Wenbo Zhou

Philippe Dague
email: philippe.dague@lri.fr

Lei Liu
email: liulei@jlu.edu.cn

Lina Ye
email: lina.ye@lri.fr

Fatiha Zaïdi
email: fatiha.zaidi@lri.fr

A Coloured Petri Nets Based Attack Tolerance Framework

Keywords: attack tolerance, coloured Petri nets, Web services, formal methods, cloud security

Web services provide a general basis of convenient access and operation for cloud applications. However, such services become very vulnerable when being attacked, especially in the situation where service continuity is one of the most important requirements. This issue highlights the necessity to apply reliable and formal methods to attack tolerance in Web services. In this paper, we propose a Coloured Petri Nets based method for attack tolerance by modelling and analysing basic behaviours of attack-network interaction, attack detectors and their tolerance solutions. Furthermore, complex attacks can be analysed and tolerance solutions deployed by identifying these basic attack-network interactions and composing their solutions. The validity of our method is demonstrated through a case study on attack tolerance in cloud-based medical information storage.

I. INTRODUCTION

Service-oriented architecture supports a lot of modern software systems, which advocates "Everything as a Service". This thought is absorbed by cloud computing and developed as its typical service models, i.e., Infrastructure as a Service (IaaS), Platform as a Service (PaaS) and Software as a Service (SaaS). Cloud service providers offer multiple resources, e.g., VM (Virtual Machine), to clients on demand through the Internet. However, since clients' information is centrally stored and managed in cloud services, it will cause terrible loss once such services are attacked successfully.

Attacks bring great threats to cloud applications and hinder further development of cloud services. How to deal with attacks towards cloud services becomes an important issue. Recently, attack tolerance has been highlighted as a significant property, which allows systems to continue when attacks occur [START_REF] Constable | Investigating correct-byconstruction attack-tolerant systems[END_REF]- [START_REF] Ouffoué | Attack tolerance for servicesbased applications in the cloud[END_REF]. However, there are very few studies towards attack tolerance for cloud services, especially researches combining formal methods into attack tolerance [START_REF] Ouffoué | An attack-tolerant framework for web services[END_REF]. Moreover, most of the existing work focuses on applications. There is a lack of research on formal foundation for better understanding the essence of attacks and their solutions.

To further tolerate attacks in a reliable way, applying formal methods is a good choice, which provides strong guarantee * Correspondence to: Lei Liu liulei@jlu.edu.cn for systems security. As one of the most typical formal models, Coloured Petri Nets (CPNs) provide an elegant and practical mathematical formalism by combining Petri nets with a programming language to obtain a scalable modelling language for concurrent systems [START_REF] Jensen | Colored Petri Nets: a graphical language for formal modeling and validation of concurrent systems[END_REF]. CPNs have been used to model and analyse security aspects of many critical systems [START_REF] Jaidka | A coloured petri net approach to model and analyze safety-critical interactive systems[END_REF]- [START_REF] Attia | Using hierarchical timed coloured petri nets in the formal study of TRBAC security policies[END_REF]. Specially, useful related tools provide strong support for verification and validation of systems models. Considering good visualization for better comprehension, concurrency description, executable simulation and wide applications, we choose CPNs as the formal model to analyse the attack tolerance issue.

In this paper, inspired from formal constructions, we define some meta operations for attack tolerance, modelled and analyzed with CPNs. First, we model the basic behaviours of attack-network interaction as CPN-based patterns. Then, we provide CPN-based detection mechanisms and investigate some CPN-based tolerance solutions according to this detection. Finally, we evaluate the effectiveness of our approach by a case study. Note that our framework is generic to services in general, but as cloud services are among the most welldeveloped and complex services, we explain the approach in this scenario. Our contributions are as follows.

• We explore a semi-formal framework for attack tolerance, specifically using CPNs to design and deploy a tolerance solution according to meta attack operations. • We classify the basic attack-network interactions behaviours into four patterns, i.e., blocking, leakage, stealing and injection. Meanwhile, we analyze their detection conditions and construct their corresponding tolerance solutions, including bypassing, encryption and compensation. • We evaluate our method through a case study about attack tolerance in cloud-based medical information storage, and demonstrate its effectiveness by means of CPN Tools.

This paper is organised as follows. Sect. 2 briefly introduces Coloured Petri Nets, which are used to model Origin-Attack-Tolerance Nets, in brief OAT Nets. Sect. 3 presents our CPNs based methods, including basic interaction attack patterns, attack detectors and their tolerance solutions. Sect. 4 discusses a case study about attack tolerance in cloud-based medical information storage with the help of CPN Tools. Sect. 5 introduces related work. Finally, Sect. 6 concludes this paper and outlines future work.

II. PRELIMINARIES

Our method is mainly described using CPNs. If CPNs have the same expressive power as Petri nets, in practice they offer much more modelling power with better structuring facilities, e.g., types and modules. A typical definition of CPNs is as follows [START_REF] Jensen | Coloured Petri Nets: modelling and validation of concurrent systems[END_REF]. ∈ pre(t) (resp., post(t)). Here, --(resp., ++) indicates the subtraction (resp. the sum) of multisets [START_REF] Jensen | Coloured Petri Nets: modelling and validation of concurrent systems[END_REF].

Fig. 1 is an example of firing. In the marking before firing t, the place p 1 is set with "2'1 ++ 3'4 ++ 1'5" (p 2 with "1'3"), which is a multiset with two occurrences of the value 1, three occurrences of the value 4 and one occurrence of the value 5. If the value "5" is selected randomly to bind to the variable a, then the guard "a > 2" is satisfied, and t is enabled and can be fired. After the firing, t produces 1'6 to p 2 according to the expression E(t, p 2 ). We refer to [START_REF] Jensen | Coloured Petri Nets: modelling and validation of concurrent systems[END_REF] for precise definitions

if (a > 4) then a + 1 else a -1 a [a > 2] 2`1++3`4++1`5 p 1 p 2 t if (a > 4) then a + 1 else a -1 a [a > 2] 1`3 ++1`6 p 1 p 2 t 2`1++3`4 1`3
Fig. 1. An example before (top) and after (bottom) firing of the semantics and show how CPN models are executable and good at modelling behaviours of concurrent systems. This enlightens their use for analysis of security design aspects in concurrent systems, e.g., attack tolerance.

III. METHOD OVERVIEW

In our model-based method, we try to discover the essence of attacks by means of semi-formal construction. This is done by modelling some basic behaviours of attack-network interaction together with their detectors and tolerance solutions, which takes advantages of CPN theory, improving thus the ability for the network to tolerate an attack. To the best of our knowledge, this work is the first that attempts to apply CPN to attack tolerance problem, thus leading to better understanding and capturing it through the formal constructions. On the one hand, we propose some basic attack-network interaction patterns modelled with CPN, which will be helpful for constructing more complex models of attack tolerance. On the other hand, since the deployment of attack tolerance solutions is always time-and resource-consuming, simulations with the help of CPN Tools provide early access to effects of solutions. These executable models are also useful for further analysis or verification of these solutions (e.g., checking deadlock or reachability), since many tools support such functions. The major steps of our whole method are as follows.

1) An original net (O net) equipped with detectors (monitoring functions), modelled as a CPN, should be simulated with CPN Tools. 2) A predefined attack, modelled as a CPN (A net), is injected to O net to constitute the attacked net (OA net), whose simulation continues.

3) The attack is detected by the detectors and then identified according to our pre-built library of basic attack-network interaction patterns. 4) From this identification, a tolerance solution for this attack is generated as a CPN (T net) by composition from our pre-built library of basic tolerance solutions. 5) The simulation is suspended, the tolerance solution is deployed by composing T net with OA net to construct attack tolerant net (OAT net), whose simulation resumes showing that it tolerates the injected attack. In real-world practice, a tolerance solution should be deployed immediately when an attack is detected. In this paper, we use CPN Tools to simulate the framework, where it is not allowed to change places and transitions dynamically during continuous multiple-steps simulation. To mimic the real situation, we use the "monitors" function of CPN Tools to monitor the simulation. When an attack is detected, the monitors would suspend the simulation. Then, a tolerance solution is deployed. This way does not interfere the correctness of our method as the "suspension" does not change any other parts except the deployment of a tolerance solution. It is the same as deploying a tolerance solution immediately when a detector detects an attack. After deploying the solution, the simulation continues from the pausing state (i.e., marking) to ensure the continuity. Note that we assume that a new deployed tolerance solution cannot be attacked. If the solution is allowed to be attacked again, it leads to an infinite meta-hierarchy problem, which is out of the scope of this paper. Next we illustrate three important concepts, i.e., basic attack-network interaction patterns, attack detectors and basic tolerance solutions.

A. Basic Attack-network Interaction Patterns

Basic attack-network interaction patterns represent malicious actions, such as unauthorisedly collecting information, illegally changing entities, and so on. Here, we classify basic units, each consisting of one place, one transition and one arc. This classification is neither empirical or experimental but considers exhaustively all the possible constructions of basic interaction units between the O and A nets. As shown in Table I, there are totally 16 types of basic units (according to whether its place (resp., transition or arc) belongs to O or A net and arc direction is from place to transition or from transition to place). Since this paper focuses on the interaction between O net and A net, four basic interaction attack patterns, i.e., blocking, leakage, stealing and injection (No. 2, 3, 6, 7), are kept for study, which can be combined to constitute more complex attacks. In Table I, the other cases are internal behaviours of O net (No. 9, 13) or of A net (No. 4, 8) and meaningless (No. 1, 5, 10-12, 14-16). For No. 1, 5, 12, 16, it is abnormal that both place and transition belong to O net (resp. A net) while arc belongs to A net (resp. O net). For No. 10, 11, 14, 15, it is also senseless that O net leaves an arc linked to a place or transition of A net. So, these cases can be excluded.

In the table and all the following figures, O net is mainly depicted in black with detectors in grey, A net in red, and T net in blue or other colours if needed. Places or transitions shared by two or three of those nets are depicted with the two or three corresponding colours.

Fig. 2. Blocking

Blocking is a behaviour that blocks the process execution and controls when it can be continued. Fig. 2 presents an example of the blocking pattern, where the transition t x is not enabled since there is no token in p b . Consequently, more and more tokens arrive at p x as shown in Fig. 2 and the marking of p y remains unchanged for a long time. Moreover, an attacker can even control when to stop blocking, and make the process run again like nothing had happened.

Leakage refers to a behaviour that discloses some important information to attackers unintentionally, which is however not detected by the original process. As shown in Fig. 3, the token o x has been delivered to both p y and p l , the latter belonging to an attacker. Stealing means that attackers take data, VM or other entities away without a permission of the system and keep it. In Fig. 4, the transition t s intends to steal the token o x from the place p x . Note that there are two differences between stealing and leakage: (1) for "stealing", an attacker needs to fire a transition to obtain the concerned token, while for "leakage", tokens flow to an attacker's place without any initiative action of the attacker; (2) stealing implies that tokens are removed from the place where they should be, however, leakage never changes related tokens in O net. Injection is a way used by attackers to throw some modified data or codes, usually malicious, into a system, that can facilitate the coordination of attackers to extract information from or interfere with the system. A successful injection, which often needs the help of other basic attack-network interaction patterns, should avoid the attention of a normal process. Normally, an attacker first collects enough information, based on which a malicious entity is then constructed and finally injected back to the original system, as shown in Fig. 5.

Furthermore, compound attack patterns can be derived from the compositions of basic attack-network interaction patterns. For example, by combining stealing with injection, we can obtain two new attack patterns, named copy and modification, as shown in Fig. 6. The "copy" pattern takes a token away from the original process, copies it and puts it back to the Comment original process. Different from "copy", the "modification" pattern puts a modified (usually malicious) token back to the original process. Note that these two attack patterns are quite simple compound attacks, and more complex ones can be constructed in a similar way.

B. Attack Detectors

In this subsection, we present examples of monitoring functions for O net, in order to detect some of the attacks and identify their corresponding patterns. These detectors are designed and efficiently installed in O net.

When a transition is blocked by an attacker, the blocking can be detected by checking that at least one of two conditions is satisfied. The first is that the number of tokens in a place exceeds a fixed threshold, this accumulation being possibly a symptom that the transition after this place is blocked. As shown in Fig. 7, when the number of tokens in p x exceeds 5, transition t z will be fired and put a token to p y . The second is that the marking of some place does not change for a predefined maximal time, indicating an interruption of the data flow. The limitation of our detection is that a blocking with a number of tokens or a time period below the predefined thresholds cannot be detected. Short-time temporary blocking (below the pre-defined threshold) is difficult to detect without more knowledge about an attacker and this is out of the modelling scope in this paper. Leakage is very difficult or even impossible to detect without explicit signals. So, for leakage, we can only take actions, e.g., encryption, to prevent attackers from using it.

For stealing, the detector determines whether some entities have been lost. As shown in the example of Fig. 8, the token o ex is backed up to the place p duplicate . Then, the transition t compensate judges whether o ex has been lost according to p duplicate , p x and p y . We use inhibitor arcs to indicate that o ex belongs to neither p x nor p y . Notice that we detect stealing in the interval between p x and p y in this example, where the marking of p x or p y is equal to or less than one. More complex situations (e.g., multiple tokens) are similar to this example but with more control structures. When it comes to injection, detectors can check whether there is an intrusive or modified entity. As shown in Fig. 9, the place p library stores some necessary information for checking. When a token arrives at t y , it will be checked with the information from the library, which is denoted as o lib . A bad token will be removed from O net, and put into p isolation for further analysis. The place p check ctrl is used to guarantee that every token will be checked and the place p ctrl makes sure that there will be only one token in the place p x . In [START_REF] Cavalli | Design of a secure shield for internet and web-based services using software reflection[END_REF], some parts of software are assigned "hash codes", whose modifications are signals of malicious actions. Actually, checking whether hash codes have been modified can be considered as one of specific implementations of our checking detector. It is worth noting that, for stealing and injection, an idea for more general detection process would be to use place invariants [START_REF] Yamalidou | Feedback control of petri nets based on place invariants[END_REF], which depend only on the topological structure of the Petri net and are independent of any dynamic process. In absence of attack in the O net, place invariants should always be satisfied; however, once some place invariants become false, there must be something wrong. Then, one way to locate the "error" place might be using the intersection of places related to multiple unsatisfied places invariants to reduce the searching scope. We would explore more about the role of place invariants and how to locate and tolerate attacks by using them in the future.

C. Basic Tolerance Solutions

In this subsection, we propose tolerance solutions for the above basic attack-network interaction patterns. They are deployed (in blue) according to the locations in the O net associated to the detectors (already in blue), in order to restore the normal function of an original system. Bypassing provides a good way to deal with blocking. Once the blocking detection condition is met, a bypassing path should be built and triggered. Fig. 10 presents an example for the number of tokens in a place exceeding a fixed threshold. In this case, the place p y obtains a token. Then, the bypassing path is activated by triggering t x , and the blocking problem is solved. Moreover, this solution can also be used to mitigate overloading besides blocking.

Encryption is a process that encodes critical information to protect it from being illegally used by unauthorised users. In Fig. 11, a leakage occurs in t l . If the token o x has been encrypted as o ex and the wiretapper is unable to decode it, the solution is successful. On the contrary, if the wiretapper can decode what he wants, the encryption solution fails. Actually, this is a very difficult problem, because we can never know the ability of an attacker. Since we cannot predict the ability of attackers to decode information, the only thing we can do is the prevention with best efforts. Compensation solution makes up for lost entities. To tolerate stealing, two things need to be done: (1) encrypting information to make attackers unable to use it, described as above; (2) compensating the lost entities in the original process, according to the backup of any token found to be lost by the detector. In the example of Fig. 12, only one token has to be compensated. In practice, we may need to deal with a set of lost tokens, and the implementations of control parts are different according to different cases. The compensation solution can also handle injection. Detectors monitor whether entities are intrusive or modified. If an entity is intrusive, i.e., the entity does not belong to the O net, we only need to remove the injected token. If an entity is illegally modified, besides removing the modified entity, a normal entity should be compensated in the original process.

These solutions correspond to the basic attack-network interaction patterns. If a complex attack is composed of multiple such patterns, we can construct its tolerance solution by combining the related solutions together, which is illustrated by the case study in the next section. Note that our framework models these attacks and solutions with the view of a relatively low-cost modelling. Though we deploy one single tolerance solution in response to one given attack, the library of generic attack patterns / tolerance solutions remains small. The large one is the potential combination of all possible deployment instances, but we do not compute it in advance. After the detectors detect and identify the attacks, the tolerance solution is instantiated with the precise locations in the network, and thus deployed on the fly.

IV. CASE STUDY

To show the effectiveness of our framework, we apply our approach to a case study about cloud-based medical information storage originally presented in [START_REF] Fitch | A petri net model for secure and fault-tolerant cloud-based information storage[END_REF], [START_REF]A raid-based secure and fault-tolerant model for cloud information storage[END_REF] and modelled with CPN Tools, a tool for editing, simulating and analysing CPNs [START_REF]CPN Tools: A tool for editing, simulating, and analyzing Colored Petri Nets[END_REF]. In this system, patients and doctors read or write medical records stored through cloud-based information storage. Note that [START_REF] Fitch | A petri net model for secure and fault-tolerant cloud-based information storage[END_REF], [START_REF]A raid-based secure and fault-tolerant model for cloud information storage[END_REF] focus on security and fault tolerance, while we introduce basic attack-network interactions and illustrate our tolerant solutions. The major differences are: (1) Their example only involves one patient and one doctor, while we adapt it to a scenario with three patients and two doctors, extendable to more patients and doctors in a straightforward way. [START_REF] Ouffoué | An attack-tolerant framework for web services[END_REF] We replace fault tolerance parts by integrating the attack tolerance framework. The whole .cpn file can be found at the site "https://github.com/TURTING-BO/CPNs-Attack-Tolerance".

In this case study, there are mainly four modules including directory, patient, doctor and cloud. The directory module receives query requests before responding. The patient or Then, the patient constructs a read request according to the provider list and sends it to the cloud module. The cloud module supervises the reading process and returns the records if successful. Finally, the patient receives his/her records. Note that a patient's record is distributed in three providers to improve security. The read and write operations of doctors are similar to the read operation of patients.

In this medical storage system, the basic attack-network interactions may violate the following security requirement aspects.

• Blocking: medical records must be guaranteed to be available to all doctors at any time to save the patients; [{prID="Pr1",mrec={recID="P1_rec",data="Name: John;"}}, {prID="Pr2",mrec={recID="P1_rec",data="Disease: Flu, Mild;"}}, {prID="Pr3",mrec={recID="P1_rec",data="Treatment: Basic;"}}, {prID="Pr1",mrec={recID="P2_rec",data="Name: Lily;"}}, {prID="Pr2",mrec={recID="P2_rec",data="Disease: Pneumonia, Mild;"}}, {prID="Pr3",mrec={recID="P2_rec",data="Treatment: Basic;"}}, {prID="Pr1",mrec={recID="P3_rec",data="Name: Tom;"}}, {prID="Pr2",mrec={recID="P3_rec",data="Disease: COVID-19, Serious;"}}, {prID="Pr3",mrec={recID="P3_rec",data="Treatment: Critical; 13), stealing and injection (Fig. 15). The attacker carries out the following steps: First, he blocks the doctor Y to read the record of the patient C ; then, during the blocking time, he steals the record of C ; next, according to the stolen one, he modifies the record and injects it back to the O net; finally, he cancels blocking, which allows the doctor Y to read an incorrect record. The composition of bypassing and compensation solutions can effectively tolerate the above attack. The current limitation is that the detectors and the tolerance solutions are not deployed automatically and can only be applied to models during the design stage instead of runtime.

A. One More Discussion: A Blocking Example

Now, for one step forward in the automation of our framework, we explore how to detect a blocking attack and deploy its tolerance solution by modifying the .cpn file, which is the format used by the tool CPN. Here, due to lack of space, we just show a very simple version of the bypassing solution by omitting some optimised control places and transitions.

As shown at Fig. 19, the blocking attack called "attack b" leads to the accumulation of tokens in the place "before". In order to detect the blocking and stop the simulation, the mechanism in this tool called "Breakpoint monitor" is adopted that can stop the simulation under some conditions [START_REF]CPN Tools: A tool for editing, simulating, and analyzing Colored Petri Nets[END_REF]. In Fig. 21, we set a Breakpoint monitor for the place "before", which will stop the simulation when the number of tokens in "before" exceeds 10. Once the blocking attack is detected, the simulation stops and the bypassing solution is deployed by modifying the corresponding .cpn file based on the information from the blocked transition. In the pink rectangle of Fig. 22, we add some .xml descriptions (i.e., one transition and two arcs of a bypassing path) to the original .cpn file. Fig. 20 presents the O net with a new added tolerance solution. As we can see, all the tokens arrive to "target" through the bypassing path. Thus the tolerance is successful.

This very useful step provides the possibility of implementing automatic tools for attack tolerance design. In the future, we will build two CPN libraries of basic attack-network interaction patterns and basic tolerance solutions, respectively. The goal is to automatically detect an attack, identify it (as a basic one from the library or a compound one made up of several basic ones), find the generic solution (from the library of basic solutions directly or by composition) and deploy this solution, i.e., inserting its code in the initial code at the proper locations. In this part, we only illustrated the idea with the simplest basic attack-network interaction pattern (i.e., blocking), and the insertion of the code is currently done manually but can be implemented as a automatical one.

V. RELATED WORK

A. Modelling and Analysis of Web Services with CPNs

Coloured Petri Nets is a graphical language for constructing models of concurrent systems and analysing their properties [START_REF] Jensen | Colored Petri Nets: a graphical language for formal modeling and validation of concurrent systems[END_REF], [START_REF] Jensen | Coloured Petri Nets: modelling and validation of concurrent systems[END_REF], [START_REF] Jensen | Coloured Petri Nets and CPN tools for modelling and validation of concurrent systems[END_REF], and has been widely used to model and analyse Web services [START_REF] Brant-Ribeiro | Interactive web interfaces modeling, simulation and analysis using Colored Petri Nets[END_REF]- [START_REF] Bhandari | Colored Petri nets based fault diagnosis in service oriented architecture[END_REF].

In [START_REF] Brant-Ribeiro | Interactive web interfaces modeling, simulation and analysis using Colored Petri Nets[END_REF], a modelling style for representing interaction flows in Web interfaces, called wiCPN (Web Interaction Modeling Using Coloured Petri Nets), was explored, which is able to refine the model components and represent interaction flows. In [START_REF] Entezari-Maleki | Modeling and evaluation of service composition in commercial multiclouds using timed colored Petri nets[END_REF], a timed CPN model was presented to evaluate the service composition in multicloud environments while minimising the number of clouds involved in serving a composite service request. In [START_REF] Deng | Automatic combination technology of fuzzy CPN for OWL-S web services in supercomputing cloud platform[END_REF], taking Fuzzy CPNs as the automatic combination technology for OWL-S Web Services in Supercomputing Cloud Platform, algorithms were designed to build and simplify the Fuzzy CPN dependency relation graph. Model-to-model transformation technologies are exploited to convert other models to CPNs since, after transformation, existing tools can provide powerful support for analysis and verification of CPNs. In [START_REF] Gómez | Profiling the publish/subscribe paradigm for automated analysis using colored Petri nets[END_REF], a UML profile for the publish/subscribe paradigm was proposed, together with a model-to-model transformation from UML to CPNs, and, with the help of CPNs Tools, design errors cloud be detected and fixed. In [START_REF] Robidoux | Automated modeling of dynamic reliability block diagrams using colored petri nets[END_REF], a reliability markup language for DRBD (dynamic reliability block diagram) models was presented, as well as an algorithm that automatically converts DRBD model to CPN, and a case study for verification of DRBD model was illustrated with CPN Tools. Specially, some CPN based diagnosis analysis approaches were also proposed [START_REF] Pang | Fault diagnosis for service composition by spiking neural p systems with colored spikes[END_REF]- [START_REF] Bhandari | Colored Petri nets based fault diagnosis in service oriented architecture[END_REF], e.g., in [START_REF] Pang | Fault diagnosis for service composition by spiking neural p systems with colored spikes[END_REF], the authors used spiking neural P systems with coloured spikes to model the fault of available service, component, and connector in the service composition for fault location and handling. The above methods efficiently deal with different aspects of Web services, including service composition modelling, model-to-model transformation and fault diagnosis. With a different motivation, we try to take one of the first steps of applying CPNs to attack tolerance.

B. Attack Tolerance for Web Services in Cloud

Attack tolerance turns out to be extremely important to improve reliability and security of cloud services. Many projects are devoted to dealing with this problem [25]- [27]. A representative one is the H2020 CLARUS project which summarised the main cloud vulnerabilities and the solutions proposed, including intrusion detection and attack-tolerance, and then, by leveraging diversity [START_REF] Baudry | The multiple facets of software diversity: Recent developments in year 2000 and beyond[END_REF], further contributed to this field by several novel and effective attack-tolerant approaches. In [START_REF] Ouffoué | An attack-tolerant framework for web services[END_REF], an attack-tolerant architecture and framework for Web services was proposed, where variants in the attack-tolerant library substitute the original implementation periodically or according to online monitoring. In [START_REF]How web services can be tolerant to intruders through diversification[END_REF], a state of the art of attack tolerance was presented, and how web services can be tolerant through diversification was explained. In [START_REF] Crane | Thwarting cache side-channel attacks through dynamic software diversity[END_REF] software diversity was explored as a defense against side-channel attacks by dynamically and systematically randomising the control flow of programs, which reduces sidechannel information leakage significantly.

Software Reflection is also an efficient technique for attack tolerance. In [START_REF] Cavalli | Design of a secure shield for internet and web-based services using software reflection[END_REF], a new approach was proposed, exploring its usage as a mean of detection and mitigation of insider attacks. The authors of [START_REF] Ouffoué | Attack tolerance for servicesbased applications in the cloud[END_REF] considered any application deployed in the cloud as a choreography of services and extended a formal framework for choreography verification by incorporating detection and remediation strategies using Software Reflection. These provide good solutions for attack tolerance. However, our goal is different. We want to design an abstract generic framework for detection and tolerance of attacks, which it will be possible to instantiate and (more or less automatically) deploy for a particular implementation.

VI. CONCLUSION

In this paper, we have proposed a model-based framework for attack tolerance using CPNs. We have extracted four meta attack operations modelled as basic attack-network interaction patterns and proposed the corresponding detectors and their tolerance solutions. To further validate our method and illustrate the way towards its automation, a case study was simulated with CPN Tools. Note that it is the first step to understand attack tolerance by modelling with CPNs and its extensibility in practice remains to explore. Our patterns of attack and tolerance are general, and may be instantiated using other formal methods that can be translated from/to PNs, e.g., membrane systems [START_REF] Kleijn | Towards a Petri net semantics for membrane systems[END_REF], [START_REF] Liu | Modeling membrane systems using colored stochastic Petri nets[END_REF].

Future work includes (1) investigating composition rules for the library of generic basic behaviours of attack-network interaction to interpret more complex attack patterns, (2) designing automatic tools for identifying such complex attacks, (3) building corresponding tolerance solutions by composition from the library of generic basic tolerance solutions, (4) deploying these instantiated solutions at the proper locations (which have to be previously identified) of the initial net. In addition, we would explore how to use the net invariants to detect and locate attacks, and more generally the analysis methods provided by Petri nets to prove some functional properties about the attacked net equipped with the deployed tolerance solution w.r.t. the original net (such as reachability, trace inclusion, equivalence, etc.), as well as model-based diagnosis combining previous work [START_REF] Li | Modeling BPEL web services for diagnosis: Towards self-healing web services[END_REF], [START_REF] Li | A CPN provenance model of workflow: towards diagnosis in the cloud[END_REF]. In addition, generating formal models (e.g., under our framework) from the basic threat models (e.g., the STRIDE framework [34]), simulating actual complex attacks and conducting more experiments is part of our perspectives, including exploring the use of this approach for users or developers to identify and mitigate threats from the perspective of experiments, as well as validating further recurring attacks and corresponding solutions [START_REF] Dong | Automated verification of security pattern compositions[END_REF].

Definition 1 (

 1 Coloured Petri Net): A Coloured Petri Net is a tuple CPN = (P, T, A, Σ, V, C, G, E, I), where • P is a finite set of places; • T is a finite set of transitions and P ∩ T = ∅; • A ⊆ (P × T ) ∪ (T × P ) is a set of arcs; • Σ is a finite set of types, each one being a non-empty "colour set"; • V is a finite set of typed variables, i.e., type(v) ∈ Σ for all v ∈ V ; • C : P -→ Σ is a colouring function that associates a type to each place; • G : T -→ Expr V is a labelling function that associates expressions (called guards) with free variables from V to transitions such that type(G(t)) = Bool; • E : A -→ Expr V is a labelling function that associates expressions with free variables from V to arcs such that type(E(a)) = C(p) M S , where p is the place connected to the arc a and C(p) M S is a multiset type; • I : P -→ Expr ∅ is an initialisation function that associates an expression without free variables to every place such that type(I(p)) = C(p) M S . Definition 2 (Marking): Given a CPN, a marking is a function M mapping P to multisets of tokens, such that type(M (p)) = C(p) M S . The initial marking is given by I. Definition 3 (Enabled): Given a marking M , t ∈ T , its preset pre(t) = {p|(p, t) ∈ A} (resp., its postset post(t) = {p|(t, p) ∈ A}) and a binding b of its variables ( b : evaluation in b), (t, b) is enabled for M if M (p) satisfies (i.e., is greater than or equal to) E(p, t) b for all places p ∈ pre(t) and G(t) b = true. Definition 4 (Firing): Given t ∈ T and a binding b, if (t, b) is enabled for M , t may fire and yield a new marking M , defined, for all p ∈ pre(t) ∪ post(t), by M (p) = M (p) --E(p, t) b ++ E(t, p) b where E(p, t) b = 0 (resp., E(t, p) b = 0) for every p /

Fig. 3 .

 3 Fig. 3. Leakage

Fig. 4 .

 4 Fig. 4. Stealing

Fig. 5 .

 5 Fig. 5. Injection

Fig. 6 .

 6 Fig. 6. Copy (left); Modification (right)

Fig. 7 .

 7 Fig. 7. Detector for blocking

Fig. 8 .

 8 Fig. 8. Detector for stealing

Fig. 9 .

 9 Fig. 9. Detector for injection

Fig. 10 .

 10 Fig. 10. Bypassing

Fig. 11 .

 11 Fig. 11. Encryption

Fig. 12 .

 12 Fig. 12. Compensation

Fig. 13 .

 13 Fig. 13. Doctor reading

Fig. 16 .

 16 Fig. 15. Cloud

Fig. 17 .

 17 Fig. 17. Checking and compensation result

17

 17 Fig. 16, Fig. 17 and Fig. 18 present the result of our solution to the attack, where the doctor Y can read the correct record of the patient C . The green boxes show the current markings of corresponding places and the red lines highlight points for the following explanations. In Fig. 16, the attacker successfully modify C 's record from "Disease: COVID-19, Serious; Treatment: Critical;" to "Disease: Flu, Mild; Treatment: Basic;". In Fig. 17, our detector found

  Fig. 16, Fig. 17 and Fig. 18 present the result of our solution to the attack, where the doctor Y can read the correct record of the patient C . The green boxes show the current markings of corresponding places and the red lines highlight points for the following explanations. In Fig. 16, the attacker successfully modify C 's record from "Disease: COVID-19, Serious; Treatment: Critical;" to "Disease: Flu, Mild; Treatment: Basic;". In Fig. 17, our detector found

Fig. 19 .

 19 Fig. 19. Simple original net with a blocking attack

ACKNOWLEDGMENT

This work is supported by the China Scholarship Council, the Graduate Innovation Fund of Jilin University under Grant No. 101832018C025 and the Natural Science Research Foundation of Jilin Province of China under Grant No. 20180101053JC.


Monoclinic Al13Fe4 approximant phase: a link between icosahedral and decagonal phases

Monoclinic Al 13 Fe 4 approximant phase: a link between icosahedral and decagonal phases It is shown that the approximant monoclinic crystal Al 13 Fe 4 , known as a (C 5 ) decagonal-approximant crystal for d-AlFe, is also a valuable approximant for the icosahedral quasicrystalline phase i-AlFeCu. The icosahedral local order, in a half-plane around Fe(5) sites, is similar, up to the sixth neighbor, to the one around the origin or around the body center site (empty sites) in the cubic (Pm3) α-AlMnSi phase, with a greater chemical disorder and a stronger tendency to geometric frustration as indicated by more empty sites in the icosahedral shells. This similarity gives some information about possible icosahedral local order in the quasicrystalline phase i-AlFeCu, and the possible atomic surfaces in a 6D Euclidean hyperspace approach.


Geometrical Features of Dislocations Gliding on non-compact Planes in Al-Zn Single Crystal

Patrick Anongba, Joel Bonneville, J.-L. Verger-Gaugry

To cite this version:

Patrick Anongba, Joel Bonneville, J.-L. Verger-Gaugry. Geometrical Features of Dislocations Gliding on non-compact Planes in Al-Zn Single Crystal. Scripta Metallurgica, 1987, 21 (6), pp.777-782. 10.1016/0036-9748(87)90321-8. hal-03133814

† Ecole Polytechnique Fédérale de Lausanne, IGA, 1015 Lausanne, Ecublens, Switzerland. † LTPCM/ENSEEG/INPG (CNRS UA 29), BP 75, Domaine Universitaire, 38402 Saint Martin d'Hères, France


Kahina Abbas

Nikola Babić

Fabienne Peyrot
email: fabienne.peyrot@parisdescartes.fr

Detection of Superoxide Radical in Adherent Living Cells by Electron Paramagnetic Resonance (EPR) Spectroscopy Using Cyclic Nitrones

Keywords: EPR spectroscopy, ESR spectroscopy, Spin trapping, Macrophage, Free radical, Cyclic nitrone, Superoxide EPR detection in adherent living cells

Spin trapping with cyclic nitrones coupled to electron paramagnetic resonance (EPR) enables the detection and characterization of oxygen-derived free radicals, such as superoxide and hydroxyl radicals, in living cells. Detection is usually performed on cell suspensions introduced in glass capillaries, gas-permeable tubing, or flat cells, even when cells normally require attachment for growth. However, radical production may be influenced by cell adhesion, while enzymatic or mechanical cell harvesting may damage the cells and alter their metabolic rates. Here, we describe the detection on adherent cells attached to microscope coverslip glasses. This method preserves cell integrity, ensures near physiological conditions for naturally adherent cells, and is relatively simple to set up. Up to 12 conditions can be screened in half a day using a single batch of culture cells.

Introduction

Spin trapping with cyclic nitrones combined with EPR spectroscopy allows the specific detection of oxygen-derived radical species which are involved in various diseases and in cell signaling processes, such as superoxide radical (1). In this technique, a covalent bond is formed between the trapped radical and the diamagnetic spin trap, giving rise to a paramagnetic spin adduct with a characteristic EPR spectrum (Fig. 1) (2). In theory, signatures of superoxide and hydroxyl radicals can therefore be distinguished. Resulting from extensive efforts in spin trap synthesis since the 1970s, several structures derived from the original DMPO (5,5-dimethyl-1-pyrroline N-oxide) have been proposed with increased spin trap and spin adduct stability (3). Among them, we can cite the frequently used DEPMPO (5-diethoxyphosphoryl-5-methyl-1-pyrroline N-oxide) (4, 5), the more lipophilic DIPPMPO (5-diisopropoxyphosphoryl-5-methyl-1-pyrroline N-oxide) (6), Mito-DIPPMPO ((4R*, 5R*)-5-(diisopropyloxyphosphoryl)-5-methyl-4-[({ [2-(triphenylphosphonio)ethyl]carbamoyl}oxy)methyl]pyrroline N-oxide bromide), and CD-DIPPMPO (6-monodeoxy-6-mono-4-[(5-diisopropoxyphosphoryl-5-methyl-1-pyrroline-N-oxyde)ethylenecarbamoyl-(2,3-di-O-methyl) hexakis (2,3,6-tri-O-methyl)]-β-cyclodextrin), analogs bearing a triphenylphosphonium and a permethylated β-cyclodextrin moiety, respectively (7-9) (Fig. 1). DEPMPO, DIPPMPO, and Mito-DIPPMPO are likely cell permeant, whereas CD-DIPPMPO is supposed not to enter cells [START_REF] Chalier | 5-Diisopropoxyphosphoryl-5-methyl-1-pyrroline N-oxide, DIPPMPO, a crystalline analog of the nitrone DEPMPO: synthesis and spin trapping properties[END_REF][START_REF] Abbas | Detection of superoxide production in stimulated and unstimulated living cells using new cyclic nitrone spin traps[END_REF][START_REF] Ross | Lipophilic triphenylphosphonium cations as tools in mitochondrial bioenergetics and free radical biology[END_REF][START_REF] Anzai | ESR measurement of rapid penetration of DMPO and DEPMPO spin traps through lipid bilayer membranes[END_REF]. Correct interpretation of spin trapping results obtained with cells requires expertise because intracellular metabolic processes interfere with the detection, especially the reduction of the aminoxyl (nitroxide) function of all spin adducts to EPR-silent hydroxylamines, and the conversion by glutathione peroxidase of the superoxide adduct to a species identical to that resulting from trapping of hydroxyl radical (12-14, 7). Possible artifacts and necessary precautions have been reviewed elsewhere [START_REF] Abbas | Use of spin traps to detect superoxide production in living cells by electron paramagnetic resonance (EPR) spectroscopy[END_REF][START_REF] Villamena | Reactive species detection in biology: from fluorescence to electron paramagnetic resonance spectroscopy[END_REF]. Especially, interferences due to culture medium components and free metal ions have been highlighted. Therefore, spin trapping with cyclic nitrone must be performed in buffered saline solutions in the presence of metal chelators such as DTPA (diethylenetriaminetetraacetic acid).

[Fig. 1 near here] Most spin trapping experiments on living cells are conducted on suspensions (8, 12, 17-23). However, results obtained with naturally adherent cells after mechanical or enzymatic detachment may occasionally differ from physiological responses, due to either physical cell damage or metabolic

35). A specific EPR cavity has been designed for horizontal positioning of EPR sample cells (36).

Alternatively, microcarrier bead cultures of endothelial cells have been used inside EPR flat cells (37, 38). However, hypoxia can quickly develop within these closed systems, leading to reduced production of superoxide and an enhanced nitroxide spin adduct reduction rate (39).

Here we present how to perform EPR detection directly on macrophages grown on microscope coverslip glasses, an easily accessible and convenient system for analysis of large numbers of samples under near-physiological conditions. In short, cells are grown on coverslips in 24-well culture plates for 24 h prior to stimulation with phorbol 12-myristate 13-acetate (PMA). Cells are then washed to eliminate interference from medium components and further incubated with the spin trap in the presence of DTPA. EPR detection is directly performed on the coverslips with cells attached (Fig. 2).

We were able to detect superoxide production from PMA-stimulated RAW macrophages using different cyclic nitrone spin traps (Fig. 3) (40). Usual controls include unstimulated (NT) and PMAstimulated cells after co-incubation of the spin trap with superoxide dismutase coupled to polyethylene glycol (SOD-PEG) (Fig. 4). The technique was initially designed for use with cyclic nitrone spin traps

Materials

Prepare all solutions using ultrapure water (resistivity of 18 MΩ cm at 25 °C) and analytical grade reagents. Diligently follow all waste and bio-hazard disposal regulations when disposing of chemical and biological waste materials. 14. Tweezers with curved pointer tips and needle with bent point (like a hook).

Cell

EPR Spectroscopy

1. 0.1 M potassium phosphate buffer (KPB), pH 7.4: Add 100 mL water to a 1 L glass beaker. Weigh 13.97 g of dipotassium hydrogen phosphate (K2HPO4) and 2.69 g of potassium dihydrogen phosphate (KH2PO4) and transfer to the beaker. Add water to a volume of about 900 mL. Mix and adjust pH with HCl or NaOH solutions if necessary (ensure that buffer solution temperature is 25°C).

Transfer to a 1 L graduated cylinder and make up to 1 L with water. Store at 4°C. 9. Custom-made quartz slides (130 × 12 × 1.5 mm). Make two small marks with a permanent marker pen at the back of the slide to indicate the optimal position of coverslips (see Note 4). [START_REF] Ross | Lipophilic triphenylphosphonium cations as tools in mitochondrial bioenergetics and free radical biology[END_REF]. Elexsys 500 EPR spectrometer (Bruker, Wissembourg, France) operating at X-band (9.8 GHz) and equipped with an ER 4103TM resonator (a flat cylindrical cavity resonant in the TM110 mode). A quartz Dewar insert (WG-821-TMR-Q, Wilmad-Labglass, SP Industries, USA) is used to protect the resonator (see Note 5). The spectrometer used here is operated by the Xepr software (Bruker).

11. 96% ethanol.

Methods

Cell Culture

1. Grow the RAW 264.7 macrophages in 75 mL culture flasks in growth medium.

2. When the cells are 75%-90% confluent, remove the growth medium from one flask by aspiration with a pump or a pipette. Wash the cells twice with 10 mL PBS (see Note 6). Add 2 mL of Trypsin-EDTA solution (let it cover the whole cell layer) and incubate for 5 min at 37°C and 5% CO2 to detach the cells. Ensure that all cells are detached (visual inspection with or without microscope). If necessary, gently tap the flask to release any remaining attached cells. Add 8 mL of growth medium to the flask to inactivate trypsin using a 10 mL pipette. Transfer to a 15 mL conical tube.

3. Determine cell density using a cell counter or a hemocytometer. 9. Save 2 mL of cell suspension (or more) for cell passaging. Introduce these 2 mL in a 75-mL culture flask with 18 mL growth medium and proceed as usual with the cell culture.

EPR Analysis

Spin trap, DTPA, and PBS solutions are kept at room temperature for the duration of the experiment. SOD-PEG solutions are kept on ice. PMA is kept at -20°C throughout. [Table 1 near here] 2. Dilute PMA to 5 µM in growth medium adding 2.00 µL of PMA stock to 4 mL growth medium (see

Note 12).

3. Take out two coverslips with adherent cells from the 24-well culture plate and transfer them to a 4well plate (see Notes 8 and 13).

4. Add 1 mL of 5 µM PMA to the wells on top of the two coverslips. Incubate for 20 min at 37°C and 5% CO2. Skip this step for baseline recording.

5. Wash cells on both coverslips with 0.5 mL PBS twice. 7. Take the coverslips out of the well. Slightly dab the back of the coverslips with tissue paper. Spread a minimum amount of grease on the quartz slide opposite the positioning marks using a pipette tip or a small spatula (see Note 3). Delicately install the coverslips on the quartz slide, cell layer facing upward (Fig. 2) (see Note 16). to use standard microscope glass slides (cut to 12 mm width) instead of quartz slides.

However, the native EPR signal of glass interferes with the weak signals of nitrone spin adducts. When using hydroxylamine spin probes such as CMH (1-hydroxy-3methoxycarbonyl-2,2,5,5-tetramethylpyrrolidine hydrochloride), the signal-to-noise ratio is higher and the background signal of glass can be neglected or subtracted from the signal of interest. It is possible to omit the quartz insert, and simply insert the quartz slide directly in the cavity. Positioning of the quartz slide at the center of the cavity is then ensured by custommade collets. In another setup, the custom-made support quartz slide is replaced by a commercial tissue quartz cell (WG-806-A-Q, Wilmad-Labglass, SP Industries, USA). Attach the coverslips opposite to the tissue cavity in this case. Beware of dropping the coverslips inside or touching the walls of the unprotected cavity.

5. Temperature control is not used here. Alternatively, the TM cavity and insert can be used with a Bruker EMX spectrometer. Benchtop EPR instruments that do not allow manual tuning are not suitable for the experiments presented here.

6. FBS present in growth medium inhibits trypsin action. Add reagents against the side wall of the flask to avoid detaching the cells at this stage. Gently shake the flask back and forth to remove all FBS.

7. The cell pellet may be difficult to disperse without formation of cell aggregates. Therefore, first add 1 mL of growth medium to the cell pellet, and gently pipet up and down with a 1 mL pipette tip set to 400 µL to disperse the pellet without forming any bubbles. Then add the rest of the growth medium and gently pipet up and down with a 10 mL pipette. Take care not to damage the cells at this stage.

8. The coverslip should lie flat on the well bottom. Avoid putting multiple coverslips in one well because movements may damage the cell layer. Manipulation of the coverslips requires great care to avoid breaking them. Tweezers with curved, pointed tips can be used to seize them, and a needle with bent point can serve as a hook to lift them from the well bottom. Once the coverslips are covered with cells, the side with cells appears slightly less shiny than the glass surface and can be recognized by scratching the edge of the cell layer a little with a needle tip.

Make sure not to damage the cells while manipulating the coverslips. 9. Under these conditions, 75-90% confluence (250,000 cells per coverslip) is obtained after 24 h of culture with RAW 264.7 macrophages. If other cell types are to be used, optimization of cell culture conditions should be performed to obtain appropriate cell confluence. The EPR signal increases with cell number but the cell layer tends to peel off the glass surface at high cell density, leading to a drop in reproducibility. accumulation in a 1D experiment because time evolution of the spectra can be monitored with the former method. At the end of the experiment, a sum of ten spectra is performed to increase the signal-to-noise ratio.

11. Here a slight overmodulation of the signal is used to increase the signal-to-noise ratio without significantly distorting the signal. At this stage, it is good practice to record a background EPR spectrum without any sample to ensure the cavity is not contaminated by unwanted paramagnetic impurities. If contamination is detected, clean the Dewar insert and TM cavity according to the user's manual.

The final concentration of DMSO in the growth medium is 0.5 % and is well tolerated by the cells. Here twice the volume needed for two coverslips is prepared to avoid pipetting very small volumes. Moreover, it is often desirable to prepare four coverslips at a time even if only two are used for EPR to prevent wasting time if you drop coverslips on the bench or break one during the experiment.

13. The use of 4-well plates is convenient but not mandatory. 24-well plates can be used instead.

14. 150 µL is the minimal volume required to cover the cells. However, when the quantity of EPR probe is not limiting such as with hydroxylamine spin probes, it is desirable to increase the incubation volume to 300 µL/well or more to ensure a more homogenous incubation of the cells without shaking of the plate.

15. Incubation time with the spin trap is a compromise of maximum formation of the spin adduct by the spin trapping reaction and minimum spin adduct decay. [START_REF] Villamena | Reactive species detection in biology: from fluorescence to electron paramagnetic resonance spectroscopy[END_REF]. Because the cell layer is exposed to air without medium, the rest of the procedure must be carried out quickly before cells dry out. The decrease of EPR intensity after 10 min of recording is a clear indication of this phenomenon. A 50% larger signal was observed with this orientation of the cells compared to the situation where the cell layer faced the quartz slide using nitrone spin traps. This is likely due to a better diffusion of oxygen to the cell layer which induces a sustained enzymatic production of superoxide and a slower reduction of nitroxide spin adducts by reductases. 17. Refer to Elexsys E 500 user's manual for detailed procedure (45). You may rotate the Dewar insert slightly on its axis inside the resonator to optimize the position of the slide and maximize the depth of the cavity "dip". Before acquiring the spectra, you may want to center the field-sweep window around the EPR signal to compensate for changes in resonating frequency of the cavity between samples: Read the uncorrected g-factor of the spin adduct from a previously recorded spectrum, write the value in the "Sample g-Factor" box under the "Absc.1: Field" tab, and then click the "Set Field to Sample g-Factor" option. [START_REF] Rosen | Hydroxyl radical generation by polymorphonuclear leukocytes measured by electron spin resonance spectroscopy[END_REF]. Cells on the coverslips can be recovered after EPR for protein titration or another biochemical assay. For this purpose, transfer the coverslips to clean wells and add 50 µL lysis buffer per

( 40 )

 40 but is compatible with other spin probes and EPR assays, as recently shown by Geroldinger et al. (41). It is especially appropriate to test different probes or stress effectors and different concentrations on the same batch of cells with technical replicates. [Figs. 2, 3, and 4 near here]

2 .

 2 KPB containing 1 mM DTPA: Dissolve 19.7 mg of DTPA in 50 mL KPB. Store at 4°C. 3. Spin trap stock solutions: Spin traps should be synthesized according to published protocols (see Note 2). Prepare stock solutions at 0.5 M for DEPMPO, DIPPMPO, and Mito-DIPPMPO, and 0.2 M for CD-DIPPMPO by dissolving the appropriate amount of spin trap in KPB containing 1 mM DTPA. For 1 mL stock solutions, use 117.6 mg of DEPMPO, 131.6 mg of DIPPMPO, 352.8 mg of Mito-DIPPMPO, and 346.8 mg of CD-DIPPMPO, respectively. Store at -20°C. 4. 10 mM PMA (≥ 99% HPLC) in anhydrous DMSO: Upon receipt in lab at room temperature, PMA must be dissolved with 162 µL/mg of anhydrous DMSO (inject DMSO directly in vial through the Methods in Molecular Biology Accepted manuscript Published in final edited form as: Methods Mol. Biol. 2021, 2202: 149-163. doi: 10.1007/978-1-0716-0896-8_13 © 2021. This manuscript version is made available under the CC-BY-NC-ND 4.0 license http://creativecommons.org/licenses/by-nc-nd/4.0/ 5/20 septum cap), and immediately stored at -20°C in 25-µL aliquots. Wrap tubes in aluminum foil to protect from light. Stable for six calendar months. 5. 0.1 M DTPA solution: Mix vigorously 39.3 mg DTPA with 1 mL 0.1 M sodium hydroxide until DTPA dissolves. 6. Solution of superoxide dismutase from bovine erythrocytes coupled to methoxy-polyethylene glycol (SOD-PEG): Dissolve the lyophilized powder in KPB to reach 2000 U/mL. Freeze 100 µL aliquots in liquid nitrogen and store at -20°C. 7. Sterile 4-well culture plates with lid (polystyrene, flat bottom, well surface ≈ 1.9 cm 2 ). 8. EPR-silent silicon vacuum grease (Bluestar silicones, Caronno Pertusella, Italy) or equivalent (see Note 3).

4 .

 4 Centrifuge the cells in the 15 mL tube at 190 × g for 5 min at 4°C. Remove the supernatant.5.Resuspend the cells in growth medium to a concentration of 3 × 10 6 cells/mL (see Note 7).6. Insert sterilized coverslips into the wells of a 24-well plate (see Note 8).7. Add 42 µL of cell suspension (125,000 cells/well) and 958 µL of growth medium in each well of the 24-well plate.8. Incubate the plate for 24 h at 37°C and 5% CO2 (see Note 9).Methods in Molecular BiologyAccepted manuscript Published in final edited form as: Methods Mol. Biol. 2021, 2202: 149-163. doi: 10.1007/978-1-0716-0896-8_13 © 2021. This manuscript version is made available under the CC-BY-NC-ND 4.0 license http://creativecommons.org/licenses/by-nc-nd/4.0/ 6/20

1 .

 1 Turn on the EPR spectrometer and open Xepr software. Connect the spectrometer and check that the calibration parameters corresponding to the TM resonator are loaded in the spectrometer configuration. Create a new 2D experiment: Select 'Field' as 'Abscissa 1' and 'Time' as 'Abscissa 2' in the drop-down list (see Note 10). Set the acquisition parameters according to Table 1 (see Note 11). Coverslips with cells that have been incubated neither with PMA nor with spin trap should be the first sample in the series to pre-tune the cavity and record the signal for baseline correction (proceed as described below but skip steps 2, 4, and 6).

6 .

 6 Mix 3 µL DTPA (1 mM final), 6 µL of DEPMPO stock solution (10 mM final), and 291 µL of PBS in a 500 µL microtube. Add 150 µL of this preparation on each coverslip (see Note 14). Incubate for 20 min at 21°C (see Note 15). Periodically rock the plate back and forth to ensure homogenous incubation. Skip this step for baseline recording.

8 .

 8 Carefully insert the quartz slide vertically in the EPR cavity without touching the side of the Dewar insert with the cells. 9. Manually tune the EPR (see Note 17) and start recording of the EPR spectra. Save to disk when the acquisition is finished. Methods in Molecular Biology Accepted manuscript Published in final edited form as: Methods Mol. Biol. 2021, 2202: 149-163. doi: 10.1007/978-1-0716-0896-8_13 © 2021. This manuscript version is made available under the CC-BY-NC-ND 4.0 license http://creativecommons.org/licenses/by-nc-nd/4.0/ 7/20 10. Go back to tune mode and carefully remove the quartz slide vertically from the resonator. Remove the coverslips from the quartz slide (see Note 18). Wipe the slide clean with tissue paper, ethanol, and PBS. Let it dry.11. Repeat the procedure from step 2 to 10 for other conditions (without PMA, with PMA and SOD-PEG, with different spin traps, and so on) until all coverslips have been used. For controls without PMA, add 2.00 µL DMSO to the growth medium at step 2. For samples with PMA and SOD-PEG, replace 30 µL of PBS for 30 µL of SOD-PEG solution (200 U/mL) in the cocktail mixture at step 6.For alternative spin traps, use 6 µL DIPPMPO or Mito-DIPPMPO stock solution (10 mM final) and 7.5 µL of CD-DIPPMPO (5 mM final) instead of DEPMPO at step 6. Adjust the volume of PBS in the last case.

1 .

 1 For long-term storage, trypsin-EDTA should be aliquoted in 15 mL conical tubes and stored at -20°C.2. DEPMPO and DIPPMPO are commercially available. However, commercial spin traps are usually contaminated with paramagnetic nitroxides or EPR-silent hydroxylamine impurities that interfere with superoxide anion detection and produce artifacts. Purification of DEPMPO by distillation and of DIPPMPO by recrystallization is possible but difficult on a small scale.Therefore, the synthesis of spin traps following published protocols affords batches suitable for cell studies. Refer to Frejaville et al. (4) for DEPMPO synthesis and to Chalier and Tordo (6) for DIPPMPO. For Mito-DIPPMPO and CD-DIPPMPO, the procedures described for diethoxyphosphoryl analogs can be followed using diisopropyloxyphosphoryl reagents (7, 9, 42-44). Spin trap stock solutions can be checked for impurities by EPR spectroscopy prior to cell experiments using a 10 mM dilution in KPB containing DTPA with and without addition of 1 mM potassium ferricyanide (an oxidant of hydroxylamines). No signal should be observed under both conditions.

3 .

 3 Vacuum grease used to attach the microscope coverslip glasses to the quartz slide is optional. Geroldinger et al. (41) used 1.5 µL ultrapure water per coverslip instead, which was pipetted at the desired position on the slide before placing the coverslip with the cells facing outward. 4. In our setup, the center of the EPR cavity is positioned 37 mm above the lower end of the slide, and the microwave excitation spreads over ≈ 2 cm high. Marks are thus made 31 mm and 43 mm above the lower end of the slide for 12 mm round coverslips. Geroldinger et al. (41) recently proposed an improvement of the design of the support slides to prevent contamination of the EPR quartz insert. Rectangular spacers made of glass (12 × 4 mm) can be mounted at the bottom and 70 mm above the lower end of the slide. The authors proposed Methods in Molecular Biology Accepted manuscript Published in final edited form as: Methods Mol. Biol. 2021, 2202: 149-163. doi: 10.1007/978-1-0716-0896-8_13

10 .

 10 Refer to Elexsys E 500 user's manual for detailed procedure (45). The use of a 2D experiment and the sequential recording of a temporal series of EPR spectra are preferred to signal Methods in Molecular Biology Accepted manuscript Published in final edited form as: Methods Mol. Biol. 2021, 2202: 149-163. doi: 10.1007/978-1-0716-0896-8_13 © 2021. This manuscript version is made available under the CC-BY-NC-ND 4.0 license http://creativecommons.org/licenses/by-nc-nd/4.0/ 9/20

Fig. 1 Fig. 2 Fig. 3 Fig. 4 Fig. 4

 12344 Fig. 1 Structure of cyclic spin traps and general principles of spin trapping

Table Captions Table 1 EPR acquisition parameters 9. Tables Table 1 Signal channel tab

 Captions1

		Modulation frequency	100 kHz
		Modulation amplitude	2.00 G
		Receiver gain	60 dB
		Time constant	40.96 ms
		Conversion time	41.04 ms
		Sweep time	42.02 s
		Center field	3465 G
	Absc. 1: Field tab	Sweep width	150 G
		Data points	1024
		Attenuation	13 dB
	Microwave tab	Microwave power	10 mW
		Acq. fine tuning	Each slice scan

Scan tab Number of scans 1 Auto offset On Absc. 2: Delay tab Delay 100 ms Number of points 10

© 2021. This manuscript version is made available under the CC-BY-NC-ND 4.0 license http://creativecommons.org/licenses/by-nc-nd/4.0/


est destinée au dépôt

In the context of Comet Interceptor: Unexpected polarimetric properties of some dust particles in cometary comae and on small bodies surfaces

Anny Chantal Levasseur-Regourd, Edith Hadamcik, Jérémie Lasue, Julien

Milli, Jean-Baptiste Renard

To cite this version:

Anny Chantal Levasseur-Regourd, Edith Hadamcik, Jérémie Lasue, Julien Milli, Jean-Baptiste Renard. In the context of Comet Interceptor: Unexpected polarimetric properties of some dust particles in cometary comae and on small bodies surfaces. EGU General Assembly 2021, Apr 2021, Virtual Meeting, Germany. insu-03133914

In the context of Comet Interceptor: Unexpected polarimetric properties of some dust particles in cometary comae and on small bodies surfaces A.C. Levasseur-Regourd, E. Hadamcik, J. Lasue, J. Milli, J.-B. Renard, J. Lasue

The future ESA Comet Interceptor mission is expected to flyby a dynamically new comet (or an interstellar one) and better reveal the properties of its dust particles and nucleus surface. We therefore tentatively compare polarimetric properties of dust released by some comets, as well as present on surfaces of some small bodies.

Phase curves of the linear polarization of cometary dust particles (observed in equivalent wavelength ranges) show analogous trends. Some unique dynamically new comets or fragmenting comets (e.g. C/1995 O1 Hale-Bopp, C/1999 S4 LINEAR) may nevertheless present a higher positive branch than Halley-type or Jupiter-family comets (e.g. 1P/Halley, 67P/Churyumov-Gerasimenko). Such differences are clues to differences in the properties (sizes, morphologies, complex optical indices) of the dust particles. Dust particles, ejected by nuclei frequently plunging in the inner Solar System, might indeed partly come from quite dense a surface layer, as detected on the small lobe of comet 67P by Rosetta [1].

Although polarimetric observations of surfaces of cometary nuclei are almost impossible to obtain, observations have been obtained on the rather quiescent nucleus of 1P/Encke [2]. Similarities between polarimetric properties of 1P/Encke and atypical small bodies (e.g. Phaeton and particularly Bennu [3]), and of dust in cometary comae may be pointed out. Numerical and laboratory simulations could represent a unique tool to better understand such similarities. It may also be added that dust particles originating from comets, with emphasis on those of Jupiter-family, may survive atmospheric entry, as CP-IDPs collected in the Earth's stratosphere, and that dust found in debris disks of stellar systems shows levels of polarization similar to those of highly-polarized comets [4].

[1] Kofman et al., MNRAS, 497, 2616-2622, 2020. [2] Boehnhardt et al., A&A, 489, 1337-1343, 2008. [3] Cellino et al., MNRAS, 481, L49-L53, 2018. [4] Levasseur-Regourd et al., PSS, 186, 104896, 2020,