levels under the desired level (Ad ) over time. However, as illustrated Figure 4(b), when the reputation mechanism is used, the average privacy protection levels gradually increase and at time 30 min, only 2% of vehicles still have privacy protection levels under the desired location privacy level (A d ), which demonstrates the efficiency of the proposed reputation mechanism. In Figures 5 and6, we evaluate the location privacy protection level provided by the VLPZ over time. In our evaluation, we use two well-known privacy metrics: the size of the anonymity set and the degree of anonymity. The anonymity set (AS) defined as the set of vehicles that are indistinguishable from the target with the set including the target itself. At a VLPZ, the anonymity set actually includes the target and all vehicles inside a VLPZ. The size of the anonymity set is then the number of vehicles that the anonymity set includes. The capacity of the VLPZ (K) is the maximum value of the anonymity set size that could be taken by a vehicle when it enters to a VLPZ. The degree of anonymity is the normalized value of the level of privacy protection level achieved compared to the maximum privacy protection level that can be achieved [START_REF] Díaz | Anonymity metrics revisited[END_REF]. The anonymity degree (d) is given by the following formula: Figure 5 compares the frequency of the anonymity set size over the simulation period between baseline scheme and the scheme using the reputation mechanism (ω = K/2). It shows that the number of times that the anonymity set size achieves high values increase when the reputation mechanism is used, which has a positive impact on the Fig. 6. The degree of anonymity over time.

degree of the anonymity provided by the VLPZ. Indeed, Figure 6 compares between the degree of anonymity of baseline scheme and the scheme using the reputation mechanism, where ω takes the following values respectively: K/4, K/2. The Figure shows that comparing to baseline scheme, the mean of the degree of anonymity increases for more than 0.1 using the reputation mechanism. In addition, the mean of the degree of anonymity slightly increases using the threshold reputation value ω equals to K/2 of k/4.

VI. CONCLUSION

In this paper, we proposed a complete and efficient pseudonym changing and managing scheme for vehicular adhoc networks. This scheme is mainly based on the VLPZ, which is a roadside infrastructure designed for the changing and the management of pseudonyms and can easily be implemented in the existing roadside infrastructures. We also proposed a reputation mechanism to simulate vehicles to enter to the VLPZs. As a future works, we will develop the communication protocols that will be used in this scheme, and propose a stochastic model to predict the optimal number of VLPZs required in a given cell over time. In addition, we will carry out a simulation study using a real map with real traffic mobility measurements.

Fig. 1 .

 1 Fig. 1. An example of the proposed system model.

Fig. 2 .

 2 Fig. 2. The VLPZ basic model

Fig. 3 .

 3 Fig. 3. Evolution of the location privacy level of a vehicle i over time.

Fig. 4 .

 4 Fig. 4. The evaluation of the location privacy level of vehicles over time.

Fig. 5 .

 5 Fig. 5. The anonymity set size frequency over time.


Hichem Sedjelmaci

Sidi Mohammed Senouci

Mohamad Al-Bahri
email: mohamad.al-bahri@u-bourgogne.fr

A Lightweight Anomaly Detection Technique for Low-Resource IoT Devices: A Game-Theoretic Methodology

Keywords: Anomaly detection, Low-resources devices, Game theory, Nash equilibrium

In the Internet of Things (IoT), resources' constrained tiny sensors and devices could be connected to unreliable and untrusted networks. Nevertheless, securing IoT technology is mandatory, due to the relevant data handled by these devices. Intrusion Detection System (IDS) is the most efficient technique to detect the attackers with a high accuracy when cryptography is broken. This is achieved by combining the advantages of anomaly and signature detection, which are high detection and low false positive rates, respectively. To achieve a high detection rate, the anomaly detection technique relies on a learning algorithm to model the normal behavior of a node and when a new attack pattern (often known as signature) is detected, it will be modeled with a set of rules. This latter is used by the signature detection technique for attack confirmation. However, the activation of anomaly detection for low-resource IoT devices could generate a high-energy consumption, specifically when this technique is activated all the time. Using game theory and with the help of Nash equilibrium, anomaly detection is activated only when a new attack's signature is expected to occur. This will make a balance between accuracy detection and energy consumption. Simulation results show that the proposed anomaly detection approach requires a low energy consumption to detect the attacks with high accuracy (i.e. high detection and low false positive rates).

I. INTRODUCTION

The Internet of Things (IoT) has the ability to incorporate transparently a large number of heterogeneous devices such as, for instance cameras, wireless sensor network (WSN), smart meters, vehicles, etc, while providing open access to a variety of data generated by such devices to provide new services to citizens and companies [START_REF] Zanella | Internet of Things for Smart Cities[END_REF]. Due to the services that IoT technology affords, it finds applications in many different domains such as medical aids, automotive, smart grid, and many others [START_REF] Bellavista | Convergence of MANET and WSN in IoT urban scenarios[END_REF]. The relevant data exchanged between IoT devices are more vulnerable to attacks since they are often deployed in a hostile and insecure environment. Therefore, security solutions are mandatory to protect IoT devices from intruder attacks. In this paper, our aim is to secure low resources IoT devices such as smart meters and sensors against any malicious behaviors.

The Intrusion Detection System (IDS) is very effective to protect IoT devices against intruders since it has the capability to detect both internal and external attacks with a high accuracy [START_REF] Raza | SVELTE: Real-time intrusion detection in the Internet of Things[END_REF]. In order to monitor and detect malicious devices, detection techniques can be classified into two main approaches [START_REF] Raza | SVELTE: Real-time intrusion detection in the Internet of Things[END_REF][4] [START_REF] Wang | An integrated intrusion detection system for cluster-based wireless sensor networks[END_REF]: (i) Signature-based detection (or Misuse detection), which is based on detection of the attack type by comparing the behavior of the analyzed target to a set of predefined rules related to each attack signature. Such technique aims to reduce the false positive and it requires a low computation overhead to model the normal behavior of a device. Nevertheless, the drawback of this technique is that it can only detect known attacks, described by a set of signatures. (ii) Anomaly detection, which uses a supervised learning algorithms [START_REF] Sedjelmaci | Efficient Intrusion Detection Framework in Cluster-Based Wireless Sensor Networks[END_REF][7] [START_REF] Rajasegarar | Anomaly Detection in Wireless Sensor Networks[END_REF], such as data mining, support vector machine (SVM) and neural networks (NNs), to build the normal behavior. The advantage of such technique is its high detection rate since it has the ability to detect new attacks that have never occurred before. However, the main drawback is the high computation overhead required to model the normal behavior.

According to several research works [START_REF] Sedjelmaci | Intrusion Detection Framework of Cluster-based Wireless Sensor Network[END_REF][5][10] [START_REF] Lee | A data mining framework for building intrusion detection models[END_REF], the combination between anomaly and signature detection techniques (defined as hybrid intrusion detection system) incurs high detection and low false positive rates. However, the activation of an anomaly detection for low-resource IoT devices could generate a high energy consumption due to the computational cost leading to a rapid decrease of the network lifetime [START_REF] Sedjelmaci | Efficient Intrusion Detection Framework in Cluster-Based Wireless Sensor Networks[END_REF][8] [START_REF] Wallgren | Routing attacks and countermeasures in the RPL-based internet of things[END_REF], specifically when this technique is activated all the time. Thereby, our aim in this paper is to make a dilemma between energy consumption and accuracy detection (i.e. high detection and low false positive rates) by activating the anomaly detection only when a new attack pattern (i.e. signature) is expected to occur. This dilemma is achieved, thanks to a proposed security game model, where we modeled the security strategy as a game formulation between the intruder attack and the IDS agent embedded at IoT device. With the help of Nash Equilibriumi, we determine the equilibrium state that allows the IDS agent to activate its anomaly detection technique in order to detect new attack pattern.

This paper is organized as follows: In section II, we put highlight in context with the related work in this area. In Section III, we explain our anomaly detection technique based on game theory. Finally, we conclude our work and give directions for future works.

II. RELATED WORK

IDS provides an effective protection to IoT networks against both external and internal intruders [START_REF] Raza | SVELTE: Real-time intrusion detection in the Internet of Things[END_REF], and acts as second wall of defense when cryptography is broken. In recent research works [START_REF] Faisal | Data-stream-based intrusion detection system for advanced metering infrastructure in smart grid: A feasibility study[END_REF][13] [START_REF] Pan | Developing a Hybrid Intrusion Detection System Using Data Mining for Power Systems[END_REF], the authors use an anomaly detection technique to monitor the smart grid's IoT devices such as smart meters and identify any external or internal attack that targets the grid. According to their simulation results, the anomaly detection technique, which is based on a learning algorithm, exhibits a high detection rate (i.e. above 90%). However, embedding this heavy detection technique for low-resources IoT devices could incur a high computation overhead and subsequently degrades the smart grid performances.

In [START_REF] Raza | SVELTE: Real-time intrusion detection in the Internet of Things[END_REF][5][9] [START_REF] Yan | Hybrid Intrusion Detection System for Enhancing the Security of a Cluster-based Wireless Sensor Network[END_REF], the authors propose a hybrid intrusion detection framework for a heterogonous WSN, where a signature detection technique runs at each sensor node and anomaly detection technique runs at a powerful node, e.g. cluster-head or base station. The anomaly detection technique computes a rule related to each attack's signature that it detects and forwards this new rule to sensor nodes (located within its range). The sensor adds the rule into its database and compares the behavior of a monitored node with the stored rules (related to each signature). If a match occurs, the analyzed node is defined as an attacker. Such hybrid detection incurs a high communication overhead since a huge number of signatures are forwarded to sensor nodes, specifically when the number of attackers is higher in the network. In [START_REF] Abduvaliyev | Energy efficient hybrid intrusion detection system for wireless sensor networks[END_REF] both anomaly detection and signature-based detection techniques run at the same sensor node. According to their simulation results, their hybrid intrusion detection system generates a high detection rate with a low false positive rate. However, the major drawback of this work is that a heavy machine-learning algorithm is activated in permanent fashion at each sensor in order to build intrusion rules. Therefore, a high computation overhead could be generated leading to a rapid decrease of the network lifetime.

The anomaly detection technique has the ability to detect almost all the attacks that occur in a network. However, a permanent activation (i.e. does not switch to idle time) of this technique for low-resource IoT devices could decrease rapidly their lifetimes. Thereby, in this paper we make a dilemma between constrained energy resources and accuracy detection by activating the anomaly detection only when a new attack's signature will be expected to occur.

III. GAME-THEORETIC METHODOLOGY FOR OPTIMAL ACTIVATION OF ANOMALY DETECTION TECHNIQUE FOR LOW-RESOURCE IOT DEVICES

Each IoT device activates an IDS agent to monitor its neighbor's devices. According to [START_REF] Stetsko | Neighbor-based intrusion detection for wireless sensor network[END_REF], the communication overhead may rapidly decrease the network lifetime compared to a computation overhead. Thereby, due to the communication overhead's issue, both anomaly and signaturebased detection techniques should run in the same IDS agent. The signature-based detection technique compares the behavior of a target device with a set of rules related to each attack pattern (i.e. signature) stored in the IoT device's database. The anomaly detection technique relies on a learning algorithm to carry out a training, classification and builds a rule related to each new detected attack pattern. Afterward, this rule is stored to be used by the signature detection technique. To save the energy, the anomaly detection technique is activated only when a new attack's signature will be expected to occur by a malicious device. Thereby to assure this dilemma, a security game approach for low-resource IoT devices is proposed.

In this section, first of all, we provide the payoff matrix of the game related to the IDS and attacker. Then, we define a set of strategies and payoffs that could occur and result between players, respectively. Finally, we determine, with the help of Nash Equilibrium (NE), the equilibrium state in which the IDS agent will activate its anomaly detection technique to train, classify and build a rule related to a new attack's signature.

A. Game description

In our approach, we consider a set of players, P={ , ,….., }, where each player represents either an IDS agent that runs at each IoT device or an attacker. Each player has a set of strategies.

= { , ,….., } is the probability that an IDS agent has detected m signatures at time t; and

′ ′ = { , ,…..,
} is the probability that the attacker launches m' signatures during a period of time t'. In this game, time is divided into regular intervals called time-slots. At the end of each time slot, the IDS player activates its anomaly detection technique to carry out training and classification processes; afterward, it builds a rule related to each new attack's signature. Furthermore, when a new signature is detected, the IDS player's payoff is increased and the attacker player's payoff is decreased as shown in equations ( 1) and (2), respectively. Otherwise the IDS player's payoff is decreased and attacker player's payoff is increased as shown in equations ( 3) and ( 4), respectively. The total payoff of IDS and attacker is given by equations ( 5) and ( 6), respectively. Based on this historical observation, the IDS can locally has knowledge of the frequencies of a signatures' occurrence; and with the help of NE it predicts when anomaly detection should be activated for rule building. The NE aims to make a dilemma between accuracy detection and energy consumption. Moreover, IDS agents located in the same neighborhood cooperate together in order to achieve the greatest possible total benefit. This means that IDSs exchange the list of signatures (with the signatures' detection time) to grow knowledge of the frequencies of attacks' occurrence and hence lead to an increase on the accuracy prediction.

1 = ( - ) (1) 1
= -( + ) (2)
2 = -( + ) (3) 2 =
(4)

= 1 + 2 (5)
′ = 1 + 2 (6)
Here, and are respectively the positive and negative reputations, which are initialized at the beginning to zero and their values increase or decrease depending upon the actions done by the IDS and attacker, s is the number of correct signatures detection and k is the number of failure signatures detection, and are respectively the required cost's rate (i.e. overhead caused by the computing processing) to generate a new attack signature by an attacker and activation of anomaly detection by the IDS agent. It's noted that, Payoff1IDS, Payoff2IDS, Payoff1attacker and Payoff2attacker vary between 0 and 1. Table I illustrates the payoff matrix of the game between IDS agent and attacker that targets IoT device.

… ….. ′ ′ ( ′ , ) ( ′ , ) ( ′ , …) ( ′ ) ′ ( ′ , ) ( ′ , ) ( ′ , …) ( ′ , ) …… (… , ) (… , ) (… , …) (… , ) ′ ( ′ , ) ( ′ , ) ( ′ , …) ( ′ , )

B. IDS and attacker gaming

In this subsection, we introduce the static and dynamic game models to compute the NE that represents the best strategy of the IDS to launch its anomaly detection technique.

1) Static game between IDS and attacker

In a static game, once a player decides his/her strategy, he/she does not have a second chance to change it [START_REF] Wu | On modeling and simulation of game theory-based defense mechanisms against DoS and DDoS attacks[END_REF]. According to Nash, there is a mixed strategy NE in which both IDS and attacker do not change their actions. As a result, we use NE to predict the equilibrium state in which the attacker will generate a new signature regardless the action of IDS (i.e. launches an anomaly detection technique or not).

Theorem 1

Let J( , ) denotes the attacker and IDS's gains, where ∈ { , ,…, } and , ∈ { ′ , ′ , , ′ }, so that

J( , ′ ) = ( , ′

).

A pair of strategies ( * and * ) is a NE point if the following inequality [START_REF] Ma | Multi-act dynamic game strategy for jamming attack in electricity market[END_REF] is satisfied:

J ( * , ) ≤ J ( * , * ) ≤ J ( , * ) (7)
There is at least one NE point J( * , *

) that satisfies the inequality [START_REF] Faisal | Data-stream-based intrusion detection system for advanced metering infrastructure in smart grid: A feasibility study[END_REF].

Proof 1

To find a NE point of the game, we calculate the average payoff of the game [START_REF] Ma | Multi-act dynamic game strategy for jamming attack in electricity market[END_REF], which is expressed as:

J( , ′ )=∑ * ′ *( ′ , ) (8)
In this game, the IDS and attacker try to maximize and minimize the value of J( , ′ ) respectively by the appropriate choice of the probability distribution vectors ( ) and ( ′ ). The equilibrium, achieved by the players in the mixed strategies, is defined as follows:

( , ′
), where i ≥0

The NE of a mixed strategy is comprised of the strategies for both players, in the form of ( * , * )= ( * , ′ * ), which satisfies the inequality [START_REF] Faisal | Data-stream-based intrusion detection system for advanced metering infrastructure in smart grid: A feasibility study[END_REF]. Hence, the mixed-strategy equilibrium is uniquely which is given by:

= ( , ′
), where i ≥0 (9) The attacker will generate a new signature when he/she reaches the equilibrium, i.e.

( , ′

), regardless the action taken by the IDS. Therefore, to assure a dilemma between accuracy detection and low energy consumption, the IDS activates its anomaly detection technique only when the equilibrium is reached, which is defined as + ( + , ′ ′+ ).

2) Dynamic game between IDS and attacker

In the static game model discussed above, no player has the chance to modify his/her strategy [START_REF] Wu | On modeling and simulation of game theory-based defense mechanisms against DoS and DDoS attacks[END_REF]. However, the dynamic game allows the IDS and attacker to adjust their strategies according to the observation of both players' past choices.

Let us consider that the game lasts for h time steps in total. We compute the total payoff of a player by adding his (her) time serial payoffs over the entire game, i.e. ∑ ( , ) .

Theorem 2

The NE solution of the dynamic game satisfies recursively the following set of h pairs of inequalities for all with i =1, 2 and t=1,…, h: , respectively on both sides of the inequality sign. Hence, we obtain the following inequality:

⎩ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎧ J ,
J ρ * , … , ρ * , ρ * ; ρ * , … , ρ * , ρ ≤ J ρ * , … , ρ * , ρ * ; ρ * , … , ρ * , ρ * ≤ J ρ * , … , ρ * , ρ ; ρ * , … , ρ * , ρ * (13)
Here, we can permute between 1 and h, hence we obtain:

As a result, we claim that the proposed security game assures a NE solution in a dynamic game by satisfying recursively a set of h pairs of inequalities.

IV. PERFORMANCE EVALUATION

Our approach was implemented in wireless sensor networks, well-known low-resource IoT devices. In the simulation, we use a TOSSIM simulator [START_REF]Simulating TinyOS networks[END_REF], a simulator of TinyOS sensor nodes.

As explained in the introduction, the hybrid intrusion detection system aims to combine between a signature-based detection and anomaly-detection techniques to get high detection and low false positive rates. In this section, we compare our lightweight hybrid intrusion detection system with current hybrid intrusion detection techniques [START_REF] Wang | An integrated intrusion detection system for cluster-based wireless sensor networks[END_REF][9] [START_REF] Yan | Hybrid Intrusion Detection System for Enhancing the Security of a Cluster-based Wireless Sensor Network[END_REF]. In the latter and as explained in the related work, the anomaly detection technique runs on each sensor node and is activated at all time. This is unlike the lightweight technique, where the anomaly detection is activated (with the help of game theory) only when a new attack's signature is expected to occur. Here, we evaluate the accuracy detection (i.e. detection and false positive rates) and energy consumption. These metrics are defined as follows:

Detection Rate (DR): defined as the ratio between the number of correctly detected attackers and the total number of attackers, False Positive Rate (FPR): defined as the ratio between the number of normal sensor nodes incorrectly classified as attacker and the total number of normal sensor nodes.

These first two metrics allow us to evaluate the accuracy detection (AD), which is equal to (DR-FPR).

Energy Consumption (EC): defined as the energy consumed by all sensors and computed as follows [START_REF] Sedjelmaci | Efficient Intrusion Detection Framework in Cluster-Based Wireless Sensor Networks[END_REF]:

= ∑ (15)
Where is the energy total of the network and N is the number of sensor nodes.

A. Simulation setup

The sensors are randomly deployed in a square area of (300×300) m 2 . We vary the number of attackers from 10% to 40% of overall nodes. In the simulation, the attacker carries out the most dangerous attack, which is a Denial of Service (DoS) attack, where he/she aims to exhaust the network resources or disrupt its proper operation. The anomaly detection technique used by the IDS agents is a Back Propagation Network (BPN), which is the most typical and the most general model to use in a neural network [START_REF] Philippe | Neural network models: theory and projects[END_REF]. The main simulation parameters are summarized in Table II. These parameters were chosen to be as most realistic as possible. [START_REF] Abduvaliyev | Energy efficient hybrid intrusion detection system for wireless sensor networks[END_REF]

B. Results analysis

The main results are summerized bellow. In the simulation, we vary the number of sensors and attackers from 50 to 300 and from 10 % to 40 % of overall nodes, respectively. Here, we compute the accuracy detection and enenrgy consumption for both lightweight hybrid detection system and current hybrid detection systems [START_REF] Wang | An integrated intrusion detection system for cluster-based wireless sensor networks[END_REF][9] [START_REF] Yan | Hybrid Intrusion Detection System for Enhancing the Security of a Cluster-based Wireless Sensor Network[END_REF], afterward we compare their performances. The accuracy detection and energy consumption metrics are computed for each hybrid detections system [START_REF] Wang | An integrated intrusion detection system for cluster-based wireless sensor networks[END_REF][9] [START_REF] Yan | Hybrid Intrusion Detection System for Enhancing the Security of a Cluster-based Wireless Sensor Network[END_REF], and the average values of these metrics are used to be comapred with a lightweight hybrid detection system. It's noted that, we compute the average values because the accuracy detection and energy consumption for each system [START_REF] Wang | An integrated intrusion detection system for cluster-based wireless sensor networks[END_REF] b) and (c), we show that when the number of sensor nodes and attackers increase, the accuracy detection of both hybrid detection systems exceeds 90%. Furhemore, we found out that the accuracy detection of our lightweight detection system is close to the current hybrid detection systems. This is achieved even in a scaling mode, i.e. when the number of sensors and attackers increase. The accuracy of attack detection that our approach exhibits is attributed to the game theory concept since with the help of Nash equilibrium, we can predict the state in which the attacker can launch a new signature with a goal to carry out an attack without being detected. In this case, the IDS agent activates its anomaly detection against the suspected nodes and ejects the malicious attacker before raising a lethal cyberattack. 30% and (c) 40% of overall nodes.

2) Energy consumption

A main constrained of a low resource IoT device is the energy consumption since when a heavy detection technique is embedded in such device, it decreases rapidly its lifetime. Thereby, energy is a very important point in the design and implementation of IoT applications. As shwon in Fig. 2, we fix the number of attackers as 40% of overall nodes, afterward we vary the number of sensors and compute the energy consumption. It's apparent that the lightweight detection technique requires a low energy consumption to achieve a high security level. This is unlike the current hybrid detection systems [5][9][15] since a high-energy consumption is generated specifically when the number of sensors increase. This spectacular result is attributed to the following reasons: (i) with a help of Nash equilibrium, the lightweight detection technique activates an anomaly detection only if needed leading to a decrease on a computation overhead generated by the NN learning algorithm. Therefore a low energy is required to build rules related to attackers' new signatures. (ii) In the current hybrid detection systems a huge number of intrusion messages (where the signature is stored) is exchanged within a network, specifically when the number of detected signatures is high leading to an increase of communication overhead.

V. CONCLUSION AND FUTURE WORK

In this paper, we are dealing with security for low resources IoT-devices. We propose a lightweight anomaly detection technique based on game theory concept. With the help of Nash equilibrium, we predict the equilibrium state that allows the IDS agent to activate its anomaly detection technique to detect new attack's signature. We have analyzed the performance and demonstrated the viability of our proposed approach under WSN, using TOSSIM simulator. According to the simulation results, we prove that our lightweight anomaly detection approach requires a low energy consumption to achieve a high security level, i.e. high detection and low false positive rates. This is unlike the current anomaly detection techniques that require a high energy to exhibit a high detection rate since these detection techniques are activated at each node in a permanent fashion (i.e. does not switch to idle time). Our future direction is to embed our lightweight anomaly detection technique in largescale IoT devices and will deal the accuracy detection, energy consumption and network delay.

  subtract and add J , +…..+ J , and J * , * +…..+ J * , *

  [START_REF] Sedjelmaci | Intrusion Detection Framework of Cluster-based Wireless Sensor Network[END_REF][START_REF] Yan | Hybrid Intrusion Detection System for Enhancing the Security of a Cluster-based Wireless Sensor Network[END_REF] are almost the same. 1) Accuracy detection According to Fig 1 (a), (

Fig1.

  Fig1. Accuracy detection with a number of attackers equals to (a) 10% , (b) 30% and (c) 40% of overall nodes.

Fig 2 .

 2 Fig 2. Energy consumption

TABLE I .

 I PAYOFF MATRIX OF ANOMALY DETECTION GAME

	Attacker	IDS

  is independently addictive as proved in[START_REF] Ma | Multi-act dynamic game strategy for jamming attack in electricity market[END_REF], i.e. the value of the dynamic game is added to the value of every single-staticgame together for h time steps. It can be described as:Based on Theorem1 introduced before, every NE-point solution at time h J * , * satisfies the following inequalities:

		… ,	, * ;	, … ,	,	≤
	J	, … ,	, * ;		, … ,	, *
	≤ J	, … ,	,	;	, … ,	, *
	J	, … , * , * ;	, … ,	, * ≤
	J	, … , * , * ;	, … , * , *
	≤ J (	, … ,	, * ;	, … , * , * )
	J	… … … … … … … … … … … … … … … . . … * , … , * , * ; , … , * , * ≤
	J	* , … , * , * ; * , … , * , *
	≤ J ( , … , Proof 2
	The function of the value of outcomes in the whole
	game,			, … ,	,	;	, … ,	,
		, … ,	,	;	, … ,	,	=	,	+ ..
	+		,	+	,
		, … ,	, * ;	, … ,	,
	≤	, … ,	, * ;	, … ,	, *
	≤	, … ,	,	;	, … ,	, *

* , * ; * , … , * , * )

TABLE II .

 II SIMULATION PARAMETERS

	Simulation time	900 seconds
	Simulation area	300*300
	Number of sensors	From 50 to 300
	Number of attackers	From 10 % to 40 % of overall nodes
	Radio model	Lossy radio model
	Radio range	15 meter
	Sensor initial energy	9 Joule
	Anomaly detection	BPN

ACKNOWLEDGEMENT

This work has been funded by the European project ITEA FUSE-IT [21].


Eric Favre
email: eric.favre@ensic.inpl-nancy.fr.

Denis Roizard

Roda Bounaceur

William J Koros

CO2/N2 Reverse Selective Gas Separation Membranes: Technological Opportunities and Scientific Challenges

HAL is

CO 2 /N 2 Reverse Selective Gas Separation Membranes: Technological Opportunities and Scientific Challenges Eric Favre,* , † Denis Roizard, † Roda Bounaceur, † and William J. Koros ‡ LSGC-UPR CNRS 6811, ENSIC, Nancy UniVersite ´,54001 Nancy,France,and School of Chemical and Biomolecular Engineering,Georgia Institute of Technology,Atlanta,Georgia Sir: A reverse selective CO 2 /N 2 membrane material has been recently reported by Kumar et al. in this journal. 1 We would like to follow up on this publication with additional information that is related to this unusual experimental observation. To our knowledge, a CO 2 /N 2 reverse selective membrane material has not been reported previously and would be a breakthrough both from the scientific and technological point of view.

Such a N 2 selective membrane would be of major interest for postcombustion carbon dioxide capture (i.e., from flue gas) which requires a purity of 0.9 (or more) together with a capture ratio of 0.9 (or more). We show in Figure 1 some simulation results performed through classical design computations for gas permeation processes 2 where a reverse selective material is compared to a classical one for a single stage permeation situation. First, when a pressure ratio of 0.01 is applied (Figure 1a), a selectivity of 300 or more is needed for a normal selective material to reach key targets, while a selectivity of 50 is enough with a reverse selectivity material. The most interesting performance of a reverse selective material can be pointed out when a moderate pressure ratio is applied. This condition is necessary in order to minimize the energy consumption, which is of primarily importance for the separation process to be selected for this application. Calculations classically show that a pressure ratio in the range of 0.1 can be tolerated. 3 In that case (Figure 1b), a reverse selective material is the only one which achieves the target performance, again with a separation factor around 50. Additionally, carbon dioxide will be recovered in that later case on the high pressure side (i.e., retentate side). This capability is very interesting since carbon dioxide has to be compressed afterward to up to 80-150 bar for transport purposes in a carbon capture and storage framework. A supplementary energy gain is thus obtained, compared to CO 2 selective materials which require permeate vacuum pumping to be operated.

Despite its attractiveness, to our knowledge, no theoretical basis for a nitrogen selective permeation process through a membrane material, be it dense or porous, has been reported. The report by Kumar et al. 1 does not offer a real mechanistic explanation of the basis for a faster N 2 permeability compared to CO 2 . Concerns that existed in explaining such results included the following:

1. Given the kinetic diameters of CO 2 and N 2 , CO 2 should always show a higher diffusion coefficient in materials showing molecular sieving properties or any conventional activated diffusion process that we can imagine.

2. On the basis of point 1, it seems that in a dense polymeric matrix (i.e., in the case of a complete filling of the pores of the material by polyetherimide (PEI)), no steady state selectivity in favor of nitrogen can be expected, be it in rubbery or glassy polymers.

3. Any surface effect (adsorption, surface flow) or phase change (capillary condensation) would be again in favor of CO 2 , due to its larger condensability.

4. The influence of a chemical reactivity between CO 2 and PEI could lead to some specific retardation effect, but this would take place only under transient state conditions. To that respect, we report in Figure 2 an example of experimental results obtained on a PEI containing dense polymeric membrane operated under cyclic unsteady state conditions (repeated timelag experiments). A very large time lag is observed for the first Figure 1. Simulation of the separation performance of a single stage membrane module operated under cross plug flow conditions for the recovery of carbon dioxide diluted in nitrogen (feed composition 10% mol fraction CO 2 ) with a CO 2 selective (lines) and a N 2 selective material (dotted lines). Carbon dioxide outlet purity corresponds to the permeate composition (y) for the CO 2 selective material and to the retentate composition (x OUT ) for the N 2 selective material. For carbon capture application, a purity of 0.9 and a recovery ratio of 0.9 are needed. Two different values of the pressure ratio ψ (downstream/upstream pressure) have been tested: (a) ψ ) 0.01; (b) ψ ) 0.1. cycle, due to the retardation effect exerted by the CO 2 specific chemical reaction. N 2 will breakthrough faster than CO 2 under these conditions, and a reverse selectivity is temporarily obtained. This effect is annihilated afterward, and a classical CO 2 selectivity is obtained when further cycles are operated without integral regeneration of the sorption sites. Nevertheless, given the time scale of the experiments reported by Kumar et al. (i.e.,170 h), transient behavior could be expected to be unlikely to take place.

5. The only mechanism that we can currently suggest that predicts a faster N 2 permeability is Knudsen flow, but with a very low selectivity (ca. 1.28) compared to the results which are reported (selectivity up to 80).

The above analysis may be overlooking some multicomponent effects or subtle coupling phenomena (i.e., role of water) in the process. We hope that this note will stimulate the curiosity and the efforts of the scientific community to explore what we consider to be an important and challenging scientific issue.

Literature Cited

(1) Kumar, P.; Kim, S.; Ida, J.; Guliants, V. V. Polyethyleneimine-Modified MCM-48 membranes: Effect of water vapor and feed concentration on N 2 /CO 2 selectivity. Ind. Eng. Chem. Res. 2008, 47, 201. ( upstream pressure 2 bar pure CO 2 ; downstream pressure 0 at time zero; membrane cellulose propionate/polyetherimide (PEI 18%) dense membrane, 55 µm thickness. After each run, the downstream pressure was quickly decreased to zero by vacuum pumping and the next run was started.

Figure 2 .

 2 Figure 2. Incidence of PEI-CO 2 chemical reactivity on the transient permeation through a dense polymeric membrane and repeated time-lag experiment performed under the following conditions: temperature 25 °C;upstream pressure 2 bar pure CO 2 ; downstream pressure 0 at time zero; membrane cellulose propionate/polyetherimide (PEI 18%) dense membrane, 55 µm thickness. After each run, the downstream pressure was quickly decreased to zero by vacuum pumping and the next run was started.


John R Dolan
email: dolan@obs-vlfr.fr

Depictions of the Deep: Illustrations in the Popular Press of Deep-Sea Animals from Jules Verne (1860's) to William Beebe (1930's) and beyond Portrait des eaux profondes : Évolution des illustrations d'animaux des profondeurs dans

Our vision of deep-sea life changed dramatically with the results of scientific explorations and study of the deep that began in the 1860's. Mythical monsters, epitomized by Jules Verne's giant octopus, gave way to mysterious landscapes inhabited by odd creatures actually dredged up from the deep. While we now know of the diversity and unusual life cycles of deep-sea creatures, visions of the deep as a world of monstrous creatures persists today in the popular press.

Introduction

Here are shown, in five 'chapters', changes in the depictions of deep-sea life in popular books and magazines. The time period covered is from the era of Jules Verne (1860's) to that of William Beebe (1930's) and to recent years. The major focus is on the period of the 1860's to the 1930's as it corresponds, firstly with early scientific exploration of the deep-sea, and secondly, growth in our knowledge of natural history of organisms in the deep-sea. Traditionally images such as those illustrating "20,000 Leagues under Sea" (and before) were of mythical monsters in the deep sea. With the first scientific explorations of the deep sea, from the 1860's -1920's, the existence of odd creatures became known. The deep-sea was then depicted as an eerie land of monstrous forms but about which little was known. Finally with the first systematic studies, including in situ observations by William Beebe, some of the natural history of deep-sea organisms became known. Organisms were then shown with their predator-prey relationships and depictions of life-cycle stages of deep-sea animals appeared. From the eras of Jules Verne to that of William Beebe, the imaginary monsters of the deep were gradually replaced by actual animals but of many with frightening shapes and unimaginable life cycles. Nonetheless, ferocious-looking and monstrous forms of the deep-sea still remain popular in contemporary works. Illustrations by Édouard Riou. The inspiration for Nemo's encounter is said to have been inspired by the "Calmar de Bouyer" alleged event of 1861 in which a giant squid was captured (below).

1865. "Le Monde de la Mer" (Frédol 1865) contained an illustration of an alleged "1861 event": the capture of a giant squid by the crew of the French steamer Alecon, near Cayene. Illustration by P. Lackerbauer The event, doubted by Frédol, included killing the squid by firing several canon balls into it. The images of this event are said to have inspired Jules Verne (Hatcher & Battey 2013). The giant deep-sea creatures in Jules Verne's book were commonly thought to exist in the 1860's despite the dominant scientific view that life was not possible at great depth. Images of giant creatures from the deep attacking ships have a long history as shown below.

1868. An illustration of the "Kraken" -the mythical deep-sea creature attacking a ship during a storm at sea. Illustration by E. Etherington. From Mangin's 1868 "Les Mystères de l'Océan". Mangin detailed the long existence of Kraken stories. 1873. Following soon after the explorations of the Bulldog were the voyages of the Porcupine and Lightening made famous in Thompson's 1873 book: "The depths of the Sea". While the Bulldog expedition was a submarine survey seeking information for laying a telegraph cable, the Porcupine and Lightning expeditions were specifically focused on collecting deep-sea life. The book's illustrations of novel organisms in the dark sea, on a black background, were striking and the first use of white on a black background. Illustrations by J. Wild. The organisms shown above appeared as 4 separate illustrations. At the left, a stalked crinoid (relative of a seastar), top center is a brittlestar much like the one retrieved on a sounding rope from the Bulldog expedition, the bottom center shows a microscopic amorphous mass "Bathybius", thought to be a primordial life form, a few years later revealed to be an inert chemical precipitate [START_REF] Rehbock | Huxely, Haeckel, and the oceanographers: the case of Bathybius haeckelii[END_REF]), and at the left, a deep-sea sponge skeleton. that the odd morphologies of deep-sea fish are simply adaptations to live in the 'Perpetual Night'.

1930. Illustration of the very strange life cycle of the deep-sea anglerfish, discovered in a few years earlier by C.T. [START_REF] Regan | Dwarfed males parasitic on the females in oceanic anglerfishes (Pediculati Ceratioidea)[END_REF]. The illustration is from an article by C.G. Noble in Natural History Magazine, "Probing Life's Mysteries". The male of the fish species is a very small form that attaches itself to the female and feeds from its blood. The life cycle of the fish is actually much stranger than its morphology. The differences in male and female morphologies of the deep-sea anglerfish are the most extreme example of sexual dimorphism known among all vertebrate animals (Fairbairn 2013).

1931.

Odd, but non-threatening, deep-sea fish shown by William Beebe in his article in the Annual Report of the New York Zoological Society on his deep sea sampling in Bermuda. Beebe established a field station from which near daily deep-sea sampling was carried out. The Annual Reports were distributed to all the over 4000 members of the Zoological Society of the Bronz Zoo. The 1931 illustration may be the first of a deep-sea fish in the popular press as an appealing, rather than a monstrous, form. Illustration not attributed.

1934. An illustration in Beebe's 1934 article in Annual Report of the Zoological Society showing some deep-sea fish, non-threatening, to be similar in feeding habits to surface water fish, feeding on prey smaller than themselves shown magnified in the circle. Illustration not attributed.

Conclusion

Our visions of life in the deep dark sea changed dramatically from 19th to the 20th century. In the popular imagination, the inhabitants changed from giant ship-eating cephalopods to ferocious, long-fanged fish in eerie landscapes. The change was due to scientific explorations of the deep-sea revealing the odd inhabitants of the deep. The explorations also changed a scientific view of the deep-sea from that of a life-less zone to that of a biome of surprising diversity of species with odd morphologies and unusual life histories. Work in recent decades has revealed the deep sea to be peppered with zones of hydrothermal vents inhabited by a unique fauna of amazing worms and bivalves, dependent on symbiotic bacteria, in turn fueled by the hydrothermal vents (e.g., [START_REF] Van Dover | Deep Ocean Journeys: Discovering new life at the bottom of the sea[END_REF]. Nonetheless, it seems that the most popular visions of deep-sea life remain the monstrous forms of strange fish!

I

  . Jules Verne's 1860's: Mythical Giants ruled the Deep in the Popular Press 1869. Left Panel: Jules Verne's "20,000 leagues Under the Sea", the frontispiece in first edition 1869 showing sea serpents, giant narwhals and octopus observed by deep-sea divers. Right Panel: Captain Nemo admiring a giant octopus.

1802.

  The first "scientific description" of a giant cephalopod: Le Pouple Colossal (Giant Octopus) from Denys-Monfort (1802). Illustration by P. Denys-Monfort. Today it is considered no more than an imagined deep-sea monster based on Denys-Monfort's finding a large tentacle, likely from a deep-sea squid. II. Early Scientific Explorations of the Deep-Sea 1862-1900: Existence of life and strange creatures at great depths revealed 1862. This sketch of a brittlestar wrapped around of piece of sounding rope is likely the first image of a deep-sea creature (from 2000 m depth) brought up alive, from Wallich 1862, Plate I. Illustration by G.C. Wallich. About the same time that 20,000 Leagues was being written, the first deep-sea explorations were underway. Early observations of deep-sea creatures were of organisms on telegraph cable brought up from deep water for repair (e.g. Milne-Edwards 1861) dispelling the dominant scientific notion of the time that life was not possible at great depth (i.e., Forbes 1844). One of the early expeditions to determine the suitability of the sea-bed characteristics for laying telegraph cables was an expedition of the British ship H.M.S. Bulldog sounding between Great Britain and Canada in 1860. During the sounding operations, living deepsea animals were brought up, seastars -having attached themselves to the ropes dragged along the sea bottom. The image above is from Wallich's 1862 account of the Bulldog expedition. He found deep-sea forms that resembled those known from shallow waters, not monsters of any sort.

  1877.The results from the Porcupine and Lightning revealing the existence of deep-sea life, motivated in large part the organization of the Challenger Expedition(1873)(1874)(1875)(1876), the first global-scale oceanographic expedition[START_REF] Bailey | The Voyage of the" Challenger[END_REF]. The 3-year voyage eventually yielded a massive series of 50 volumes composed of over 80 monographs published from 1885 to 1889. The illustrations above, from the Preliminary Report by C.W. Thompson in 1878, showed ferocious fish, monstrous, but small (left panel) and showed armored prawns, perhaps monstrous, but also small. Illustrations by J. Wild. 1877. Another illustration from the Preliminary Report by C.W. Thompson in 1878 showed tiny jewels of the deep sea -"Challengerids", protists of the microzooplankton, he named them (all about 200 µm in size) for the ship, the Challenger. Illustrations by J. Wild. 1885. The first French oceanographic expedition was the expedition of the Travailleur in 1880 (Rice 1980). In 1885 Filhol published "La Vie au Fonds des Mers: Les explorations sous-marines et les voyages du Travailleur et du Talisman". Left Panel: Animals of the deep sea shown in an eerie landscape. Right Panel: a fantastic, garden-like seascape. Illustrations by A.L. Clément. 1885. A sea of fierce anglerfish from Filhol "La Vie au Fonds des Mers: Les explorations sous-marines et les voyages du Travailleur et du Talisman". Illustrations by A.L. Clément. 1894. By 1894 some of Filhol's images of scary fish mages were becoming widespread appearing in other books such as Hickson's book "Fauna of the Deep" published in 1894. Illustrations by A.L. Clément. III. Early Modern Period 1900 -1928: Actual deep-sea creatures appear in not only in books but also newspapers and magazines 1900. The San Francisco Chronicle reporting on the findings of the Albatross explorations of the deep Pacific. Pictured were preserved odd deep-sea fish but note that a deep-sea octopus still decorated the view of the deep sea. Illustration by L. Anguth.

1902.

  From an article in "Everybody's Magazine" by C.H. Townsend: "Life in the Deep Sea", also on the Albatross expeditions. Note that that non-monstrous organisms, a microscopic foraminifera (top) and a flower-like crinoid (bottom) were shown along with the Gulper Eel. The unattributed illustrations were likely those of J. Wild. 1902. "The Way of a Deep-Sea Fish". Illustration by A. Alcock Perhaps the first depiction of the natural history of a deep-sea fish, as it shows what it ate, a squid larger than itself. From Alcott's 1902 book, "A Naturalist in Indian Seas" 1903. The cover of Chun's popular book on the 1901 Valdivia Expedition was decorated with the strange shapes of deep-sea fish. The Valdivia Expedition was the first large-scale (global) devoted to investigation of deep-sea life. Cover artwork not attributed. 1903. From Carl Chun's popular book (1903) on the Valdivia Expedition. More deep-sea oddities from the first large-scale oceanographic expedition dedicated to deep-sea exploration, the Valdivia Deep-Sea Expedition. Illustration by F. Winter. 1904. The mysterious view of the deep-sea persisted. From a Strand Magazine article by C.J. Cornish "Living Lamps on Land and Sea" on bioluminescent creatures. Note that 2 of the 3 forms of deep-sea fish shown are fearsome. Illustration not attributed. 1904. Bullen's popular book "Denizens of the Deep" showing actual fish described as "strange monsters", then known to exist and shown fearsome, in an eerie landscape. Illustration by C.L. Bull. 1912. Illustrations of scary fish and bright red shrimp in the second large-scale expedition dedicated to deep-sea explorations in 1910, from Murray and Hjort (1912) on Michael Sars Expedition in the North Atlantic in their book "The Depths of the Ocean". Illustrations not attributed. 1915. By Cleveland Moffett in Strand Magazine. Still showing deep-sea as full of Anglerfish and monstrous forms. The artistic images of bizarre fish were based on actual reports from the Albatross Expedition. Illustrations not attributed. 1922. An illustration from the book "Haunts of Life" by J.A. Thomson. As the ship dredging is a steamer, it is possibly the Albatross. Note the often-shown gulper eel, and the fish with stalked eyes (also on the cover of Chun's 1903 book) but also a non-monstrous, flower-like, meter-long stalked crinoid at the left. Illustration by W. Smith. 1926. Left Panel: The first illustration, the frontispiece, in William Beebe's book "The Arcturus Adventure", an account of a 6-month oceanographic expedition in 1924 focused on deep-water sampling. Illustration by H. Tee-Van. Note that the hachetfish, shown also by Chun in his 1903 book and Murray & Hjorts's 1912 book, while quite odd are not threatening. Right Panel: One of the last illustrations in William Beebe's book, the anglerfish shown were found in deep water about 125 Km off New York in the deep-sea Hudson River Canyon. Ferocious fish, one with a diabolical smile, were still prominent. Illustration by D. Franklin.

1934.

  Left Panel: The inside back cover illustration from William Beebe's book "Half Mile Down" on his dives in the bathysphere to observe deep sea creatures, the first in situ observations ever made. Illustration by J. Tee-Van. Right Panel: Plate 1 from Beebe's book, Hachet fish as seen through the porthole of the Bathysphere, crossing the light beam of the Bathysphere's light. Note the harmless, social (schooling) depiction compared to the hachetfish images in the 1903 plate of Chun or the 1912 plate of Murray & Hjort. Illustration by E. Bostelman. 1934. Beebe's "Half-Mile Down" book had illustrations showing predator-prey relationships in the deep based on his observations. Again, social scenes as schools of fish are shown, as predators in the left panel, and as prey in the right panel. Illustrations by E. Bostelman. 1938. From Beebe's last popular article (1938) in New York Zoological Society Bulletin on a deep-sea species concerned its life cycle -showing the remarkable sexual dimorphism and male parasitism in deep-sea anglerfish in a cartoon-like fashion. A school of dwarf males are shown headed toward the female. The species is the same as that shown in the 1930 article in Natural History magazine. The bizarre secret lives of deep-sea fish were revealed to the public in a nearly comical fashion. Illustration by G. Swanson.

 (www.tamupress.com). Note that the monstrous stalk-eyed fish larvae, (shown by [START_REF] Chun | Aus den Tiefen des Weltmeeres[END_REF][START_REF] Moffet | Living wonders of the deep sea[END_REF][START_REF] Thomson | The Haunts of Life[END_REF], appear to be attracted to the lighted lure of the anglerfish. The stalk-eyed form was found by [START_REF] Beebe | New data on the deep sea fish Stylophthalmus and Idiacanthus[END_REF] to be no more than a larval form of a normal-looking, cigar-shaped fish, another example of a strange life cycle in deep-sea forms.