Jean-Philippe Abegg

Quentin Bramas

Timothée Brugi Ère

Thomas Noel

Distributed Publish/Subscribe Protocol with Minimum Number of Encryption

Keywords: blockchain, publish/subscribe protocol, key sharing, session synchronization

Publish/subscribe is a scalable communication method for one-to-many communications. Centralized Pub/Sub protocols rely on a centralized broker that is a trusted third party managing the subscriptions. To prevent data alteration by the broker, or by an entity outside of the system, the literature proposes E2E security solutions. The issue with this solution is that they all introduce a third party who is hardly trustable in practice.

Recently, Pub/Sub protocols have been proposed using the blockchain to manage the subscriptions and provable data deliveries. In this paper, we focus our work on one publish/subscribe protocol, called SUPRA, that uses the blockchain only when necessary.

We explain why the current version of the protocol does not respect the publish/subscribe paradigm because a subscriber has to encrypt and sign each data as many times as there are subscribers. Then, present how to update the protocol in order for each data to be encrypted and signed only once, regardless of the number of subscribers, while keeping the security properties of the protocol. The result is a publish/subscribe protocol with strong delivery guarantees and traceability that can be used to share sensitive data.

Introduction

The publish/subscribe paradigm is a communication model used to exchange information. In this model, the broker is a central entity in a star topology. There are different kinds of publish/subscribe protocols and we will focus on topic based ones [START_REF] Th Eugster | The Many Faces of Publish/Subscribe[END_REF]. In this type of protocol, the publisher sends data linked to an ID, called the topic, to the broker, and the broker forwards data to all subscribers interested in the ID. The broker introduces a loose coupling between the publisher and the subscribers. This property makes the publish/subscribe model more scalable than the request/reply model, but it can also create trust issues in the system. Indeed, in a threat model where the broker can be malicious, the publisher is never sure that the data is received by the subscribers, and the subscribers are never sure that data are coming from the publisher or if there are missing messages. This issue can discourage the usage of such a paradigm for sensitive data.

The blockchain has been used to resolve this trust issue. The first propositions force the published data to go through the blockchain. Data are signed by the publisher to avoid tampering and to prove the identity of the author. The blockchain is used as a distributed storage system for sharing data between brokers. The issue with these solutions is it cost, due to the fees associated with blockchain transactions. The higher the number of messages in the blockchain, the more expensive it becomes for the publisher.

Recently, a publish/subscribe protocol called SUPRA [START_REF] Abegg | Supra, a distributed publish/subscribe protocol with blockchain as a conflict resolver[END_REF] has been proposed. It uses the blockchain only when necessary, hence making it much cheaper to deploy while having strong guarantees. The protocol uses the blockchain to set up a hybrid channel called the unidirectional channel with on-off proof of delivery. The purpose of this channel is to exchange, most of the time, messages directly between the two ends of the communication (off-chain) and only use the blockchain when we cannot guarantee the delivery of a message otherwise. Messages going through this channel are chained together with signatures, which allows the receiver to detect missing messages. Because of the message format, if N subscribers are connected to the same topic, the publisher has to encrypt N times the message and do N signatures, one for each published data. This solution does not scale well with the number of users, because with a high number of subscribers, the workload from the signature and encryption process becomes important.

Contributions

The contributions of this paper are threefold. First, we show that the current version of SUPRA does not scale well with a high number of subscribers. This problem is also present in other solutions that rely on a blockchain. Second, we present a modification of SUPRA that reduces the complexity in the number of signatures and encryptions for the publisher. With our solution, we reduce the complexity, for each data in a given topic, from N signatures and encryptions to 1, where N is the number of subscribers to this topic. Finally, we prove that, with this modification, the protocol has strong delivery guarantees. In more detail, a publisher (resp. subscriber) that follows the protocol correctly can always defend itself against any accusation and if a publisher does not follow the protocol, the subscriber can successfully accuse it with non-delivery proof.

Related work

End-to-end security End-to-end (E2E) security is a method used in [START_REF] Borcea | Picador: End-to-end encrypted publish-subscribe information distribution with proxy re-encryption[END_REF][START_REF] Dahlmanns | Transparent End-to-End Security for Publish/Subscribe Communication in Cyber-Physical Systems[END_REF][START_REF] Kumar | Jedi: Many-to-many end-to-end encryption and key delegation for IoT[END_REF][START_REF] Pallickara | A framework for secure end-to-end delivery of messages in publish/subscribe systems[END_REF] to resolve security issues in publish/subscribe environments. These propositions present how the publisher and the subscriber can protect the payload from unwanted accesses and alterations. To achieve this purpose, these propositions rely on encryption mechanisms. By encrypting data, security is achieved between the publisher and the subscribers because the subscribers are the only things in the system capable of decrypting data. In [START_REF] Pallickara | A framework for secure end-to-end delivery of messages in publish/subscribe systems[END_REF], the payload is also signed to prove message integrity.

The critical part with this security method is the key sharing process, and all these propositions introduce a new third party to handle the keys. In [START_REF] Borcea | Picador: End-to-end encrypted publish-subscribe information distribution with proxy re-encryption[END_REF], a policy authority has to create for the broker a re-encryption key derived from the publisher's private key and the subscriber's public key. [START_REF] Kumar | Jedi: Many-to-many end-to-end encryption and key delegation for IoT[END_REF] also uses a trusted third party to derived keys in the system. In [START_REF] Dahlmanns | Transparent End-to-End Security for Publish/Subscribe Communication in Cyber-Physical Systems[END_REF][START_REF] Pallickara | A framework for secure end-to-end delivery of messages in publish/subscribe systems[END_REF], the symmetric keys used for each topic are stored in a specific node in the system. All these third parties have critical information for the system. Proving the integrity of the trusted third parties is difficult as long as you do not have total read access on what it is doing. For this reason, to resolve this issue, we think that the blockchain can be used as a trustable third party to exchange public keys.

Blockchain

Blockchain is a distributed ledger technology that was first presented by Satoshi Nakamoto in 2008 [START_REF] Satoshi | Bitcoin: A peer-to-peer electronic cash system[END_REF]. The purpose of this technology is to make a network of nodes maintaining an immutable distributed ledger of transactions. These transactions are grouped into blocks. Each block is linked to the previous block using hash pointers and then added to the ledger. It creates a chain of blocks, hence the name blockchain.

The author of a transaction is identified with a pair of public/private cryptographic keys. Each transaction is signed by its author using the private key and blockchain nodes verify the signature using the author's public key. The transaction is sent to a node of the blockchain and then broadcasted over the network. Each node saves incoming transactions in a pool used to build the next blocks. Once a new block is validated, transactions integrated into this block are removed from the pool. The way blocks are appended is a result of a consensus algorithm that depends on the blockchain technology (e.g., in Bitcoin a single node is elected to append the next block).

Once a block is added to the chain, the transactions in it cannot be modified (or at least the probability that a modification can be made decreases exponentially fast over time). That is why data on the blockchain is considered immutable. This property remains true as long as a certain amount of nodes follow the protocol honestly. The minimum amount of honest nodes depends on the consensus algorithm and the blockchain implementation.

Everyone connected to the blockchain has read access to the transactions inside the blocks. If the implementation allows arbitrary data inside transactions, the blockchain can be used to resolve trust issues in publish/subscribe paradigm. Indeed, publishers can share data with subscribers through the blockchain. This idea was already presented in [START_REF] Gowri Sankar Ramachandran | Trinity: A Distributed Publish/Subscribe Broker with Blockchain-based Immutability[END_REF][START_REF] Gowri Sankar Ramachandran | Trinity: A byzantine faulttolerant distributed publish-subscribe system with immutable blockchain-based persistence[END_REF], where a network of brokers share publish data by adding it in a block. In this solution, every piece of data is signed and added to the blockchain. It adds trust, because data are signed, and the blockchain orders messages, but it is expensive because transactions have fees. With these fees, the network pays the node and stays alive. Since all published data go through the blockchain, the publisher has to pay fees for each new data. In this proposition, there is no usage of encryption mechanisms.

In [START_REF] Abegg | Supra, a distributed publish/subscribe protocol with blockchain as a conflict resolver[END_REF], a protocol named SUPRA is presented. It is a publish/subscribe protocol using the blockchain, but it reduces the number of messages. In the best-case scenario, aside from key declarations, the blockchain is never used. We will explain in further detail how the protocol works.

SUPRA

In this section, we will present SUPRA and the scalability issues in the protocol. To do so, we will first present the general concepts on which the protocol runs.

General concepts

Manager/worker model

The manager/worker model is an abstraction model used to represent systems using the publish/subscribe paradigm. In this model, the worker is an entity that computes or generates data. It is connected to a manager who handles a set of workers. Workers from this set may need data from workers handled by another manager, this dependency in data can be translated into topics used in publish/subscribe protocols. The manager acts as a broker for its workers, it forwards data from other managers to the interested workers in the set. Managers are publishers and are subscribers on the behalf of their workers.

With the manager/worker model, the central broker, present in the publish/subscribe model, is removed and replaced by the managers. It creates a distributed architecture, which removes the single point of failure introduced by the central broker. If a manager goes offline, only the subscriptions in which it is involved will be stopped.

The model assumes that the workers have total trust in the manager because it is own by the same entity. It means that the manager obtains no profit from dropping messages from or to its workers. It's the manager's job to make sure that the links between it and its workers are secured from unwanted alterations. On the other hand, since the managers do not trust each other, the links between managers are the only links in the system that need to be secured with a new protocol, and it is the purpose of the unidirectional channel with on-off proof of delivery.

Unidirectional channel with on-off proof of delivery

The unidirectional channel with on-off proof of delivery is a hybrid channel used to secure the link between managers. The channel offers to the managers delivery guarantees for each message.

As presented in Figure 1, the channel is split into two sub-channels. The first sub-channel is called the off-chain channel, it is a direct link between the sender and the receiver. When messages go through this channel, the receiver has to acknowledge them. The other sub-channel is called the on-chain channel because messages go through the blockchain to arrive at the receiver. To work, the hybrid channel assumes that the sender and the receiver are reliably connected to the blockchain. This is possible by being a full node in the blockchain network, or by being connected to a trusted full node.

Before using the channel, the sender and the receiver agree on a timeout T acknowledged . The purpose of the channel, for the sender, is to be sure that the message M i was received before T acknowledged . Each message M i has a timestamp T i . To avoid paying fees, the sender uses first the off-chain channel to send M i directly to the receiver. This sub-channel is unreliable, so M i or ACK i , the acknowledgement for M i , can be lost. Let ∆ on-chain be the maximum amount of time to add a transaction in a block. After a delay T off -ack = T acknowledged -∆ on-chain from the first sending, if the sender did not receive ACK i , the sender will use the on-chain channel to deliver M i in time. The receiver will always have a proof of delivery for M i , because it either has ACK i from the receiver or the message is publicly available in the ledger. Acknowledgments are signed by the receiver but are never send through the on-chain channel.

The channel also gives guarantees for the receiver. Indeed, the message M i is signed by the sender. The signature S i of the message M i proves the identity of the author but also the integrity of the message. The channel assumes that the public keys of the sender and the receiver are known. Also just like blocks in a distributed ledger, each message M i+1 has a reference to the previous message M i . This is represented in Figure 2. M i+1 contains the signature of the previous message P re i+1 = S i . Chaining the messages allows the receiver to detect any missing message. At the reception of M i , if the receiver detects a missing message, it does not send ACK i until the missing messages are found, because each message has a reference to the previous message, so Compared to counters, signatures evolve randomly. By comparing two messages using counters, a third party can guess how many messages were exchanged by comparing the counters. This action is impossible using signatures, since from one signature, it is impossible to guess the next one.

Overview of SUPRA

SUPRA is the first protocol using the manager/worker model and the unidirectional channel with on-off proof of delivery. The purpose of the protocol is to set up and use the channel in a publish/subscribe environment.

Before using the protocol, each manager has to declare a public key in the blockchain (doing so the blockchain also acts as a Public Key Infrastructure). This public key can be updated later, for instance, if the integrity of the private key is at risk. These keys are used to sign the chained messages going through the channel, but also to encrypt the data payload, and avoid unwanted accesses and alterations. The sender signs messages with its public key and encrypts data with the public key of the receiver. Each manager has a unique identifier. This identifier is in the transaction that contains the public key and is also repeated in the messages exchanged with other managers. When a message is received, the receiver uses the identifier of the source to check in the ledger the last public key declared by the sender and check the signature.

To set up a unidirectional channel, the publisher and the subscriber do a triple handshake, in which the subscriber indicated the topic name T N . After that, the publisher can publish data using the unidirectional channel with on-off proof of delivery. If the publisher does not deliver the messages in time, the subscriber can use a smart contract to prove that the publisher did something wrong.

Let M j be the last received message, with signature S j , from the subscriber. When it receives a new message M i , if P re i is not equal to S j , then the subscriber knows that at least one message is missing. Because of network delays, messages can be disordered but if the publisher waits for T acknowledged and is still unable to find the missing message, it knows that the publisher did not respect the properties of the channel. Indeed, the missing messages should at least be available in the distributed ledger. The subscriber can present M j and M i to SUPRA's smart contract to accuse the publisher. The publisher is unable to present proof of delivery for the missing message, since the subscriber never received them, and is penalized.

The publisher is always capable of defending itself if the subscriber does a fake accusation. If the subscriber is lying, the supposedly missing messages can not have been exchanged on-chain, otherwise, the smart contract easily found them in the ledger. This means that the publisher received an acknowledgment for the missing messages. Since each message has a dependency on the previous message, acknowledgments are cumulative. Let be ACK k the last acknowledgment from the subscriber. If the publisher presents M k and ACK k to the judge it will prove that the subscriber is lying because T j < T k . This proves that the subscriber is lying because the timestamp inside the message is superior to the timestamp inside the message presented by the subscriber. This means that the subscriber was aware of a further state in the chain of signatures, and is lying. To defend themselves against fake accusations and because the protocol assumes that two different messages can not have the same timestamp, the managers have to store, for each active subscription, the last explicitly acknowledged message and the triple handshake.

Compared to other publish/subscribe protocols using the blockchain, SUPRA reduces the number of messages sent in the ledger. Indeed, in the best-case scenario, the managers just send one message on-chain, the public key declaration, then all the messages are exchanged off-chain.

In the worst-case scenario, all the messages are sent on-chain, which is what is done in the other propositions [START_REF] Gowri Sankar Ramachandran | Trinity: A Distributed Publish/Subscribe Broker with Blockchain-based Immutability[END_REF][START_REF] Gowri Sankar Ramachandran | Trinity: A byzantine faulttolerant distributed publish-subscribe system with immutable blockchain-based persistence[END_REF]. The protocol uses the blockchain as a trusted third party. Anybody can check if the ledger is correctly handled by the network of nodes. On top of the unidirectional channel, the blockchain is used to resolve conflicts between managers, and SUPRA uses a smart contract to detect managers who do not respect the protocol.

Scalability issue

The functionalities of SUPRA are split into 5 modules. The most important module is the publishing module. Once the subscription is set up, the publisher uses this module to send data to the subscribers. The most used message in the protocol is the one named "data publication" and, in this section, we will see why this message creates a scalability issue.

For the rest of the paper, we assume that there are N subscribers for the topic T N . Each subscriber is identified by a unique number Sub, with 0 ≤ Sub < N . In Figure 3, we can observe the message M i that the publisher has to create to publish data D to the N subscribers in SUPRA. The message is the concatenation of:

• T i : timestamps of M i .
• Sub: the identifier of the subscriber.

• P ub: the identifier of the publisher. It is used by the receiver to retrieve the public key used to sign the message.

• A Sub : the alias for the topic name T N . This value is used to identify multiple subscriptions between the same publisher and the same subscriber without using the topic name T N , just like port numbers.

• Enc Sub (D): data D encrypted with the subscriber public key.

• P re i : the signature of the previous message.

• S i : the sender's signature of the message.

This message has three fields that generate a scalability issue with the number of subscribers N .

Indeed, M i contains Sub, the identifier of the subscriber. This identifier is unique for each subscriber. With this information, the smart contract can understand which managers are involved in the communication. Since each identifier is unique, the publisher has to create N version of M i to share the same data D.

To avoid unauthorized entity to have access to D, the publisher encrypts data. In the current version of SUPRA, the publisher uses the public key of Sub to encrypt D. Each subscriber links a public key to its identifier in the distributed ledger. The public key of each subscriber is unique. It forces the publisher to do N encryption operations for D and it creates N versions of Enc Sub (D), one for each subscriber.

A Sub is used to identify active subscriptions between a publisher and its subscribers. This value is set during the triple handshake between the subscriber and the publisher and is chosen by the subscriber. A Sub is coded on 2 bytes, which means that it is very unlikely that subscribers to a given topic have the same alias. At the same time, it can happen that two subscribers to different topics chose the same alias, which is something we want to avoid (with a numerical analysis 1 , if more than 302 subscribers choose a value independently and uniformly at random, there is a probability more than 1 2 that at least two will choose the same). Because of these three fields, the value of S i cannot be equal in each subscription to the same topic T N , and by extension the value P re i . Since there is N versions of the message M i , the 1 It is known that the probability that at least a collision occurs is 1 -

2 16 ! (2 16 -N )!•2 16N
(known as the Birthday problem), which is greater than 1 2 when N ≥ 302. publisher has to do N signature operations. This idea is against the publish/subscribe model. In this model, the publisher and the subscriber are loosely coupled, they do not know each other, and the publisher should not do actions specific for each subscriber. In the current version of SUPRA, the publisher has to generate N messages for the same data, encrypted N times, and sign each version. For these reasons, we consider that the protocol does not scale well with the number of subscribers and does not respect the publish/subscribe model.

To make SUPRA scalable with the number of subscribers, we will present how to synchronize the signatures between subscriptions for the same topic.

Signature synchronisation

In this section, we present how SUPRA can be modified to reduce the number of signatures and encryption operations to 1 for each data, no matter the number of subscribers. We showed in the previous section that

M i = T i ||Sub||P ub||A Sub ||Enc Sub (D)||P re i ||S i
is different for each subscriber Sub (despite the fact that the data D is the same).

A schematic idea of our solution is presented in Figure 5. If we want to make SUPRA scalable, we have to find a solution to make S i equal for all subscribers. This means that from N chains of signature, the publisher can synchronize the subscriptions to the same chain of signature. To do so, we need to prove two things:

• R1: The first message M 1 after the synchronization is the same for every subscriber.

• R2: if the message M i is the same for every subscriber, then the message M i+1 will also be the same for every subscriber.

Solution Details

Removing the Sub field from the message Sub is the unique identifier of the subscriber. To resolve our scalability issue, we are forced to remove this field from the data publication. Indeed, if we let this field in the message, two signatures for two subscribers must be different. In section 4.2, we prove that removing this field from the message does not affect the traceability of the protocol and that the judge smart contract can still work without this information.

Using a symmetric key to encrypt the data As long as data are asymmetrically encrypted, it is impossible to synchronize the subscriptions, because each public key creates a different value for Enc Sub (D). In Figure 4, we present a new control message. This message allows the publisher to securely share a symmetric key K with the subscriber. The symmetric key is encrypted with the public key Sub. By sharing the same symmetric key K with all subscribers, the publisher only has to encrypt the data D one time by using the key K.

Let the publisher chose the topic Alias In the previous triple handshake (that occurs when opening a subscription), the subscriber chooses the value A Sub . Now, to make sure that this value is equal for all subscriptions to the same topic, we have to update the handshake and let the publisher choose it. We will refer as A P ub the alias chosen by the publisher for the topic T N . The new message format for a data publication is

M i = T i ||P ub||A P ub ||Enc K (D)||P re i ||S i .
Since the message does not contain information about the subscriber, if the publisher can create one version M i that is the same for all subscribers, then the message M i+1 will also be the same for all the subscribers (rule R2). Currently, if we denote M 1 the first message that the publisher uses to share data D, P re 0 is the signature of the last message of the handshake used to set up the subscription. This signature is made by the subscriber and each subscriber has a unique public key, so there will be N version of P re 0 .

Allow P re signature overwrite In order for all the subscribers to start with the same message M 1 , we present a new control message, named Signature overwrite SigOver, to set the same value for P re 0 between the N subscribers. The message has this format SigOver =

T SigOver ||Sub||P ub||A P ub ||S Over ||P re SigOver-1 ||S SigOver Sub, P ub, and A P ub identify the subscription. T SigOver is the timestamp of the message, P re SigOver-1 is the signature of the previous message in the chain, and S SigOver is the signature of the all the previous fields concatenated. The message contains the value S Over that is used in the next data publication as the value for P re i . This message allows the manager to set the rule R1 at any time, as illustrated in Figure 6.

In the figure, we can observe that M 1 uses the value indicated in the signature overwrite as P re 0 and not S N +1 . Before the message, the publisher has a chain of signatures with each subscriber. Then, after the publisher overwrite the P re signature with the same value S 0 for all subscribers, the publisher ends up with one chain of signatures for all subscribers. This idea is represented in Figure 7. In this figure, we can observe that the publisher shares the same value S 3 between all subscribers. By doing so, it synchronizes the N chains of signatures into one unique chain.

The proposition can be optimized by adding the values of K and S 0 , directly in the triple handshake, but it is still important to be able to do these actions outside of the triple handshake. For instance, when the publisher wants to update the symmetric key (if there is a risk of leakage), without stopping and reopening every subscription.

Security

In this section, we explain why the signature synchronization process does not change the security properties of SUPRA.

Reuse acknowledgements

In SUPRA, messages are acknowledged explicitly by the subscriber or implicitly when they are added in a block. If the subscriber explicitly acknowledges the message, it signs the signature of the message. Since we add a new message to overwrite signatures, one could ask whether the publisher can reuse an acknowledgment from the subscriber for another message on the same topic.

Recall that an acknowledgment implicitly acknowledges the previous messages on the same topic received by a subscriber. However, an acknowledgment for a message M i should not be used directly for another message, or the same message for another subscriber. Lemma 1. Let M i and M i be two messages, and let ACK i,k be the acknowledgement of message M i by subscriber Sub k . Then, ACK i,k is not an acknowledgement of message M i , for any subscriber Sub k , with (i, k) = (i , k ).

Proof. Assume for the sake of contradiction that ACK i,k is an acknowledgement for message M i , for a subscriber Sub k , with (i, k) = (i , k ).

First, if the messages have different topics, hence different topic alias, then their signatures are also different. This implies that M i and M i have the same topic alias.

Since M i and M i have the same topic alias, if i = i , then their associated timestamp are different, say T i < T i . With these different timestamps, the signatures of the two messages are different, and so are their acknowledgment.

If i = i , then k = k . In this case, by definition, ACK i,k is the signature by Sub k of the signature S i of the message M i . Hence ACK i,k cannot be the signature of S i by another subscriber S k

Data access on-chain

When the acknowledgment from the subscriber takes too much time, to deliver the message before T acknowledged , the publisher sends the message on-chain. With our modifications, there is no information directly related to the subscribers inside the data publication, and the payload is symmetrically encrypted with the key K. One cannot decrypt the data without knowing this key. With our modification, we also reduce the number of messages on-chain. In the first version of the protocol, each message M i is different for each subscriber, so if n subscribers do not send ACK i in time, the publisher has to send n messages on-chain. Now, since there is only one version of M i , the publisher just has to send M i in the distributed ledger and the n subscribers will retrieve the message.

Subscriptions can be open, but they can also be closed. A former subscriber still has the key K, which means that it can decrypt the payload of messages present in the distributed ledger, without subscribing to the topic. To avoid such a scenario, good practice from a publisher's point of view is to update the symmetrical key at each unsubscriptions. However, this can lead to a lot of updates, when subscribers come and go quickly. Another technique is to set a threshold value for the unsubscriptions, when this value is reached, the publisher updates the key. This technique introduces a trade-off between the update rate of the symmetric key and the risk for former subscribers to decrypt messages in the ledger.

Conflict resolution with the smart-contract

SUPRA uses a smart contract to detect publishers who do not deliver messages in time. By comparing the signatures in the last received message and a new message, the subscriber can detect if a message is missing. If the subscriber is unable to find the missing message after T acknowledged , it knows that the publisher did not respect the protocol, because the message should at least be in the distributed ledger.

To prove that the publisher did not respect the protocol, the subscriber has to present the two messages used to detect the missing message. In our proposition, we remove the identifier of the subscriber from the message, but it is still possible for the subscriber Sub to prove that any message M i is from an active subscription with the publisher P ub.

The publisher and the subscriber do a handshake to set up the subscription. During this phase, the publisher indicates the alias A P ub used for the subscription. This value is then added to all the messages from the subscription. The handshakes of active subscriptions have to be stored by the managers. When the subscriber presents the two messages used to detect an error, it also presents the handshake to prove that there is an active subscription. The repetition of A P ub and P ub in all messages proves that the messages are from the same subscription.

Lemma 2. If a subscriber Sub has an active subscription with publisher P ub and receives two messages M i and M j with i + 1 < j, and does not receive messages M i , i < i < j before time T j + T acknowledged , then Sub can accuse P ub of not respecting the protocol.

Proof. Sub does not know how many messages are missing between M i and M j but by showing M i and M j to the judge smart-contract, everyone can see the mismatch between the previous signature P re j in M j and the signature S i of message M i . Showing the acknowledgment of the subscription message proves that the subscription is open. If the subscription is still open, the publisher cannot show a closing subscription to defend itself. If the messages M i , i < i < j, are not all on the distributed ledger and the publisher does not have the acknowledgments Ack i ,Sub for those messages from Sub (which is the case since Sub did not receive those messages), then the publisher has no way to defend itself. The publisher indeed did not follow the protocol and the accusation is successful.

Preventing false accusation

Lemma 3. If a publisher P ub follows the protocol, it can always defend itself against any accusation.

Proof. Assume that a subscriber Sub accuses P ub of not delivering a message before T acknowledged . In the worst-case Sub has access to all the messages sent by P ub to Sub and other subscribers with other topics. To start the accusation Sub has to send a message M j to the judge smart contract, accusing P ub of not sending the previous message M j-1 before T j-1 + T acknowledged . Sub also sends the subscription acceptation message from P ub to show that the subscription is open. To be valid, the Message M j must have the same topic alias as the subscription acceptation message. Since the publisher followed the protocol correctly, this topic alias is unique and is not used for another topic so the message M j is indeed addressed to Sub.

First, if the subscription is closed (correctly), the publisher either has an acknowledgment, from Sub, of the closing subscription message, or this message is in the distributed ledger. In this case, the publisher can defend itself.

Otherwise, if the subscription is still open, for every message M i older than T acknowledged , the publisher, which follows the protocol, either has received an acknowledgment or the message has been included in the distributed ledger. In both cases, it can defend itself against the accusation.

Conclusion and future works

The loose coupling property of the publish/subscribe paradigm makes this communication model interesting for one to many communications. On the other hand, the broker introduced by the model creates threats that need to be handled before exchanging sensitive data through it. The propositions relying on E2E security present how data can be protected from unwanted access and alteration, even from the broker. Unfortunately, it is difficult to present trust guarantees in the third party used to add security between the publisher and the subscriber.

The blockchain, which is by design decentralized, can be used as a trusted third party in a publish/subscribe system. This is the case in SUPRA, a publish/subscribe protocol using the blockchain. However, the protocol is not scalable with the number of subscribers, based on the publish/subscribe model. In this paper, we explain how SUPRA can be updated to be scalable with the number of subscribers while keeping the security in the system.

Compared to other publish/subscribe protocols with blockchain usage, SUPRA reduces the number of fees for the users. In future work, we want to find a method to make the solution profitable for the publisher. Currently, the publisher has to pay fees for each message send onchain. By using ideas from [START_REF] Radhakrishnan | Streaming data payment protocol (sdpp) for the internet of things[END_REF], we want to propose a method for the publisher to sell data to the subscribers, and reduce the impact of the transaction fees.

Figure 1 :Figure 2 :

 12 Figure 1: The two modes of communication of the unidirectional on/off chain channel protocol

Figure 3 :

 3 Figure 3: Data publication for the subscriber i

Figure 4 :

 4 Figure 4: Symmetric key sharing message in SUPRA

Figure 5 :

 5 Figure 5: Schematic representation of signature synchronisation.

Figure 6 :

 6 Figure 6: Example of signature overwriting

Figure 7 :

 7 Figure 7: Synchronisation between several subscriptions.


Delphine Charuau
email: delphinecharuau1@gmail.com

Béatrice Vaxelaire

Rudolph Sock

Speech Breathing Behavior During Pauses in Children

Keywords: speech breathing, children, pause, syntactic location

scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Studying breathing behavior during pauses is of interest for understanding respiratory functioning in speech, particularly in children, for whom few studies have been conducted on the subject. Breathing is in constant interaction with the linguistic level, playing an essential role in the demarcation of syntactic units, in the same way as intonation and silent pause. Pauses, with or without inhalation, are mostly realized at the grammatical boundaries [START_REF] Henderson | Temporal patterns of cognitive activity and breath control in speech[END_REF][2] [START_REF] Godde | Pausing and breathing while reading aloud: development from 2 nd to 7 th grade[END_REF]. Breathing pauses are mostly performed at the boundaries of major syntactic constituents [START_REF] Grosjean | Breathing, pausing and reading[END_REF]. Moreover, the inhalation depth depends on its location within the speech [START_REF] Conrad | Speech respiration as an indicator of integrative contextual processing[END_REF] [START_REF] Winkworth | Variability and consistency in speech breathing during reading[END_REF]. In reading, it appears that the inspiratory contribution is higher at the borders of paragraphs, and then of utterances. These patterns are not observed in children. Indeed, in young speakers, inspiratory amplitude is not significantly different according to its location at the boundaries of utterances or sequences [START_REF] Charuau | La variation des patterns respiratoires en parole chez l'enfant[END_REF]. Nevertheless, inhalations are less important when they occur outside the syntactic boundaries. The management of lung volumes did not vary significantly depending on the speech task and the increase in the cognitivelinguistic demands [START_REF] Mitchell | Cognitive-linguistic demands and speech breathing[END_REF]. On the other hand, the speech task had an effect of fluency-related parameters such as the duration of breath groups, the number of syllables per breath group, etc. Furthermore, while no significant difference is observed in the duration of inspiratory movement between reading and spontaneous speech in adults [START_REF] Wang | Breath Group Analysis for Reading and Spontaneous Speech in Healthy Adults[END_REF], there is evidence that the duration of inhalation is significantly higher in spontaneous speech in children [START_REF] Charuau | La variation des patterns respiratoires en parole chez l'enfant[END_REF]. While speech breathing has been the subject of numerous studies, recent data provide new insights into the analysis of respiratory phenomena in speech. These data reveal the occurrence of 'partial' inhalation, characterized by a reduced or incomplete intake of air compared to a typical full inhalation, in spontaneous speech [START_REF] Weston | Proposal for a novel analysis of the organization of breath pauses, silent pauses and speech intervals in spontaneous speech[END_REF]. The author of this study hypothesizes that these partial inhalations could be associated with disfluencies and/or correspond to a planning time for speech.

In addition, we will also focus on respiratory behaviors during non-breath pauses. Indeed, some data have highlighted the cassation of rib cage closure during the realization of nonbreathing pauses [START_REF] Charuau | Étude de la corrélation entre l'organisation temporelle des patterns respiratoires et la production de la parole chez les enfants porteurs de fentes labio-palatines[END_REF]. These punctual blocks could be a result of hesitation or high cognitive activity. The aim of this study is to explore breathing behaviors during breathing and non-breathing pauses, depending on the syntactic structure of utterances and the speech task, in order to supplement the description of breathing patterns in children's speech. If partial inhalations are related to disfluency and planning phenomena, we hypothesize that they would occur more frequently in spontaneous speech and be more commonly found outside the syntactic boundaries. Furthermore, we hypothesize that an increase of the duration of non-breathing pauses would correspond to a longer inhalation duration. Finally, regarding the non-breathing pauses, the punctual cessation of rib cage closure would be associated with an increase in the cognitivelinguistic demands. Consequently, these interruptions would likely occur during non-syntactic pauses and be more prevalent in spontaneous speech.

Method

Speakers

Our corpus includes recordings from ten children between 8 and 11 years old (mean = 9.71; sd = 0.772) with no reported speech or respiratory disorders. They were native speakers of French. These recordings come from a corpus created for the study by Charuau [START_REF] Charuau | Étude de la corrélation entre l'organisation temporelle des patterns respiratoires et la production de la parole chez les enfants porteurs de fentes labio-palatines[END_REF] about speech breathing in children with and without cleft palates.

Corpus

Each participant was instructed to read the tale La bise et le soleil at comfortable speech rate and intensity. This task was repeated once. For the spontaneous speech task, the speakers were asked to carry out a picture-based storytelling activity. An example with similar images was provided prior to the recording session.

Acquisition system

The variation of respiratory movements was measured using Respiratory Inductive Plethysmography (Respitrace system, ADInstruments). Two electromagnetic belts were positioned on the thorax and the abdomen of each speaker. Acoustic data was collected using a Senheiser e835s microphone and a Marantz Professional digital recorder. The children stood upright 30 cm away from the microphone. A marking on the floor was made to maintain this parameter across speakers. The synchronization of the acoustic and respiratory signals was achieved using PowerLab (ADInstruments). The respiratory and speech signals allow observing variations of the thoracic-abdominal perimeter during phonation.

Data processing

To analyse the breathing movements as a whole, we created a new signal by collapsing the thoracic and abdominal signals ( 1Tho + 1 Abd) [START_REF] Hixon | Kinematics of chest wall during speech production: volume displacements of the rib cage, abdomen, and lung[END_REF]. The amplitude of respiratory movements was measured in terms of maximum displacement (%MD) [START_REF] Rochet-Capellan | Changes in breathing while listening to read speech: the effect of reader and speech mode[END_REF], which was estimated for each speaker from isovolume maneuvers [12] [13]. The respiratory data, synchronized with the speech signal, was processed using MATLAB software [19]. In addition, the acoustic speech signal was analysed using the Praat software [START_REF] Boersma | Praat, a system for doing phonetics by computer[END_REF], and semi-automatically annotated with EasyAlign [START_REF] Goldman | EasyAlign: An automatic phonetic alignment tool under Praat[END_REF].

Speech and respiratory measurements

We were measuring the amplitude inspiratory movement, wich was defined as the difference between the minimum and maximum values of the inspiratory movement [START_REF] Tanguy | Projet FRFC "Périphérie gauche des unités de discours" -Protocole de codage syntaxique[END_REF]. The duration of inhalation was measured as the interval between these two values of movement. The pause duration was the time between the end of the speech and the beginning of the new breath group.

Labeling of pauses and syntactic analysis

For our analyses, we made a distinction between breathing pauses and non-breathing pauses. Breathing pauses were characterized by a cessation of phonation accompanied by an increase in the respiratory curves. For the analysis of inspiratory movements, we also differentiated between inspiratory and partial inspiratory, as defined by Weston [START_REF] Weston | Proposal for a novel analysis of the organization of breath pauses, silent pauses and speech intervals in spontaneous speech[END_REF] as 'half the range of the fullest inhalation in the trial'. Syntactic labelling was performed manually using Praat, based on a method relies on the dependency relations between units, according to the principles of micro-and macro-syntax [START_REF] Tanguy | Projet FRFC "Périphérie gauche des unités de discours" -Protocole de codage syntaxique[END_REF]. Thus, we categorized pauses located at the boundaries of major syntactic units (rection unit), at the boundaries of minor unit (verbal, subject, object, or rule sequences) and non-syntactic pauses located outside these boundaries.

Statistical analyses

Statistical analyses were performed using RStudio software (version 1.4.1717) [START_REF]RStudio: Integrated development for R, Computer software[END_REF]. The data were compared using repeated measures analysis of variance (ANOVA). This model has been chosen to examine the impact of intra-subject factors (speech tasks and syntactic location) on the variables under analysis, such as the duration of inhalation and pauses. The overall significance level was set at p < 0.05. When significance was indicated, Bonferroni tests were conducted for post-hoc comparisons.

Results

Inspiratory and partial inspiratory

Figure 1 illustrates the distribution of partial inhalations and inhalations among the total number of breaths (693 breaths), according to the speech task. The results show that the frequency of partial inhalations was significantly lower than that of inhalations, both in reading and spontaneous speech (reading: partial inh. = 7.81 %; inh = 92.19 %; spontaneous speech: partial inh = 11.41 %; inh = 88,59 %). While there was a slight increase in the occurrence of partial inspirations during spontaneous speech, although the difference was not statistically significant. The results reveal that the majority of inspirations occurred between two major syntactic units, although there is a minor difference between major and minor units in reading. Most of the partial inhalations were observed at the boundaries of the syntactic constituents, like the 'typical' inhalations. Only a small number of partial inhalations were non-syntactic. In reading, partial inspirations were slightly more frequent at the boundaries of minor syntactic units. On the other hand, in spontaneous speech, they were significantly more important at the boundaries of major syntactic units.

Figure 2: Syntactic distribution of inhalations and partial inhalations according to speech task.

Duration of inspiratory and breathing pauses

Figure 3 shows the distribution of inspiratory duration values in reading and spontaneous speech, according to their syntactic location.

In reading, the duration of inhalation tended to be longer when it occurred at the boundaries of major syntactic units (mean = 0.475 sec), but the difference was not statistically significant (minor = 0.367 sec; non-syntactic = 0.379 sec; p = 0.087). Generally, inspiratory duration was significantly higher in spontaneous speech (F (1,21) = 36.5; p < 0.01). Additionally, inspiratory movement was significantly longer when it performed outside of syntactic boundaries (non-syntactic = 0.653 sec, major = 0.641 sec; minor = 0.538 sec) (F (1,21) = 24.707, p < 0.001). The duration of breath pauses followed similar patterns as the duration of inhalation, as shown in Figure 4.

In reading, the pause duration was longer when located between two major syntactic units (major = 0.682 sec; minor = 0.473 sec; non-syntactic = 0.509 sec; p = 0.029). In spontaneous speech, while the duration of pauses at major boundaries was longer than that of pauses at the ends of minor syntactic units (major = 1.134 sec; minor = 0.808 sec; p = 0.006), they were shorter than non-syntactic breath pauses (mean = 1.239 sec), consistent with the observations made for the duration of inhalation. Then, we computed the ratio of inspiratory duration to breath pause duration (figure 5). The duration of inspiration relative to the total duration of the respiratory pause was lower in spontaneous speech (reading = 0.732; spontaneous speech = 0.659). Nevertheless, figure 5 shows a inter-individual variability regarding the duration of the pause, suggesting a diversity of strategies operated by the speakers. Although the ratio of duration of inspiration to duration of pause was more important in reading for the majority of speakers, the opposite tendency was observed for others in spontaneous speech.

Analyses of non-breathing pauses

This section of the study investigates the respiratory behavior during non-breathing pauses. During some non-breathing pauses, the speaker stopped a rib cage closure, leading to stagnant respiratory curves. The blockage of chest may extend throughout part or the entire duration of the pause. On average, the duration of chest blockage accounted for 80% of the total pause duration. Therefore, we consider a non-breathing pause with chest blockage (NBP-B) as a pause in which expiratory flow is stopped for at least 80% of the total pause duration. The non-breathing pauses characterized by a momentary stop of rib cage closure account for 20.67% of all non-breathing pauses. Figure 6 illustrates the percentage of non-breathing pauses with (NBP-B) and without arrest of chest closure (NBP). Chest blocking occurred mainly during non-syntactic pauses in both reading (58.62%) and spontaneous speech (77.78%). In reading, 31.03% of non-breathing pauses with ribcage blocking occurred at the boundaries of minor syntactic units. In contrast, in spontaneous speech, there were relatively few pauses with blocking observed at the syntactic unit boundaries. Non-breathing pauses without ribcage blocking were primarily observed at the boundaries of minor constituents in both reading and spontaneous speech.

Discussion

The results obtained provide valuable insights into the organization of respiratory patterns in children with the observation of particular breathing behavior. They also offered new perspectives of research in this area. In our study, we have considered the presence of 'partial' inspirations, as described by Weston [START_REF] Weston | Proposal for a novel analysis of the organization of breath pauses, silent pauses and speech intervals in spontaneous speech[END_REF]. If these partial inspirations were fewer in number compared to 'typical' inspirations, they were observed in both reading and spontaneous speech. Contrary to the initial hypothesis proposed by Weston [START_REF] Weston | Proposal for a novel analysis of the organization of breath pauses, silent pauses and speech intervals in spontaneous speech[END_REF], these partial inspirations were not systematically associated with hesitation phenomena. Instead, they predominantly occurred at syntactic boundaries, indicating their integration within the child's breathing patterns. Moreover, all of our speakers exhibited at least one partial inspiration during reading and/or spontaneous speech, further suggesting their regular occurrence in children's respiratory behavior during speech production. Considering the presence of partial inspirations in the study of breathing in speech is important in order to understand the respiratory strategies implemented by speakers, whether in a context of typical speech or of speech disturbances, both natural or pathological. In addition, further investigation into the realization of these inspirations in a larger number of speech types or in the context of speech disorders could provide valuable insights into the emergence of these partial inspirations. The duration of inhalation, as well as the overall duration of pauses, were longer in spontaneous speech. The higher cognitive-linguistic demands associated with spontaneous speech exerts an influence on the duration of the respiratory movements. Additionally, in spontaneous speech, non-syntactic breaths and pauses are significantly longer than those occurring at the boundaries of syntactic units. The increased cognitivelinguistic demands, and the consequent rise of planning time, may lead to a slowing of the inspiratory movements. The increase in cognitive-linguistic demands affected not only the duration of inhalation but also the overall duration of pauses. The ratio of the inspiratory duration to the total duration of the pause indicated that the pause was not solely dedicated to inhale both in reading and spontaneous speech. It also appears that, in spontaneous speech, the duration of inhalation relative to the total pause duration tends to be shorter compared to reading. Consequently, the lengthening of the breathing pause in spontaneous speech was not only due to the slowing down of the inspiratory gesture. The speakers used this inspiratory time to plan the upcoming utterance or to search for words, and the other way round. If the duration of inhalation to the duration of pause was shorter in spontaneous speech than reading, we have observed the opposite phenomenon in some speakers. Indeed, the inhalation time during the pause was lower during reading. This decrease could be due to hesitations related to decoding errors occurring during reading.

The manual verification of the delimitation of inspirations revealed that the beginning and end of an inspiration could be perfectly aligned with the delimitation of the pause. Indeed, for a significant number of respiratory pauses, the inspiration starts at the end of the previous breath group, coinciding with the end of the last sound emitted, and its end corresponds to the resumption of phonation. These findings were consistent with previous research conducted by Godde et al. [4]. The thoracic and abdominal breathing behaviors during nonbreathing pauses was ignored in literature. However, understanding thoraco-abdominal behaviors during these pauses would contribute to a better understanding of breath control phenomena in speech. Some non-breathing pauses are characterized by the cessation of thoracic cage closure. As expected, the majority of these pauses are non-syntactic. These data suggest the influence of cognitive-linguistic demands on the expiratory movement control during pauses. Chest blocking during a pause can be used as an indicator of elevated cognitive activity, potentially resulting from increased planning effort or encoding error in reading. Finally, these data encourage us to approach breathing not as a biphasic phenomenon, corresponding only to inhalation and exhalation, but as a process that can involve intermediate phases characterized by a momentary pause in rib cage compression. The study of respiratory behavior during non-breathing pauses should be further investigated, particularly by considering additional measures such as the amplitude of expiratory movement during a non-breathing pause, or the speed of chest closure during the pause in comparison to the speed of the exhalation per syllable, for example. Such data, alongside an electroglottograph, would provide an overview of the synchronization of respiratory and laryngeal movements. Specifically, it would be necessary to determine whether the blockage of the thoracic cage during the pause concerns only the subglottic respiratory level, or if it is accompanied by a vocal folds closure, or laryngeal obstruction, as in apnea. These data would enhance our understanding of the control of breathing in speech. Moreover, these data would also hold clinical interest for the treatment and rehabilitation of individuals with dysarthria, stuttering, or speech disorders in children.

Conclusions

In conclusion, this study highlights the importance to consider new approaches in investigating of speech breathing. Although we have not yet identified the factors behind the emergence of 'partial' inhalations in speech, it appears that these inhalations are incorporated into the respiratory patterns of our speakers. These data should be further verified with a larger panel of children as well as with adults. Additionally, while the speech task and syntactic location did not significantly affect lung volume management, they did influence the duration of inhalation, with the movement slowing down as the cognitivelinguistic demands increased. Finally, we sporadically observed the arrest of rib cage closure, indicating a temporary interruption of the thoracic and abdominal gestures. These blockages occurred mainly during non-syntactic pauses, potentially reflecting heightened cognitive and planning activity. Furthermore, considering the influence of cognitivelinguistic demands on the respiratory control, we suggest that these breathing behaviors could be observed in adults.

Figure 1 :

 1 Figure 1: Distribution of inhalations and partial inhalations according to speech task.

Figure 2

 2 Figure 2 displays the distribution of partial inhalations and inhalations according to their syntactic location in reading and spontaneous speech.The results reveal that the majority of inspirations occurred between two major syntactic units, although there is a minor difference between major and minor units in reading. Most of the partial inhalations were observed at the boundaries of the syntactic constituents, like the 'typical' inhalations. Only a small number of partial inhalations were non-syntactic. In reading, partial inspirations were slightly more frequent at the boundaries of minor syntactic units. On the other hand, in spontaneous speech, they were significantly more important at the boundaries of major syntactic units.

Figure 3 :

 3 Figure 3: Distribution of duration values inhalation according to syntactic location and speech task.

Figure 4 :

 4 Figure 4: Distribution of duration of breathing pauses according to syntactic location and speech task.

Figure 5 :

 5 Figure 5: Ratio of the duration of inhalation to the total duration of the respiratory pause according to the speech task.

Figure 6 :

 6 Figure 6: Distribution of non-breathing pauses with rib cage blocking (NPB-B) and without (NPB), according to the syntactic location and speech task.