Jerome Henry
email: jerhenry@cisco.com

Yann Busnel

Romaric Ludinard

Nicolas Montavont

Reducing FTM ranging and location attack exposure with crowd-wisdom

Keywords: 11az, FTM, indoor location, ranging

Introduction

Outdoor location is commonly possible with methods leveraging GPS. Indoor however, GPS signal is often not available and other techniques have been sought for decades. Among several proposed methods, Fine Timing Measurement (FTM) specifies an indoor location procedure based on Time of Flight (ToF). Defined in 802.11-2016 [START_REF]Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specification[END_REF] and augmented in the 802.11az amendment (planned for publication in 2022), FTM enables an initiating station (ISTA, typically a mobile Wi-Fi client) to perform ranging exchanges with a responding station (RSTA, typically a Wi-Fi system set at a fixed location, e.g., an access point) and also query the RSTA location. Performing such exchange with multiple RSTAs allows the ISTA to compute its location.

FTM does not include an AP validation mechanism, and an attacker can send invalid range or location information, driving the ISTA off course. Such attack could have dramatic consequences in some environments, for example self-driving shuttles in convention centers and airports that use FTM to assess their position. This paper shows that 1. an attacker can easily drive an FTM station to the destination of the attacker's choice 2. protection techniques intended for similar ranging technologies (GPS) are mostly ineffective, because of FTM fundamental properties and assumptions 3. 802.11 security techniques also provide only limited protection, but 4. a crowd-sourcing technique that augments the Pre-Association Security Negotiation (PASN) process (an unauthenticated 802.11 security procedure) to make it 802.11r, or Fast Transition equivalent, coupled with a better AP sorting algorithm, can dramatically reduce the attack surface.

The rest of this paper is organized as follows: Section 2 exposes how FTM computes range and location and why it is vulnerable to attacks. Section 3 details why current protection techniques, for GPS or 802.11, cannot protect FTM efficiently. Section 4 presents an improvement to 802.11 security that can limit FTM exposures to ranging and location attacks. Section 5 demonstrates how this proposed method reduces exposure in various experimental scenarios, while Section 6 concludes this paper.

FTM Vulnerabilities to Ranging and Location Attacks

FTM is particular in the 802.11 world. It is the first 802.11 protocol where a station (STA) exchanges unassociated user-targeted content with an access point (AP). Prior provisions of the Standard allowed an AP and a STA to exchange elements pre, or without association. However, these provisions were either intended to provide general information to the STA about the services expected to be found at or beyond the AP (e.g., clause 11.22.3. in [START_REF]Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specification[END_REF]), or were focusing on radio parameters exchanges to allow the STA to associate to the best AP (e.g., clause 4.3.11.1 in [START_REF]Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specification[END_REF]). But with FTM, the result of the unassociated exchange is directly leveraged for user-centric purposes (finding one's location indoors). This trend has since appeared with other provisions (e.g., 802.11bc allowing a STA to discover and receive video broadcast without association). 802.11 was not engineered to protect such exchanges, leaving the STA exposed to attacks.

FTM Principles

Understanding the principles of FTM is necessary to understand the attack vector. The ISTA starts by negotiating with the RSTA some ranging session parameters (intended number of exchanges over a given number of bursts). Then, in each burst, the RSTA first sends a frame at time 𝑡 1 , which is received by the ISTA at time 𝑡 2 . The ISTA replies at time 𝑡 3 with an acknowledgement frame, received by the RSTA at time 𝑡 4 . In the subsequent frame, the RSTA communicates the values (𝑡 1 , 𝑡 4 ) to the ISTA. The ISTA can then compute the messages times of flight (ToF) [(𝑡 4 -𝑡 1 ) -(𝑡 3 -𝑡 2 )] and thus its distance to the RSTA. In a related exchange, the ISTA can request from the RSTA its Location Configuration Information (LCI), a set of geographical coordinates which logic is similar to that defined in RFC 6225 [START_REF] Polk | Dynamic Host Configuration Protocol Options for Coordinate-Based Location Configuration Information[END_REF]. The exchange repeats several times. In a typical implementation, the ISTA then retains the smallest ToF, with the reasoning that direct line of sight (LoS) path always produces the shortest ToF.

The 802.11-2016 or 802.11az Standards do not define a method for computing location from these elements. However, it should be clear that the position is computed solely from the ToF and LCI values extracted from the frame exchanges with the local RSTAs.

Several techniques exist for such location computation. Geometric methods, like the simple three spheres method, consider the distances as the radii of matching spheres and find their intersection (when it exists). Another technique organizes the measured distances in a matrix, then attempts to minimize the error between the positions computed from the distance to each RSTA. A third common technique is the use of an extended Kalman filter (or an alpha-beta filter). Shareef and Zhu [START_REF] Shareef | Localization using extended kalman filters in wireless sensor networks[END_REF] provide a good introduction to this technique. Kalman filters are popular in technologies where the subject is expected to move, which is the case with FTM. For this technique like the previous ones, because the measured distances are noisy [START_REF] Horn | Doubling the accuracy of indoor positioning: Frequency diversity[END_REF], using more than 5 to 6 responders offers diminishing incentive, as ranging to each additional RSTA increases the energy and ranging (airtime) cost with a decreasing accuracy gain.

Ranging and Location Attacks on FTM

Thus, these techniques use the distances to 3 to 6 APs. However, 802.11 specifies that a STA can only associate with one AP at a given time. Therefore, even if the STA associates to a first AP, its exchanges with the other APs will be unassociated, leaving the ranging exchanges unprotected.

A simple attack vector is thus to add an AP that returns manipulated (𝑡 1 , 𝑡 4 ) or LCI values. The victim's machine then unwittingly integrates these values into its location computation. Because the exchanges are unprotected, the attacker can also spoof the MAC address of a valid AP and add its answers to that of the real AP. Client stations prefer the shorter range as explained above, and thus will retain the attacker's returned (𝑡 1 , 𝑡 4 ) values if they are smaller than the real AP's. In an environment where the AP positions are known, and the victim path predictable (e.g., along hallways), ensuring such conditions is trivial.

We studied such effect in [START_REF] Henry | Ranging and Location attacks on 802.11 FTM[END_REF] with a setting represented in Figure 1, where 5 valid APs are deployed along the victim path. One to three temporal attacker APs are then introduced, sending invalid (𝑡 1 , 𝑡 4 ) values or invalid LCI. As the STA starts detecting the invalid AP (labelled AP6 in the figure) and integrating its values into the computation mix, the victim's STA calculated location deviates from its true position.

When knowing the type of algorithm that the victim would use (e.g., because the victim location app is known), the attacker can insert targeted false values selectively and progressively, pushing the victim away from its real trajectory and toward a destination of the attacker's choice. This possibility is illustrated in the upper part of Figure 1, where the attacker drives the victim toward a target 13 meters away from the intended path (after a 38-meter walk) and represented by a cross (envisioning location determination through the three-sphere method [top left], a least square technique [top center] and a Kalman filter [top right]).

Such attack may not be of consequence if the victim is a human in a casual setting, who also uses other input for trajectory determination (e.g., visual inspection of the environment in search of a particular object, like a store in a shopping mall), although a human victim may not carefully validate the trajectory provided by a navigation device and still be driven off course. However, the consequences can be more severe if the victim is a robot guided through FTM to operate a particular task (e.g., self-driving delivery robots in hotels or convention centers, self-driving shuttles in indoor amusement parks, airports and other public venues, etc.), without a multiplicity of other validation techniques. In all these cases, an attack on FTM used as the primary navigation source can cause the robots to bring about damage, hit equipment, hurt people, or lose certainty about its location and paralyze operations. In a world with aggressive business competition and hostility between state actors, such an attack is an easy and cheap vector to conduct.

Insufficiency of Existing Protection Solutions

FTM is not the only location solution relying on distances, and not the only 802.11 technology where data validation is required, so one could think that the problem is well-known and possibly solved. However, FTM is a young protocol and the literature has not yet studied the issues that this paper exposes.

Related Work

Although there are multiple methods to determine the location of an RF object indoor [START_REF] Yassin | Recent advances in indoor localization: A survey on theoretical approaches and applications[END_REF], the most scrutinized location technique based on ToF is GPS. Just like FTM, GPS uses the estimated distance to multiple satellites, which positions are known, to determine station location. Similar to FTM, the GPS signal available for civilian usage is neither encrypted nor authenticated. The same limitation is currently true for the other systems, Gallileo, GLONASS, Michibiki, BeiDou and NavIC, although protection schemes have been proposed for the BeiDou protocol [START_REF] Hu | A security transmission system for beidou short message based on SM9[END_REF].

There are many documented attacks techniques against GPS that are similar in concept to the attacks against FTM that this article studies. These attacks spoof the identity of one or more valid satellites [START_REF] Su | A Stealthy GPS Spoofing Strategy for Manipulating the Trajectory of an Unmanned Aerial Vehicle[END_REF], and provide signals which timing and timestamps cause the station to misevaluate its distance to the source [9] and compute an incorrect location [START_REF] Horton | Development of a GPS spoofing apparatus to attack a DJI Matrice 100 Quadcopter[END_REF].

In some cases, these attacks can be detected. A simple technique is to use Receiver Autonomous Integrity Monitoring (RAIM) [START_REF] Hewiston | Gnss receiver autonomous integrity monitoring (raim) performance analysis[END_REF]. With this technique, the client uses a rolling subset of satellites, and alerts if any particular satellite contribution provides results inconsistent with the others.

Additional techniques look at each individual signal. For example, Foruhandeh et al. [START_REF] Foruhandeh | Spotr: GPS Spoofing Detection via Device Fingerprinting[END_REF], fingerprint each satellite signal, and recognize the impersonation by matching the received signal against the expected signature. Other techniques use fusion to compare the GPS-computed location with estimations from other sources, like cellular towers [START_REF] Oligeri | Drive me not: Gps spoofing detection via cellular network: (architectures, models, and experiments[END_REF] or accelerometers and other sensors internal to the station [START_REF] Lee | GPS spoofing detection using accelerometers and performance analysis with probability of detection[END_REF]. More complex, multi-factor detection methods naturally augment the reliability of the detection [START_REF] Hu | A composite detection method for direct GPS deception attack[END_REF], for example when neural networks combine all contributing elements together to determine if one of them is surfaced as an outlier [START_REF] Shafiee | Detection of spoofing attack using machine learning based on multi-layer neural network in single-frequency gps receivers[END_REF].

All these techniques mitigate the surface attack, but do not completely remove it. A large trend is to apply to the civil GPS the same authentication and encryption scheme as military grade GPS [START_REF] Wesson | Practical cryptographic civil gps signal authentication[END_REF], thus disabling the spoofing risk, and complement security with resilience features to disable the jamming risk [START_REF] Molina-Markham | Probabilistic models for assured position, navigation, and timing[END_REF].

Applicability Limitation of GPS-attack Solutions

Unfortunately, GPS-attack protections that apply fusion techniques [START_REF] Henry | Ranging and Location attacks on 802.11 FTM[END_REF] prove often insufficient for FTM. These techniques use a primary source, and one or more secondary (less accurate or reliable) sources. The values coming from the secondary sources are used to spot outliers in the primary source, but then the primary source data is used to compute location. In other words, the secondary sources augment, but do not entirely replace, the primary source. GPS is commonly not available inside buildings, and cell tower triangulation is also usually not possible. The STA can collect information from movement sensors (gyroscopes etc.), and the combined information from these sources (Pedestrian Dead Reckoning, PDR) to compute the movement of the object containing the sensor. PRD is a very promising direction for indoor positioning, and provides good results in constrained scenarios e.g., for example when the sensors are attached to the user's foot [START_REF] Wu | A survey of the research status of pedestrian dead reckoning systems based on inertial sensors[END_REF]. In the cases addressed by FTM however, the trajectory can change rapidly, causing the accuracy of the values returned by the sensors to dissolve with distance [START_REF] Simoes | A review of technologies and techniques for indoor navigation systems for the visually impaired[END_REF]. For example, a user may have parked in the underground garage of a shopping mall, have a smartphone in their hand, then their pocket, then hands again, while the user undergoes a complex trajectory (stopping, moving aside to navigate through a crowd with constantly changing speed, slowing down and turning near store windows etc.), each change introducing errors into the positioning algorithm [START_REF] Ma | Pedestrian dead reckoning trajectory matching method for radio map crowdsourcing building in wifi indoor positioning system[END_REF]. Without an additional reliable source of reference, the STA cannot compensate for the continuous injection of invalid parameters. Wi-Fi commonly cannot be the primary or the secondary source reliably. This difficulty is caused by the fact that Wi-Fi ToF values are usually noisy. With obstacles and multipath, there is no good correlation between the AP signal strength and the calculated distance, and the precision of measurement is low. Therefore, fusion is not a sustainable solution for FTM.

Other GPS attack protection techniques that rely on signature and fingerprinting are also not transferable. With billions of Wi-Fi APs on the planet, and the assumption that a core use case for FTM is a human with a handheld device (e.g., a smartphone) in an unfamiliar venue, the designers of FTM have not implemented any validation technique, and there is no global database that the ISTA could use to verify the identity of each AP in range.

RAIM-like mechanisms are not widely implemented yet in FTM-based app. However, even when they are, we have shown [START_REF] Henry | Ranging and Location attacks on 802.11 FTM[END_REF] that the progressive insertion of invalid parameters could defeat the protection.

Therefore, although the attack exposure of FTM is similar to that of GPS attacks, the particularities of FTM makes that the solutions for GPS-attack mitigation cannot be transparently transposed to the FTM case.

Limitations of IEEE 802.11 Solutions

Another avenue to explore could be to leverage 802.11 existing solutions. For example, 802.11 association can be followed with a mutual authentication mechanism, where both the STA and the infrastructure prove that they know a shared secret (which is a proof that the AP is legitimate). It could be suggested to use this mechanism to protect the FTM exchanges. However, besides the difficulty that each ISTA would need to be configured with credentials for the local SSID, the entire procedure commonly takes 300 milliseconds (and can take more than one second when the 802.1X/EAP part relies on an external RADIUS server). Once association is complete, the STA can leave the AP cell and re-join with a re-association process, which delay is much shorter (80 to 100 ms).

This overhead can cause several problems. A first immediate issue is time consumption. In the FTM negotiation, the ISTA and the RSTA agree to meet on the channel at pre-determined points in time to exchange FTM frames in a burst. The designers understood that either side may be delayed. For this reason, the burst duration can last up to 128 ms. During that interval, each side will attempt to be on the channel and perform ranging. The ISTA will listen on the channel, waiting for the RSTA first FTM frame of the burst. The RSTA will send the first FTM frame, and wait for the first acknowledgement response from the ISTA (then retries repeatedly until the end of the burst when no acknowledgment is received). The ISTA and the RSTA also agree on an inter-burst interval, but if during that interval the ISTA goes to another channel and does not know if it will spend there 80 ms, 300 ms or more than a second before coming back, failed bursts are guaranteed to be a common occurrence. This would not be a reasonable design.

Another issue is the processing cost on the RSTA. The ISTA and RSTA negotiate a number of bursts (between 1 and 16384). If the ISTA reassociates for each new burst, then the AP potentially has to manage 16384 reassociation procedures per client and FTM session, each with a computing cost related to key verification (not to mention 80 ms inserted delay each time). A few stations performing rapid-fire ranging with multiple APs are susceptible to exhaust the APs computing resources. For these reasons, relying on 802.11 authentication has never been considered as a viable solution by the 802.11 designers of FTM.

These limitations do not mean that the ISTA cannot associate and perform FTM. The ISTA could associate with one AP, perform FTM with that AP, then go to other channels and perform unassociated and unprotected exchanges with the other APs. Quite obviously, this mode would offer very limited protection.

In an attempt to provide better exchange protection while limiting the overhead, 802.11az, the 802.11 Amendment for Enhancements for Positioning that expands FTM, defines a Pre-Association Security Negotiation (PASN), allowing an ISTA to establish a secure session with an AP/RSTA without association. This mode is efficient because it only relies on a two-frame exchange (plus one acknowledgement) with each AP. PASN exists in two modes. One mode supposes the existence of pre-existing shared keying material between the ISTA and the RSTA. In that mode, the ISTA and the RSTA then form what 802.11 calls a Robust Security Network Association (RSNA) authentication, in that they create a secure link and authenticate each other. This mode is efficient to protect from spoofing, as an attacker AP would not have the valid keying material, and would therefore not be able to insert frames in the exchange between an ISTA and a valid RSTA.

One clear limitation of this mode is the requirement to pre-populate the ISTA with the keying material. This is easily possible in a private setting (e.g., a factory with a single WLAN system). However, in a public venue, this constraint becomes difficult to overcome, even for a device that is expected to be familiar with the venue (e.g., a self-driving shuttle or delivery robot in a shopping mall). It is likely that there will be many APs and SSIDs (for example, an American shopping mall commonly includes 4 or 5 anchor large stores, and several dozens of small shops in between). APs may communicate over the back-end, but it is unlikely that the ISTA would have credentials for all stores and SSIDs. Even in a private setting, it is common to find zones with different SSIDs (for example department names in a hospital), forcing the implementers to configure multiple profiles on the device, even if the APs communicate with the same backend infrastructure (and thus even if the device credentials would be the same for all SSIDs).

Thus RSNA PASN provides an interesting, but incomplete direction for FTM protection. PASN also exists in a non-RSNA mode, where no initial keying material exists between the STA and the APs. In that case, a protected, but unauthenticated link is established ad-hoc between the STA and each AP, creating what some call "trust at first sight". The frames that the STA and the AP exchange (including FTM) are then encrypted. In this scenario, (𝑡 1 , 𝑡 4 ) and possibly LCI values can be protected from eavesdroppers. A similar unauthenticated but encrypted link is formed between the ISTA and each and any other AP with which the ISTA needs to range. This mode simplifies the deployment (no pre-existing keying material required), but does not include any validation structure. Thus, an attacker can pretend to be an additional AP in the system, or can impersonate (spoof) a valid AP. The ISTA would then establish an unauthenticated but encrypted connection to that rogue AP, with no means to know that the AP is invalid and send forged (𝑡 1 , 𝑡 4 ) and LCI values. The only protections that this mode offers are exchange obfuscation (an observer cannot see the values exchanged between the ISTA and RSTA) and session hijacking protection (an attacker can spoof the identity of a valid AP at the time of a new FTM session establishment, but cannot insert rogue values once a session has started with a valid AP).

A Crowd-Wisdom FTM Attack Exposure Mitigation Solution

Clearly, RSNA PASN is a good option for environments with a single SSID and a device that is familiar with the venue (and thus can be programmed with keying material). However, in environments with a single WLAN infrastructure but multiple SSIDs, or multiple neighboring WLAN infrastructures, or environments with which the device is not familiar (thus does not possess any keying material), RSNA PASN shows its limitation, and non-RSNA PASN offers no real protection.

For these environments, it is difficult to establish trust when no APs are known. However, we propose a mechanism to reduce the likelihood that a given contributing AP would be an attacker's. In a setting where there is no authentication, and no protected exchange, all exchanges are open to all abuses, and we do not believe that an easy remediation is possible. However, if an initial protection can be built between an ISTA and a first AP, we believe that partial further protection becomes possible. We write "partial" because without authentication, the protection stays limited, but it can be implemented in a way that makes the attack less trivial, and thus less attractive to an amateur attacker. Therefore, we next examine partial remediation options for cases where the ISTA is not associated to a network but can establish a protected link to APs.

Modified FTM AP Sorting Algorithm

One key assumption for this method is that the venue presents several APs announcing the same SSID. These APs communicate with each other (either in a mesh fashion, or because they are connected to the same management system, e.g., a WLAN controller). Other APs may be present in the same RF space, forming individual islands of Wi-Fi coverage around individual or shared SSIDs. In this environment, it is unlikely that the attacker can become the dominant system, i.e., deploy with impunity more APs than the valid network, without causing multiple rogue alarms on the main system and being detected. Most managed Wi-Fi systems can identify AP MAC address spoofing or SSID impersonation. An attacker can deploy one or a few temporal (physical or virtual) RSTAs for the duration of the attack, but is unlikely to have deployed a system larger than the venue legitimate WLAN infrastructure.

When initiating an FTM session, the ISTA needs to first establish a list of possible RSTAs. The ISTA starts by scanning all channels (standard 802.11 discovery) and establishes the list of channels and AP MAC addresses (Basic Service Set identifiers, BSSIDs) offering RSTA services. In traditional FTM, the ISTA would then directly start ranging against the first AP (i.e., the AP with the strongest signal, or the AP on the lowest channel in the band). We now propose instead that the ISTA sorts the BSSIDs by signal level, then considers BSSIDs within the same signal level (RSSI) range (e.g., within 6 dB of each other) as being a single system (for a reason that will become apparent later). We then propose that the ISTA operates a second sort, grouping the BSSIDs by their announced SSID. Thus, we propose that the ISTA starts by ranging against the RSTAs representing the largest system (max BSSID count for the given SSID). This first step is precautionary and does no offer any strong protection, but decreases the likelihood of ranging against a lone attacker, as will be seen.

We then suggest that the ISTA selects one BSSID at random within the largest SSID group, and first establishes a protected link to the RSTA, using PASN (likely, the non-RSNA PASN flavor). The goal of such link is to protect the exchange from eavesdropping. Although the largest group is likely to be a valid system, the attacker may impersonate one AP of the valid system, and thus it is possible that the first AP may belong to the attacker.

PASN and 802.11r

We then propose an augmentation of PASN, that we call PASN-FT, to allow secure link preestablishment to other APs. FT, or 802.11 Basic Service Set (BSS) Fast Transition (FT), was defined in the 802.11r-2008 amendment (integrated in the 2012 version of the 802.11 Standard), and is intended for RSNA, fast roaming key exchanges for associated STAs. In this mode, a STA first establishes a secure association (RSNA) with an AP. During that process, the 802.11 choreography allows for AP and STA mutual validation (as they both have to prove to the other that they have the right temporal keying material). The 802.11-FT process incorporates two major changes to the previous 802.11 association process:

• The AP advertises a Mobility Domain Element (MDE), which is a string representing the domain, i.e., the set of APs between which fast transition will be possible. The string is commonly an arbitrary set of characters (it does not need to have a meaning, and just needs to be common between APs participating to the same group). When roaming, the STA selects APs that advertise the same MDE.

• 802.11r establishes a new key hierarchy. Upon a STA first association, the WLAN infrastructures establishes a first Pairwise Master Key (PMK-R0). This key is derived from the Master Session Key (MSK), which is formed on the client side and the infrastructure side through the regular authentication process defined for 802.11. In a non-FT mode, the PSK is directly derived from the MSK (the PSK is the first 256 bits of the MSK). With FT, the PMK-R0 is derived by also integrating other elements, such as the value of the domain in the MDE, the SSID name, the STA MAC address and the identifier of the first entity with which the client establishes this first keying material (this can be the first AP MAC address, or a value for a centralized WLAN controller; this entity is later identified as the holder of the PMK-R0, or R0KH-ID). Then, for each AP, a PMK-R1 is established, built from the PMK-R0 value, the MAC address of the client and the MAC address of the target AP. When a STA needs to establish a communication with a first AP, it is provided the elements it needs to compute PMK-R0 from the MSK (that the client should be able to derive during the authentication phase, from its credentials or a pre-shared key). The client can then compute the PMK-R1 to associate with any AP in the domain, if the AP MAC address is known. From the PMK-R1, other keys are derived (temporal unicast keys).

This key hierarchy allows BSS-FT to enable a fast transition mode. When a STA needs to roam to a neighboring AP, a non-FT mode would mean that the STA should deassociate from the current AP, associate to the next AP, then undergo the full authentication exchange in order to derive a new PMK. This process can take a long time, as detailed in Section 3. With FT, the keying material required for association to the next AP can be derived while the STA is still associated to the first AP. BSS-FT allows two modes for that process:

• With the Over-the-air mode (OTA), the STA sends to the next AP an FT authentication request, that includes the PMK-R0 Name, the MDE, and a Fast Transition Information Element that includes the R0KH-ID. These elements allow the next AP to determine if it can build a PMK-R1. If the answer is positive, the next AP responds with an FT authentication response, that includes the elements the STA needs to derive the PMK-R1 value for the next AP.

• With the Over the Distribution System method (Over-the-DS), the STA first identifies the target next AP, then sends to its current AP an action frame requesting the establishment of keying material with the target AP. The request also includes the PMK-R0 Name, the MDE value and the R0KH-ID. The current AP should relay this request over the wire to the target AP. Similar to above, the target AP should determine if it can build the PMK-R1, and reply through the current AP (over the wire) if the answer is positive, with a frame containing the elements the STA needs to derive the PMK-R1 value for the next AP.

In both cases, the STA is then ready to communicate securely with the next AP. At any time, the STA can deassociate from the current AP, and send a reassociation request to the next AP, mentioning the PMK-R1 Name, the MDE, the R0KH-ID and the MAC of the target AP. The STA also mentions a message integrity check (MIC) that proves that the STA has the right keying materiel. The next AP replies in kind, and data communication can resume immediately.

PASN FT

802.11 BSS-FT was intended for associated STAs. However, we propose to adapt FT principles to the PASN case by adding to PASN exchanges the FT elements that do not strictly force the STA to undergo an association.

Thus, in this method, all APs part of the same infrastructure include the MDE in their probe responses and beacons. This informs the STA about which APs are claiming to be part of the same domain.

In PASN, the STA seeking to establish a secure link sends a first PASN 802.11 authentication frame to the first AP. The frame may include base Authentication and Key Management (AKM) parameters (if there is a pre-existing keying material that the STA can use), but also includes an ephemeral public key that the STA wishes to use (the STA also generates internally the matching private key). We add the MDE value to this frame.

In PASN, the AP responds with a second PASN authentication frame that includes the AP temporal public key (the AP also generates internally the matching private key), and optionally base AKM parameters (if the STA included them). We also add the MDE value to this frame.

In PASN, the STA then responds with a third PASN 802.11 authentication frame, that serves as an acknowledgment to the exchange. We reuse this frame unchanged.

At this point, the STA has established keying material with the AP and can undergo protected exchanges. With PASN, the secure link is established with a single AP at a time (the AP with which the STA wishes to communicate). We augment this procedure by allowing an Over-the-DS key pre-establishment with other APs. An OTA mode would also be possible, but presents limited added value. From an airtime consumption standpoint, the amount of frames to exchange would be equivalent to a direct PASN exchange with the next AP (thus bringing no airtime consumption, and no process time consumption, advantage). From a security standpoint, both the Over-the-DS and OTA modes prove that that the first AP has a trusted backend relationship with the second AP, thus that they belong to the same infrastructure. The OTA mode thus does not surface specific advantages.

The Over-the-DS PASN FT is illustrated in Figure 2, and works as follows:

• When in need to communicate securely with a second AP, the STA sends to the current AP a PASN FT authentication frame wrapped in a protected (robust) action frame. The frame resembles the PASN first frame, but also includes the MDE, and a Fast Transition Element (FTE) that includes the target AP BSSID (MAC address), and also the client intended MAC address (called S0KH-ID) for exchanging with the next AP. This last element offers an interesting additional protection. The STA can decide to use a different MAC address for its dialog with the next AP (using locally administered MAC addresses). As the frame is encrypted with the current AP public key, this value is obfuscated from an eavesdropper's view. This way, the infrastructure can keep track of the client queries while observers do not see a single STA.

• The current AP forwards this frame over the backend to the next AP. The next AP responds over the DS with a frame that resembles the PASN second frame, but also includes the MDE, the second AP MAC address, the target STA current MAC address (used by the STA to send the first PASN FT frame to the current AP) and the S0KH-ID. The frame also includes the FTE that includes a timeout value. This value tells the STA the interval for which the current keying material will be valid.

• The current AP relays the frame to the STA. The STA validates the frame components, and returns an acknowledgement frame. The frame resembles the PASN third authentication frame, but also includes the FTE that mentions the next AP MAC address, and the client intended MAC address (S0KH-ID).

At this point, the STA is ready to communicate securely with the next AP. Within the timeout interval specified by the next AP, the STA can switch to the next AP channel and directly send protected data (using as a source MAC the S0KH-ID value). The STA can this way pre-establish secure links with a multiplicity of APs, then switch to their respective channel in turn to proceed to protected FTM exchanges. This process does not guarantee that no attacker will insert in the exchange. However, this methods greatly limits the risks, as four permutations and scenarios are possible:

Current AP Next AP Legitimate Attacker Legitimate (1) (2) Attacker (3) (4)
1. The APs can communicate over the backend and the STA can successfully establish a secure connection to the next AP.

2. The legitimate AP does not have a trusted relationship to the attacker AP, and rejects the PASN-FT request from the STA. 3. The attacker AP may attempt to pass the PASN FT request to the legitimate AP, but they do not have a backend trusted relationship. The attempt fails and the STA does not receive a response from the next AP.

4. The APs may communicate over the backend, and the STA may be able to successfully establish a secure connection with the next AP.

It should be noted that, because the STA merges RSTAs with the same RSSI as indicated above, scenario (4) only succeeds if the attacker has positioned 2 different physical APs. Scenarios (2) and (3) do not directly allow the STA to determine that one AP is illegitimate. From the STA viewpoint, the PASN FT process failed, possibly because one of the APs is illegitimate, or because both APs are legitimate but in disjoint systems (a less common, but possible case).

However, as the process repeats with more APs, the STA surfaces groups of APs that have a backend trusted relationship, and outliers APs (𝐴𝑃 𝑂 ) that are not trusted by others (because requests made to an 𝐴𝑃 𝑂 to PASN FT toward other APs will usually fail, and requests made to other APs to PASN FT toward an 𝐴𝑃 𝑂 will also usually fail, unless the other AP is also an 𝐴𝑃 𝑂 ). The STA can then use these groups of largest APs having a trusted relationship as the set of RSTA from which location is computed. These are likely to be legitimate, unless the attacker is the dominant system in the venue.

Experimental Validation

We tested this method in two different environments. The first setting is similar to the attack test setup described earlier (5 legitimate APs, and the attacker emulating one to three APs), and leads to the following observations:

1. The attack fails in 100% of cases where the attacker presents a single AP. This is likely because that AP cannot form a group large enough to be usable (and of course the AP also fails to establish PASN-FT with the other APs).

2. When the attacker emulates three APs, the attack fails if the APs are all emulated from the same physical system (e.g. virtual APs on the same laptop, or physical APs at the same location). Despite RF signal stochasticity, all APs then present an RSSI in the same range and get merged by the filtering procedure (thus leading the STA to the same conclusion as above).

3. When the attacker deploys 3 non-co-located APs, the attack fails for any location method using 4 APs or more (e.g., least square or Kalman filter with 4 or more RSTAs, Figure 1 bottom center). This outcome is expected. For location method using 3 APs, the attacker system becomes self-sufficient and may partially succeed. The STA temporarily follows the attacker's data, then suddenly jumps back to the correct trajectory as soon as contributors from the valid system are introduced (Figure 1 bottom left). When using Kalman filtering, the slide toward the correct path is progressive, as the system arbitrates between the observed and the computed values (Figure 1 bottom right).

4. The above attack succeeds only if the attacker system is within the first 3 APs to be attempted by the STA, and if the attacker system is large enough to be entirely sufficient for the STA calculations (i.e., 3 APs for the 3-sphere methods, and up to 6 APs for other methods). The STA then forms 2 groups of non-compatible sets (the legitimate APs, and the attacker's APs) and can then randomly consider the location by the valid AP set, or the attacker's AP set.

The second setting is a shopping mall with 4 major store anchors and a multiplicity of smaller stores, each with an individual SSID. The mall is set on two floors, and Figure 3 represents the ground floor. A user walks along the main corridor path, from bottom to top (represented by a dashed line).

In this environment, without changes, the attack fails in all attempts. One likely reason is that, at any point of the path, 9 to 11 APs can be heard that form groups larger than 4 APs, from a combination of the main mall Wi-Fi and one of the anchors'. In such environment, the attacker is unable to establish a system large (and distributed) enough to compete with one of the valid groups.

Forcing the ISTA to ignore the main mall Wi-Fi (supposing a targeted denial of service) does not allow for an attack vector either, because at least one of the anchors' Wi-Fi can be detected from any location along the path (commonly with 4 APs or more). In some areas (mid-point on the walking path), only one anchor's SSID is detectable, and its APs are all in the same direction (to the right). Location precision dilution occurs in this zone if only the anchor's SSID is used. Adding the smaller stores RSTAs restores the precision. Even when an individual store does not allow for PASN-FT with others, the anchor's RSTAs serve as a reference and the attacker is also identified as an outlier (when injecting forged LCI or (𝑡 1 , 𝑡 4 ) values causing an error larger than that resulting from computing location with valid RSTAs).

Forcing the ISTA to also ignore the anchors' Wi-Fi systems provides only a mild attack vector. Although each store display a specific SSID, in effect, many of the smaller stores use APs managed by the mall (and therefore would be displaying the same MDE value), even as most stores complement the system with home or small-business grade APs. These other APs may not communicate with one another over the wire. It is only when removing all small store APs that communicate over the wire that the attack succeeds. However, such a dramatic scenario (all major stores, and the entire shopping mall main WLANs are disabled, only isolated single-AP SSIDs remain) is unlikely in a real environment.

Conclusion and Future Work

In this paper, we have shown that 802.11 FTM is vulnerable to ranging and location attacks. As the client does not know in advance the APs, and as the exchanges are neither authenticated nor protected, an attacker can easily insert an additional AP that provides invalid ranging or position (LCI) information. The client has limited ability to distinguish the attacker's from valid APs, and tends to integrate the data provided by the attacker, if it is not excessively implausible, into its location computation.

The existing IEEE 802.11 Standard, along with a modification of the PASN protocol to allow for fast transition between APs, can be used to mitigate the attack exposure. The effect of these simple changes is to turn the attack from "trivial" to "challenging". There is still a weak vector left, where the attacker is one of the first APs picked by the ISTA and has deployed a system as large as the main WLAN. Future work will examine how deeper protection can be achieved, for example by moving the LCI information into a trusted database that the ISTA could interrogate (e.g., while retrieving the venue map), instead of relying of over-the-air interrogation of APs that the ISTA cannot completely trust.

Figure 1 :

 1 Figure1: Top: Injection of misleading LCI with the three-sphere method (left), the matrix method (center) and a progressive injection for the Kalman filter method (right), leading target toward the location marked with a cross. Bottom: the same attack attempts against PASN-FT and the improved AP selection method proposed in this paper. The victim real position is marked p, the forged path 𝑒, real AP responders with a triangle and the attacker APs with a square.

Figure 2 :

 2 Figure 2: Proposed PASN-FT choreography. The elements that diverge from strict PASN are labelled in boldface.

Figure 3 :

 3 Figure 3: Attack attempts with PASN-FT.


Guillaume Cabanac
email: guillaume.cabanac@univ-tlse3.fr

Bibliogifts in LibGen? A study of a text-sharing platform driven by biblioleaks and crowdsourcing

Keywords: Research, Publication, LibGen, Biblioleaks, Crowdsourcing, #icanhazpdf

Research papers disseminate the knowledge produced by the scientific community. Access to this literature is crucial for researchers and the general public. Apparently 'bibliogifts' are available online for free from text-sharing platforms. However, little is known about such platforms. What is the size of the underlying digital libraries? What are the topics covered? Where do these documents originally come from? This paper reports a study of the Library Genesis platform (LibGen). The 25 million documents (42 terabytes) it hosts and distributes for free are mostly research papers, textbooks, and books in English. The paper collection stems from isolated but massive paper uploads (71%) in line with a 'biblioleaks' scenario, as well as from daily crowdsourcing (29%) by worldwide users of platforms such as Reddit Scholar and Sci-Hub. By relating the DOIs registered at CrossRef and those cached at LibGen, this study reveals that 36% of all DOI papers are available for free at LibGen. This figure is even higher (68%) for three major publishers: Elsevier, Springer, and Wiley. More research is needed to understand to what extent researchers and the general public have recourse to such text-sharing platforms, and why.

Introduction

Are biblioleaks inevitable? In a stimulating essay, opening like a sci-fi novel [START_REF] Dunn | Is Biblioleaks inevitable[END_REF] coin the neologism 'biblioleaks' with reference to the information leakage cases that have made the news in the past few years. What if so-called hackers infiltrated the digital libraries of major subscription-based publishers, downloaded scientific articles en masse, and released them through anonymous peer-to-peer networks? With growing incentives from people hitting paywalls1 daily, and virtually no technical barriers high enough to stop high-profile hackers, this essay stresses how feasible this scenario is.

Well. . . Biblioleaks are happening right now: various text-sharing platforms distribute tens of millions of documents online for free. However, these are still unknown to most of academia. Only a handful of papers acknowledge their existence in short passages (e.g., [START_REF] Egorov | The specifics of access to scholarly journal literature in the digital society[END_REF][START_REF] Veletsianos | Open practices and identity: Evidence from researchers and educators social media participation[END_REF] and no systematic study of the available collections has been undertaken until now.

In this paper, I study a prominent text-sharing platform: the Library Genesis, also known as LibGen (libgen.org). As of January 2014, it hosted and distributed 25 million digital documents, 95% of which being for educational purposes (i.e., scientific articles, books, and textbooks) and the other 5% for recreational purposes (i.e., fiction books and comics). This collection arguably covers a significant share of the scientific literature, as 1.3 million journal papers were published in 2006 [START_REF] Björk | Scientific journal publishing: Yearly volume and open access availability[END_REF]).

In addition to biblioleaks feeding LibGen (i.e., a few isolated but massive additions of materials), there is evidence of crowdsourcing happening continuously. This terms encompasses many activities and more than 40 definitions (Estellés-Arolas & González-Ladrón- [START_REF] Estellés-Arolas | Towards an integrated crowdsourcing definition[END_REF]. I use it here to qualify the explicit collaboration of people who build a distributed collection of items that can be shared among users (Doan, Ramakrishnan, & Halevy, 2011, p. 88). I discuss how people crowdsource papers through various channels, such as Reddit and Sci-Hub. They request papers that eventually get cached at LibGen, thus contributing to increasing its collection. The growing popularity of the #icanhazpdf hashtag on Twitter is yet another manifestation of [START_REF] Wark | Copyright, copyleft, copygift[END_REF] gift economy, with people relying on their social relations to access literature. However, such 'bibliogifts' may contravene copyright laws and more research is needed to assess the legal issues related to these materials and text-sharing platforms.

Data and Method

The LibGen website runs a search engine allowing users to search and download materials directly from its servers. Files are available for individual download2 or bulk download via peer-to-peer torrent files. LibGen releases all its code and data to foster the deployment of several mirrors (e.g., gen.lib.rus.ec) and to launch other websites (e.g., bookzz.org) according to its online documentation (see Appendix). The data stored in its relational databases associate the metadata of the available files with their URL.

This paper reports a study of the four MySQL databases run by LibGen (Table 1). All the cataloged materials are recorded with various metadata, such as title, authors, DOI,3 journal or conference title, and volume/issue (for journal papers). Information specific to LibGen is also provided, such as when the file entered the cache and where the full-text version of the cached document is located on LibGen's servers.

In this study, I rely on DOIs assigned to papers to estimate the coverage of the scientific literature by LibGen. On the one hand, papers available from LibGen have their DOIs recorded in the scimag database. On the other hand, the CrossRef DOI registration agency represents 4,751 publishers and societies called registrants. This agency runs the CrossRef Depositor service4 releasing the following data about the registrants and DOI allocations:

• The journals published by each registrant with the number of DOIs assigned per journal.

These DOIs are used to identify papers, editorials, reviews, and so on. DOIs are grouped according to journal titles. For example, the 65 volumes of JASIST are distributed into four records of the Depositor, as the journal has been successively known under four titles (Table 2). Note that the 'journals' listed in the Depositor include bulletins, news, forum, and more. For example, the following are listed for the Association for Computing Machinery: ACM Transactions on X, ACM SIGGROUP Bulletin, ACM SIGACT News, ACM SIGBIO Newsletter, ACM SIGIR Forum, ACM Inroads, ACM SIGPC Notes, ACM Queue, and more.

• The conference proceedings published by each registrant with the number of DOIs assigned per proceedings. These DOIs are used to identify conference papers.

• The books published by each registrant with the number of DOIs assigned per book. These DOIs are used to identify book parts, such as book chapters.

Each DOI has a prefix that uniquely identifies its registrant. For example, the registrant of the DOI '10.1098/rstl.1665.0001' is 'The Royal Society' (with identifier '10.1098') and 'rstl.1665.0001' is the identifier of [START_REF] Oldenburg | Epistle dedicatory[END_REF] in the library of the registrant. Although the DOI System was launched in 1997 [START_REF] Davidson | Digital Object Identifiers: Promise and problems for scholarly publishing[END_REF], publishers assigned DOIs to publications pre-dating the introduction of DOIs retrospectively -even the first paper published in the first journal has a DOI [START_REF] Oldenburg | Epistle dedicatory[END_REF]. I rely on registrant identifiers to compute the coverage of publishers' digital libraries by LibGen in this paper.

Browsing the Digital Shelves of LibGen

Figure 1 shows the growth of the collection of educational (scimag and bookwarrior databases) and recreational materials (fiction and comics databases) available at LibGen. The largest database (scimag) comprises 22 million scientific articles that were progressively collected from October 28, 2012 onwards. The number of papers cached per day is usually low (Mdn = 2,720 and Avg = 52,957) compared to the four discontinuities clearly visible in the cumulative distribution. April 30, 2013 saw the largest growth with 12,466,342 papers added on that day, representing 55% of the current collection. Overall, 71% of the scimag papers stemmed from uploads of more than 100,000 papers a day, which occurred on 13 days in total. These figures suggest that biblioleaks as imagined in the essay by [START_REF] Dunn | Is Biblioleaks inevitable[END_REF] have already happened.

The three other databases represent 10% only of the LibGen collection. Scientific books (bookwarrior database) were collected from 1997 onwards, with a strong increase in the frequency of additions after 2009. Fiction books (fiction database) were added from 2011 onwards, though less frequently than scientific books. Finally, the comics collection (comics database) started in 2001 and it has grown on a daily basis since 2009.

The following sections discuss the features of the 25 million materials available from the four databases run by LibGen.

Scientific Articles

LibGen distributes the PDF files of scientific articles published in 27,134 journals by 1,342 publishers (Figure 2). Journals are partially indexed, with only one paper available for some journals and all the papers published in each volume for others. 5 LibGen covers 78% of all journal titles (Table 3). This large coverage suggests that LibGen is not focused on a few publishers or journals. Some publish open-access journals only (e.g., BioMed Central, Hindawi, PLOS), but this is not the case for the majority of publishers shown in Figure 2. 5 See the individual record of each journal available from the journal list (e.g., http://libgen.org/ scimag/journals.php?letter=A lists journals with titles starting with 'A'). Table 3 focuses on three of such major publishers, where the number of journals indexed was summed for all 'variants' of a publisher's name (e.g., Springer in Table 3 aggregates the values of Springer, Springer-Verlag, Springer US, Springer Netherlands, and the other lower-ranked variants shown in Figure 2). LibGen covers (at least partially) an average of 59% of all the journals published by Elsevier, Springer, and Wiley. After assessing the presence of journals in LibGen, I wondered about the distribution of the cached papers across publishers. The prefix of the DOIs assigned to papers (identifying registrants) was used as a proxy for publishers (database field scimag.publishers.doicode). There were 1,064 registrants overall, with a highly skewed distribution of cached papers (Figure 3). After grouping registrants related to a single publisher, Elsevier (42%), Springer (20%), and Wiley (22%) account for 83% of all of the papers cached at LibGen.

The coverage of LibGen in terms of research papers (Table 4) was assessed by dividing the number of cached papers (LibGen) by the number of papers published in each of the digital libraries (i.e., the number of assigned DOIs given by CrossRef). Note that all the DOIs assigned by CrossRef might not have been used by registrants yet (e.g., papers to appear), which implies that the results reported here are conservative. LibGen hosts 36% of all papers with DOIs. Its coverage is higher for the three aforementioned publishers with an average of 68% of all papers published by Elsevier, Springer, and Wiley that are distributed at LibGen. Wondering about the topics of the papers available from LibGen, I labeled each paper with the research field of the journal it was included in, as found in the Essential Science Indicators6 (ESI). This database published by Thomson Reuters lists 11,155 journals, each one being classified into one of 22 research fields. About one-third of the LibGen papers appeared in journals not included in the ESI (Figure 4). Clinical medicine and chemistry feature more than 10% of the remaining papers, while the other research fields represent 5% or less of all LibGen papers. The collection distributed at LibGen is up-to-date, as the most recent papers are published in 2014. The oldest paper available [START_REF] Oldenburg | Epistle dedicatory[END_REF] appeared in the first issue of the Philosophical Transactions of the Royal Society of London, which is recognized as the first scientific journal [START_REF] Singleton | The first scientific journal[END_REF]. Figure 5 shows the distribution and exponential model of the number of cached papers published during the last 60 years. Half of the papers where published after year 2000. The decline in 2013 with 'only' 601,969 papers available (compared to 1,156,322 in 2012) looks like an interruption of service. However, more likely, it might reflect the delay of paper caching.

Scientific Books and Textbooks

LibGen also distributes 1,126,091 scientific books and textbooks, 88% of which were published between 1953 and 2013 (Figure 6). Most of the books and textbooks are written in English (65%) and Russian (22%). PDF is the most frequent file format (71% of .pdf files), followed by DjVu (16% of .djvu files), and electronic publication (5% of .epub files). Some books are even available in multiple formats.

The bookwarrior database features a list of topics available for indexing purposes. The topic of 44% of the books and textbooks is known, although it is unclear how topics were assigned. Figure 7 shows the distribution of books and textbooks across these topics, with mathematics being the most frequent topic. Both the natural sciences and the social sciences are represented. 1953 1958 1963 1968 1973 1978 1983 1988 1993 1998 2003 2008

Fiction books

In the category of recreational materials, LibGen distributes 932,307 fiction books. The publication date is known for only 46% of the books, which were mainly published after 2008 (Figure 8). This period corresponds to an increased availability of e-books [START_REF] Walters | E-books in academic libraries: Challenges for sharing and use[END_REF]. Most of the fiction books are written in English (74%). Electronic publication is the most frequent file format (30% of .epub files), followed by PDF (20% of .pdf files), and Mobipocket (12% of .mobi files). 1953 1958 1963 1968 1973 1978 1983 1988 1993 1998 2003 2008

Comics

Comics are another type of recreational material distributed at LibGen. Each of the 472,269 files distributed comes with its cover and title, such as "Superman The Dailies 1939Dailies -1942Dailies (2006))." The Comic Book Archive is the most popular format (68% of .cbr files and 26% of .cbz files that is, compressed .cbr files), followed by PDF (2% of .pdf files). Unfortunately, fields documenting the other types of materials (e.g., publication date, topics, language) are not provided in the comics database.

Population of LibGen with Biblioleaks and Crowdsourcing

The growth of LibGen suggests that it has benefited from a few isolated but massive additions of scientific papers to its cache (Figure 1). For instance, 71% of the paper collection was uploaded in 13 days at a rate of 100,000+ papers a day. It is likely that such massive collections of papers result from biblioleaks [START_REF] Dunn | Is Biblioleaks inevitable[END_REF], but one can only speculate about this because of the undocumented source of each file cached at LibGen. With a median of 2,720 new papers uploaded a day, most additions to the text-sharing platform are not massive. People crowdsource papers to LibGen directly or indirectly. Direct uploading from a user provided PDF file and DOI is available from a regular webform hosted at libgen.org. Indirect uploading occurs when the papers that users request (via services such as Reddit Scholar and Sci-Hub -discussed in the following sections) get automatically uploaded to LibGen, thus contributing to its growth.

Crowdsourcing of Papers via the Scholar Subreddit

The reddit.com website is used to share (and vote for) hyperlinks to contents organized in categories called 'subreddits' [START_REF] Weninger | An exploration of discussion threads in social news sites: A case study of the Reddit community[END_REF]. The Scholar subreddit 7 was launched in June 2009 "for requesting and sharing articles available in various databases, as well as discussion relating to the material." Users are advised to "see if [the] article is already available by checking LibGen, Google, and Google Scholar" before requesting it. Another caveat is displayed on the front-page: "If the request isn't urgent, please try an interlibrary loan (ILL) first. ILL avoids potential copyright issues and lets libraries know which subscriptions are useful." Users of the service submit the metadata and hyperlink (DOI) of the requested papers, hoping that another user entitled to download the paper for free will share the PDF file by uploading it to LibGen and posting the hyperlink of the cached file on the text-sharing platform. Once a request is fulfilled, the Reddit user is advised to "mark [his/her] request as NSFW after it's been found." Posts marked NSFW (not safe for work) are then hidden from the other users to prevent them from seeking any paper already found. It is thus impossible to see the history of all requests on this subreddit. Nonetheless, I estimated that there are 17,000 posts per year requesting the PDF of a paper, based on my systematic monitoring of Reddit Scholar for a 3-month period (see code in Appendix). Unfortunately, I do not know the number of fulfilled requests, and the number of subsequent PDF downloads.

Crowdsourcing of Papers via Sci-Hub

The sci-hub.org website is used to download paywalled papers without paying a subscription to subscription-based publishers (Figure 9). Users requesting papers not present in LibGen are advised to download them from Sci-Hub ("Nothing was found: search in sci-hub.org?").

On Sci-Hub, papers are requested by submitting their DOIs via the form displayed on the front-page of its website. Sci-Hub is connected to computers worldwide that are running on networks entitled to access to subscription-based publishers. The user's browser is redirected to one of these computers, which acts as a proxy server to show the publisher's page for the requested DOI. The name and logo of the compromised institution are displayed -mostly Fig. 9 This activity diagram shows how Sci-Hub serves PDF files of papers through proxy servers operating on the networks of worldwide institutions. The user randomly switches proxy servers until he/she get connected to a proxy entitled to download the PDF of the requested paper.

universities and libraries -as if the user was operating from this distant location. When the proxy is operating on a network entitled to access the paper in full-text version, the user can download the associated PDF file. These PDF files bear the marks added by most publishers: Date and time of download, originating IP, and name of the (distant) institution. If the full-text version is not available from the current location, the user can randomly switch to another proxy server operating in a different institution, until he/she eventually finds a proxy entitled to download the PDF of the coveted paper. Sci-Hub also acts as a proxy to subscription-based services, such as the Web of Knowledge and the Journal Citation Reports run by Thomson Reuters (see screenshots in Appendix).

PDF files downloaded from Sci-Hub are served to users and automatically added to LibGen (if not already present). Further requests for already downloaded DOIs are fulfilled by serving the PDF file directly from the LibGen cache. This is how LibGen grows daily by adding the papers crowdsourced by the users of Sci-Hub.

Related Work

Volentine and Tenopir (2013) studied the value and outcome of scholarly reading for academic staff. Academics described scholarly articles as "critical," "essential," or "vital" to their work but, in the meantime, they complained about not having access to all the articles that they would like to read. Academics even expressed frustration and stated that they could not do research without the availability of scholarly articles.

Scientists and the general public [START_REF] Davis | The impact of free access to the scientific literature: A review of recent research[END_REF] rely on a wide range of channels to access research literature. Paper-based journals once embodied the dominant channel and one can still read papers in printed issues of journals or request hard copies via interlibrary loan. However, scholars are increasingly downloading papers and reading them on-screen, or printing them off [START_REF] Tenopir | Electronic journals and changes in scholarly article seeking and reading patterns[END_REF][START_REF] Volentine | Value of academic reading and value of the library in academics' own words[END_REF]. Papers are now available online from a variety of platforms. On the one hand, publishing houses run digital libraries, such as Elsevier ScienceDirect, and the Wiley Online Library. For paywalled papers (i.e., non open-access), one needs to pay a fee or to be affiliated to a subscribing institution. For open-access papers, there is no such barrier and papers are freely available to anyone to read [START_REF] Harnad | The access/impact problem and the Green and Gold roads to Open Access: An update[END_REF]. On the other hand, one can read papers for free from preprint repositories, such as ArXiv [START_REF] Davis | Does the arXiv lead to higher citations and reduced publisher downloads for mathematics articles[END_REF] and institutional websites where authors self-archive their papers [START_REF] Harnad | The self-archiving initiative [Commentary[END_REF].

People failing to retrieve papers through these channels have recourse to another more direct strategy: paper requests. There is a long tradition of readers requesting paper reprints from authors by post or email (Hartley, 2004a[START_REF] Hartley | On requesting re-prints electronically[END_REF]. But the success of this strategy depends on various factors, such as authors' willingness to honor such requests, and their swiftness in finding and sending the paper.

In a reflexive and autobiographic paper, Veletsianos (2013) considers how researchers participate in social media. He discusses how they defy restrictions to get papers through crowdsourcing. Research-oriented platforms (e.g., Academia.edu, Mendeley, and Research-Gate) now support readers who connect with a larger audience than the paper's author(s) who may or may not answer requests. Now, readers who use social media ask their (dozens of) followers/connections to check if they have access to the coveted paper for them. This practice is popular on Twitter, the leading microblogging service where users post short messages called 'tweets' [START_REF] Efron | Information search and retrieval in microblogs[END_REF]. The #icanhazpdf hashtag was coined in 2011 to mark tweets requesting the PDF file of a paper [START_REF] Bond | How #icanhazpdf can hurt our academic libraries[END_REF][START_REF] Dunn | Is Biblioleaks inevitable[END_REF][START_REF] Kroll | #icanhazpdf: Civil disobedience?[END_REF]. These tweets invite users entitled to access the requested paper to send it by email or direct message (i.e., non-public). Figure 10 illustrates this strategy. The first tweet recommends to use #icanhazpdf with the metadata of the requested paper, and advises the deletion of the tweet-request once the PDF is received. The second tweet requests a paper with #icanhazpdf and a link to the paper. While #icanhazpdf was far from being mainstream with about 1,000 requests posted between May 2012 and April 2013 [START_REF] Liu | Interactions: The numbers behind #icanhazpdf[END_REF], its use is clearly increasing.8

A C

@t In #icanhazpdf tweets: inc. link, lead author, date, your email address. Perhaps field too (e.g. 'physics'). Delete request once fulfilled. A final note relates to methodological discrepancies found in several studies that estimate the share of the research literature available online for free. Van Noorden (2013) summarized these in a Nature paper headlined "Half of 2011 papers now free to read" based on a report to the European Commission [START_REF] Archambault | Proportion of Open Access Peer-Reviewed Papers at the European and World Levels-2004-2011[END_REF]. According to Khabsa and Lee Giles (2014, p. e93949):

Our estimates show that at least 114 million English-language scholarly documents are accessible on the web, of which Google Scholar has nearly 100 million. Of these, we estimate that at least 27 million (24%) are freely available since they do not require a subscription or payment of any kind.

Prior work by Gargouri, Larivière, Gingras, and Harnad (2012, p. 286) 2010) designed a hybrid method combining the use of a standard search engine (i.e., Google) and manual validation. This allowed them to discard articles "openly accessible by accident, clearly against the [subscription] site policy" (Björk et al., 2010, p. e11273). While acknowledging this, Archambault et al. (2013, p. 5) "made no such attempt as [their] research question seeks to find what is available for free at a given time."

I believe that future studies should stress that apparent bibliogifts (i.e., papers available online for free) come from a variety of channels, such as publishers' libraries, institutional repositories, preprint repositories, personal websites, and text-sharing platforms. The scholarly documents available from LibGen through a URL (and thus retrievable from a search engine9 ) are free to download, but they are certainly not always distributed as open-access.

Conclusion

Access to the research literature is essential to the work of researchers [START_REF] Volentine | Value of academic reading and value of the library in academics' own words[END_REF] and the education of the general public [START_REF] Davis | The impact of free access to the scientific literature: A review of recent research[END_REF]. Gigantic text-sharing platforms supported by new practices on social media (e.g., #icanhazpdf on Twitter) are currently emerging to bypass any barriers preventing readers from accessing published research papers. This phenomenon is so recent that it has hardly been studied to date.

The present study focused on the LibGen text-sharing platform hosting 25 million documents (42 terabytes in size). This collection contains 95% of educational materials, such as scientific articles, books, and textbooks. It also distributes recreational materials, such as fiction books, and comics. Most of the documents were added en masse, as in the hypothetical 'biblioleaks' scenario imagined by [START_REF] Dunn | Is Biblioleaks inevitable[END_REF]. No less than 71% of the collection was collected at a rate of 100,000+ papers a day. Documents were also crowdsourced: directly on LibGen or indirectly via Sci-Hub. This latter service automatically adds to LibGen all of the retrieved papers from the proxy servers it operates in worldwide institutions. These figures reveal the extraordinary breadth of LibGen in academic publishing. As a comparison, only 1.3 million journal papers were published in 2006 [START_REF] Björk | Scientific journal publishing: Yearly volume and open access availability[END_REF]. Another point of comparison lies in the United States v. Aaron Swartz case [START_REF] Atkinson | The meaning and future of copyright[END_REF][START_REF] Sims | Library licensing and criminal law: The Aaron Swartz case[END_REF] which was concerned about the legality of 4.8 million papers downloaded from JSTOR -"about [their] entire database." 10Legal issues certainly apply to text-sharing platforms like LibGen for operating paper caching [START_REF] Borrull | Legal aspects of the Web[END_REF][START_REF] Oppenheim | Legal issues for information professionals IX: An overview of recent developments in the law, in relation to the Internet[END_REF]. Unfortunately, there is no systematic way to separate the documents that are in the public domain or published in open-access from those that are not. Reddit Scholar calls users' attention to legal issues: "Please be aware of copyright issues and Fair Use Copyright".11 Varian (2005, p. 125) elaborates on the concept of Fair Use in the U.S. as follows:

"Furthermore, under certain conditions, extracts from works that have been copyrighted may be reproduced. The U.S. Copyright Act of 1976 indicates that reproductions for purposes such as "criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." This "fair use doctrine" is essentially a defense against an infringement claim, and U.S. law indicates several factors that can be taken into account in such a defense, including the purpose of the use, the nature of the work, the proportion of the work copied and the economic impact of the use on the market. The fair use exemption is notoriously vague, but perhaps intentionally so, as it allows the law to deal flexibly with cases as they arise."

More research is needed to clarify the consequences of enjoying these bibliogifts. What are the penalties (if any?) incurred by the various worldwide users of text-sharing platforms, including the owners running the platforms, the users populating them en masse with biblioleaks, the users crowdsourcing one paper at a time, and the readers who download papers for free?

The availability of text-sharing platforms such as LibGen raises a variety of questions. How many people use this service? How did they become acquainted with it? What is the balance of users between scientists and the general public? For what purposes do users need the papers? Are they for educational purposes only? Are they for research-related projects related with, for example, text-mining [START_REF] Van Noorden | Trouble at the text mine [News In Focus[END_REF])? These open questions, and many more, require further research and studies involving a variety of users familiar with text-sharing platforms.

Appendix: Supporting Information

Additional supporting information may be found in the online version of this article at the publisher's website or at http://www.irit.fr/publis/IRIS/2016_JASIST_C.zip.

Fig. 1

 1 Fig.1Growth of the number of educational and recreational materials available at LibGen as of January 5, 2014.

Fig. 2

 2 Fig. 2 Distribution of the number of journals with at least one paper cached at LibGen (N = 27,134), by publisher -limited to the top 20 publishers among the 1,342 listed in the database.

  Fig. 3 Distribution of the 22,829,088 papers available from LibGen, for each registrant (DOI prefix and associated publishing house). Only the top 20 publishers in number of cached papers are showed, totaling 94% of all cached papers.

Fig. 7

 7 Fig.7Topics of the scientific books and textbooks available at LibGen. Books with unknown topic (i.e., 56% of all the 1,126,091 recorded books) are not included in this figure.

  Fig. 10 Example of two tweets published with the #icanhazpdf hashtag on Twitter (user accounts are anonymized). The first tweet recalls informal guidelines when requesting papers. The second tweet requests a paper by mentioning its title and hyperlink.

Table 1 Database dumps of LibGen downloaded from http://gen.lib.rus.ec/dbdumps on January 5, 2014. Each database stores the metadata and link to full-text for the cached materials.

 1

	Database		Cached materials
		Number	Size	Type of material
			(terabytes)
	scimag	22,829,088	15 Scientific articles
	bookwarrior	1,126,091	13 Scientific books and textbooks
	fiction	932,307	1 Fiction books
	comics	472,269	13 Comics
	Total	25,359,755	42 -

Table 2

 2 History of title changes for the JASIST journal.

	Active period Volumes Title of the journal
	1950-1969	1-20	American Documentation
	1970-2000	21-51	Journal of the American Society for Information Science
	2001-2013	52-64	Journal of the American Society for Information Science and Technology
	2014-	65-	Journal of the Association for Information Science and Technology

Table 3

 3 Number of journals from which at least one paper is available in LibGen and the number of journals published by DOI registrants at CrossRef.

	Publisher	Number of Journals	Coverage of
		LibGen CrossRef	LibGen
	All	27,134	34,670	78%
	Elsevier	2,503	3,925	64%
	Springer	1,814	3,394	53%
	Wiley	1,418	2,401	59%

Table 4

 4 Number of papers available at LibGen versus registered with a DOI at CrossRef.

	Publisher	Number of Papers	Coverage of
		LibGen	CrossRef	LibGen
	All	22,829,088 63,580,196	36%
	Elsevier	9,579,795 12,398,807	77%
	Springer	4,504,256	8,538,817	53%
	Wiley	4,973,954	6,848,146	73%

  Exponential distribution of the number of papers available at LibGen that were published between 1953 and 2013. This sample represents 95% of all cached papers published between 1665 and 2014 (N = 22,829,088).

													1,200,000
										y = 1E+06 e -0.057x
										R² = 0.9876		200,000 400,000 600,000 800,000 1,000,000	Number of papers cached at LibGen
													0
	1953	1958	1963	1968	1973	1978	1983	1988	1993	1998	2003	2008	2013
					Publication year of the papers
	10,000 20,000 30,000 40,000 50,000 60,000 Fig. 5 0 70,000

  Distribution of the publication years and languages recorded for the scientific books and textbooks available at LibGen. Books with unknown publication date (i.e., 9% of all the 1,126,091 recorded books) and unknown language (1%) are not included in this figure.

	Number of books available	at LibGen	0 200,000 400,000 600,000 800,000	65% English Russian German French Spanish Other 22% 8% 1% 1% 3% Language of the books	Number of books available at LibGen
				2013
				Publication year of the books
	Fig. 6

  Distribution of the publication years recorded for the fiction books available at LibGen. Those with unknown publication date (i.e., 54% of all 932,307 recorded fiction books) are not included in this figure.

	Number of fiction books	available at LibGen	0 200,000 400,000 600,000 800,000	74% English German 11%	5% Dutch Language of the fiction books 4% 2% Spanish Portuguese Other 5%	Number of fiction books available	at LibGen
					2013
					Year of publication of the fiction books
	Fig. 8

  relied on a program to "estimate what percentage of journal articles [. . . ] were freely available on the Web (OA) in September 2011." Khabsa and Lee Giles (2014) used specialized search engines (i.e., Google Scholar and Microsoft Academic Search) to search for a set of papers and estimate the number of scholarly documents available on the web. Björk et al. (

According toPickard and Williams (2014, p. 195) in the context of digital journalism "a paywall acts as a barrier between an internet user and a news organization's online content. To access content behind the paywall, users must pay a fee either on a one-time basis, or as part of a subscription."

See, e.g., http://libgen.org/scimag/get.php?doi=10.1002%2Fasi.20971 or its mirrored version http://lib.gen.in/36ba9ab556f46fcfcb52d37756b26891.pdf.

3 A Digital Object Identifier (DOI) is a character string (e.g., 10.1098/rstl.1665.0001) used to uniquely identify a digital object (see[START_REF] Davidson | Digital Object Identifiers: Promise and problems for scholarly publishing[END_REF]. Most papers are published with a DOI today. The DOI of this particular paper is 10.1002/asi.

23445. 4 cf. the CrossRef system reports http://www.crossref.org/06members/

http://about.esi.incites.thomsonreuters.com

The query #icanhazpdf on Twitter retrieves many tweets posted every day about paper requests, see https://twitter.com/search?q=%23icanhazpdf.

While http://libgen.org/robots.txt currently forbids robots to crawl LibGen, not every mirror enforces the same policy. Moreover, documents hosted at LibGen can also be indexed when a crawler follows a direct link to it (e.g., http://lib.gen.in/36ba9ab556f46fcfcb52d37756b26891.pdf) from any online document. See for instance the result of the query "filetype:pdf site:libgen.org OR site:lib.gen.in OR site:gen.lib.rus.ec" submitted to Google in Appendix.

JSTOR Evidence in United States vs. Aaron Swartz http://docs.jstor.org/.

Including a link to http://www.lib.purdue.edu/uco/CopyrightBasics/fair_use.html

Acknowledgements I am grateful to Jérémie Clos, Adam Dunn, Yves Gingras, James Hartley, Marie-Dominique Heusse, Gilles Hubert, and András Schubert for their feedback on previous versions of the paper. I also acknowledge the anonymous reviewers and the Editor-in-Chief of JASIST for their valuable comments.


Anabela Da Silva
email: anabela.dasilva@fresnel.fr

Charles Handschin

Christophe Riedinger

Serge Mensah

Amélie Litman

Hassan Akhouayri

Quantitative Photoacoustic Tomography in Biological Tissues Assisted with Intrinsic Acoustic Measurements

Purely acoustic information can be extracted from photoacoustic measurements that can be used afterwards as prior knowledge in the reconstruction process. The fact is illustrated through experiments conducted on biological phantoms and on synthetic data.

Introduction

The initial purpose of PhotoAcoustic Tomography (PAT) is to obtain, by the resolution of an inverse problem, the optical absorption coefficient spatial distibution of heterogeneously absorbing media, such as biological tissues. These tissues being heterogeneous both in terms (optical) absorption and scattering, quantification of this absorption coefficient can be achieved if the scattering process is taken into account. Multiple sources illumination [START_REF] Bal | Multi-source quantitative photoacoustic tomography in a diffusive regime[END_REF][START_REF] Song | Considering Sources and Detectors Distributions for Quantitative Pho-toAcoustic Tomography (QPAT)[END_REF][START_REF] Shao | Iterative algorithm for multiple illumination photoacoustic tomography (MIPAT) using ultrasound channel data[END_REF] is a method to achieve Quantitative Photoacoustic Tomography (QPAT) by discriminating optical absorption and diffusion: the medium is actively probed, locally at different sources positions in order to sense the different responses of the medium.

Furthermore, local illumination generates near the interface a primary photoacoustic wave that propagates from the region close to the surface through the medium. Usually, one avoids to measure it, for example by placing the transducers in an orthogonal direction, because this signal can hide or at least pollute the photoacoustic signal coming from the abnormalty of interest. However, this primary acoustic wave is going to be sensitive to any acoustic perturbations present in the medium. With local sources illumination, the interesting point is that the detection of this acoustically sensitive signal and the photoacoustic signal is detected within two separate times intervals.

In the present work, examples of measurements of this primary signal are performed on different phantoms. The filtering protocol is detailed and the motivation of using the acoustic echoes measurements as prior knowledge is illustrated through reconstructions performed on synthetic phantoms.

Fast localization of embedded objects introduced as a priori constraints in reconstructions of optical maps

The experimental setup (Fig. 1) is composed principally of a Nd:Yag pulsed laser at 1064 nm (Quantel, France, 330 mJ, 5 ns, 10 Hz). The energy, monitored by an attenuation system (rotating half wave plate and a polarizing cube) is thus reduced to 10 mJ and the frequency is doubled with a 8 mm 3 KTP crystal in order to produce 532 nm optical pulses (energy left 3.6 mJ). The optical beam is drived through a periscope to the studied phantom, immersed into water for acoustic impedance matching. A cylindrical concave lens is used to produce a large illumination on the phantom in one dimension (35 mm), keeping the second one practically unchanged (5mm), leading to a maximal fluence estimated less than 3.5 mJ.cm -2 . The generated acoustic waves are collected with immersion acoustic transducers (diameter 10 mm, focal length 1", central frequency 3.5 MHz, Olympus, France). The collected signal is then preamplified (Olympus, France, gain 40 dB, cutting frequency 10 MHz) and drived to an oscilloscope (Tektronix, USA, 4 channels, bandpass with 200 MHz) for signal analyzis. Sound and light speeds being so different, the optical fluence is going to be deposited instantaneously within the whole medium according to the spatial distribution of the absorption and the diffusion coefficients. The deposited energy is dissipated into heat, microdilatations are produced that give birth to a pressure wave that can propagate through the medium.

If the medium is optically and acoustically homogeneous, an acoustic wave pressure echo is going to be measured due to the deposition of energy, mostly near the illuminated surface because of the high level of scattering. Hence the time-of-flight of this echo corresponds mostly to the distance between the illuminated surface and the detector position. This measure can firstly serve as a rough estimate of the speed of sound in the medium. Note that in measurement shown in Fig. 1, the measurements were performed at 90°from the source illumination. Due to transducers directivity and wide field illumination, the surface signal is barely visible under this configuration. This pressure wave is propagating and probing the medium as a conventional acoustic wave. If acoustic heterogeneities are present in the medium, for example because of a different density or structure as in tumors (example mammary tumors visible with US echography), then this primary photoacoustic wave is going to be perturbed, and echoes (Fig. 1 (c)) related to the presence of acoustic heterogenities will be sensed at longer times-of-flight. If optically absorbing heterogeneities are present within the medium, more energy will be absorbed locally giving birth to photoacoustic echoes (Fig. 1 (b))) arriving at a shorter times-of-flight compared to the above mentioned photoacoustic echo generated at the interface. Fig. 1 shows an example of such measurement performed on a homogeneous cylindrical phantom (Agar-agar 2%) with a black hair located in the center. ). From the sinograms, an algorithm of peak detections is applied [START_REF] Yoder | [END_REF], and the spatial histogram of probabilities of intersections between circle C and E is calculated. The gradient of the resulting image is taken to obtained enhanced contours and a final thresholding allows rejecting artifacts due to sources positions (Fig. 2, 1 st row, last column).

A minimization based approach has been adopted for the resolution of the inverse problem, in which it is sought to find (µ a , D) which minimizes the error functional F = 1 2 ∑ s Ω (H m s (r) -H s (r, µ a , D)) 2 dr, where H m s is the measured initial pressure distribution map due to source s, that can be obtained from the measured pressures, after resolution of the acoustic propagation inverse problem. Here, to test the feasibility, we considered an ideal initial pressure distribution map H m s = Γµ a φ s , obtained from the multiplication of the Grueneisen coefficient Γ (kept constant, here), the absorption coefficient distribution map and the fluence deposited by source s calculated by solving the diffusion equation. The reconstructions of the optical parameters have been performed with an adjoint-assisted gradient-based method [START_REF] Beard | Quantitative photoacoustic imaging: measurement of absolute chromophore concentrations for physiological and molecular imaging[END_REF]. The reconstructions obtained with and without use of the localization map are shown on Fig. 2 (two last rows). The results clearly exhibit reconstructions of much higher quality, especially for the reconstruction of the diffusion coefficient. The robustness of the approach on experimental data will be presented.

Acknowledgements

This research project was supported by Agence National pour la Recherche (ANR) (AVENTURES-ANR-12-BLAN-BS01-0001-04); SATT-SE programme de maturation Mammoscan.

Fig. 1 .

 1 Fig. 1. Left, schema of the set up; Right: Example of acoustic measurement of a black hair inserted on a cylindrical Agar-agar 2% homogeneous phantom (diameter 5 cm, see insert), placed at the center of the phantom, angle between source and transducer, 90°.

Fig. 2 .

 2 Fig. 2. 1 st row: schematic of the numerical phantom, homogeneous disk ( =5cm), containing two small inhomogeneities (1: disk =0.5cm; 2: square 0.25×0.25cm 2 ), sinogram of the measurements (8 sources and 36 detectors positions), map of occurences of intersections between cercles C and ellipses E after post-treatment; 2 nd row: absorption coefficient maps µ a (target (a), without (b) and with (c) a priori constraints, and horizontal cross-plot passing through the inhomogeneity; 3 rd row: same as 2 nd row for diffusion coeeficients D.