Olivier Savry

Mustapha El-Majihi

Thomas Hiscock

CONFIDAENT : CONtrol FLow protection with Instruction and Data Authenticated ENcrypTion

Computing devices became part of our daily world. But being physically accessible they are exposed to a very large panel of physical attacks, which are most of the time underestimated. These systems must include protections against these attacks in order to keep user data secret and safe.

In this work, we argue that addressing the security requirements of embedded processors with independent countermeasures is not the most efficient strategy and may introduce security flaws in the process. Instead, we suggest a more monolithic approach to security design. Following this idea, we propose a new efficient and flexible memory encryption & authentication mechanism called CONFIDAENT, that can protect code and data in embedded processors. On the top of this primitive, we build a strong Control Flow Integrity (CFI) countermeasure. We describe a RISC-V instruction set extension to support these mechanisms and the compiler support needed in the LLVM framework. This new countermeasure is developed on a modified RISCY RISC-V core and its performances are evaluated on a FPGA target. We conclude that a truly high-security can be achieved, with an overhead factor of ×2.66 up to ×3.73 on execution time of benchmarks programs.

I. INTRODUCTION

Embedded systems are nowadays omnipresent in our lives. They can be found in many areas from the autonomous car to the industrial Iot where safety and security are essential. This is nevertheless a difficult problem to solve for objects which have strong cost constraints and which are physically accessible to any attacker. The past has shown with the Miraï attack [START_REF] Antonakakis | Understanding the mirai botnet[END_REF] for example that simple connected objects such as IP cameras could cause a global denial of service on the Internet.

A. Security Challenges

Physical access to the devices requires a strong protection of both the confidentiality and integrity of the code as well as the data. Memory tampering allows the recovery of the firmware, which opens the door to reverse engineering, the first step towards an attack allowing copyright infringement, or the simple understanding of proprietary algorithms. The code can also be modified during a physical access to the memory. This modification can be done during execution with fault injection (by voltage or clock glitches), on instructions or registers such as the Program Counter (PC) which points to the next instruction to be executed. The code reuse attack and its many variants (such as ROP [START_REF] Roemer | Return-oriented programming: Systems, languages, and applications[END_REF], JOP [START_REF] Bletsch | Jump-oriented programming: a new class of code-reuse attack[END_REF] or return to libc [START_REF] Shacham | The geometry of innocent flesh on the bone: Return-intolibc without function calls (on the x86)[END_REF]) allow to modify the Control Flow Graph (CFG) and to reuse parts of the original code in a malicious way. Stack overflows also allow the CFG to be compromised with a data buffer whose boundaries are not checked. It is then possible to overwrite a return address of a function on the stack to send the CFG back to a shellcode injected in the faulty buffer. We can see that a real protection of the control flow cannot be done by simply protecting the instruction sequences, but that a protection of the integrity of the stack data, which constitutes the real hinge of the CFG, is essential.

B. Existing Countermeasures

All these attacks are addressed in the literature one by one with specific countermeasures. Thus, stack overflows are prevented more or less successfully by Data Execution Prevention (DEP) (e.g. the well-known NX bit of the x86 architecture), or by Address Space Layout Randomisation (ASLR) [START_REF] Shacham | On the effectiveness of address-space randomization[END_REF]. These countermeasures have been quickly bypassed by code reuse attacks which propose to use legitimate code parts (called gadgets) to execute any instruction sequences. The response has been to further monitor the CFG to catch deviation from the normal behavior by using Control Flow Integrity (CFI) mechanisms. Abadi et al [START_REF] Abadi | Control-flow integrity principles, implementations, and applications[END_REF] first propose to apply CFI by replacing vulnerable indirect jumps by code snippets. Then solutions involving compilers protect the forward edges by addition of appropriate protections at direct branch site [START_REF] Tice | Enforcing forward-edge control-flow integrity in GCC & LLVM[END_REF]. The return instructions are traditionally verified by a shadow stack which stores a duplication of return addresses to be compared with usual ones [START_REF] Frantzen | Stackghost: Hardware facilitated stack protection[END_REF]. These fine-grained CFIs, supported by hardware to maintain acceptable performances, are the most promising solutions. However, these CFIs have shown their limitations particularly because they do not really address the protection of the stack content which is an essential element of the CFG and the protection against faults on code and data.

In order to overcome both fault injections and code reuse attacks, it has been proposed to combine a CFI with an encryption of the instructions [START_REF] Hiscock | Lightweight instruction-level encryption for embedded processors using stream ciphers[END_REF], [START_REF] Lashermes | Hardware-assisted program execution integrity: Hapei[END_REF] and finally with authenticated encryption. This approach first appeared with SOFIA [START_REF] De Clercq | SOFIA: Software and control flow integrity architecture[END_REF], which proposes to encrypt instructions by associating them with their PC and the previous PC in the CFG. A Message Authentication Code (MAC) is added to this encryption to ensure integrity. This integrity is verified in the stages following the Decode stage in the pipeline and validated by a single signal. Unfortunately, this signal is vulnerable to a fault injection which can validate an illegal instruction. Another more recent approach called SCFP [START_REF] Werner | Sponge-based control-flow protection for iot devices[END_REF] proposes to link the internal state of a cryptographic sponge function with the CFG. At each branch or function return a patch is added to the internal state allowing a single collision and thus a unique change of direction of the CFG. Indirect jumps are also allowed but to a restricted set of locations and require 4 patches per call. The interrupts are managed by saving the internal state of the AE primitive which can potentially be cumbersome. At the end, the performance of the solution is attractive but it is shown on an example without authentication or even sponge function.

We can see that if SOFIA and SCFP are looking to effectively protect the CFG against modifications or reuse, they give up protecting data-driven attacks such as stack overflows even though the stack is the hub of the CFG, especially during function calls. Moreover, their approaches are purely static and do not handle real indirect jumps where the destination address is only known at runtime, such as when calling a dynamic library.

C. Contributions

In order to address all of the above vulnerabilities, we propose, in line with SOFIA and SCFP, an approach that breaks with the stacking of countermeasures and is more holistic. Our solution is based on authenticated encryption of both instructions and data. This has the merit of first detecting fault injections such as DRAM rowhammers [START_REF] Seaborn | Exploiting the DRAM rowhammer bug to gain kernel privileges[END_REF] or glitches on the code and data and in particular on the stack. The integrity check is no longer done at boot time like classical secure boots which are long for small processors (it's always annoying to wait at boot time!) and then leaves the code vulnerable to modifications. Integrity checking is now done at runtime just before the Fetch stage for instructions and before the Load/Store Unit (LSU) level for data. The CFI that we call CONFIDAENT is done in the form of xored masks with each instruction and which are specific to each Basic Block. New instructions added to the RISC-V ISA ensure the change of the mask's root at the moment of a branch. To manage indirect jumps, an encrypted mask is added in the header of the first Basic Block called. Thus, there are no restrictions on the destination of indirect jumps which can be totally dynamic (switches, callbacks, or dynamic libraries are managed). Finally, during function calls, the return address and the mask necessary for decryption at this address are stored on the stack in an encrypted way. An attacker who wants to exploit a buffer overflow will need to know the mask used where he wants to jump to. The guess will be difficult since masks are secret.

We demonstrate the feasibility of this solution on FPGA with a RISCY processor of the Pulpino platform [START_REF] Gautschi | Near-threshold RISC-V core with dsp extensions for scalable iot endpoint devices[END_REF] which uses the RISC-V ISA [START_REF] Waterman | The RISC-V instruction set manual, volume I: Base user-level isa version 2[END_REF]. An LLVM compilation toolchain including the new instructions added at the backend has been developed. The authenticated encryption step is done after the link, which makes our solution compatible with binaries that are already compiled (they will however not benefit from the protections provided by our CFI). Overheads in code size and CPU cycles number are in the same order of magnitude as SCFP: from 0 to 36%. To this must be added a doubling of the memory occupation for the storage of meta-data and integrity tags.

D. Outline

In this paper, we first define a security framework with a threat model and targeted attacks. Then, the architecture of our solution will be described followed by a presentation of the CFI and the required adaptation of the LLVM compiler. Finally, we will discuss its performances and analyze its security properties.

II. SECURITY FRAMEWORK

A. Threat Model

As we have seen, we assume that the attacker has physical access to the device but is limited to elements that are potentially external to the CPU such as RAM. He can then dump and manipulate these memories at will, he will not have access to the data in plain text. The inputs and outputs are accessible and faults can be injected in the form of voltage or clock glitches for example. On the other hand, we do not consider in our model an invasive intrusion on the core. Similarly, we consider side-channel attacks outside the scope of this study. Finally, we place ourselves in the Dolev-Yao [START_REF] Dolev | On the security of public key protocols[END_REF] threat model where the attacker is capable of performing protocol-level attacks but cannot break cryptographic primitives.

B. Targeted Security Properties

Faced with these threats, we define a set of security properties that our device will have to verify in the model described in the previous section:

• Entry Protection: An attacker must not be able to jump to any address in the code.

III. ARCHITECTURE

Encryption-based CFI hardware solutions generally consider the encryption of instructions and not data. A joint encryption of the two represents a challenge for the choice of the primitive and its mode. Many constraints have to be taken into account such as lightness in particular with the possibility of encrypting/decrypting with the same hardware block, low latency, random access to memory byte by byte which requires a nonce, iv or tweak and memory alignment for fast addressing. Our encryption method must also have the ability to encrypt already compiled binaries. With these constraints in mind, we looked for 128-bit security for confidentiality and 64-bit tags for integrity. The recent NIST competition for lightweight AE has resulted in many primitives that meet our requirements. Most of them are defined by the update of an internal state with which the plaintext is xored. This scheme matches well with the encryption of a sequence of instructions. We have chosen one of the finalists, ASCON [START_REF] Dobraunig | Ascon v1. 2[END_REF], which fills our criteria. However, if encryption must not to be the limiting factor of CPU speed, operating instruction by instruction and data by data is not realistic.

The data or instructions are therefore grouped in blocks of 16 bytes (or 4×32-bit words) on our 32-bit architecture (i.e. 128-bit ciphered text) associated with a 64-bit integrity tag. Nevertheless the structure of the AE primitives obliges to renew the nonce and thus requires that a part of it is stored (Cf Figure 1). We thus put 32 bits of the nonce in a 64 bits Fig. 1: Format of the Code or Data authenticated encryption with a zoom on the metadata sub-block part of metadata which is seen as authenticated data (AD i.e. not ciphered but authenticated with the integrity tag). At each store instruction of a new data, the nonce is changed by taking 31 bits of the previous integrity tag. This saves an implementation of an RNG. The missing bit is a NX bit (Non Executable) which is set by the compiler to 1 for data and to 0 for instructions. This bit is checked by the Fetch stage of the processor and in case this bit is equal to 1, an exception is raised. This is a real simple proven hardware mechanism to avoid stack overflow attack. The Nonce being on 128 bits, we also have 32 bits which are defined by the address of the block allowing us a random access to each data and a diversity of encryption. The remaining 64 bits of the Nonce are considered secret to contribute reinforcing security. With this management by block, the writing of one byte of data can pose integrity problems because it involves, by the decryption of a 128-bit block (before being encrypted again), the validation of all the other bytes. Indeed, they may not have been initialized and therefore they must not have a valid integrity tag. To avoid this inconvenience, we have used 16 bits (1 per byte) in the authenticated data part that we call Encryption Validity Bit (EVB) which goes from 0 to 1 during a valid writing of a byte. Consequently, on reading only the bits set to 1 allow the associated bytes to be considered as valid (provided that the block integrity tag is also valid).

We then have a block size of 256 bits (128 bits of data/instructions, 64 of AD including 16 bits of EVB, 32 bits of nonce and 16 useless bits set to 0, and 64 bits of integrity tag) which allows a simple memory alignment to be addressed but at the price of doubling the memory. The size of this block can be lowered with the presence of a cache. For example, we can have a 64 byte block of encrypted data with 16 bytes of metadata and 16 bytes of MAC for an overhead of only 50% of the memory occupancy but requiring the implementation of an addition for its addressing. Figure 2 shows the position of the encryption/decryption block between the instruction memory and the data memory for a RISCY core. It provides an average of just over 1 de/encryption per CPU clock cycle thanks to two 128-bit buffers at the memories input/output. The loading of the key and the secret part of the Nonce is done through the debug port which can be locked by a 128-bit password.

IV. CONTROL FLOW INTEGRITY

A. Overview

Control Flow Integrity is ensured by a lightweight masking scheme applied to the instructions, the latter can be built on top of the memory encryption mechanism described previously. In a nutshell, the fetch logic of the processor holds a mask register named m, which is updated at each cycle by applying a function called next (see Definition IV.1) to the current value of m. The processor mask m is combined at each cycle with data coming from instruction memory using a XOR to produce the plain instruction. While our proof of concept implements the next function as a very simple permutation, more complex functions may be selected, such as a LFSR.

Definition IV.1. The function next : {0, 1} 32 → {0, 1} 32 is defined as the 32-bit DES permutation whose bit association is shown in Table I. Note that the hardware implementation of such permutation has almost no cost. For a given sequence of instructions (i 0 , i 1 , . . . , i n ), the masked instructions stored in memory (before being encrypted) will be:

(i 0 ⊕m 0 , i 1 ⊕next(m 0 ), . . . , i n ⊕next(m n-1 )).
Where the initial mask m 0 is picked randomly and the rest of the sequence m i = next(m i-1 ) is computed by updating the previous mask. Branchless programs can be easily executed using this scheme: the instructions are stored in memory in masked form, and at each cycle the processor unmasks the instruction using m and updates it. The processor only needs the initial mask of the sequence m 0 . However, when a branch is taken, the value of m must change to the mask of the target location. This simple observation implies two important requirements:

1) There should be a mechanism to change the mask on branches to a value other than next(m) 2) The mask used at the target address of any branch (both direct and indirect) must be known

To address these requirements, we describe a RISC-V [START_REF] Waterman | The RISC-V instruction set manual, volume I: Base user-level isa version 2[END_REF] ISA extension that allows programmers to manipulate masks using additional instructions and registers. This extension was designed to be highly flexible and be compatible with existing programs. Thus, this extension allows to apply CFI on very complex programs, for example we successfully compiled the C library Newlib [START_REF]Newlib C library[END_REF] with CFI and run programs that use it. While programmers can use these extra instructions explicitly, manually managing masks can be cumbersome. A better approach that we develop in this paper is to leverage compiler to handle the mask management for us.

B. Instruction Set Extension

The RISC-V ISA extension we proposed is called ECR, which stands for Encryption Control Registers. It adds a new register bank (holding up to 16×32-bit registers) and four new instructions: ecr.lui, ecr.addi, ecr.lw and ecr.sw. An additional instruction ecr.enter is also reserved. It should never be executed, its sole purpose is to reserve a mask slot in code. Because this instruction has a unique encoding, the masking software can detect them and replace them through the relocation mechanism (see subsection IV-E). The instructions semantics are described in Table II. Four important ECR registers are:

• m, the current mask value used by the Fetch stage to retrieve the plaintext of the current instruction. This register is implicit, its value is not directly accessible to the programmer. • emb, the mask value to be used as m if the next branch is taken. • emr, a return mask which contains the value of next(m)

when the last jal instruction was executed. • eme, which contains the value of next(m) when the last exception was taken. It is the analogous of emr for exceptions. • emt, a configuration registers which defines the masks to be used when jumping to an exception.

The registers emr and eme are updated automatically by the processor when executing any jump (for emr) or jumping to an exception handler (for eme).

C. Transformation of common code structures

As we have seen, each Basic Block has its own m 0 mask which must be changed at each direct or indirect branches. Conditional branches and direct jumps are managed by loading in the emb register the new m o mask of the Basic Block the CPU is jumping to. As the mask is on 32 bits, the loading of an immediate value of a register requires 2 instructions: where m 0, 20 are the 20-bit MSB of m 0 and m 0, 12 are the LSB 12-bit of m 0 (Cf Figure 3). The next instruction is therefore a direct jump or a conditional branch that will automatically change the current mask register m (m ← emb). This instruction also puts next(m) in the emr register to keep track of the mask necessary to decipher the sequence of instructions in case of a non-leaf function return (emr ← next(m)).

Fig. 3: Modification of the mask during a conditional branch or a direct jump. For the ease of understanding, each instruction has a MAC whereas it is only 1 MAC for 4 instructions in practice Fig. 4: Modification of the mask during an indirect jump. The first Basic Block of the called function has a ciphered header which is the mask required to decipher it. For the ease of understanding, each instruction has a MAC whereas it is only 1 MAC for 4 instructions in practice

For nested function calls, the return mask is stored on the stack along with the return address. This is done by the instruction ecr.sw emr , offset(rs1) which loads the mask into emr at of f set(rs1). Since the data is encrypted, the masks stored in main memory are encrypted as well. The attacker is then forced to make a brute force attack to find the right mask. This structure allows us to easily manage indirect jumps. Indeed, the instruction jalr behaves as a jal with respect to the registers m, emb and emr. It also writes next(m) into emr. The ecr.lw emb , offset(rs1) instruction loads the mask stored on the stack in the register emb before any jalr instruction. Any function can also have a mask as the header of its first Basic Block, which can then be retrieved by the ecr.lw instruction and thus be called indirectly (Cf Figure 4). This approach has the advantage over the state of the art to allow dynamic calls to libraries for example, calls to C++ class methods via vtables, switch tables and many other things. This mechanism does not compromise protection against code reuse attacks because the masks remain secret and must be found by brute force by the attacker if he wants to use parts of the legitimate code.

On the other hand, a stack overflow attack is still possible because an attacker can take advantage of a buffer whose bounds are not checked to overwrite not only the return address of the function on the stack as usual but also the return mask with a mask of his choice with which he will have instrumented his shellcode. This masked shellcode is then put in the faulty buffer. It is only the hardware NX bit mechanism, of negligible cost, that avoids the execution of this shellcode and thus the exploitation of the vulnerability.

The proposed CFI scheme allows to handle exceptions without trouble. Indeed, exceptions can be viewed as jumps (to a specific handler) that can be taken before executing any instruction. Thus, in order to take an exception the processor needs 1) to setup the mask associated with the current exception handler and 2) when done, to restore the source instruction mask in order to resume execution. Fortunately, the exception return mask is already available in the ecr.eme register. Configuring the mask of the exception handler is done by using the ECR register emt presented previously. Thus, a typical boot code would now have to setup the handler appropriately using a code snippet such as (given using RISC-V GNU assembly syntax): This scheme can also support vectored exceptions. For that, the processor will set the mask to emt + 4 * exception number . Of course, the exception table entries must be masked appropriately on the compiler side.

D. Compiler Support

The CFI mechanism proposed relies on a compiler for inserting appropriate mask manipulation instruction. We extended the LLVM [START_REF] Lattner | LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation[END_REF] compiler RISC-V backend to support this extension. The modifications are done in 3 passes:

1) A first pass allocates for each non-leaf function stack slots for return masks 2) A second optional pass takes care of splitting basic blocks 3) A third pass inserts the appropriate ecr. * instructions, mask saving instructions in the prologue epilogue and pairs of ecr.addi, ecr.lui before direct jumps.

E. Applying CFI on Executable Files

While the algorithm for performing the masking is conceptually simple, it has lots of subtle corner cases. Thus, we make the effort to formalize the data structures and algorithms used.

The CFI algorithm workflow is depicted in Figure 5. The masking algorithm takes as input a sequence of CFI regions, which are continuous regions of memory. An ELF file for instance may contain different segments (.text, .data) that resides at completely different memory addresses, a CFI region is associated to each memory segment to be analyzed.

1) Analysis: A first pass performs a whole program analysis in order to build CFI chunks and find relocations. A CFI chunks is defined as a sequence of instructions whose masks are only updated using the next function. Given a CFI chunk, a single mask is generated for the first instruction, then all other masks are derived. While creating CFI chunks, CFI relocations are also collected. CFI relocations are the analogous of relocations used in linkers (such as GNU ld). Namely, a relocation is made of a target address (or equivalently a mask, since a single mask is associated with each program address) and a relocation type. Three types of relocations are supported:

1) RELOC_IMM20: 20 bit relocations, the upper 20 bits of the instruction will be replaced by the 20 upper bits of the target mask. This relocation appears in ecr.lui instructions (for example, ecr.lui emb, %hi(loop) involves such a relocation). 2) RELOC_IMM12: 12 bit relocations, the lower bits of the instructions will be replaced by the 12 lower bits of the target mask. This relocation appears in ecr.addi instructions, as in ecr.lui emb, %lo(loop). 3) RELOC_IMM32: 32 bit relocations, the instruction is completely replaced by the target mask. This type of relocation is emitted for each ecr.enter instructions encountered. The algorithm for performing the analysis is shown in algorithm 1. It disassembles all CFI regions and looks for ecr. * instructions to build appropriate relocations. Furthermore, it uses a very reduced RISC-V interpreter (called scpu in algorithm 1) to reconstruct branch target values. Indeed, we need to detect reliably direct jumps to the next instructions (such as j 4), which are interpreted as explicit mask change request. Then, CFI chunks are divided by the algorithm in two cases: if the current instruction is an ecr.enter or when a direct jump to the next instruction is found. 2) Masking: Once CFI chunks are properly constructed, the rest of the algorithm is straightforward. First, the masks for the whole program are computed. More precisely, a RNG is used to sample a 32-bit mask for the first instruction of each CFI chunk. Then, the next function is called repeatedly to generate the masks for the chunk. It is important that all masks are computed first, as relocations might refer to mask at any point of the program. For example, the mask of loop in Figure 5 must be known for resolving relocations before the loop_end label, generating only masks for chunk entry is not sufficient since the loop label appears in the middle of a block.

All relocations are iterated in order and applied: some bits of the instructions are modified according to the relocation type and the target mask. A last pass applies masks to the whole program by doing a bitwise exclusive OR (XOR) with the masks generated and the instructions. Obviously, the relocations must be patched before doing the masking.

3) Use Shorter Masks: A slight modification of the algorithm described above allows to use shorter masks, for instance only represented on 20 bits. This is interesting, since shorter masks means less size overhead and better performances (fewer instructions are needed to modify the mask value). In order to support shorter masks, the following modifications are required:

• Enable Basic Block boundary splitting in the compiler discussed in the subsection IV-D.

• Emit only ecr.lui emb for defining the mask (the ecr.addi instruction is not emitted). • In the analysis pass of the masking program (algorithm 1), create a chunk for each direct branch entry A full example is shown on Figure 6. Even if the masking program generates much more CFI Chunks (4 instead of 2 for 32-bit masks), the overall number of instructions is not highly affected. On this small example, the number of instruction remains the same. Interestingly, the number of instructions in the critical path (the body of loop) has two less instructions, which will make the code faster. The security of the proposed solution is ensured by a first layer of data and code authenticated encryption based on the ASCON primitive with a 128-bit key associated with a 32-bit part of secret nonce which ensures a complexity of 160 bits (Code/data confidentiality). The integrity tags are 64-bit long which, with the birthday paradox, reduces the collision search to 32 bits. However for each address, the nonce changes and thus any brute force attack has to start again for different addresses. The security of the instructions also relies on a second level of encryption provided by the secret masks of each basic block. In the case of a fault injected on a mask, the tag will not detect an error and the CPU will continue to execute false instructions until it encounters an illegal instruction. This happens very quickly (usually 2 to 3 instructions) given the sparse ISA of RISC V. This concern has been well documented in the SCFP [START_REF] Werner | Sponge-based control-flow protection for iot devices[END_REF] solution. Changing the mask at each instruction prevents an attacker from jumping indiscriminately at any instruction of a basic block and from permuting line of code(Entry Protection). On the other hand, the integrity tag allows to efficiently avoid data faults and thus protect indirect jumps (Fault Attack, Data/Code Integrity). To carry out a code reuse attack, the attacker will have to guess blindly (because of the ASCON encryption) the 32-bit mask allowing the CPU to correctly decipher the instruction he wants to jump on. It is therefore difficult to generalize ROP type attacks requiring several gadgets (Code Reuse Attack). We have seen that the authenticated encryption of code and data alone does not prevent stack overflows from being exploited. On the other hand, the encryption structure used with metadata allows a simple use of a hardware NX bit which makes the stack un-executable and therefore prevents the execution of shellcode (Stack Overflow). Finally, data encryption requires protection against replay attacks. Data memory integrity is generally provided by very heavy Merkle tree structures. The implementation we have done does not take into account this security objective for the moment. Nevertheless, the authenticated encryption structure described in this article opens the way to much simpler possibilities to deal with this problem. This will be the subject of further work (Replay attack).

VI. PERFORMANCE EVALUATION

A. Control Flow Integrity

The CFI countermeasure presented in section IV was implemented in a RISCY core from the Pulpino project [START_REF] Gautschi | Near-threshold RISC-V core with dsp extensions for scalable iot endpoint devices[END_REF]. We compare the cost of the different CFI variants in terms of execution time and program size. The RISCY core being tailored for IoT applications, we chose a subset of the Embench-IoT benchmarks [START_REF]Embench: Open benchmarks for embedded platforms[END_REF] for our evaluation. Some of these benchmarks make calls to the C-library. To support them, we successfully compile and link a Newlib [START_REF]Newlib C library[END_REF] C-library with CFI enabled. This highlights the robustness of the proposed mechanism. The benchmarks are all compiled in -O2 mode, which is the common compilation mode for general-purpose applications. The following CFI variants are compared:

• base: the program is compiled without CFI.

• cfi: the program is compiled with CFI.

• cfi-split: the program is compiled with CFI and the mask is changed for each basic block of the program. • cfi-split20: same as the cfi-split mode, but only the 20 bits upper bits of the masks are used (lower bits are set to zero). Each benchmark is executed on the FPGA implementation of the RISCY core, from which we retrieve the exact number of clock cycles. The size of the executable is obtained by measuring the size of the .text section given by GNU binutils size tool. The binary is stripped from any uncalled functions (using gc-sections), thus the .text section only includes code that will be executed and no "dead" sections from the C-library. We then compute the relative overhead in terms of cycle and size.

The cycle overhead measurements are shown in Figure 7. The most performant is the cfi-split20 variant, which is not obvious since it inserts additional direct jumps to any basic block. However, having the 20 bit masks reduces the number instructions to setup the mask in loops and hence, improves performances compared to the base CFI version. The overhead for this variant ranges from 0.08% to 36% in the worst case, which is pretty good comparing current state-of-the art solutions. Interestingly, the cryptographic benchmarks (nettleaes and nettle-sha256) have a very low overhead (lower that 4%). This is due to a low number of basic blocks, as most of the code is unrolled in such benchmarks. The size overhead measurements are shown in Figure 8. Unfortunately, the embench benchmarks remain "small" benchmarks by design, thus these results should be interpreted with care. The overall CFI overhead lies in the range 0%-40% range. Here, the cfi and cfi-split20 variants are the best and only differs by a few percents.

B. Memory Confidentiality and Integrity

CFI and memory encryption must be used conjointly for the countermeasure to be secure. However, regarding performance evaluation, the memory encryption mechanism can be studied separately. The current memory encryption engine implemented on FPGA uses a single ASCON instance shared between the instruction and data memory. It can perform both encryption and decryption and has a latency of 4 CPU clock cycles. This is achieved by dividing the ASCON clock (250 MHz) 10 times to obtain the CPU clock (25 MHz) (Cf Figure 2). In results shown in Table III, we only provide results for the most efficient CFI profile which uses 20-bit masks. In our current proof of concept, the memory encryption overhead lies between ×2.32 and ×3.27 in the worst case.

VII. CONCLUSION

In this paper we show a new way to deal with the stack of countermeasures thanks to authenticated encryption of both code and data for assurance of confidentiality and integrity at runtime, protection against code reuse attacks and stack overflows. This encryption structure allows data writes at byte granularity and the scheme enables efficient CFI by adding a second level of masks on the instructions and new instructions to manage them. In particular, data encryption supports indirect jumps without restrictions allowing all the dynamic programming subtleties offered by today's languages and OSes. An LLVM RISC-V compiler has been modified in this sense with an encryption step pushed back after the linker. This allows easy encryption of already compiled libraries. The FPGA proof of concept on a RISCY core which shows that the overhead in terms of code size and number of cycles is really dependent of the program and falls between 0% to 36% in our benchmark. The integrity of data and code forces us to double the memory occupancy. The increase in computation times by a factor of 2 to 3 is due to the latency introduced by the sole ASCON instance switching between data and code. The addition of caches or the duplication of ASCON will drastically improve this drawback. This encryption structure of both data and instructions gives us a glimpse of further possibilities for lightweight protection against replay attacks or spatial and temporal memory safety concerns.

Fig. 2 :

 2 Fig. 2: RISCY Core with ASCON AE block and the two buffers enabling a sharing between Instruction and Data encrypted memories. Debug lock mechanism with 128-bit password to store the cryptographic key.

  ecr.lui emb , m 0, 20 ecr.addi emb , m 0, 12

Fig. 5 :

 5 Fig. 5: Data flow of the CFI masking algorithm

Fig. 6 :

 6 Fig. 6: Difference between a program compiled with 32-bit (left) and 20 bit masks V. SECURITY ANALYSIS

Fig. 7 :

 7 Fig. 7: Evolution the number of cycles for different benchmarks

TABLE I :

 I Bit permutation, adapted from the DES cipher

		0	1	2	3	4	5	6	7
	0	16	7	20 21 29 12 28 17
	8	1	15 23 26	5	18 31 10
	16	2	8	24 14 32 27	3	9
	24	19 13 30	6	22 11	4	25

TABLE II :

 II ECR instructions semantic

	Instruction	Pseudo-code
	ecr.lui ecrd , imm20	ECR[ecrd] ← imm20	12
	ecr.addi ecrd , ecrs , imm12	ECR[ecrd] ← ECR[ecrs] + signext(imm12)
	ecr.lw ecrd , offset(rs1)	ECR[ecrd] ← MEM[rs1 + signext(of f set)]
	ecr.sw ecrt , offset(rs1)	M EM[rs1 + signext(of f set)] ← ECR[ecrt]

Authorized licensed use limited to: CEA GRENOBLE. Downloaded on November 27,2023 at 13:35:08 UTC from IEEE Xplore. Restrictions apply.

ACKNOWLEDGMENTS

The authors would like to thank the reviewers for their helpful comments. This work was funded thanks to the French national program "Programme d'Investissement d'Avenir IRT Nanoelec" ANR-10-AIRT-05.

Fig. 8: Evolution of the size of the .text section

TABLE III: Cycle cost of memory encryption. The overhead is computed between cfi-split20 and cfi-split20-xmem. benchmark base cfi-split20 cfi-split20-xmem aha-mont64 4,983,621 6,311,849 15,316,543 (+142.66%) crc32 4,159,221 5,348,729 13,370,535 (+149.98%) edn 4,778,450 5,171,863 13,764,446 (+166.14%) huffbench 3,931,101 4,786,819 14,124,502 (+195.07%) matmult-int 2,808,107 2,990,772 7,946,961 (+165.72%) nettle-aes 3,342,817 3,448,319 8,560,447 (+148.25%) nettle-sha256 3,692,382 3,813,947 9,253,494 (+142.62%) nsichneu 3,304,837 3,307,563 9,847,562 (+197.73%) slre 4,510,608 6,144,376 16,942,249 (+175.74%) statemate 5,212,495 5,939,445 19,456,443 (+227.58%) ud 2,803,095 3,214,037 7,461,564 (+132.16%)


L Carnis

Automated Speed Enforcement: What The French Experience Can Teach Us

Keywords: Speed Enforcement, Deterrence, Public Policy, Network Centric

The French authorities installed the country's first speed cameras in November 2003 and at present some 2500 devices are in operation throughout the road and highway network. France has seen a significant decrease in the number of fatalities and injuries since the implementation of this speed enforcement programme. However, in comparison with its Australian counterparts, the French system functions differently and has its own special characteristics. An empirical analysis of this programme can yield new findings regarding the enforcement mechanism and could open up new avenues for traffic safety policy.

The first section of this article proposes a presentation of the French programme and how it is currently operated. The second section offers a detailed investigation into the deterrent effect and punishment policy, with emphasis on the specificities of the strategy followed by the French public authorities. The final section focuses on the political consequences of implementation of such a programme. This contribution highlights the insights the French ASE programme can yield for countries interested in installing such apparatus or in improving their own programmes.

Introduction

Automation of speed checks represents a major change in road safety policy in France in recent years. It is part of a broader policy of punishing illegal driving behaviour and reinforcing the penalties incurred by offenders. This campaign against road violence 1 foregrounds a political determination to put an end to impunity for those whose behaviour endangers, among other things, the lives of others.

This public policy has yielded remarkable road toll statistics. The number of fatalities has diminished by over 40% since 2002, and the authorities are speaking of 12,000 lives saved since the new policy was implemented. The number of injuries avoided is also considerable, even if the fatality figures are those that draw most attention from official decision-makers and the media.

Introduction of the automated speed enforcement (ASE) system took place in a favourable context, the then President Jacques Chirac having expressed a personal commitment and made road safety a priority for his term in office. The French system of automatic speed enforcement has its own distinctive form of organization and revolves around a number of basic principles (section 1 of this article). Study of the French ASE stresses the use of an innovative strategy for deterring speed limit offences. The authorities opted for a mixed strategy utilizing "network-centric" deterrence. In addition, installation of an automatic system necessitates consideration of its effects on the division of labour within the deterrence framework (section 2). The acquisition of such a system hinges on a deliberate political choice, which in turn requires a favourable political context and ongoing backup as a means of resisting the system's opponents. All in all, automatic speed enforcement signals the coming of a new age in public road safety policy (section 3).

I Presentation of automatic speed enforcement in France

The introduction of an automatic speed enforcement system in France represents a major change in public sector road safety policy over the last few years. This section presents the circumstances of its ongoing installation, its organisational structure and its basic operating principles.

A favourable context and a gradual rise in impact

In his presidential speech of July 2002 Jacques Chirac made the first mention of the introduction of an automatic speed enforcement system in France. In December of the same year the Interdepartmental Road Safety Committee (CISR) officially announced the establishment of the system in the course of 2003, with the first checking devices to be installed in the course of that year [START_REF] Carnis | The French automated speed enforcement programme: first results and analysis[END_REF]. Introduction of the system was facilitated by a favourable political agenda, President Chirac having decided to make road safety a priority concern for his term of office. The intention was to implement a resolute road safety policy aimed at effective application of the Highway Code provisions and breaking with past practice characterised by random, ineffective speed limit enforcement (Carnis 2008a).

In November 2003 the first radar speed traps were installed, with the authorities planning the introduction of 500 new units per year. By the end of 2007 it was announced that over 1850 devices were fully operational. 2 By September 2008 the number had risen to over Road Safety 2020: Smart Solutions, Sustainability, Vision, Conference Proceedings, 5-6 November 2009 Duxton Hotel, Perth, Western Australia 3 2200. At the meeting of the CISR in February 20083 the government announced a further 2000 devices by 2012, an annual increase of 500. At present 2500 devices are in place on the road network, the aim being a total of 2800 for the end of 2009. [START_REF] Mariton | Rapport d'information déposé en application de l'article 146 du règlement par la Commission des finances, de l'économie générale et du plan sur les amendes radars et le financement de la politique de sécurité routière[END_REF] In the first half of 2009 the first red light cameras were installed, with a total of 150 planned for the end of the year.

Organization

The French system uses a form of digital technology allowing for near-complete automation of the detection and penalty procedure. The offender may pay his fine without having had any contact with a police officer, judge or state representative.

The French ASE programme uses fixed devices which, according to their generation, take photographs of offending vehicles front on or from behind. Mobile on-board devices (some of which could operate outside the vehicle) are also part of the programme.

The infractions detected by different checking units (fixed or mobile) are communicated to the National Processing Centre (CNT) in Rennes, where they are computerprocessed. The centre then draws up the documents needed for legal action regarding the infractions recorded. Given that the procedures are all automated, the centre has a high processing capacity and can cope with a very large number of infractions. In addition it is reliable (there are very few challenges) and fast (most fines are communicated to the offender within a week of the offence). In 2008 alone the system sent out 17 million traffic infringement notices, with the total since 2003 running at over 57 million.

The Interdepartmental Automatic Speed Enforcement Project (DPICA) handles the strategic sidemonitoring of the installation and functioning of the devicesand decisionmaking: number and location of devices, issuing of contracts, etc. It also has a communication role and looks after relationships with Prefects (the principal state representatives in each département) and such political decision makers as mayors and members of Parliament. 4Headed up by a Prefect, it also includes advisors from the National Police and the Gendarmerie, and expert analysts.

Main functioning principles

To my knowledge there exists no official document specifying installation criteria for speed detection devices (Carnis 2008b, pp. 225-226;[START_REF] Canel | Sécurité routière et contrôles automatiques en France : résultats et perspectives[END_REF]. The choice of localities should in theory reflect perceived dangers, excess speed problems or the impossibility of using traditional detection methods, but in fact this choice also points up the existence of technical constraints and political trade-offs (between centre and periphery).

Fixed detection devices function on a fulltime basisexcept in cases of breakdown or wilful damagewhile the mobile ones, whose setting-up requires the presence of police personnelare used less and discontinuously. The authorities have opted for signalling the presence of devices, warning road users with a standardised sign placed ahead of the detection point. Detection points are also publicised on the official road safety site on the Internet.5 Mobile devices, however, are not signalled. Detection in these cases is effected using unmarked, specially equipped cars used solely for this purpose.

In France a speeding offence leads to a fine and the deduction of driving licence points (of which the initial total is 12). The penalties for speeding offences do not depend on the The Australasian College of Road Safety Road Safety 2020: Smart Solutions, Sustainability, Vision, Conference Proceedings, 5-6 November 2009 Duxton Hotel, Perth, Western Australia method of detection used: whether detected by a "traditional" method or an automatic device, a given offence carries the same penalty. Automatic devices detect offending vehicles, with the owner presumed to be the driver. Thus the owner is automatically considered responsible for the offence. He may appeal this responsibility by designating the person who was driving the vehicle at the time of the offence, but he must first pay the fine, which is held as a deposit and repaid in the light of the final decision. In cases where the driver cannot be identified, the owner of the vehicle is obliged to pay the fine, even if the procedure does not entail a loss of licence points.

The authorities have also opted for systematic elimination of all photos likely to generate challenge. In practice more than one photo in two is rejected, in the interests of quality and of maintaining public confidence in the functioning of the system. Automation of the procedure also excludes the once current practices of tolerance and indulgence: equity is one of the goals of the system and requires that each citizen receive identical treatment, whence the importance of keeping the system impervious to external influences. A further characteristic of the system is its rapidity: 80% of all fines are paid within 45 days (source: ONISR -National Interdepartmental Road Safety Observatory, 2006). Thus efficiency, rapidity, reliability and equity are the underlying principles applied by the authorities in implementing a policy the public will consider as both credible and acceptable.

Conclusions to be drawn regarding speeding deterrence policy

Automatic speed enforcement has generated an enormous literature (Elvis and Vaa 2004) from which recommendations for public policy can be drawn. The French experience highlights the benefits accruing from use of a mixed strategy and network-centric deterrence. Automation of controls also necessitates thinking about the implications for the establishing of a new division of labour in the field of deterrence.

Mixed strategy, hybrid system

Implementation of a policy for deterring excessive speed via an automatic enforcement system requires advance definition of a number of parameters. Thus the authorities must decide if the aim of their policy is general deterrence (deterring the committing of offences) or/and specific deterrence (detecting the offence and punishing the offender) (Cameron and Sanderson 1982). In concrete terms this means deciding whether or not to indicate the presence of checks, finding the appropriate signing, and opting for fixed or mobile devices.

The French authorities decided in favour of a mixed strategy combining signalled and hidden devices (mobile devices are operated from inside unmarked police cars), with a view to achieving both general and specific deterrence. The fixed devices are preceded by signals intended to modify driver behaviour in terms of excess speed, with their quantity and continuous functioning enabling the creation of "recurrence" or "resonance" effects (zones under full-time surveillance). All in all the point is to educate drivers towards new behaviours via repeated reminders of the law. The mobile devices are used to detect and punish offenders, which explains why their presence is not signalled. Their mobility allows for numerous random checkpoints on the road network and this generates a situation of widespread uncertainty (Carnis 2008c).

The combination of these two elements provides a system which is both effective and acceptable to drivers. Its effectiveness resides in the dual education/deterrence approach, while acceptability can draw strength from a system not intended as exclusively punitive. Overall this mixed strategy reflects a hybridisation of the system with a view to meeting the need for both effectiveness and acceptability.

Creating "network-centric" deterrence

Official policy can aim at local deterrence, with a view to modifying behaviour in respect of a dangerous infrastructure (a tunnel, for example); route deterrence (over a road or highway as a whole); or global deterrence (not limited to the section under surveillance, but rather extending to other, non-checked sections of the network).

The French authorities opted for a progressive gridding of the road network, so as to ensure that whatever route a driver takes, he must at some point encounter a speed trap. The increasing number of such points on the country's roads and freeways can be interpreted as a deployment of sensors covering the entire territory and sending a message to drivers about the sheer difficulty of avoiding speed checks. What we have, then, is a nationwide detection network overlaid on the road network yet not merging with it. Moreover, the number and diversity of detection points makes their identification difficult and costly for the driver (even if currently available warning facilities reduce these costs).

This network-centric aspect of deterrence relies on nodes interlinked by their access to the National Processing Centre. The sheer massiveness of the system comprising 4500 detection points in 2012 (and no doubt more in the years to follow), the interdependence of those points and their incorporation into a single unified programme constitute the basis of a network-centric deterrence (Joffe 2007-08, p. 927) distinct from the practices classically observed in other countries.

Deterrence and a new division of labour

Organizing the work of deterrence within police bodies is a complex task. A police force is a productive organization which must provide different services by combining numerous productivity factors (Carnis 2009a). The choices involved are far from easy for the decision maker, who does not always have the necessary information at his disposal.

Moreover, putting this process to work is a tricky business in many respects. There is competition from other productive activities within the same organizationpublic safety, for instancewhile for the organization's members this activity most often seems lacking in prestige and is thus perceived as unattractive.

Thus a police force is built around a multiservice organization whose numerous responsibilities include public safety and road safety. In the case of the latter, to narrow the work of police bodies to the merely punitive would be reductive and mistaken, given that the police provide a host of services (emergency assistance, post-accident safety measures, escort assignments); that they work with schools; and that they take part in educational and training activities [START_REF] Carnis | Les polices de la route, Une approche comparée Etats-Unis, Nouvelle-Galles du Sud et Nouvelle-Zélande[END_REF]. Thus the issue of the allocation of resources to combat various kinds of offencesspeeding, failure to wear a seat belt, alcohol and drug useadds fresh difficulties for the decision maker.

Automatic speed enforcement represents a technical innovation in the production of road safety services, and as far as I can ascertain its impact on police organization and the work of the traffic policeman has never been studied. There exists a host of different possibilities for the implementing of ASE (Carnis 2009b). Automation can lead to the subcontracting of some tasks to the private sector (data processing, speed checks carried out by operatives); and entrusting of certain police functions to administrative personnel. Police work can also be replaced by totally automatic systems. In this way automation can free up police resources for other tasks. In concrete terms, automation of speed checks calls for a

The Australasian College of Road Safety Road Safety 2020: Smart Solutions, Sustainability, Vision, Conference Proceedings, 5-6 November 2009 Duxton Hotel, Perth, Western Australia redefinition of the functions of traffic police, and a new division of labour between the organizations involved that requires study in its own right. Automation also means that the authorities now have at their disposal a range of activities (traditional checks and automatic detection with its various modalities) and resources (equipment and personnel) which they must combine optimally in the interests of deterrence [START_REF] Cameron | Development of Strategies For Best Practice in Speed Enforcement in Western Australia: Supplementary Report[END_REF]. The allocation of these facilities may reflect an economic analysis of the situation: it must also take account of empirical lessons regarding deterrence policy [START_REF] Cameron | Scientific Basis For The Strategic Directions Of The Safety Camera Program in Victoria[END_REF]), and at the same time come to terms with the existence of private sector alternatives for behaviour regulation [START_REF] Young | Intelligent Transport Systems To Support Police Enforcement Of Roads Safety Laws, ASTB Research and Analysis Report[END_REF]. In addition, this public sector decision is part of a specific institutional framework (police jurisdictions, initial equipping of police forces, legal constraints, etc.) and must correspond to citizen values in respect of the protection of privacy, public safety, etc.

To keep things simple and to limit my analysis to the deterring of speeding, I should point out that the introduction of ASE can have two distinct effects on the global effort put into speed detection.

The first of these can be termed complementarity. ASE represents a public sector gambit which complements the traditional checks carried out by police bodies. In France the installation of automatic radar speed traps has not caused any reduction in the number of offences recorded by the police. On the contrary, the total has risen slightly. This is worth noting in that the use of mobile devices requires the presence of police personnel. Automation of the detection process is seen as a means of increasing the effort put into deterring potential speeding offenders.

The second effect has to do with a process of substitution or commutation. In concrete terms this means total replacement of traditional checks by automatic detection. In this situation automation is aimed more at improving productivityboosting the number of offences detected per hour of surveillance, for examplethan of increasing the total number of detection hours. 6 The British context provides a good illustration here, as automatic detection of speeding violations has led to a substantial reduction in the number of police officers working in the road safety field. (PACTS 2005, p. 11) Thus the automation of speed detection reflects public policy choices that are not always made explicit. These aspects of the issue also need to be taken into account when the effects of the introduction of such a system have to be assessed.

The political issues related to automatic speed enforcement

Establishment of an automatic speed enforcement system reflects a number of political trade-offs. It represents a specific public sector intervention whose analysis can bring to light various aspects crucial to its implementation. Automation of detection points to a new age for public road safety policy, which can only advance in a favourable political context.

A new age for public road safety policy

Speed regulation is the outcome of a long historical process: of the accumulation of major political decisions, the ongoing advance of scientific knowledge, extensive debate and numerous back-and-forth shifts in terms of rules7 [START_REF] Cohen | Limitations de vitesse, les décisions publiques et leurs effets[END_REF]TRB 1998)

. Automation

The Australasian College of Road Safety Road Safety 2020: Smart Solutions, Sustainability, Vision, Conference Proceedings, 5-6 November 2009 Duxton Hotel, Perth, Western Australia of speed detection can be interpreted as pointing to the coming of a new age in public road safety policy.

Initially the authorities' task was identification of the main contributing factors in the road toll. In France the first ventures into speed regulation date from the early 1960s, for traffic in built-up areas. It was only in the early 1970s, however, that speed limits were set for national highways and the freeway network; this followed local experiments, the first of which dated from…1959! At the same time studies were carried out on the impact of speed limits in many different foreign countries. This slow maturation of the relevant knowledge aided public sector decision makers when steps had to be taken to regulate behaviour on the roads.

There then followed the second phase of public intervention: the establishing of best practices for making road safety regulation effective. The country's police forces had to be mobilised, equipped and trained in enforcement. The implementation of centralised decisions by devolved organizations all over the country was a more or less difficult process finally crowned with success. The devolved authorities had to adapt these centralised decisions to their own terrain and come to terms with local and peripheral actors, the outcome including various forms of tolerance and indulgence as well as haphazard speed checking of traffic networks. (Pérez-Diaz 1998) The issues were strategic, too: there had to be trade-offs in general surveillance of the network, but with arrests of offenders guilty of dangerous driving practices (which remained extremely ill-defined).

The move to automatic speed enforcement constitutes a recognition of the dangers of excessive speed on the roads and to a certain extent expresses a consensus among the population regarding the penalizing of this kind of behaviour. (There thus exists minimal support from the public and from state agents for the introduction of such a system.) Automation of detection not only allows for the removal of most of the operational constraints involved (this is especially true of the fixed devices), but also facilitates the choice of location and timing andvia the number of offenders identifiedevaluation of the system's effectiveness. For the authorities the problematics of the current situation lies in timing, location and surveillance density level, the aim being to produce optimal deterrence, use the system to the best advantage and allocate resources as efficiently as possible. The system's redoubtable operational efficiency nonetheless raises questions of equity: technical trustworthiness becomes a major aspect in that margins of tolerance are reduced, while equitable treatment of offenders, the legality of the procedure and proportional appropriateness of the penalties represent new matters for the authorities to deal with. There are issues of transparency, too, which find expression in debate about the use of the accrued revenue for specific purposes, so as to avoid accusations that the government is seeking new forms of tax income; about the criteria for the location of the devices; about the standard margin of error; and about the laying down of appropriate penalties and a clearly established procedure. There is also the question of a regular public evaluation of the ASE. Lastly, the authorities must do all in their power to make the action taken "acceptable" to road users, a situation which, among other things, requires the drawing-up of a communication policy on aims and results. Whereas the launching of the French system was the subject of no public awareness operation whatsoever, 8 the authorities have recently begun a backup campaign titled "The 12,000 Lives", which foregrounds road safety gains since 2002. The campaign's positive message is that those who have gained most from the new policy are those 8 Nonetheless, the launch of ASE had the backing of the media -TV, local and national presswhich presented the government initiative in a favourable light. Overall the system has benefited from approval by the media generally. An interesting account is to be found in the postgraduate thesis by Yann Even, La sécurité routière dans la presse quotidienne de juillet 2000 à juin 2003, "Un effet Chirac", Université Saint Quentin en Yvelines, 2003. The Australasian College of Road Safety Road Safety 2020: Smart Solutions, Sustainability, Vision, Conference Proceedings, 5-6 November 2009 Duxton Hotel, Perth, Western Australia anonymous folk who continue to lead normal lives when they might have been victims of a fatal or severely handicapping accident. All in all, the new age augured by automatic detection of traffic offences makes it clear that for the authorities it is less a question of identifying the factors contributing to the road tollthese now being known to and accepted by the population as a wholeor of ensuring effective application of the road rules by mobilizing and organizing the means appropriate to carrying out detection, but rather a question of making the right strategic choices regarding the deployment and use of the devices, while informing the population about what is being done and how.

The political aspect

Setting up an ASE system involves implementing a specific public policy and thus a very real political choice (Carnis et al 2008). The most conclusive illustration of this is the explicit commitment of the then President Jacques Chirac to the road safety campaign in making the issue a priority for his term of office. This political commitment was equally displayed by successive ministers of Transport and the Interior, who made the struggle their own and systematically defended the programme against attacks by its critics.9 This increased engagement with road safety issues by political decision makers had already emerged from the debate on the timeliness of pursuing the policy of amnestying road traffic offenders.10 An advisory committee had been set up to assess the effects of this practice on the road toll [START_REF] Bergel | Amnistie présidentielle et sécurité routière : rapport d'un groupe d'experts[END_REF] with a view to limiting its scope. This commitment at the highest state level also allowed for the effecting of change in police practices, notably in terms of motivating personnel who now saw themselves doing a respected job and generously provided with new, high-performance equipment. Despite their "corporate" differences, both the police and the gendarmerie willingly integrated the new systems into their way of working, and their commitment has played its part in the excellent results obtained in respect of the road toll (Carnis 2008b).

The political aspect needs to be seen in a broad sense, and not merely in terms of the role of centralised state decision makers. The project has also been extremely well received by local political actors: the prefects have played their part as intermediaries for the départements, while mayors and département councillors have requested the installation of the system on their territories. The courts have also aligned themselves with the new policy by systematically upholding the system's decisions when these come under challenge. Furthermore the system has received the media support and moral endorsement of experts and those in charge of road accident victim associations, who have fought tooth and nail for the system. Lastly, the population as a whole has "altruistically" accepted implementation of the system (ONISR 2006, p. 47 sqq.).

However, the highly favourable political context of the early years seems to have changed somewhat. A number of specialist automobile magazines publish regular attacks on the system, notably in respect of its (in)correct use by the police and the accuracy of the devices. The aim here is to undermine the system's legitimacy. Certain lawyers have specialised in the defence of drivers deprived of their licences, 11 trumpeting their successes in exposing legal shortcomings within the system and being extremely well paid at the same time. More recently the Council of State handed down a decision ordering the Ministry of the Interior to establish a real relationship between the penalty imposed and the danger represented by the driver.12 In addition, certain parliamentarians have taken action to have the penalties modified, so that a speed of less than 5 kph over the limit should not cost a licence point;13 and in some cases the courts have discharged defendants on the grounds of a doubt as to the accuracy of speed measurement, even when the speed in question was recognised as excessive. 14Effective introduction of an ASE system and its maintenance require a favourable political context. Those in favour must make their point of view clear and provided organised defence of the system, given that its opponents are not slow to speak up. Public consent to the use of the system must be maintained via sound communication and transparency of functioning. The trustworthiness, equity and efficiency of the system require particular attention on the part of the authorities; and when necessary, corrective measures must be taken to improve functioning and ensure continuing user support.

Conclusion

The French system of Automatic Speed Enforcement is an innovative experiment in speed regulation. It differs from its European and Australian counterparts in its modalities, its functional principles and its institutional character.

Detailed analysis enables stress on the major contributions to deterrence policy regarding speed limit offenders. The system's strategic aspects cannot be reduced to an exclusive choice between distinct strategic modalities; rather they call for a trade-off between different, simultaneously applied detection strategies and modalities. The authorities work with a set of options which they adapt as best they can to their specific territories. In France they have also opted for a network-centric form of deterrence explicable in terms of, among other things, a totally automatic approach. Study of the French system highlights the fact that introduction of this system took place in a specific institutional framework which may, as a result, be modified and give rise to a new division of labour as regards deterrence.

Lastly, the introduction of the system expressed a public-sector policy whose success resides in, among other things, a favourable, lasting political configuration. Doubtless the quest for public support for this policy is opening up new possibilities for public sector intervention in road safety. The political significance of automation of detection methods calls for detailed studies of the various systems used with a view to identifying points of convergence and achieving an understanding of specifically national differences

Interdepartmental Road Safety Committee (CISR) press kit, 13 February 2008, 22 pp.

DPICA members were heard as part of the background report for the Commission of Finance, the Economy and Planning on the revenues generated by speed fines and the financing of the road safety policy.

www.securiteroutiere.gouv.fr

Installation of an automatic device functioning fulltime also enables an increase in the total number of hours of surveillance.

The United States are an iconic example, given the changes in speed limits that have taken place there since the mid-1970s.

Angélique Négroni, "Excès de vitesse: MAM défend une répression ferme", www.lefigaro.fr,

April 2009. 10 A traditional follow-up to a presidential election in France.

Angélique Négroni, "Radars: ces avocats qui courtisent les automobilistes", Le Figaro, Monday 25May 2009, no. 20160, p. 2.

Conseil d'Etat,

March 2009, no. 322303. 13 Angélique Négroni, "Polémique autour des petits excès de vitesse", Le Figaro, Wednesday 18March 2009, no. 20103, p. 9.

Angélique Négroni, "Des juges préfèrent relaxer des conducteurs flashés", www.lefigaro.fr, Le Figaro, 28 July 2009.

The Australasian College of Road Safety Road Safety 2020: Smart Solutions, Sustainability, Vision, Conference Proceedings, 5-6 November 2009 Duxton Hotel, Perth, Western Australia

The Australasian College of Road Safety Road Safety 2020: Smart Solutions, Sustainability, Vision, Conference Proceedings, 5-6 November 2009 Duxton Hotel, Perth, Western Australia