Romain Modzelewski
email: romain.modzelewski@chb.unicancer.fr

David Gensanne

Sébastien Hapdey

Pierrick Gouel

Pierre Vera

Sébastien Thureau

How to work together between nuclear medicine and radiotherapy departments? Comment travailler en commun entre services de médecine nucléaire et de radiothérapie ?

Keywords:

Among the available imaging techniques, functional imaging provided by nuclear medicine departments represents a tool of choice for the oncoradiotherapist for targeting tumour activity, with positron emission tomography as the main modality. Before, during or after radiotherapy, functional imaging helps guide the oncoradiotherapist in making decisions and in the strategic choice of pathology management. Setting up a working group to ensure perfect coordination at all levels is the first step. Key points for a common and coordinated management between the two departments are the definition of an organizational logistic, training of personnel at every levels, standardization of nomenclatures, the choice of adapted and common equipment, implementation of regulatory controls, and research/clinical routine continuum. The availability of functional examinations dedicated to radiotherapy in clinical routine is possible and requires a convergence of teams and a pooling of tools and techniques.

Résumé

Avant, pendant ou après la radiothérapie, l'imagerie fonctionnelle permet de guider l'oncologue radiothérapeute dans ces décisions et dans son choix stratégique de prise en charge de la pathologie.

Pour parvenir à une utilisation optimale de l'imagerie fonctionnelle en radiothérapie, il convient de

Introduction

With the deployment of high-tech radiation treatments, such as stereotaxis, static, rotational intensity modulation or proton treatments, the oncoradiotherapist is increasingly working on imaging examinations from multiple modalities in order to better define the target volume and its possible extensions. Among the available imaging techniques, functional imaging, and foremost positron emission tomography (PET), provided by nuclear medicine departments represents a tool of choice for the oncoradiotherapist for targeting tumour activity. Before, during or after radiotherapy, functional imaging helps guide the oncoradiotherapist in making decisions and in the strategic choice of pathology management.

Numerous studies have shown that PET imaging allows, depending on the radiotracer uptake, to adapt prescribed radiation dose (this is called dose painting) (1). Thus, for example, an additional dose can be added to the hypoxic areas of the tumour, which are known to be radioresistant and visible on ( 18 F)labelled misonidazole or ( 18 F)-fluoroazomycin arabinoside PET imaging [START_REF] Vera | Radiotherapy boost in patients with hypoxic lesions identified by ( 18 F)-FMISO PET/CT in non-small-cell lung carcinoma: can we expect a better survival outcome without toxicity? [RTEP5 long-term follow-up[END_REF]. In this approach, the prescribed dose is directly correlated to the radioactive concentration of the radiopharmaceutical.

The performance of imaging examinations during treatment makes it possible to evaluate the tumour response to treatment. Depending on the response observed, it is possible to readjust the volumes of interest or the dose to be delivered [START_REF] Guckenberger | Adaptive radiotherapy for locally advanced non-small-cell lung cancer does not underdose the microscopic disease and has the potential to increase tumor control[END_REF]. Reducing the target volume limits the exposure of healthy tissues and thus contributes to a better tolerance of the treatment. On the other hand, taking into account an increase in volume maintains optimal targeting in order to guarantee the effectiveness of the treatment. A dose escalation on radioresistant areas can also complement the treatment.

Finally, functional imaging performed after radiotherapy provides an indication of the effectiveness of the treatment performed and detects possible recurrences.

To achieve an optimal use of functional imaging in radiotherapy, a framework and a number of rules of good practice should be defined. Based on the experience gained over the last ten years in the field, we propose to define recommendations for the implementation of collaborative work between the nuclear medicine and radiotherapy departments.

Good practice recommendations

The organization should be primarily focused on the patient journey and can be divided into the following subobjectives:

• organize the deployment of the PET/CT in radiotherapy condition, or even the use of CT associated with PET for the calculation of radiotherapy dosimetry (fewer examinations, more precision); • optimize radiotherapy and nuclear medicine coordination to reduce the time to care; • fix technical and organizational obstacles resulting from these changes in practice.

To achieve these objectives, we propose various recommendations:

Set up a radiotherapy and nuclear medicine steering working group

The creation of a multidisciplinary steering group clearly demonstrates the willingness of the imaging (nuclear medicine/radiology) and radiotherapy departments to work together to improve patient management. Human resources necessarily included in this steering group represent the professionals taking part in the patient's management in each of both departments involved (physicians, nuclear medicine and radiotherapy physicists, managers, technologists, dosimetrists, secretaries). The inclusion of people with dual skills (radiotherapist with nuclear medicine practice, radiotherapy physicist with good imaging practice, etc.) is an advantage when consensus/commitments need to be found and decision to be applied.

The objectives of such a steering group are:

• to choose imaging equipment compatible with the constraints of the radiotherapy set-up; • to pool or to have common and homogeneous equipment allowing a patient management synergy; • to choose the radiotherapy localizations (pathologies) concerned in order to limit the complexity of the implementation; • to define and set up imaging acquisition protocols adapted to the needs of radiotherapy and tools dedicated (immobilization equipment, software) to the different common patient management; • to solve the various problems, whether they are of a technical or logistical nature (to set up a feedback system);

•
to disseminate unique and complete information to both services; • to set up a dedicated quality assurance system (documentation, quality control, etc.); • to ensure the follow-up and respect of the different instructions.

Define organizational logistics

Various steps are necessary for patient management.

Prescription of PET imaging examination by the oncoradiotherapist, and validation by the nuclear physician

The request for a PET imaging scan in radiotherapy position is the starting point of the patient's management. This request, approved by the nuclear medicine physician, must therefore contain all the information necessary to perform an examination for future radiotherapy treatment, in particular:

• the tumour location; • the desired technique (type of acquisition, injection or not of contrast agent, four-dimensional modality, etc.); • information given to the patient about future radiotherapy treatment; • the choice of patient immobilization equipment.

Making appointements (jointly or sequentially)

Appointments must be made by the imaging secretary office in collaboration with the radiotherapy secretariat/planning. Specific planning slots should be available in order to guarantee a fast patient's management. At the same time the schedules in nuclear medicine department should be optimized to group several PET exams of this type in succession and thus avoid handling the radiotherapy equipment.

Information distribution to the teams

Nuclear medicine and radiotherapy teams must have the same level of information at the same time.

Possible dissemination tools include: the hospital information system, nuclear medicine and radiotherapy information system or a mailing list.

Train staff

Multidisciplinary knowledge is necessary for the implementation of this type of patient management:

•

Standardize nomenclatures

Specific terminologies are needed during the journey of patients undergoing this type of examination (examination request, appointment, specific name of the examinations, name of the examination series, contour nomenclature, etc.).

Choose the right equipment

Computer tools (visualization/contouring/transfer)

If the contours are made in the nuclear medicine department, the software used to make the contours must allow to export in DICOM RTSS format.

If the contours are performed on the radiotherapy software, it must be able to perform a standardized display (standard uptake value) and allow a contour by thresholding with respect to the maximum standard uptake value of a three-dimensional (3D) region of interest.

Specificities of the PET examination room

In order to achieve the best integration of functional imaging in radiotherapy, the equipment present in the PET/CT room must be adapted to the set-up of patients in radiotherapy position.

Minimum settings

As a minimum, settings should be as follows:

• field of view size (ring diameter) compatible with radiotherapy set-up; • rigid tabletop: helps to improve patient repositioning between sessions; • centring lasers: necessary for patient positioning and alignment; • tattoo system: identification of landmarks on the patient's skin to help with alignment.

Recommended settings

The use of the same contention systems as for radiotherapy allows the patient to be imaged under the exact conditions of the future radiotherapy treatment and thus helps to facilitate the registration between examinations.

Acquisition technique

If the PET/CT is used for dosimetry calculations, the acquisition and reconstruction parameters must be identical to those used in radiotherapy:

• slice thickness, spatial resolution and field of view (acquisition field of view); • number of slices; • acquisition parameters (kV, mAs); • respiratory synchronization; • injection of contrast agent.

Implement regulatory quality controls

Beyond the standard quality controls required for every PET system, working with the tools of radiotherapy requires compliance with the regulations in force regarding quality control dedicated to radiotherapy.

Lasers

The teams must check their adjustment daily. This control concerns their horizontality, verticality and orthogonality.

Flatness of the examination table

This must be checked externally at the start of the installation and on an annual basis.

Patient z-axis positioning accuracy

This is a monthly internal and annual external control.

Correspondence curve between Hounsfield units and electronic densities

If the CT of the PET/CT exam is used for dosimetry planning, a calibration curve linking the electronic densities to the Hounsfield units must be established and checked annually. This curve must be integrated into the planning software (TPS) for dosimetry calculation. This verification must be carried out internally on an annual basis. The use of the PET/CT for dosimetry planning requires a specific declaration of the PET scanner to the nuclear security agency.

Data transfer

Check that data transfer between the various software made available in the departments does not lead to loss of information. This concerns the format of the images (compression, interpolation during PET/CT fusion), their headers as well as the associated contours (smoothed or not). An annual internal verification must be carried out.

PET quality controls (not mandatory)

Quality controls are carried out on the PET imaging to ensure that the standard uptake value measurements are stable over time.

Interpretation, discussion, common contouring meeting between the radiotherapist and the nuclear medicine physician

PET/CT examination in treatment position does not theoretically require a report. However, it is of interest to the radiotherapist, especially if the regions of interest segmented are defined by the nuclear medicine physician (exported in DICOM RTSS).

Discussions/explanations between the nuclear physician and the radiation therapist in front of the same viewing and contouring screen prove to be the optimal communication solution. This multidisciplinary contouring meeting allows a quick consensus to be reached, but requires additional medical time.

Research and clinical routine continuum

The rigor necessary for the proper accomplishment of clinical research protocols is an important support to ensure that these protocol-specific operating modes are integrated into the clinical routine and thus contribute to a better care of the patient and his or her course between the nuclear medicine department and the radiotherapy department.

For several years, the Henri-Becquerel centre in Rouen (France) has acquired expertise in tumour characterization using metabolic imaging (PET) as well as in the mechanisms of tumour evaluation during radiotherapy. Several clinical trials have enabled the imaging and radiotherapy teams to collaborate together to achieve personalized patient care, particularly for localizations such as the lung, oesophagus, or the lymphatic system (4-10).

Conclusion

Working together between nuclear medicine and radiotherapy departments requires the setting up of a working group to ensure perfect coordination at all levels. The key points for a common and coordinated management between the two departments are the definition of an organizational logistic, training of the personnel at every level, standardization of nomenclatures, choice of adapted and common equipment, implementation of regulatory controls, the research and clinical routine continuum.

The availability of functional examinations dedicated to radiotherapy in clinical routine is possible and requires a convergence of teams and a pooling of tools and techniques. Working together between two different disciplines allows constructive exchanges but also often leads to constraints and can generate conflicts. This is generally linked to misunderstandings that can be overcome through common information and training. The human factor is, as always, a central point of a project like this one, and dialogue is the solution.

This mode of operation is the precursor of a future mode of work in radiotherapy that will rely more and more on imaging. The evolution of equipment (digital PET, PET linear accelerator) and improved precision (detectability) will enable the radiotherapist to make full use of multimodal imaging in all phases of the treatment.

Author statement

All persons who meet authorship criteria are listed as authors, and all authors certify that they have participated sufficiently in the work to take public responsibility for the content, including participation in the concept, design, analysis, writing, or revision of the manuscript.


Mohamed Amine Khelif
email: mohamed-amine.khelif@ensea.fr

Jordane Lorandel

Olivier Romain

Matthieu Regnery

Denis Baheux

Guillaume Barbu

Toward a hardware Man-in-the-Middle attack on PCIe bus

Keywords: Hardware, Man-in-the-Middle, Security, Smartphones, Forensic, PCIe

The growing need for high rate communication of recent embedded systems is leading to the adoption of the PCIe protocol (Peripheral Component Interconnect express) as an internal data bus. This technology is used in some recent smartphones, and will probably be adopted globally in the next few years. The communication between the processor (in the SoC) and its memory through the PCIe bus represents an important source of information for criminal investigations. In this paper, we present a new attack vector on PCIe based on a hardware Man-in-the-Middle. This system allows real-time data analysis, data-replay, and a copy technique inspired by the shadow-copy principle. Through this one, it is possible to locate, duplicate, and replay sensitive data. The main challenge here is to develop an architecture compliant with PCIe protocol constraints, such as response time, frequency, and throughput, in order to be non-detectable to the communication parts. We designed a proof of concept of an emulator based on a computer with PCIe 3.0 bus and a Stratix 5 FPGA with an endpoint PCIe port as a development target.

Introduction

With the emerging of Internet of Things (IoT), Internet of Everything (IoE), and the proliferation of communicating objects that store and share data with their environment, new issues, and opportunities are created in many fields of application, such as industries, health care, smart homes, and so on. Moreover, with the recent technological advances, these objects have become more and more complex, by continuously integrating sophisticated functionalities, which are implemented either in hardware or in software.

Most of these devices are now smart, connected and store personal or sensitive data which must be strongly protected. These devices could represent the new backdoor towards information systems and a third party could benefit from these data without user consent. These backdoors are a security vulnerability, and their numbers have greatly increased in the last years [START_REF]CVE Details the ultimate security vulnerability datasource[END_REF].

Nowadays, from the point of view of forensic experts, accessing encrypted personal data in a smartphone has become one of the main challenging parts of investigations, to retrieve information from pieces of evidence. In order to better specify their properties and the positioning of our approach, a taxonomy of attacks is given. This paper deliberately focuses on attacks targeting smartphones. For forensic investigation domain, these attacks can be categorized into three types, depending on the operating range, advantages, and complexity of countermeasures:

Software Level Attacks (SLA) are realized by exploiting vulnerabilities in operating systems or applications to get a privilege escalation, or by confusing the user about the nature of the software to get more privileges. Both approaches aim to leak secret data or even to take control of the infected device. The main advantage here is the unlimited distance between the attacker and the victim. However, the attacker has little or no precision on the targeted device. This constraint makes this kind of attack unattractive for forensic experts, except for specific cases where the target is clearly identifiable and can be precisely attacked. Countermeasures are easily deployable, usually, a simple upto-date antivirus program can solve the problem.

Hardware Level Attacks (HLA) create vulnerabilities on devices by modifying the hardware and realizing unexpected interactions with its components. Historically, chips like CPU, GPU, hardware crypto engine, RAM, cache memory, NAND and baseband are the most affected by these attacks. Now, they are more laborious due to physical countermeasures like E.M. shields and sensors implemented directly into the chips, making them more robust. Countermeasures against hardware attacks are less flexible as they could only be integrated and effective for the next generation of devices.

Protocol Level Attacks (PLA) target both wired and wireless communication protocols. For wireless protocols, it could be applied to NFC, Bluetooth, WiFi, and RF communications. These attacks require to be within the range of the device protocol, i.e. going from 10cm for NFC to 30m for WiFi. No hardware modification of the targeted device is needed, but a minimum of equipment is required to interact at the protocol level. Depending on the used vulnerability and protocol, countermeasures may be more or less difficult to implement through a software update.

Another alternative consists of performing attacks on wired protocols, like USB through the smartphone's connector. These attacks can be more intrusive if targeting internal communication buses of smartphones such as I2C or PCIe. The latter has been introduced since the last generation of smartphone. The most challenging part of an attack on internal data buses consists of interfacing, while satisfying protocol requirements in terms of throughput and limited response time. These attacks can be considered as hardware and protocol attacks at the same time because they involve both hardware modification of the smartphone and deep knowledge of the wired communication protocol to be effective.

Finally, a good strategy could be the development of a combination of attacks, allowing a third-party to control and to enable features in order to exploit or create vulnerabilities.

In this article, we present the design of an FPGA-based platform that will be used to perform a hardware Man-in-the-Middle (MitM) attack on the PCIe bus of a computer, which emulates the behavior of the SoC of a smartphone. This MitM attack is able to log, modify and copy the data online into a shadow memory in order to be replayed to the host. The main challenge of our architecture is to perform this attack in real time and without being detected by the host. For this purpose, we must imperatively respect PCIe protocol constraints such as response time, frequency and throughput. The architecture and the attack are conceived with the intent of applying it to the context of a smartphone, but still compatible with all devices using PCIe bus.

This paper is organized as following: section 2 gives a state of the art related to the main known attacks on smartphones and Man-in-the-Middle techniques. Then, section 3 describes the challenges and the proposed approach. Finally, experimental results are presented in section 4, then perspectives and conclusion are given.

Related works

The growing interest of law enforcement agencies (LEA) to access information and personal data in connected objects is notable, particularly for criminal investigations. Smartphones represent an important source of personal information (SMS, phone calls, GPS positions, contacts, photos, etc.) that can be used to solve criminal cases or cold cases. Figure 1 illustrates the architecture of a smartphone, allowing the identification of the generic components that can be targeted by either protocol, software, or hardware attacks.

Attacks on smartphones

As seen below, the attacks can be resumed in these categories:

Attack on Smartphones

SLA

Viruses Spywares

Trojans

Rootkits

Backdoors Keylogger

HLA

Side channel Fault injection and instruction skipping

Physical tampering

HLA/PLA

MitM

PLA

WiFi

Bluetooth NFC USB I2C Fig. 2. Taxonomy of attacks on smartphones.

Software Level Attacks

Malwares are the fastest attacks to implement as they only require a computer to be realized. They have the advantage of being achievable at a long distance with more or less efficiency and accuracy, depending on the type of malware used. Malwares for smartphones work in the same way as for computers. Several types exist and the most relevant for forensic purposes are: Viruses: Hummingbad [START_REF]A whale of a tale: Hummingbad returns[END_REF], FalseGuide [START_REF]Falseguide misleads users on googleplay[END_REF] and Shedun family [START_REF] Bentley | Lookout discovers new trojanized adware; 20k popular apps caught in the crossfire[END_REF] malwares are the most famous examples. They are used to modify, corrupt or delete data and/or files on the device.

Spywares: are malicious softwares secretly installed on a device, in order to collect and transfer private information without the user's knowledge. A well-known example is Pegasus [START_REF] Lab | Sophisticated, persistent mobile attack against high-value targets on ios, Online[END_REF] which is capable of collecting passwords, gathering information from other apps, tracking location, phone calls, and text messages.

Trojans: are malicious programs disguised as normal applications, such as Swearing [START_REF]Check Point Software Technologies LTD, Swearing trojan continues to rage, even after authors' arrest[END_REF], which is a bank trojan operating in China which collects personal data, bank account information and bypasses the two-factor bank authentication.

Rootkits: are specific malwares allowing to take full control of an infected device by automatically install the necessary tools. The Gooligan [START_REF]Check Point Software Technologies LTD, More than 1 million google accounts breached by gooligan, Online[END_REF] rootkit is a famous example that breaches over one million Google accounts by rooting the infected device and accessing data from various Google applications.

Backdoors: are hidden features unknown to the legitimate user, which gives secret access to the software. It can be implemented in the operating system directly or in an application. They are often used to install malicious softwares among those seen above.

Keyloggers: are softwares that record the actions of the user on an infected device. For example, they can capture inputs from the touchscreen, take screenshots, or list user actions and active applications. This information can be used to acquire personal information from the user.

Other malwares: includes all other malwares that do not lead to data extraction or privilege escalation from smartphones:

• Botnets: are malwares that use a smartphone without the user's consent to perform specific tasks, usually for cryptocurrency mining or DDoS attack.

• Worms: are softwares that do not interact with smartphone's data, but have the only task to multiply themselves in the mass storage by exploiting OS vulnerabilities. • Ransomwares or cryptoviral malwares: are softwares that encrypt all personal data stored in a smartphone in order to block access to the user unless he pays the ransom to get the encryption key. • Logic Bombs: are malicious code portions developed to perform a specific task like removing data or files when particular setup conditions are met.

In general, malwares combine several of these types in order to be more efficient and to cover all possible scenarios. In addition, they exploit the user's credulity as well as software vulnerabilities or even other malwares already installed to attack the device.

Hardware Level Attacks

As previously defined, HLA attacks focus on the information leaks, by interacting with device's hardware. Such attacks require a deep understanding of the target (reverse engineering, etc.) and a physical access to the device. Hardware attacks mainly target the SoC (processor, cryptocore, cache memories, etc.), the NAND memory, clocks or PMU. For HLA attacks, several types are known from the state of the art and are described as follows.

Side channel: is performed by analyzing different physical parameters of the system in order to reveal secret information like encryption keys. The most relevant parameters to be analyzed are power consumption, execution timings and electromagnetic signals. Examples of recent exploits target the integrated AES cryptocore of the ARM Trust Zone cache [START_REF] Lapid | Cache-attacks on the arm trustzone implementations of aes-256 and aes-256-gcm via gpu-based analysis[END_REF] or the extraction of encryption keys from iOS and Android devices by electromagnetic analysis [START_REF] Genkin | Ecdsa key extraction from mobile devices via nonintrusive physical side channels[END_REF].

Fault injection and instruction skipping: is performed using different methods like: UV beams, laser, radiation, overheating, incorrect power supply voltage, noisy clock or power signals. This attack can lead to processing errors by introducing faults or skipping instructions to the benefit of the attacker.

Two of the recent practical examples are: attack against the instruction cache of an ARMv7-M using electromagnetic fault injection [START_REF] Riviere | High precision fault injections on the instruction cache of armv7-m architectures[END_REF], and fault injection using laser to bypass the secure boot [START_REF] Vasselle | Laser-induced fault injection on smartphone bypassing the secure boot[END_REF].

Physical tampering: this type of hardware attack is more invasive than the previous ones. Indeed, a deep hardware modification of the mother-board or the chip is required in order to perform the attack. An illustrative example is presented in [START_REF] Skorobogatov | The bumpy road towards iphone 5c nand mirroring[END_REF] dealing with the NAND mirroring of the iPhone 5C. The attack consists of desoldering the memory chip in order to have an unlimited number of password attempts. For this attack, all the NAND memory image is re-writed at every attempt to lock the value of the password attempts counter.

Protocol Level Attacks

Another kind of attack targets wireless and wired communication protocols used by smartphones, by exploiting implementation vulnerabilities. From the most used protocols in smartphones and the most affected by attacks are:

WiFi: it is a well known wireless communication protocol and one of the most attacked. A recent exploit on WiFi is the key re-installation attack [START_REF] Vanhoef | Key reinstallation attacks: Forcing nonce reuse in WPA2[END_REF], which consists in forcing WiFi cryptography protocol implementation to re-install the encryption key through a MitM. Several types of Wifi handshake protocols were concerned and critical issues were demonstrated on smartphones. This attack is particularly devastating on smartphones running Android 6.0 OS since it replaces the encryption key by an all-zero key.

Bluetooth: the most recent attack and at the same time one of the major threats on Bluetooth, was carried out in September 2017 by Armis Labs company after the discovery of eight zero-day vulnerabilities known as BlueBorn [START_REF] Seri | Blueborne: The dangers of bluetooth implementations: Unveiling zero day vulnerabilities and security flaws in modern bluetooth stacks[END_REF]. These vulnerabilities are the result of defects in the implementation of the Bluetooth protocol stack, affecting all devices under Linux, Windows, Android, tvOS and iOS. A proof of concept was realized on Android [START_REF] Seri | Blueborne on android: Exploiting an rce over the air[END_REF] and Linux [START_REF] Seri | Exploiting blueborne in linux-based iot devices[END_REF] devices.

NFC: an attack against this protocol has already been performed in 2012 [START_REF] Miller | Exploring the nfc attack surface[END_REF] revealing vulnerabilities in the Android NFC stack. The attack, also known as fuzzing, consists in generating NFC-compliant random data and performing data injection. This attack is often used for robustness tests and vulnerability identification in algorithm and protocol implementations. In [START_REF] Miller | Exploring the nfc attack surface[END_REF], a contactless NFC mobile reader is used to take control of a Galaxy Nexus running Android 4.0.1. A malicious web page is sent through NFC to further exploit another vulnerability and take control of the device.

USB: by injecting a malicious application through the USB port, an iPhone running on iOS 6 was attacked, allowing a hacker to take control of the device [START_REF] Lau | Mactans: Injecting malware into ios devices via malicious chargers[END_REF]. However, to make Mactans possible, the user must unlock its phone at least once while it is connected to the attacker device disguised as a charging station.

Internal data buses: are a potential target of attack in smartphones that are not deeply exploited while they represent a major source of sensitive data. However, a recent attack [START_REF] Shwartz | Shattered trust: when replacement smartphone components attack[END_REF] was performed on the I2C bus using a malicious touchscreen, allowing a touch injection attack combined with a buffer overflow attack on the touchscreen controller to inject malware to an Android phone. More recently, with the growing need for fast and massive memory accesses and the democratization of highspeed flash memories such as NVMe, it is critical to switch to high-performance buses, providing higher transfer rates such as PCIe. This bus was historically used in computers as a data bus for GPUs and expansion cards. No hardware attack was found in the state of the art, targeting PCIe protocol. Such attacks on internal communication buses can be considered as both physical tampering attack to access and interface with the bus, and protocol attack as we exploit the data exchanged between peripheral without being detected, in the case of a Man-in-the-Middle.

Table 1 gives a list of the most recent attacks inventoried and realized on smartphones, targeting protocol, hardware or software. Attacks targeting high speed communication buses have not been deeply investigated and remain a potential source of vulnerability with a direct access to sensitive data. Hardware Man-in-the-Middle on a communication bus used in smartphones has been chosen here due to the wide vector of different attacks that can be done with the same system.

The Man in the Middle

The Man in the Middle -MitM -is an attack which consists of introducing a third device into an end-to-end communication. This device works as an undetectable router between the two peripherals. In this position, the attacker can compromise the confidentiality and the integrity of the communication by recording and interfering with the exchanged data in real-time. This attack has been widely used [START_REF] Conti | A survey of man in the middle attacks[END_REF], especially in network communications for wireless protocols like WiFi [START_REF] Vondráček | Automated man-in-the-middle attack against wi-fi networks[END_REF], NFC [START_REF] Akter | Can you get into the middle of near field communication?[END_REF], Bluetooth [START_REF] Haataja | Two practical man-in-the-middle attacks on bluetooth secure simple pairing and countermeasures[END_REF], and few wired protocols like Ethernet [START_REF] Kiravuo | A survey of ethernet lan security[END_REF].

So far, performing a hardware MitM attack on a communication bus remains an under-exploited approach, particularly for internal buses of smartphones like PCIe or I2C. This type of attack does not require the exploitation of any vulnerability but uses the normal behavior of bus protocol by interfering between communication (SoC/NAND, SoC/baseband or SoC/WLAN) and operating as an invisible router. MitM is also a vector towards more evolved attacks such as data replay, traffic analysis or data corruption, which are particularly interesting, especially in the context of encrypted communications as for smartphones.

Traffic analysis: is an eavesdropping type attack that consists of deducing information from patterns. Typical information that can be obtained are the size of data in packets, the reading/writing addresses and the number of access to particular data, etc.. Data corruption: consists of modifying random data on the flow of communication, by switching bits for example. This attack can be used to discover potential implementation vulnerabilities by fuzzing the protocol.

Replay data: is another type of MitM attack, consisting in replaying encrypted or clear messages, previously recorded from legitimate communications between two devices. The final objective is to gain privileges by confusing the communication master. This attack works well, even on some encrypted communications making it a very interesting and efficient approach.

Problem statement and approach

In smartphones, the non-volatile memory contains all the user's personal data as well as critical security data such as encryption keys or the password attempts counter. Usually, the stored data is encrypted by a dedicated cryptocore in the SoC. In addition, another version of the password attempts counter can also be stored in a dedicated memory, usually an EEPROM, to improve security. If the counter values are different at a particular moment, the smartphone is automatically locked, preventing any access to the smartphone's content.

All this information including user and security data are exchanged through communication buses making access to such sensitive data a real threat, even if the the communication is encrypted. Thus, our approach consists of implementing a hardware MitM attack on these communication buses. This type of hardware attack is one of the less exploited attacks in the state of the art, while it is very promising as it is the only one that allows direct access to data and, in addition, offers a wide attack vector possibilities including data replay, traffic analysis and data corruption.

The goal behind using a hardware MitM attack is to reduce the amount of time between two password attempts by preventing the effect of the counter over time, as illustrated in Figure 4. This is very useful when trying to unlock a smartphone using a brute-force attack, as the time between two attempts evolves exponentially in a normal behaviour [START_REF] Gulati | Security enclave processor for a system on a chip[END_REF]. Using our approach, the attacker will have an unlimited number of password attempts. This represents a clear advantage if the attacker wants to try a large number of passwords without triggering any security mechanism. In fact, existing smartphones generally erase critical encryption files after a low number of tries, preventing the attacker to access sensitive data. An- other advantage is the time spent for testing a large number of passwords. As illustrated in Figure 4, our approach tends to significantly reduce the time needed to perform an exhaustive number of attempts. For example, if we consider a time window of 24 hours, the attacker could achieve near 10 attempts in a normal case, while using our approach, the attacker could try more than 1 million of passwords, representing approximately the number of combinations for a 6-digit password.

We also chose the high-performance PCIe communication bus as the target for our attack. Indeed, it is becoming widely used in embedded systems, particularly in smartphones. For example, PCIe is now used in the recent smartphones as a data bus between the SoC and NVMe (Non-Volatile Memory express), as related in [28]. Moreover, PCIe is also massively used in computers which will be very helpful to validate the approach before performing the attack onto a real smartphone.

To realize a hardware MitM on PCIe, the protocol imposes very strict constraints in terms of bus frequency, data rate and response time. The architecture must imperatively satisfy all these constraints in order to guarantee MitM's invisibility. In addition, several PCIe configurations exist, requiring the proposed approach to be compatible with the maximum of devices, if not all.

In the rest of the paper, we describe our architecture implemented onto an FPGA board and the smartphone emulator developed at a computer scale, that will demonstrate the effectiveness of the approach.

MITM attack on PCIe

Objectives and Challenges

The PCI express [29] is a serial local bus and the evolution of the parallel buses PCI and PCI-X. It was developed and introduced by Intel in 2004, with the aim of replacing all computer buses (PCI and AGP) for expansion boards. The bus is composed of serial links named lanes that connect the devices directly to each other. Each lane is composed of 4 wires, two differential pairs, one for transmission and one for reception, all in full-duplex. There are six possible interfaces for PCIe, depending on the number of lanes (x1, x2, x4, x8, x16, and x32). It has also five generations, and at each new one, the throughput is doubled, as indicated by Table 3. Historically used for GPU boards, PCIe technology has been extended for fast massive data transfers. Recently, a faster generation of SSD (Solid-State Drive) using an overlay called NVMe was proposed to overcome the throughput limitations of the SATA bus and the need for higher speed. For now, NVMe technology relies on multiple parallel memory accesses allowing to fully exploit the capabilities offered by PCIe. SSD based on NVMe are compatible with PCIe 3.0 and later. Transaction Layer (TL): uses header and payload, provided by Device Core, to generate a digest (optional) and to transfer the packet to the Data Link Layer. The header is made of 3 or 4 Data Words (1 DW = 32bits) depending on its format and type. The first DW has a fixed format and is composed of the main information needed to decode the rest of the header i.e. size of the header, presence of payload, type of packet, presence of digest, length of the payload, etc. When this information is known, the whole header can be decoded. The packets provided by the TL are called TLP (Transaction Layer Packets) and are divided into 4 categories: memory, Io, configuration, and messages.

Data Link Layer (DLL): has two principal purposes. Firstly, to transfer incoming packets from the TL to the Physical Layer, to add a sequence number and, a CRC that is checked by the receiver. Secondly, to transmit packets called DLLP (Data Link Layer Packets) used for flow control, power management, and acknowledgment, or negative acknowledgment of packets after checking sequence number and CRC.

Physical Layer (PL): adds 8-bit start and end-characters to make easier the detection of the packet boundaries at the receiver.

Regarding the chosen attack and the target communication bus, the architecture in our case of study must fulfill the following requirements:

• PCIe 3rd generation with transfer rates up to 8GT/s (0.985GB/s per lane).

• Maximal response time of 1ms.

• Physical interfacing to keep signal integrity.

• Invisibility to the communicating devices, without triggering any security mechanism. • Access to the exchanged packets.

To the best of our knowledge, there is no work dealing with a hardware MitM attack targeting PCIe gen 3.0 protocol.

Hardware MitM attacks for smartphones

Based on the previous requirements, three incremental scenarios were developed:

Traffic analysis: consists of analyzing bus communications to locate sensitive data. The main target in smartphones is the password attempts counter. Our goal is to identify at which address is stored the counter in the memory. This information could be obtained by triggering memory read/write accesses during a password unlock attempt.

Shadow Copy: when the secret data is located, the next step is to store a copy of it in an external memory (shadow memory). For smartphones, we can try again a password, and when the counter is read from memory by the host, we duplicate its value in the shadow memory.

Replay data: this will allow us to replay the recorded data to the host when needed. For a smartphone, we will be able to perform a brute force attack against the user password and at each time the SoC wants to read the value of the counter, we will replay the one stored in our shadow memory. This will provide an unlimited number of password attempts.

Typically, these attacks are the most used in the forensic domain since it will ultimately allow targeting the critical data. In this work, three scenarios are proposed but many other attacks could be investigated like statistical attacks for example. It can also be performed on other peripherals based on PCIe like baseband or WLAN.

A PC-based Emulator for MITM attacks on PCIe

For our proof of concept, we chose to develop a smartphone emulator at PC scale. This emulator [START_REF] Khelif | A versatile emulator of mitm for the identification of vulnerabilities of iot devices, a case of study: smartphones[END_REF] must be PCIe 3rd generation compliant to be as close as possible to smartphone SoC/NAND behavior. The MitM has to support transfer rates up to 8GT/s, meaning a throughput of 1GB/s per lane with a maximal response time tolerance of 1ms. To this purpose, an Intel Stratix V FPGA development board and a host computer are used to build the emulator. The considered FPGA owns a PCIe endpoint port 3.0 x8 and physical blocks compliant with the transfer rates and throughput requirements of the bus. Regarding the response time, the way of implementing the architecture will make the MitM respecting or not this constraint and this will be detailed later. Developing and performing this MitM on a computer allows us to validate the approach, and will also work on any device using the PCIe like smartphones after an adaptation of the setup to the proprietary physical interface requirements.

A schematic of the emulator is illustrated in Figure 6. It is composed of an ST-Avalon IP for interfacing with the host's PCIe port, our MitM IP for intercepting, filtering, and modifying PCIe packets, Xillybus IP which emulates the memory accessible from the host, and a softcore NIOS II to report information to the attacker computer.

ST-Avalon IP for PCIe

To physically interface with the PCIe bus, our architecture is based on Intel ST-Avalon interface [START_REF]Stratix V Avalon-ST Interface for PCIe Solutions, User Guide[END_REF] which is based itself on the PIPE IP [START_REF]Intel, V-Series Transceiver PHY IP Core, User Guide[END_REF] and specially built for PCIe. This IP is fully compliant with different generations and number of lanes, and supports all DLLP and TLP types. The DLLPs are handled internally by ST-Avalon and TLPs, which contain data from the host, are transmitted to Xillybus.

PCIe peripheral emulation with Xillybus IP

Xillybus [START_REF]Xillybus, Xillybus IP core product brief[END_REF] is a proprietary IP that is designed to easily interface FPGA with a host computer through PCIe Bus. Drivers are provided, which greatly simplifies communication. It also includes an ST-Avalon IP to interface with the bus. Xillybus IP is designed to process the TLP packets of the communication as a peripheral would do. The IP is available for several FPGA families, which makes it flexible to adapt to a specific model. In our case, it was also necessary to update the architecture of the PCIe interface from the first generation x8 lanes that is provided by default to the third generation x2 lanes in order to be closer to the interface used by most of the smartphones. Our design must also satisfy the data size constraints of the ST-Avalon IP.

NIOS II

The Stratix V development board doesn't own a hardware processor, this is why we integrate a NIOS II softcore. In our architecture, the NIOS II is mainly used to send information to the attacker computer after the analysis of the packets. It also helps to control the MitM and quickly switch between scenarios without modifying the IP and synthesizing it again.

MitM IP

This element, designed in the FPGA logic fabric, is able to analyze, filter, and modify PCIe packets on-the-fly. The analysis of the packets will permit the identification of sensitive data by determining access times and frequencies of memory read/write, and correlate them to particular events such as unlock attempts of the smartphone. This password attempts counter can be incremented and updated in the memory if the password is wrong, or reset to zero if the password is correct. Once the sensitive partition is identified, it will be duplicated into a shadow memory, in order to replayed at each time it is read again, which will freeze the counter value from the SoC's perspective.

Thus, the host can always update the value of the sensitive data in memory (Xillybus), but when it sends a read data request packet, it will be the MitM that will serve the initial recorded value of the data.

The proposed architecture [START_REF] Khelif | Toward a hardware man-in-the-middle attack on pcie bus for smart data replay[END_REF] for the hardware MitM attack on PCIe was gradually modified to satisfy the defined scenarios. It can perform:

1) Analysis and filtering of packets that may contain encrypted data. However, packet headers are always not encrypted and can be used to retrieve the metadata of the packet, including packet size and write/read addresses, to then analyze the number of accesses and their frequency to a particular memory location. 2) Data corruption by modifying/replacing partially or all the packets on-the-fly without triggering security countermeasures.

ST Avalon MitM IP Xillybus

3) Duplication of the data sent by the host to the NAND in the shadow memory, and replay it at each time the host wants MitM IP is now physically inserted between Xillybus and ST-Avalon, which means that all communications go through the MitM and could be modified by injecting errors or modifying their contents. The principle and the corresponding communications are presented in Figure 13. To illustrate the data injection capability of the architecture, we decided to modify the content of the WMR packet sent by the host to the memory. Results are presented in Figure 14. As it can be seen, the packet sent by the host is transmitted through several signals and filtered on-the-fly. Then the packet is modified during a single clock cycle between the arrival of the packet to its re-transmission from our MitM to Xillybus. We also generate new start/end of packet and packet valid signals, in order to be coherent with the modified packet and its timings.

SoC
In this example, our architecture only modifies data in the packet but other filtering options could be applied to modify any field of the packets such as packet type, write address, etc. Table 4 gives an overview of the resource utilization of the MitM design for the considered FPGA. The design uses less than 1% of the FPGA which permits to implement much more functionalities, such as shadow copy or more complex processing.

Shadow Copy

An interesting feature for an attacker is to bypass security mechanisms (which are not activated) by allowing only write access to memory while the read access is under control of the attacker. For this attack, we took inspiration from the shadow copy technology of Microsoft [START_REF] Gerend | Volume Shadow Copy Service[END_REF], which makes an instant snapshot of the volume. Figure 15 illustrates the shadow copy principle and the corresponding communications between the host, and the memory, and the role of our MitM architecture. To perform and test our shadow copy architecture, we used StreamWrite drivers of Xillybus with a custom C code to send random data with different PCIe packet payload size, between 1DW to 1024DW. The architecture stores a copy of all the data sent from the host to Xillybus by filtering and decoding the packets on-the-fly. When the communication is done, we use the StreamRead driver to recover the data sent by our shadow copy memory that took the place of Xillybus memory in the communication. We finally compare the original data sent with the data sent back from the architecture. Our solution does not generate any error and does not miss any data for these tests, up to PCIe gen3 x2. Our architecture achieves also better performance for decoding and recording data than Xillybus. On-the-fly packet decoding and data recording, allows to store all the data transmitted by a packet, 4 cycles before Xillybus begin to store the first DW, as it can be seen in Figure 16. The latency of 9 cycles of the shadow copy is due to the double FIFO design developed to convert the 64bits of data to 32bits in order to have the same output as for Xillybus IP.

Analysis

A summary of resources used by the hardware design is given in Table 4, allowing to evaluate the low footprint of the 3 MITM architectures. Another point with PCIe is the variety of possible configurations that could be implemented according to a given genera- tion, impacting the number of lanes, and the clock frequency. Table 5 illustrates the evolution of the number of hardware resources required by the MitM and ST-Avalon IPs for different PCIe configurations. It can be noticed that the number of hardware resources used by the MitM and ST-Avalon IPs is less than 1% of the total resources of the considered FPGA. In addition, in our case, Xillybus uses only 2% of the FPGA, but must not be taken into account as we used it as a test IP. As a summary, the proposed MitM architecture uses very few resources, giving us the possibility to implement new attack scenarios and much more complex real-time processing, including new analysis and decoding algorithms.

Perspectives and future works

We are currently working on the implementation of this attack on a smartphone that uses a PCIe bus. We started by reverse-engineering the smartphone motherboard, in particular, the SoC and the NAND chips, to find the best way to interpose. To realize a MitM between the NAND and the motherboard, we developed a protocol to extract the memory without damaging it, or loss the data. We also design an interposer allowing us to log all the signals using an active differential probe. The first results are presented in Figure 17. The recorded signals need to be improved by using a higher frequency probe. The next step is to develop a board that will interpose our MitM FPGA architecture between SoC and NAND.

For the architecture, we also need to upgrade the FPGA board to one that has a dual-port PCIe like the Intel Alaric Arria 10 board which owns 2 PCIe gen 3.0 x4 ports, one endpoint, and one root. The ports will be connected to both smartphone's motherboard from the endpoint port and the memory from the root port. Depending on the targeted smartphone for our attack, we possibly need to make our architecture NVMe compliant by implementing an overlay to decode this type of packets, which will potentially increase the latency of our MitM.

We are also looking to develop a daughter-board that will interface between the SoC/NAND of a smartphone, see Figure 18. The first version will be a sniffer in order to refine our architecture and analyze the communications to locate the sensitive information in encrypted communication. The second version will be then a MitM by redirecting PCIe lanes to make the communications between the memory and the SoC routed through the FPGA, using both of the endpoint and the root ports of the

board.

The countermeasures for our attack will also be investigated, implemented and tested in a real situation with the setup that will be realized based on the FPGA and the daughter-board.

Conclusion

In this paper, we present a versatile hardware MitM architecture capable of interfacing with PCIe bus communications. This low-footprint architecture proves that an invisible MitM can be performed on a high-performance data bus like PCIe with respect to its constraints. We also present an emulator used to evaluate this architecture, which aims to mimic the typical smartphone communications between the SoC and its memory through the internal PCIe data bus. To test our architecture, we performed three practical scenarios of attack: log and filter packets, log and corruption, and shadow copy of all the data transmitted through the PCIe bus in real-time. The architecture is able to process the packet in the flow, duplicate and store all the data 4 clock cycles before Xillybus begins its processing. It uses less than 1% resources of the FPGA board which is useful when implementing more complex algorithms. Our future work will focus on the evolution of the PCIe MitM architecture and the emulator to be NVMe compliant. We will investigate also the possibility of physical interposition between the SoC and the memory of a smartphone. This will require the development of a custom board to interface with its PCIe communication bus and to perform the MitM attack.

Moreover, once the interface will be designed, an investigation regarding how to analyze and extract useful information from PCIe communications will be done. Even if the content of the data stored into the smartphone's memory is encrypted, we are interested in the analysis of the number of access to particular locations of the memory, to then try to correlate them to security mechanisms such as the password attempts counter.

Fig. 1 .

 1 Fig. 1. Simplified smartphone architecture.

Fig. 3 .

 3 Fig. 3. Man in the Middle principle.

Fig. 4 .

 4 Fig. 4. Time evolution versus password attempts.

Fig. 6 .

 6 Fig. 6. Emulator of smartphone MitM on PCIe developed at PC scale.

Fig. 7 .

 7 Fig. 7. MitM architecture in sniffer mode.

Fig. 12 .

 12 Fig. 12. Chronogram data logging and packet filtering scenario test (recorded with SignalTap 2 logic analyzer).

Fig. 13 .

 13 Fig. 13. Communications during data logging and injection mode.

Fig. 15 .

 15 Fig. 15. Communications in the shadow copy mode.

Fig. 14 .

 14 Fig. 14. Chronogram of data logging and corruption scenario test (recorded with SignalTap 2 logic analyzer).

Fig. 16 .

 16 Fig. 16. Real communications during the Shadow Copy attack (recorded with SignalTap 2 logic analyzer).

Fig. 17 .

 17 Fig. 17. Clock and data signals recorded from a real smartphone.

Fig. 18 .

 18 Fig. 18. Illustration of the MitM prototype on smartphone.

Table 1 .

 1 State-of-the-art of attacks on smartphones.

	Attack	Type	Date	Target	Device	Results	Countermeasure
	Hummingbad [2]	SLA	2017	Virus	Android	Data corruption	Antivirus update
	FalseGuide [3]	SLA	2017	Virus	Android	Data corruption	Antivirus update
	Shedun [4]	SLA	2015	Virus	Android	Data corruption	Antivirus update
	Pegasus [5]	SLA	2016	Spyware	iOS	Stealing data	Antivirus update
	Swearing [6]	SLA	2017	Trojan	Android	Stealing data	Antivirus update
	Gooligan [7]	SLA	2016	Rootkit	Android	Control device	Antivirus update
	Nand mirroring [8]	HLA	2016	NAND	Apple iPhone 5c NAND	Unlock iPhones	From iPhone 6 counter redundancy in EEPROM
	EM attack [9]	HLA	2015	Cache	ARMv7-M	Fault injection	Ad-hoc protections designe and Algorithm protection
	Side channel [10]	HLA	2018	Cache	ARM TrustZone	Key extraction	bit-sliced AES implementation in ARMv7
	key extraction [11]	HLA	2016	CryptoCore	Android and iOS crypto lib	Key extraction	iOS 9: new library implementation
	I2C attack [12]	HLA	2017	I2C bus	Android 6.0	Inject malware	I2C encryption or device authentication
	Blueborne [13]	PLA	2017	Bluetooth	Windows, Linux, Android, iOS	Stealing data	Correction of the implementation protocol
	MitM Bluetooth [14]	PLA	2010	Bluetooth	Bluetooth Secure Simple Pairing	Data interception	Improve Secure Simple Pairing protocol
	Mactans [15]	PLA	2013	USB	Apple iPhone iOS	Inject malware	iOS 7: Ask user for trust host
	NFC Fuzzing [16]	PLA	2012	NFC	Android	Inject malware	Correction of NFC implementation protocol
	MitM NFC [17]	PLA	2017	NFC	NFC Tags	Data interception	Atmospheric and temperature sensors
	Key Reinstallation [18]	PLA	2017	WiFi	Android 6.0	Stealing data	Protocol update: One time key installation
	MitM Wifi [19]	PLA	2018	WiFi	Windows, Linux, Android, iOS	Data interception	DHCP snooping, dynamic ARP inspection and NDI
	Cellebrite [20]	PLA	2018	USB	Apple iPhone iOS	Unlock iPhones	iOS 12: Disable USB protocol after 1h
	GreyKey [21]	PLA	2018	USB	Apple iPhone iOS	Unlock iPhones	iOS 12: Disable USB protocol after 1h
	Our MitM Attack	HLA/PLA	2019	PCIe bus	All devices using PCIe bus	Log and modify data	No countermeasure known

Table 2 .

 2 Time for N password attempts.

	Nb of attempts	Time	Our method
	4	320 ms	320 ms
	5	1mn	400 ms
	6	6mn	480 ms
	8	36mn	640 ms
	9	1h36mn	720 ms
	10	25h36mn	800 ms
	11	data lost	880 ms
	10 6	data lost	22h 5mn 16.8s

Table 3 .

 3 PCIe evolution.

		PCIe	Date	Data	Transfer	Throughput
	Generation	Encoding	Rate	per lane
		1.0		2003	8b/10b	2.5GT/s	0.25GB/s
		2.0		2007	8b/10b	5GT/s	0.5GB/s
		3.0		2010	128b/130b	8GT/s	0.985GB/s
		4.0		2017	128b/130b	16GT/s	1.969GB/s
		5.0		2019	128b/130b	32GT/s	3.938GB/s
	As illustrated by Figure 5, PCIe protocol is based on three
	layers [29]:
				TLP				Device
				Physical Layer
				Data Link Layer			Device Core
				Transaction Layer
	STP	Seq Num	Device Core HDR Payload	Digest	CRC	End	Transaction Layer
	1B	2B		3-4DW 0-1024 DW 1DW 1DW 1B
				DLLP			Data Link Layer
				Physical Layer
				Data Link Layer		Physical Layer
		STP	DLLP Type Misc CRC	End
		1B		1DW	2B	1B		RX TX
				Fig. 5. PCIe Layers and packet types.

Table 4 .

 4 MitM Architecture performances and resources.

	Tests	ALUT	Registers	Frequency	Latency	Throughput
	Logger	25 (<1%)	137	250 MHz	1 cycle	16Gb/s
	MitM	56 (<1%)	138	250 MHz	1 cycle	16Gb/s
	Shadow Copy	187 (<1%)	276	250 MHz	9 cycles	16Gb/s

Table 5 .

 5 MitM and ST-Avalon resources for several PCIe configurations.

	Tests	ALUT	Registers	Utilization	Frequency	Interface
	Gen1 x1	601	584	<1%	125 MHz	64 bits
	Gen1 x2	642	688	<1%	125 MHz	64 bits
	Gen1 x4	725	673	<1%	125 MHz	64 bits
	Gen1 x8	948	771	<1%	250 MHz	64 bits
	Gen2 x1	739	783	<1%	125 MHz	64 bits
	Gen2 x2	794	822	<1%	125 MHz	64 bits
	Gen2 x4	914	900	<1%	250 MHz	64 bits
	Gen3 x1	761	796	<1%	125 MHz	64 bits
	Gen3 x2	821	835	<1%	250 MHz	64 bits

Acknowledgement

The authors would like to thank the Paris Seine Initiative and IDEMIA for their financial support, and the members of PJGN for their constructive contribution to this work.

ST Avalon MitM IP Xillybus

to read at a specific memory address. Even if the data have been updated in memory, the MitM will continue to replay the initial value. We can notice that one of the main advantages of our architecture is that can be used with any device communicating over a PCIe bus with only a few modifications to adapt to the proprietary interface.

ST Avalon MitM IP Xillybus

Experimental results

Experimental setup

To validate our architecture, we emulate a smartphone architecture on a dedicated setup. For the host (SoC) we choose to use a dedicated computer, a DELL T7910 with double Intel Xeon Processor E5-2600 v4 (22 cores per processor) and 40 lanes PCIe split into 6 slots PCIe 3.0 x16. The proposed MitM architecture, described previously, was implemented into an Intel FPGA Stratix V DSP development board [START_REF] Intel | DSP Development Kit, Stratix V Edition[END_REF] which is equipped with a compatible gen 3.0 x8 lanes endpoint PCIe slot, 1GB DDR3 SDRAM, 939k registers and 622k logic elements. This FPGA will allows us to implement complex designs requiring real-time data analysis and modification. A second computer is used to switch between the different scenarios through the NIOS. It is also used to display results of filtering like packet headers.

The experimental setup is shown in Figure 10. All the figures in the following sections, showing the effectiveness of the approach, were obtained from real measurements on PCIe using SignalTap II Logic Analyzer from Quartus Software. We also have used an integrated logic analyzer (ILA) IP in order to physically access specific signals of our MitM architecture, e.g. control and data signals indicated in Figure 6.

Data logging and packet filtering

A first test was to perform packet filtering during host/memory or memory/host communication. This set-up will validate the possibility of being invisible from the two communicating elements, i.e. the computer and Xillybus. In our case, we deliberately filter three types of packets, by directly looking at the headers, which correspond to read memory request (RMR), write memory request (WMR), and completion with data (Cpl). The communication with the memory is done in the following way: if the host (master) wants to write data in memory, it sends a WMR packet, with the write address and the data, to be written into memory. Then, the memory responds with a DLLP acknowledge. In the case of RMR, if the host wants to read from the memory, it sends a RMR packet with the read address and the data size. Then, the memory responds with a Cpl packet which contains the requested data. These operations are described in Figure 11. As indicated by Figure 12, the architecture is able to successfully log the appropriate communications by filtering and decoding the packets.

Figure 12 represents a completion with data packet that contains a test message. This message is correctly sent by the host, then filtered by our architecture from the information available in the packet header, in order to only extract the data from it.

Data logging and packet corruption

To go further, the previous architecture was improved, by enabling on-the-fly modification of the content of packets. This


Gilles Créhange

Michaël Soussan

David Gensanne

Pierre Decazes

Juliette Thariat

Sébastien Thureau
email: sebastien.thureau@chb.unicancer.fr

Interest of positron-emission tomography and magnetic resonance imaging for radiotherapy planning and control Intérêt de la tomographie par émission de positrons et de l'imagerie par résonance magnétique pour la planification et le contrôle de la radiothérapie

Keywords: PET, Radiotherapy, MRI, PET/MRI, MRI linac

Computed tomography (CT) in the treatment position is currently indispensable for planning radiation therapy. Other imaging modalities, such as magnetic resonance imaging (MRI) and positron emissiontomography (PET), can be used to improve the definition of the tumour and/or healthy tissue but also to provide functional data of the target volume. Accurate image registration is essential for treatment planning, so MRI and PET scans should be registered at the planning CT scan. Hybrid PET/MRI scans with a hard plane can be used but pose the problem of the absence of CT scans. Finally, techniques for moving the patient on a rigid air-cushioned table allow PET/CT/MRI scans to be performed in the treatment position while limiting the patient's movements exist. At the same time, the advent of MRIlinear accelerator systems allows to redefine image-guided radiotherapy and to propose treatments with daily recalculation of the dose. The place of PET during treatment remains more confidential and currently only in research and prototype status. The same development of imaging during radiotherapy is underway in proton therapy.

Résumé

La tomodensitométrie en position de traitement est actuellement indispensable pour la planification de la radiothérapie. D'autres modalités d'imagerie, comme l'imagerie par résonance magnétique (IRM) et la tomographie par émission de positons (TEP), peuvent être utilisées pour améliorer la définition de la tumeur et/ou des tissus sains mais également donner des données fonctionnelles du volume cible. Un recalage précis des images étant indispensable pour la planification thérapeutique, l'IRM et la TEP doivent être recalées à la scanographie de planification. La TEP/IRM hybride avec un plan dur, peut être utilisée mais pose le problème de l'absence de scanographie. Enfin, des techniques de déplacement du patient installé sur une table rigide sur coussin d'air permettent de réaliser des TEP/scanographie/IRM en position de traitement en limitant les mouvements du patient existent. En parallèle l'apparition d'accélérateurs avec IRM embarquée permet de redéfinir la radiothérapie guidée par l'image et de proposer des traitements avec recalcul quotidien de la dose. La place de la TEP au cours du traitement reste plus confidentielle et actuellement uniquement au statut de recherche et de prototype. Ce même développement de l'imagerie en cours de radiothérapie est en cours en protonthérapie.

Introduction

Radiotherapy is an essential treatment for more than 50% of cancers in both the curative and palliative phases. Current treatments have presented major advances in the field of drugs with a range of less toxic and more effective systemic therapies (targeted therapies, immunotherapies). In surgery, the arrival of minimally invasive techniques has made it possible to significantly reduce the morbidity.

The greatest advances in improving local control and reducing the side effects and sequels of radiotherapy are based on advances in medical physics and imaging [START_REF] Atun | Expanding global access to radiotherapy[END_REF].

Image-guided radiotherapy is widespread and used for the treatment of the majority of cancers using low (kilovolt) or high (megavolt) energies including onboard imaging systems to improve targeting accuracy before or during the session from a direct or indirect target that may be a bone target, implanted fiduciary markers or soft tissues [START_REF] Jaffray | Image-guided radiotherapy: from current concept to future perspectives[END_REF]. For several cancers, such as prostate cancer, imageguided radiotherapy has established itself as a technique that reduced toxicity and hypofractionated treatments. Image-guided radiotherapy is also essential for certain tumours considered radioresistant that can now be treated with stereotaxis [START_REF] Jaffray | A facility for magnetic resonance-guided radiation therapy[END_REF][START_REF] Simpson | A survey of image-guided radiation therapy use in the United States[END_REF]. Despite these advances, radiotherapy, guided by x-ray images and delivered by a low or high energy source, remains a technique that still suffers from several limitations and disadvantages: irradiating techniques, difficulty in managing movement, overor underestimation of the target volume related to the quality of the computed tomography (CT) image by cone beam reconstructed in three dimensions (3D), artefacts related to prostheses or air in the intestines, adaptation to the response to radiotherapy.

Due to its excellent spatial resolution and high soft tissue contrast, magnetic resonance imaging (MRI) has become a reference anatomical imaging tool for tumour staging and remote extension. This nonirradiating, repeatable technique also has the advantage of performing functional measurements (multiparametric MRI) in order to study tissue function (diffusion or dynamic infusion sequence). It thus combines the advantages of optimal anatomical imaging with a strong contrast between tissues, bones and fat while giving major information on the mapping, behaviour and aggressiveness of the tumour.

Positron emission tomography coupled with CT (PET/CT) has also significantly altered the diagnosis and staging of several cancers (lung, haematological, prostate, etc.). This technique has a more limited spatial resolution but allows detection of distant lesions in order to optimize the therapeutic strategy but can also give functional information about the tumour (hypoxic zones, proliferative zones, etc.), notably to consider therapeutic adaptations (escalation, de-escalation, pertherapeutic imaging).

What role for PET/MRI in radiotherapy planning?

The use of MRI and PET is becoming increasingly common in radiotherapy planning. The integration of these two modalities ideally requires the performance of examinations in the processing position, followed by an adjustment of the PET and MRI images on the dosimetric scanner. These different steps can generate biases in image registration and have important consequences on the contouring of target volumes.

Hybrid PET/MRI, with its digital PET detectors insensitive to magnetic field, allows simultaneous acquisition of both modalities. Hybrid PET/MRIs are relatively new equipment, the first installations took place in 2010 to be used for clinical or research purposes [START_REF] Fendler | Variations in PET/MRI operations: results from an international survey among 39 active sites[END_REF]. The theme of oncology dominates the indications, particularly prostate cancer, brain or head and neck tumours. Hybrid systems are concentrates of recent technological developments in PET detection systems: time of flight (TOF) correction, modelling of detector response function (point spread function, PSF), new reconstruction methods (Bayesian method), and compensation for respiratory movements [START_REF] Grant | NEMA NU 2-2012 performance studies for the SiPM-based ToF-PET component of the GE SIGNA PET/MR system[END_REF].

In clinical practice, PET/MRI has shown superior performance to PET/CT when MRI was used for diagnostic purposes, particularly in the identification of bone metastases of breast cancers, staging of colorectal cancers, and recurrence of pelvic tumours [START_REF] Eiber | Prospective head-to-head comparison of ( 11 C)-choline-PET/MR and ( 11 C)-choline-PET/CT for restaging of biochemical recurrent prostate cancer[END_REF]. The 2017 International Workshop in Tübingen, Germany, discussed the potential of PET/MRI to monitor therapeutic responses and adapt therapeutic targets during radiotherapy [START_REF] Bailey | Combined PET/MRI: global warming-summary report of the 6th International Workshop on PET/MRI[END_REF]. However, in 2019, an international workshop mentioned benefits in terms of patient comfort and improved image registration, but the interest in radiotherapy was not mentioned [START_REF] Hope | Summary of the first ISMRM-SNMMI Workshop on PET/MRI: applications and limitations[END_REF]. By the simultaneous acquisition of both modalities, hybrid PET/MRI could facilitate image shift and improve radiotherapy planning [START_REF] Thorwarth | Combined PET/MR imaging using ( 68 Ga)dotatoc for radiotherapy treatment planning in meningioma patients[END_REF].

The first applications of PET/MRI contribution for radiotherapy were published in 2011, reporting a clinical case of meningioma treatment by intensity-modulated irradiation: the planning target volumes measured on MRI and PET separately, were significantly different, from a planning target volume measured on simultaneous PET/MRI acquisition [START_REF] Thorwarth | Simultaneous ( 68 Ga)dotatoc-PET/MRI for IMRT treatment planning for meningioma: first experience[END_REF]. A German team subsequently developed a prototype treatment table, on which MRI antenna supports (6-channel body antennas) were attached for PET/MRI imaging of the head and neck region in the thermoformed mask treatment position [START_REF] Paulus | Towards integration of PET/MR hybrid imaging into radiation therapy treatment planning[END_REF].

The authors demonstrated the technical feasibility of the system, with good MRI image quality, even if the "signal-to-noise" ratio of the images is reduced by about 20 to 30% compared to diagnostic MRI; they also showed a good quantification of the PET signal, provided that the attenuation caused by the immobilization equipment is corrected, using an attenuation map generated by a scanner.

Another prototype, for whole body imaging, has been developed by a Swedish team [START_REF] Brynolfsson | Technical note: adapting a GE SIGNA scanner for radiotherapy[END_REF]. In this study, the authors observed a relative decrease of 30 to 50% in the signal-to-noise ratio in MRI, compared to the PET/MRI performed in the diagnostic position, requiring an adjustment of MRI protocols and probably an increase in examination time. Other authors mention the possibility of doing without the dosimetry scanner, by performing only a PET/MRI scan in the treatment position, and by constructing a pseudo CT from MRI images to perform pretherapeutic dosimetry, this technology could have a major interest in prostate or head and neck cancers [START_REF] Zhu | integration of pet/mr hybrid imaging into radiation therapy treatment[END_REF].

PET/MRI therefore has a definite potential in radiotherapy planning, justified above all by the improvement of intermodality registration through the optimization and better definition of therapeutic target volumes. However, this potential remains limited due to the small number of machines available and the high cost of the devices.

The alternative to PET/MRI is to perform both examinations under the same conditions and in the treatment position. This system should make it possible to reduce the misalignments between images and to benefit from the PET/CT scanner in the absence of validation of the pseudo CT that could be created from the PET/MRI. This system can be envisaged using General Electric® equipment (PET/CT Discovery™ GE710 and an Optima™ MR450w MRI). Both examination rooms should be equipped with centring lasers and rigid tabletops. Patient transfer from one modality to the other is performed using a rigid Zephyr XL (Diacor®) tabletop. This air-cushioned device, which is multimodality compatible, makes it possible to move the patient while keeping him/her in the treatment position. The acquired images are aligned using the "Integrated Alignment" module of the AW Server 3.2 (General Electric®) software. Zephyr XL in the context of trimodality for radiotherapy allows for a reduction in image registration uncertainties for the different modalities, thus improving the definition of dosimetric volumes.

What role for PET/MRI in radiotherapy?

This imagery remains underutilized and often associated with CT imaging, and will require training for our teams if we want to disseminate it and improve:

• the management and handling of these machines in the environment of a particle accelerator;

• the identification and selection of the acquisition sequences best adapted to the pathology to be treated;

• the interpretation of images.

During planning, MRI produced for diagnostic or performed in the treatment position ("fused" MRI) remains the most widely used technique. During processing, some linear accelerator manufacturers offer image-guided radiotherapy, based on the same principle by integrating a real-time MRI fusion management platform to adapt the positioning or distribution of the dose to the MRI shift. These techniques suffer from several disadvantages that add uncertainties in the definition of the target volume:

• quality of the registration: automatic, semi-automatic, manual (cognitive);

• image distortion management;

• different MRI acquisition time from treatment planning CT acquisition time that may decrease the likelihood of reproducing the patient's or tumour's anatomy.

The integration of an MRI coupled with a particle accelerator offers multiple advantages: better definition of target volumes, non-irradiant examination that can be repeated or used in fourdimensional (4D) cinema mode during the session, ease of integration into an adaptive radiotherapy clinical program. Internal physiological movements during irradiation imply the use of additional margins to manage these uncertainties (an "internal margin" which added to the "set up margin" can lead to planning target volumes of 3 to 15 mm classically). The introduction of MRI to a radiotherapy accelerator should make it possible to reduce the target volume and improve its definition and, above all, reduce the irradiation of the organs at risk around it and reduce the "internal margin" to a value close to zero. At the same time, multiple technical constraints exist requiring complex engineering and quality assurance of physics associated with the distribution of emitted dose from the beam under a magnetic field of variable intensity.

Equipment

Currently four MRI machines exist, two of which are marketed after obtaining a CE marking in France: the MRidian® from ViewRay® (Oakwood village, Ohio) and the Unity™ from Elekta™ (Stockholm, Sweden). The main characteristics of these two machines are summarised in Table 1.

MRidian®

This system was developed with its MRI-guided adaptive radiotherapy solution "plug and play". The Tumours treated with this machine are mainly abdominopelvic: pancreatic cancer, liver cancer, prostate cancer but also breast, thorax or head and neck cancers [START_REF] Bruynzeel | A prospective single-arm phase 2 study of stereotactic magnetic resonance guided adaptive radiation therapy for prostate cancer: early toxicity results[END_REF][START_REF] Acharya | Magnetic resonance image guided radiation therapy for external beam accelerated partial-breast irradiation: evaluation of delivered dose and intrafractional cavity motion[END_REF].

MRIdian® allows adaptive radiotherapy with gating of the tumour position by MRI. This adaptive radiotherapy is based on the anatomy of the day (intrafractional movements of the tumour and interfractional movements of organs at risk) on sagittal T1 or T2 sequences and will soon be available in all three planes [START_REF] Klüter | Technical design and concept of a 0.35 T MR-linac[END_REF]. The major disadvantage are a heavier service organization and a treatment time that remains long, 30 to 60 minutes, with the required presence of a doctor, a physicist and a manipulator during each session [START_REF] Cusumano | Predicting tumour motion during the whole radiotherapy treatment: a systematic approach for thoracic and abdominal lesions based on real time MR[END_REF]. More recent work seems to show that dose and/or volume adaptive radiotherapy based on response should be possible thanks to the technical feasibility of 0.35 T diffusion sequences [START_REF] Shaverdian | Feasibility evaluation of diffusionweighted imaging using an integrated MRI-radiotherapy system for response assessment to neoadjuvant therapy in rectal cancer[END_REF].

Unity™

This system has been developed by the UMC Utrecht team who succeeded in integrating a 1.5 T MRI (Philips®, Best, Netherlands) with an Elekta™ particle accelerator (Stockholm, Sweden) delivering 6MV X-photons. The proof of concept was established and published in 2008 and 2009 [START_REF] Raaymakers | Integrating a 1.5 T MRI scanner with a 6 MV accelerator: proof of concept[END_REF][START_REF] Lagendijk | MRI/linac integration[END_REF].

Currently the system has evolved to include a 7 MV accelerator. The integrated MRI can also evaluate the movements and anatomical position of the tumour and surrounding organs, as well as their deformation before and during each session [START_REF] Stemkens | Effect of intra-fraction motion on the accumulated dose for free-breathing MR-guided stereotactic body radiation therapy of renal-cell carcinoma[END_REF][START_REF] Winkel | Adaptive radiotherapy: The Elekta Unity MR-linac concept[END_REF]. Replanning based on MRI is also possible.

Unity™ therefore makes it possible to envisage the integration of real-time imaging biomarkers to evaluate the response to irradiation between sessions and adapt irradiation volumes and/or doses. The first treatments were carried out in 2018 in Utrecht on pelvic lymph node relapses of prostate cancer and to evaluate the analgesic response to vertebral radiotherapy of spinal metastases [START_REF] Werensteijn-Honingh | Feasibility of stereotactic radiotherapy using a 1.5 T MR-linac: Multifraction treatment of pelvic lymph node oligometastases[END_REF]. Treatment times were less than 60 minutes. Soft tissue contour tracking appears to be feasible with a precision close to that of fiduciary marker tracking (less than 1mm) [START_REF] De Muinck Keizer | Fiducial marker based intrafraction motion assessment on cine-MR for MRlinac treatment of prostate cancer[END_REF]. Uncertainty still exists on the clinical impact of the electron return effect with 1.5 T MRI, responsible for areas of over or under dosage at the interface of low and high density areas (lungs, airway, soft tissue, bone) [START_REF] Mcdonald | Low-density gel dosimeter for measurement of the electron return effect in an MR-linac[END_REF]. Approximately 40 machines are installed worldwide, with a first machine planned in France in 2021 in Lyon.

PET-linear accelerator

A prototype (not commercialized) combining a PET scanner and a linear accelerator, RefleXion™ X1, is being developed by RefleXion™ (Hayward, California, USA).

The concept of this machine compared to the current low or high energy image-guided, or MRI-guided radiotherapy systems is completely different. It introduces a new concept: biologically guided radiotherapy. The rotary gantry combines a linear particle accelerator delivering 6 MV X-rays with a flow rate of up to 800 UM/min and a multiblade collimator of 2 x 64 blades and a double PET detector, positioned on the rotary gantry at 90° from the accelerator, allowing to guide the radiotherapy according to the metabolism detected after injecting the patient with a radiotracer.

Positron emission from the tumour generates two photons at 180°. The emission of these two photons at 180° causes response lines which are detected by the accelerator in 250 ms and allow dynamic targeting, in real time (tracking), of multiple metabolically active mobile lesions [START_REF] Fan | Toward a planning scheme for emission guided radiation therapy (EGRT): FDG based tumor tracking in a metastatic breast cancer patient[END_REF][START_REF] Fan | Emission guided radiation therapy for lung and prostate cancers: a feasibility study on a digital patient[END_REF]. The advantages could therefore be multiple: no need for trustees, no need for gating and internal target volume, possibility of treating multiple lesions in the same session over short treatment times.

This PET-linear accelerator prototype may have clinical potential for optimizing radiation therapy for metastatic whole body disease due to its ability to detect the whole body and the possibility of treating multiple targets at the same time and large volumes with helical radiation therapy. A major limitation to this technology is the need to inject a radiotracer prior to each session, which severely limits the number of sessions to target tumour metabolism.

What role for PET/MRI in protontherapy?

MRI and protontherapy

Protontherapy and MRI-linear acccelerator are quite regularly opposed in current debates in oncology.

There are actually several aspects to the issue: the first is probably strategic. In a context of constrained health expenditure and the attractiveness or competitiveness of health care centres, access to the latest innovation is a strong decision-making factor in the choice of investments. Another aspect of the question is the degree of innovation of these two technologies. MRI-linear accelerator systems represents 2.5 to 3 times the cost of a modern accelerator, and proton therapy is of the order of 10.

Reimbursement for procedures is not valid for either technique. The other aspects of this question are more debatable. Indeed, a non-irradiating image guidance modality associated with a photon irradiation modality is compared to a charged particle irradiation modality allowing to limit the irradiated volumes outside the tumour target without precision on the associated image-guided radiotherapy modality.

Is the clinical question relevant? These two technologies have a common objective: that of reducing toxicities with tumour control at least equivalent or even better by allowing hypofractionation and/or dose escalation.

However, it should be noted that the advantage of a non-irradiating image guiding system would be even more clinically relevant with a volume-saving irradiation modality. Cancer patients have a 36%

higher risk than the general population to have a second cancer (French national cancer institute

[INCa] report 2019): individual genetic susceptibility, role of environment and lifestyle, aging population and/or susceptibility to chemotherapy and radiotherapy? The impact of low doses of intensity-modulated radiotherapy will remain a point of vigilance for the occurrence of secondary cancers in the coming decades. In this context, the development of hadrontherapy, at least through the reduction of irradiated volumes, could ideally be coupled with a non-irradiating image guidance modality.

The concept of protontherapy MRI has been described from 2015 [START_REF] Oborn | Proton beam deflection in MRI fields: Implications for MRI-guided proton therapy[END_REF]. The deflection of protons in magnetic fields is well controlled since it is on these magnetic fields that the principle of active scanning is based. It remained to take into account the interaction of the magnetic fields of the onboard MRI with the elements of the beam line. Feasibility and resolution have been shown to be compatible with clinical use. The first clinical prototypes should be available within the next 5 years.

PET and protontherapy

PET is currently being developed as a way of online monitoring of the course and dose of hadrontherapy. One of the limits of use is the lifetime of the emitted elements. Online or offline approaches are being developed, each with their own advantages and disadvantages.

In a completely different direction, diagnostic PET imaging on board of a particle accelerator could be particularly useful for the dynamic measurement of hypoxia. Indeed, although data are relatively rare, a number of elements suggest that hypoxia is a dynamic phenomenon during radiotherapy. In hadrontherapy, the production of oxygen on the trace of charged heavy particles of high transfer linear energy [START_REF] Meesungnoen | High-LET ion radiolysis of water: oxygen production in tracks[END_REF].

The failure of intensity-modulated radiation dose-painting strategies based on imaging of hypoxia may be due in part to changes in hypoxia during fractional radiotherapy. The choice of tracer and the order of magnitude of insufficient dose escalation (+10% in photons) for oxygen enhancement ratio values of the order of 3 in hypoxic tumours could be other explanations. It is therefore potentially a field to investigate for radioresistant tumours due to hypoxia treated with hadrons, which would be facilitated by an online PET scan. Other features of varying tumour aggressiveness during irradiation, such as proliferation, could theoretically be targeted with tracers such as fluorothymidine. On the other hand, the problem of repeated dose in PET is an unavoidable limiting factor.

Conclusion

Precision radiotherapy requires high-precision imaging, which initially focused on pretherapeutic imaging. In this context, the use of multimodality has become a standard in the management of patients, particularly for cerebral, head and neck, pelvic or lung cancers. This imaging is still highly dependent on images obtained from diagnostic examinations, which poses problems of registration and fusion, image orientation (strict axial), distortions, MRI sequences, organ mobility, etc.

In this context, the appearance of examinations dedicated to radiotherapy makes it possible to resolve many of the limitations of multimodality. The appearance of PET/MRI is a major opportunity for radiotherapy to combine very high-resolution images and functional information. The use of these images remains limited by the lack of development of antennas dedicated to radiotherapy and compatible with thermoplastic masks. Specific patient transfer systems between PET and MRI can also be used and allow the patient to benefit in addition to the scanner from PET/CT. However, these more complex systems pose the same problem with respect to dedicated antennas.

Adaptive radiotherapy has developed little since its introduction, mainly due to problems with pertherapeutic imaging and dose recalculation. These problems seem to be being resolved and allow for daily replanning. The first MRI-linear acccelerator scanners have demonstrated the capacity for daily rescheduling but their therapeutic impact remains to be demonstrated. Alternative solutions based on CT imaging are also possible and would make it possible to treat patients in about 15 minutes while adapting the dose on a daily basis without any problems thanks to artificial intelligence.

Finally, the same problem arises for proton therapy and seems to be solvable. The problem of multiple image processing and verification systems may make future clinical studies and validation of such systems difficult

  robustness and speed of implementation of this system in routine operation are linked to the use of a low-energy magnetic field to reduce the constraints of image distortion and the return effect of electrons under a magnet. The first machine installed to treat patients dates back to 2014 at Washington University in Saint Louis (Missouri, USA), since then approximately 5,000 patients have been treated worldwide. More than fifty machines are installed worldwide, including three MRIdian® in France: Marseilles, Dijon and Montpellier.

Table 1 .

 1 Image-guided radiotherapy: main characteristics of the MRI-linear acccelerator systems on the market.

	Trade name	Magnetic	Ring size Beam energy	Beam size	Collimator
	(manufacturer)	field
	Mridian®	0.35 T	70 cm	6 MV flattening filter	27.4 × 24.1 cm	138 blades
	(Viewray®)			free
	Unity™	1.5 T	70 cm	7 MV flattening filter	57,4 × 22 cm
	(Elekta™)			free