Arcangelo Castiglione

Ciriaco D'ambrosio
email: cdambrosio@unisa.it

Alfredo De Santis

Francesco Palmieri
email: fpalmier@unina.it

Fully Distributed Secure Video Surveillance Via Portable Device With User Awareness

Keywords: P2P Surveillance, Ubiquitous User Awareness, Secure P2P Systems, Mission Critical Systems, Portable Surveillance Monitor, Kademlia

Internet-based video surveillance systems are now widespread in the modern e-Society, since they can be used to manage multiple physical security problems in a lot of contexts. Moreover, the growing diffusion of portable device, along with the necessity of keeping specific environments and motion events under control, brought out the need for more flexible and proactive systems, which allow the management of such scenarios. However, most of the state of the art video surveillance systems, are known to be unscalable, unreliable, insecure, and do not provide adequate guarantees for user awareness when a determined situation of interest occurs. Furthermore, almost all the currently defined systems, lack in operation flexibility: they are designed for a specific context and can not be easily adapted to other ones. In this work, we propose a general purpose video surveillance system, which is fully distributed and accessible through ubiquitous portable devices. Such system, whose architecture is based on a self-organizing overlay network built on top of a mixture of already existing physical network connections, provides an high degree of reliability for the interactions among all its components, and ensures to its users, regardless of where they are located, the ability to receive notifications upon the occurrence of interesting events.

Introduction

The ever-growing need for security in the modern society, led to an increasing demand for surveillance activities in many areas, which may include transportation applications, monitoring of public places, remote surveillance of human activities, monitoring for quality control in industrial processes, remote surveillance in forensic applications and military sites [START_REF] Valera | Intelligent distributed surveillance systems: a review[END_REF]. The new generation video surveillance systems, are concerned with the monitoring of permanent and transients objects within a given area or environment, both indoor and outdoor [START_REF] Hu | A survey on visual surveillance of object motion and behaviors[END_REF], [START_REF] Hampapur | Smart video surveillance: exploring the concept of multiscale spatiotemporal tracking[END_REF], [START_REF] Buxton | Visual surveillance in a dynamic and uncertain world[END_REF], [START_REF] Cucchiara | Detecting moving objects, ghosts, and shadows in video streams[END_REF] and typically rely on Computer Vision techniques [START_REF] Hartley | Multiple view geometry in computer vision[END_REF], [START_REF] Forsyth | Computer vision: a modern approach[END_REF], [START_REF] Parker | Algorithms for image processing and computer vision[END_REF] [START_REF] Moeslund | A survey of computer vision-based human motion capture[END_REF]. By using such techniques, our system is able to automatically interpret the scene, as well as to understand and predict actions and interactions taking place among the observed objects, based on the information acquired by the involved observation camera(s).

Depending on scenarios in which they operate, that are often mission-critical and require real-time response, such systems must provide, fully or partially, the following basic features: availability, reliability, scalability and security [START_REF] Kornecki | Middleware for distributed video surveillance[END_REF]. At the state of the art, many network-based video surveillance solutions have been proposed, each one with its own specific characteristics, strengths and weaknesses. However, most of the widely known systems, are usually designed for a specific context, and can not be easily adapted to the others. Nowadays, those systems are typically structured according to the traditional client-server paradigm [START_REF] Cucchiara | Computer vision techniques for PDA accessibility of in-house video surveillance[END_REF], [START_REF] Javed | KNIGHT trade;: a real time surveillance system for multiple and non-overlapping cameras[END_REF], [START_REF] Comaniciu | Adaptive Resolution System for Distributed Surveillance[END_REF], [START_REF] Cucchiara | A multi-camera vision system for fall detection and alarm generation[END_REF], [START_REF] Ostheimer | A modular distributed video surveillance system over IP[END_REF], [START_REF] Castiglione | Towards a Lawfully Secure and Privacy Preserving Video Surveillance System[END_REF] or are based on complex overlay communication [START_REF] Yuan | A distributed visual surveillance system[END_REF], [START_REF] Dias | Distributed surveillance system[END_REF] and middleware [START_REF] Desurmont | A general purpose system for distributed surveillance and communication[END_REF], [START_REF] Kornecki | Middleware for distributed video surveillance[END_REF] architectures or, even when claim to be structured according to a resilient and robust Peer-to-Peer (P2P ) [START_REF] Wu | An Architecture for Video Surveillance Service Based on P2P and Cloud Computing[END_REF] scheme, this is only partially true, because their operations still rely on the presence of a centralized directory service, that can be easily identified as the system's security and performance bottleneck.

Hence, it is easy to note that all the currently available systems, do not provide proper guarantees of availability, scalability and reliability that are, however, the fundamental requirements in a modern and really effective surveillance solution. Moreover, we point out that even if the surveillance systems are mainly used to monitor and improve the security in certain specific scenarios and environments, none of them addresses the problems of authentication and privacy among the involved parties, as well as the surveillance data integrity ones, except the one presented in [START_REF] Albano | A Secure Distributed Video Surveillance System Based on Portable Devices[END_REF], [START_REF] Albano | Secure and distributed video surveillance via portable devices[END_REF], which partially addresses the privacy issue among the interacting entities. Furthermore, no distributed video surveillance solution has yet been proposed, allowing a portable device to be efficiently and securely notified, in an ubiquitous manner, about the occurrence of certain interesting situations.

In order to cope with all the above issues, we propose a fully distributed flexible and adaptive video surveillance system, composed by a set of interacting peer nodes within a self-organizing overlay network, each connected with one or more camera(s). To ensure the needed robustness and scalability guarantees, such system is structured according to a completely decentralized and distributed model, based on the use of a P2P implicit communication architecture among its components. In particular, it is based on Kademlia, a Distributed Hash Table (DHT ) management facility for pure P2P organizations, used by many systems such as Kad, Overnet, BitTorrent and Gnutella. The system we proposed can be accessed in an ubiquitous manner through the use of any portable device (e.g., smartphones, tablets, laptops, etc.), even when it has limited hardware features. Moreover, it can be instructed to autonomously detect, recognize and classify certain situations of interest that may occur in monitored environments, by using sophisticated Computer Vision techniques. Given the scenarios where our system is able to operate effectively, which can be mission critical, highly risky, and also prone to attack given the potentially sensitive information that it has to manage, we paid particular attention to confidentiality and integrity of the involved surveillance data. In particular, authentication, confidentiality, integrity and non-repudiation are fully guaranteed for all the interactions and data exchange operations that take place among the system components. Ubiquitous surveillance capabilities are granted to any authorized mobile user, who, by using its own remote network access facilities, can arbitrarily choose to monitor his places of interest from everywhere and at any time. Furthermore, when there is a situation of potential interest and the mobile user is not connected to the system, he can be notified in real-time about such events through SMS and e-mail, in order to take the appropriate actions as quickly as possible. We engineered a simple proof of concept prototype of this system in order to evaluate its performance in terms of scalability, reliability, fault tolerance and security. In particular, we simulated the use of the proposed system in a WAN, and the results of the tests we performed, shown that it guarantees good performance with respect to objectives we set out above.

The remainder of the paper is organized as follows: Section 2 provides a description of the basic prerequisite concepts needed to better present the proposed solution. Section 3 gives a general system overview from the architectural point of view together with some implementation details. Section 4 describes the module responsible for the user situation awareness. Section 5 highlights all the security aspects of the system while Section 6 describes the proof-of-concept implementations and the functional tests performed on it. Finally, Section 7 shows some possible future extensions and draws the conclusions.

Background

Peer to Peer Overlay Organizations

A P2P overlay is a flexible virtual organization of logical associations between peer entities that is dynamically built and managed on top of existing network connections. The fundamental features of such organization is the ability of each participating entity of searching within the organization for some specific key or attribute and finding all the other networked entities within the overlay organization that are associated to that key/attribute in a very effective way, independently from its physical location and network dependent information.

Simply stated, to search a node(s), characterized by some specific attributes a querier does not need to know the IP address of the involved entities, but only attributes characterizing it. Moreover, such organizations are self-organizing, that is, participating peer nodes may dynamically join and leave the overlay in a seamless way without requiring complex reconfiguration operations or affecting the behavior and operations of other nodes in a significant way. From a performance perspective, modern structured P2P overlays support the localization of any resource/peer in a bounded time that scales with the total number of nodes n in the overlay as O(log(n)).

The Kademlia Overlay DHT System

Kademlia is a DHT management infrastructure for decentralized P2P networked systems [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the XOR metric[END_REF] where each peer component is identified by a unique n-bits identifier (node ID), usually determined by using an hash function on its IP address. Basing its decisions on these identifiers the Kademlia P2P algorithm determines where to store information, and which peers are going to be responsible for it, according to a fully distributed hash table scheme. The distance between two peers is computed as the exclusive OR (XOR) of two node IDs and taking the result as an integer number. This ensures, due to the symmetric nature of the XOR operation, also the symmetry of the associated overlay structure. Each node stores contact information about the other ones in a properly crafted "routing table" needed to ensure the mutual reachability among nodes. Nodes are logically managed as leaves into a binary search tree where the position of each node is determined by the shortest unique prefix of its ID. In order to face the problem of stale contacts due to churn (departure of peers) [START_REF] Rhea | Handling churn in a DHT[END_REF], Kademlia uses redundancy, i.e., the routing table stores more than one contact (typically k) for a given distance. Every node keeps a list of: IP address, UDP port and node ID, for nodes of distance between 2 i and 2 i+1 from itself, with 0 ≤ i ≤ n, where n is the number of bits in the node ID. These lists, called k-buckets, have at most k elements. For example, in a network with k = 20, each node will have lists containing up to 20 nodes for a particular bit (a particular distance from itself). k-buckets are kept sorted by the time at which the associated contacts were last seen. The routing table is organized as a binary tree whose leaves are k-buckets. Thus, each lookup step has a choice of k different contacts for the next step. When a k-bucket is full and a new node is discovered for that k-bucket, the least recently seen node in the k-bucket is probed through a PING operation. If the node is found to be still alive, the new node is placed in a secondary list, called replacement cache, which is used only if a node in the k-bucket stops responding. In other words, new nodes are used only when older ones disappear. Kademlia has four messages, corresponding to remote procedure calls:

-PING: probes a peer to check if it is active.

-STORE: instructs a peer to store a {key, value} pair for later retrieval.

-FIND NODE: takes an ID, and returns {IP address, UDP port, NodeID} triples for the k peers it knows that are closest to the target ID.

-FIND VALUE: is similar to FIND NODE, it returns {IP address, UDP port, NodeID} triples, except for the case when a peer received a STORE for the key, it just return the stored value.

A node which would like to join the network must first performs a bootstrap process with another node that is already participating in the Kademlia network. The joining node inserts the bootstrap node into one of its k-buckets and then does a FIND NODE of its own ID against the bootstrap node. The "self-lookup" will populate other nodes' k-buckets with the new node ID, and the joining node's k-buckets with nodes in the path among it and the bootstra node. Afterwards, the joining node refreshes all the k-buckets further away than the k-bucket the bootstrap node falls in. Kademlia uses iterative routing, where the client is responsible for the entire lookup process. At each step, the client sends a lookup request to the next-hop peer and waits for a lookup reply. The reply lets the client know what the next hop is. In Kademlia, a peer must locate the k closest peers to some given node ID. This lookup initiator starts by picking α peers (parallel routing) from its closest non-empty k-bucket [START_REF] Stutzbach | Improving lookup performance over a widely-deployed DHT[END_REF], and then sends parallel asynchronous FIND NODE messages to the α peers it has chosen. If a FIND NODE operation fails to return a peer that is closer than the closest peers already seen, the initiator resends the FIND NODE to any of the k closest peers that has not been already queried.

In supporting key-based searches on its own DHT infrastructure, Kademlia does not introduce periodic overhead, but exploits the previous search transactions to stabilize the overlay network connections.

The System Overview

The proposed surveillance system is composed by three logical entities: the surveillance node, the portable device needing to access the surveillance data and the P2P overlay communication and search infrastructure, used to implements a fully distributed index for the rapid localization of surveillance nodes associated to specific monitoring environments. The overall system architecture is sketched in Figure 1.

Basic architectural choices

The system is able to support a large number of video monitoring stations, located in different physical places, each one with its own access privileges and private views. These stations are controlled by surveillance nodes, reachable though the Internet or a mix or public and private networks and typically run on generic Commercial Off-The-Shelf (COTS ) workstation hardware. Each surveillance node, associated to one or more camera(s), is autonomously responsible for all the interactions among controlled cameras and portable devices, involved in the monitoring of certain areas or environments, in order to detect situations of interest. The surveillance node, also deals with the acquisition of relevant information from camera(s), along with the management of the whole Computer Vision process. These activities are managed by using the user situation awareness module, which issues real-time notifications when a situation of interest subscribed by a portable device occurs.

The portable device, instead represents the system interface for the mobile user, which is interested in monitoring a specific area or environment and wants to have an awareness about the occurrence of specific situations or events.

The P2P overlay communication and search infrastructure is based on Kademlia [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the XOR metric[END_REF], which, as we have previously seen, is a DHT for decentralized P2P overlay organizations. We made that choice since Kademlia, among the existing similar systems, is the one which minimizes the number of messages sent by each node in order to acquire information about the registered surveillance services and their associated nodes. We model our system in a fully distributed way, where the whole architecture is organized as a P2P network of nodes, which may be geographically located everywhere on the Internet or connected to any combination of local and wide area IP-based communication infrastructures, and may use completely different kinds of networking and communication technologies, as shown in Figure 1.

We have chosen this architectural scheme since among the similar available, it is the one which best supports our needs of reliability, scalability and availability, by exploiting the self-organization capabilities of the DHT overlay communication infrastructure. In fact, in traditional systems, the surveillance stations are accessible by their users only through a centralized brokering services, imposing severe limits on the scalability and reliability of the whole solution. That is, the system performance, in presence of n client and server nodes, has to scale with O(n 2 ) due to the n • (n -1) potential relationships among the n involved entities, and this is clearly not acceptable for very large n, for example in systems with many monitoring sites and an huge number of users, such as the publicly accessible ones, usually deployed in the tourism and travel sectors. In other words, the number of hosts that can be monitored at a given time, is limited by the bandwidth and the processing power of the central brokering system, and hence the solution does not scale. Furthermore, once the single central brokering unit fails, the whole system will lose its functionality and the entire set of controlled places will be without any kind of surveillance. Simply stated, any centralized brokering service becomes a single point of failure.

On the contrary, the proposed solution avoids the necessity of any centralized directory or brokering services providing access to surveillance nodes and their managed resources. In particular, by eliminating single points of failure and performance bottlenecks, such solution provides our system with the ability of allowing quick topology changes and easily grow/shrink by adding or removing new nodes or portable devices according to a plug-and-play paradigm, without complex configuration and management tasks. In this way, it is easier to ensure an high degree of scalability and flexibility, and the overall architecture is able to survive to failures or disruptions of any of its components, without stopping its global operations, so that any kind of damage only affects the locally involved nodes.

Moreover, in presence of a very large number of nodes scattered throughout the Internet, the Kademlia-based solution allows the delivery of multiple parallel queries for the same key to different peers. In this way, any delay or timeout on a specific route to destination do not necessarily affect the search process, thus ensuring faster and more reliable searches, also in presence of a large number of nodes continuously joining and leaving the overlay network.

Implementation Details

The system, is accessible to both the surveillance nodes and mobile monitoring devices through a publicly available hostname, registered on the Internet Domain Name System (DNS ). Such an hostname, is dynamically mapped to one of the nodes in the P2P network, through Dynamic DNS [START_REF] Vixie | Dynamic Updates in the Domain Name System (DNS UPDATE)[END_REF] techniques. A new node or portable device who want to join our system, must only know such hostname, along with the proper access credentials (username and password, or digital X.509 certificate). The above hostname, must be also used as the Kademlia bootstrap node for all the entities (surveillance nodes and portable devices devices) that need to access the overlay network infrastructure. Surveillance nodes, when joining such network, register their monitoring capabilities, in terms of associated camera(s)/monitored environment(s), by storing on the Kademlia DHT each environment identifier (key), together with the serving node IP address (value). Portable devices, which want to join the surveillance system, can search the Kademlia overlay for keys corresponding to the environments of interest under monitoring, by obtaining the IP addresses of associated surveillance nodes, in order to connect to them for visualizing the cameras' video materials.

Moreover, a portable device that is not currently joined, can be asynchronously notified about the occurrence of events of interest (motion detection occurrences etc.). It is important to point out that there is no explicit communication among surveillance nodes, which only interact among themselves indirectly, by exposing and sharing their service information (monitored environments) through the overlay DHT facilities. Instead, the communication among portable devices and surveillance nodes takes place according to the traditional client-server paradigm, where each surveillance node assumes the role of server for all the mobile nodes' queries. In particular, the interaction between such two parties, is carried out via (secure) TCP socket, by using an ad-hoc FTP-like protocol, for the delivery of control messages (queries and results) and video surveillance data. Like in passive-mode FTP, such ad-hoc protocol (as defined in [START_REF] Albano | A Secure Distributed Video Surveillance System Based on Portable Devices[END_REF]) in order to overcome limitations introduced by firewalls or NATs, as well as restrictions and policies imposed by cellular operators, forces the portable device to open two communication channels, one for the sending of control messages and the other for data transfer, by thus avoiding the opening of any connection backwards, from the surveillance node to the mobile one. The messages used for the interaction among a node and a portable device are four: Login, List, MGet and Subscribe. The Login message is used by the portable device for communicating to the node its login credentials, i.e., username, password and optionally its own certificate, in the case in which strong mutual authentication among endpoints is needed. The authentication phase, accomplished through the use of such message, can be successful or not. If it has been successfully completed, the node sends to portable device a message which contains the "200" return code, as in the standard FTP, and the interaction between these two parts continues normally. In the case of failure, the portable device is notified about that by the node, and it is shown an alert message on its display. Upon a successful authentication, a portable device can use the List message for requesting a preview (typically in JPEG) of each of the environments monitored by the node to which it is connected. As soon as a node receives such command, it takes a snapshot from each of its camera(s), and sends such snapshots to the portable device. When a portable device, based on the snapshots it has received, chooses the particular environment which intends to monitor (identified by an univocal code), at this point it can use the MGet command. Once a node receives this command, it creates a data channel with the portable device, and through this mechanism it sends a video streaming to the latter. It is important to point out that a portable device, after its successful connection to a surveillance node, is able to communicate the possible events in which it is interested and for which it wants to receive notifications, by using the Subscribe message.

The User Awareness Module

If an event of interest for a particular place occurs when the user is not connected to the system, such user has no awareness about what has happened, and therefore has no information about that. Hence, we decided to provide our system with an asynchronous notification facility, that enables the user to have the full control on what happens, even when it is not connected. For this reason, our system allows the user to specify places and scenarios which he/she intends to monitor, as well as the events of interest.

When an event in a place of interest occurs, the user is notified as quickly and reliably as possible about that, in order to appropriately manage such a situation. The notification, must reach the user in an ubiquitous way. For this reason, we think that GSM network coverage is a fairly realistic assumption, so our system sends to the user a notification message through the SMS system. However, in some particular circumstances, the user may not be connected to the cellular network and may only use a local data network (such as W-Fi). Therefore, our system uses as a notification method, at the same time, the one based on SMS and the other based on e-mail. The notification message, includes all the information defining the event, along with any other useful thing to remedy it in the most appropriate and quick way. In order to guarantee the user awareness about the monitored scenarios, we enable our system to semantically interpret detected objects behavior.

The system we propose is autonomously able to identify and learn from events and occurring interactions, that take place in a given monitored environment [START_REF] Valera | Intelligent distributed surveillance systems: a review[END_REF]. In particular, we provide our system with a component dealing with the so-called Computer Vision, which allows video processing, real time scene recognition with related data analysis and decision making with respect to them [START_REF] Hartley | Multiple view geometry in computer vision[END_REF], [START_REF] Forsyth | Computer vision: a modern approach[END_REF], [START_REF] Parker | Algorithms for image processing and computer vision[END_REF], [START_REF] Moeslund | A survey of computer vision-based human motion capture[END_REF], [START_REF] Cucchiara | Computer vision techniques for PDA accessibility of in-house video surveillance[END_REF]. We implemented the Computer Vision module through the use of the Open Source Computer Vision (OpenCV ) library [START_REF] Bradski | The OpenCV library[END_REF], [START_REF] Bradski | Learning OpenCV: Computer vision with the OpenCV library[END_REF]. OpenCV is a library of programming functions, mainly aimed at real-time Computer Vision and is released under the BSD license. The Computer Vision, can be considered as a process constituted by a number of phases that may vary, depending on the operating scenario and the specific system application domain. Such phases, can be typically grouped into four main blocks, which are image preprocessing, object recognition with motion detection, object monitoring and reasoning with activity recognition [START_REF] Wijnhoven | Flexible surveillance system architecture for prototyping video content analysis algorithms[END_REF], [START_REF] Cucchiara | Detecting moving objects, ghosts, and shadows in video streams[END_REF], [START_REF] Buxton | Visual surveillance in a dynamic and uncertain world[END_REF], [START_REF] Hu | A survey on visual surveillance of object motion and behaviors[END_REF].

In the preprocessing phase, the image sequence produced by one or more camera(s), is processed by our Computer Vision module in order to ensure resampling, noise reduction, contrast enhancement and scale space representation. The recognition phase, instead, finds an object within an image or video sequence, also when such object is partially obstructed from view. In particular, in such phase, image features as lines, edges and ridges, along with any other localized points at various levels of complexity, are extracted in order to obtain the segmentation of one or multiple image regions which contain a specific object of interest. The motion detection phase, detects a change in position of an object relative to its surroundings or the change in the surroundings relative to an object. Object monitoring (or tracking) instead locates a moving object (or multiple objects) over time by using one or more camera(s). The main aim of such phase is to associate target objects in consecutive video frames. It is important to point out that the association can be especially difficult when the objects are moving fast relative to the frame rate, or when the tracked object changes orientation over time. In order to manage such situations, our system employs a motion model which describes how the image of the target might change for different possible motions of the object. The last Computer Vision phase implemented by our system is the activity recognition, that is, the process of recognize actions and goals of one or more actors from a series of observations on their actions and environmental conditions. After such phase, if a potential situation of interest for the mobile user is detected, then the system triggers the notification module which takes care of notifying users about the events of interest. Such a component, dealing with the user notification, is composed by two modules, the former takes secure and efficient delivery of SMS messages, while the latter takes care of sending e-mail messages. It is easy to note that the portable device, when it is joining the system, it must provide one or more e-mail addresses, along with one or more telephone numbers, by which it intends to be notified. In Figure 2, we show the various components which constitute the user situation awareness module, along with its flow of events. Video streaming, acquired from different camera(s) connected to each node of our system, is continuously analyzed by the corresponding module responsible for the Computer Vision process. As soon as such module detects, based on how it has been trained by, the occurrence of a certain situation of interest, it provides the user with an overview of the situation that has arisen, through an appropriate alert message, which is sent either by SMS and through e-mail.

The Security Services

It can be easily observed that due to its mission critical nature, any surveillance system is particularly exposed to security problems [START_REF] Castiglione | Do You Trust Your Phone[END_REF], especially because of the scenarios where it has to operate. In detail, such type of system, may be subjected to several types of threats, such as eavesdropping, data modification, IP address spoofing, Denial-of-Service (DoS ) [START_REF] Naoumov | Exploiting P2P systems for DDoS attacks[END_REF] and man-in-the-middle attacks [START_REF] Wallach | A survey of peer-to-peer security issues[END_REF], [START_REF] Urdaneta | A survey of DHT security techniques[END_REF], [START_REF] Wang | Attacking the KAD network[END_REF]. However, the absence of single point of failure, and hence of elements which may become an easy target for DoS attack, makes the proposed solution sufficiently robust, because of Kademlia, due to its decentralized architecture that is the only critical component for the overall system operations, is resistant against most of the known DoS attacks.

Moreover, in relation to the environments in which it operates, our system may be particularly vulnerable to compromised-key attacks, carried out by using social engineering techniques. In order to avoid, or at least to limit such kind of attacks, we must take into account the interaction among all the system parties, in particular we consider the one among the various nodes and the other between a node and a portable device. In order to ensure security during the access to the Kademlia overlay information exchange infrastructure, we have chosen to use cryptographic functions provided by maidsafe-dht library [START_REF] Irvine | Kademlia DHT with NAT traversal[END_REF]. Such library, introduces a strong encryption layer to ensure secure operations within the DHT overlay. It also ensures to our system NAT traversal capabilities, TCP emulation for fault tolerance, routing of queries through low-latency paths as well as use of asynchronous and parallel queries to avoid timeout delays from failed nodes. Furthermore, maidsafe-dht also includes some significant enhancements to the traditional Kademlia implementation, by providing a downlist modification with notification of dead nodes in searches as well as forcing partner bucket to contain the most recent closest nodes, in order to further increase the reliability of the whole DHT system.

Instead, regarding the interaction among a node and a portable device, our system uses the Transport Layer Security (TLS ) protocol, which ensures security and privacy for stream-oriented communications. We also paid particular attention to security concerning user notifications about situations of interest.

In particular, security properties of component which deals with SMS based notification, rely on the SEESMS architecture (Secure Extensible and Efficient SMS ) [START_REF] Castiglione | Engineering a secure mobile messaging framework[END_REF], initially presented in [START_REF] De Santis | An Extensible Framework for Efficient Secure SMS[END_REF].

SEESMS is a framework for the exchange of secure SMS, which aims to be efficient through the support of several cryptosystems by using a modular architecture, as it is shown in Figure 3. In particular, it is important to point out that the SMS notification module of our system is implemented by using the Secure SMS Management Center of SEESMS, while the SEESMS client is included tioned surveillance architecture, with an emphasis on the use of currently available COTS devices and open-source components. The testing was carried out on three surveillance nodes connected to the network in a stable way, along with three other ones which dynamically connect and disconnect from it. Each node used for the functional testing operations, consists of conventional PCs with different hardware characteristics, each one controlling a single camera, interconnected through a Local Area Network (LAN). We also used several common portable devices (smartphones and tablets), connected to the network in different ways, ranging from Wi-Fi LAN connections to 3G/UMTS ones, provided by traditional cellular Internet service providers.

In general, our preliminary functional tests, shown that, by dynamically varying the number of its parties as well as the amount of data exchanged, our system continues to behave correctly and is essentially not affected from the above events, both in terms of performance and efficiency. We point out that, due to the self-organizing nature of its basic association mechanism, the system tends to be highly reliable. The resources exposed from surveillance nodes dynamically joining the P2P network, become correctly available to portable devices almost immediately after the successful connection and registration of the corresponding information. Search operations on the overlay DHT by the mobile nodes, are carried out instantaneously and are resilient to multiple node failures until other nodes are able to respond about a specific key. However, this feature can be useful only in presence of different surveillance nodes controlling the same camera(s), according to an architectural scheme which introduces redundancy at the surveillance node level, since in presence of a single node controlling a set of camera(s), its failure implicitly isolates all the associated devices.

The portable devices we used, including those with limited hardware features, showed for access, monitoring and control of recorded data, a response time in the order of a few milliseconds. Also the notification task, appears to be very lightweight and well tolerated by portable devices. For measuring the response time which concerns detection and notification of interesting events, we configured the system in order to make it able to recognize and notify the user about the occurrence of common situations, such as the entrance of people into a given environment or the move of an object. We also empirically evaluated the time elapsed since the detection of an event by a node, until the receipt of a notification by the portable device. Such time, may vary from one to ten minutes, depending on the complexity associated to the detection and understanding of the occurred event. However, the asynchronous notification task, affects that time only by a negligible factor. The security of our system, was assessed by subjecting it to several attacks, carried out through exploits and tools for sniffing (e.g., Wireshark) and man-in-the-middle (e.g., Ethercap) attacks. In addition, we also used a vulnerability scanner (Nessus) to asses the whole testing network where the surveillance nodes have been located. The system has been found to be sufficiently secure, with respect to the analysis carried out by using such tools.

The system we propose, ensures to the mobile user a complete awareness about the scenarios under consideration, over the whole P2P-based surveillance organization. The user awareness module, combines together video analysis, intelligence and ability to cope with real-time events of interest.

Our system, guarantees to mobile users, real-time monitoring of scenarios and notification about relevant events as soon as they occur, always by paying particular attention to all the security issues that may arise. In the future, we intend to provide our system with a Web-based interface, which enables the uniform access to its services, thus avoiding the use of a specific client for that purpose. Furthermore, in order to improve the efficiency of data exchange, we plan to use data compression techniques over the communication channel among the portable device and the surveillance node.

We also plan to take advantage of new features provided by the "Smart Cameras", and in general by the "Embedded Smart Devices", especially to alleviate the computational load that each node must handle, considering the number of operations it performs. Our further aim, is also to improve the system security, by involving biometric techniques, smart cards and trusted hardware modules, in order to prevent compromised-key attack and threats from insider, due to social engineering techniques. Moreover, we intend to store some interesting data acquired, and to protect them by using an Attribute-Based Encryption Scheme, which permits the fine-grained access control over them [START_REF] Goyal | Attribute-based encryption for finegrained access control of encrypted data[END_REF]. We think that, it would be particularly interesting to provide each node also with different types of sensor(s), such as detectors for smells (to prevent gas leaks), vibrations (for earthquakes) and noises (to help the system in low light conditions).

Finally, it may be useful to use optimization algorithms, for the exact positioning of camera(s) and sensor(s), according to the specific monitored place. By adding such new features, we intend to create an even more intelligent system, which enables the user to have an additional support, concerning not only the monitoring, but also the deployment of camera(s) and sensor(s).

Fig. 1 .

 1 Fig. 1. The overall system architecture and the components interaction

Fig. 2 .

 2 Fig. 2. The user awareness module

within the portable device. Such framework, represents a tool which uses an SMS based communication mechanism to exchange encrypted, non-repudiable and tamper-proof messages. One of the main advantage of SEESMS over similar systems, is the possibility to choose which combination of cryptosystem/security parameters to use during message exchange. Moreover, one of the two parties (node or portable device), could set a minimum security level to be fulfilled during the communication, giving the other peer the possibility to increase (but not decrease) it. From an architectural point of view, as can be seen from Figure 3, the flexibility of SEESMS has been made possible by the adoption of a modular architecture, where the cryptographic functions of the framework are not built into SEESMS, but are delegated to some external pluggable modules.

On the other hand, with respect to the security of e-mail based notification, we chose to rely on the Secure/Multipurpose Internet Mail Extensions (S/MIME ) standard [START_REF] Ramsdell | S/MIME version 3 message specification[END_REF], in order to use X.509 certificate for signing and encrypting each e-mail notification message sent. By doing this, we intend to guarantee identification (authentication), confidentiality, integrity and non-repudiation of all the notification messages sent, in order to avoid fake alerts to be maliciously sent to the monitoring users.

Proof of concept and functional evaluation

We engineered a very simple proof-of-concept prototype of our system in order to validate its functional behavior and test the effectiveness of the aforemen-


Francesco Palmieri
email: fpalmier@unina.it

Ugo Fiore
email: ufiore@unina.it

Aniello Castiglione
email: castiglione@ieee.org

Fang-Yie Leu

Alfredo De Santis

Analyzing the Internet Stability in Presence of Disasters

Keywords: Internet Resilience, BGP, Disasters, Critical Infrastructures, Catastrophic Events

The Internet is now a critical infrastructure for the modern, information-based, e-Society. Stability and survivability of the Internet are thus important, especially in presence of catastrophic events which carry heavy societal and financial impacts. In this work, we analyze the stability of the inter-domain routing system during several large-scale catastrophic events that affected the connectivity of massive parts of the address space, with the objective of acquiring information about degradation of service and recovery capabilities. Results show that the Internet has maintained good responsiveness: service disruption has been contained and recovery times have been fast, even after catastrophic events. However, combining the view provided by the routing table and the view originated by the analysis of the BGP updates is not a trivial task, as such phenomena need to be analyzed at multiple time scales.

Introduction

Much of the social life is now reliant on interactions carried out remotely, and a significant fraction of these interactions happen over the Internet that assumes Corresponding author: Ugo Fiore, Information Services Center, Università Federico II, Via Cinthia 5, Napoli, I-80126, Italy -Phone: +39081676632, Fax: +39081676628, email: ufiore@unina.it the role of a critical infrastructure for the modern information-based e-Society. This is also true for money-involving applications such as financial transactions, which make heavy use of the Internet infrastructures. Disruption of service on the Internet would carry catastrophic consequences over these activities: therefore, resilience and survivability of the Internet are now extremely important aspects, both at the business level and at the governmental level.

The impact of an Internet outage on essential economic sectors may in fact be devastating for an entire country. Furthermore, to respond to emergencies in an effective and timely manner, availability of accurate information and ability to disseminate it are critical factors that both depend on the correct functioning of a communication infrastructure. The term survivability is generally referred to the ability, in the aftermath of a disruptive event, to recover and quickly return to service levels offered before. While the Internet has become a critical infrastructure, there is no comprehensive knowledge about its expected behavior during crises, particularly in terms of its survivability in presence of large-scale disruptions or failures over its fundamental transport infrastructure. Due to the distributed architecture of the Internet, there are many exchange points around the globe, owned by consortia of service providers who share costs and capacity, where a number of transmission links converge in order to connect networks operated by different organizations. In addition, there are critical connections such as undersea links, forming an essential part of the global Internet. These points and links assume the role of critical assets for the overall Internet coverage and operations, since their failure, due to fiber damage or power outages, may wreak havoc on connectivity of significant portions of the Internet. Fiber damages and power outages may be either due to natural phenomena, such as earthquakes, typhoons, and floods, or man-made disasters consequent to war or terrorist actions. Other service disruptions may originate from malware (e.g., worms) devouring all communication resources during the course of their spread throughout the Internet.

In order to achieve a better understanding of the fundamental dynamics governing the Internet behavior, one must study historical data, recorded over the last decade, that describe the state and evolution of network reachability information, and correlate such data with knowledge about the events occurred at the time data were registered. With this in mind, we analyze the stability and behavior of the routing infrastructure, whose fundamental glue is the interdomain routing system, empowered by the Border Gateway Protocol (BGP), during several large-scale catastrophic events that affected the connectivity of large regions within the Internet, in order to acquire some information about its fundamental service degradation properties and fault recovery capabilities.

In this work we limit our study to catastrophic events originated by physical causes, disregarding any kind of malicious network/traffic activity that can adversely affect the Internet operations on a large scale. We are interested in analyzing the entity of damage to Internet connectivity, its distribution across the globe, and the time needed to recover together with the effects perceived on global reachability from several observation points scattered throughout the world.

Related Work

Several experiences available in literature focus their attention on the analysis of the Internet behavior in presence of large scale infrastructure failures due to both natural or human-driven causes, such as catastrophic events or worm/malware outbreaks. The study presented in [START_REF] Li | Toward understanding the behavior of BGP during large-scale power outages[END_REF] carefully analyzed the BGP system dynamics, during a power outage that affected the connectivity of 3,175 networks in a large number of cities in the eastern United States and Canada. The 2006 earthquake in Taiwan has been extensively analyzed from the BGP point of view in [START_REF] Popescu | Quaking tables: The Taiwan earthquakes and the Internet routing table[END_REF], largely focusing on an AS-based perspective. Similarly, in [START_REF] Sahoo | Characterization of BGP recovery time under large-scale failures[END_REF] a characterization is presented of BGP recovery times under large-scale failure scenarios associated to disasters or man-made events, resulting in substantial recovery times in presence of massive failures. In addition, the work in [START_REF] Hu | Evaluating potential routing diversity for internet failure recovery[END_REF] evaluates the potentiality of BGP-compliant recovery schemes exploiting route diversity in order to recover from large-scale Internet failures. A survey on the security issues related to disasters, with emphasis on maintaining network access, is presented in [START_REF] Kiyomoto | Security issues on IT systems during disasters: a survey[END_REF]. From a more theoretical point of view, the contribution presented in [START_REF] Cohen | Resilience of the internet to random breakdowns[END_REF] studied the stability of the Internet, as a scale free network with respect to crashes, such as random removal of sites, according to a percolation theory-driven approach. The effects of other kind of events, such as large worm outbreaks on Internet stability has been analyzed in [START_REF] Palmieri | Inter-domain Routing Stability Dynamics During Infrastructure Stress Events: The Internet Worm Menace[END_REF].

Routing, BGP, and Stability

The number of services running on the Internet continually increases, and so does the network size. This continued growth challenges the capability of routing layer to produce a stable, coherent, and reasonably efficient view of the topological structure of all portions of the network. This is an essential condition for continued delivery of packets to their destination addresses.

BGP

Adjacent Autonomous Systems (ASes) [START_REF] Hawkinson | RFC1930: Guidelines for creation, selection, and registration of an autonomous system (AS)[END_REF] exchange reachability information about destination Internet address blocks, so that routers can reach a consistent topological view of the network. In turn, this allows consistent routing decisions to be taken, without generating undesirable situations such as conflicts or loops. The de-facto standard protocol for inter-domain routing is the Border Gateway Protocol (BGP). A BGP announcement (BGP UPDATE message) concerns a route, and carries a set of attributes. A mandatory attribute is the AS-PATH, indicating the sequence of ASes to be traversed to reach the listed destinations. A BGP-speaking router at an AS, passing an announcement originated at another BGP peer, prepends its own AS number to the AS-PATH. Each AS makes its own routing decisions based on several factors, including financial considerations or various agreements with other ASes: the chosen route is not necessarily the shortest one, but it is the more convenient one. BGP also provides network administrators with means to influence the routing selection process at other places. A comprehensive source of information about BGP and the network prefixes advertised and withdrawn can be found in the CIDR Report [START_REF] Bates | Submarine Cables Cut after Taiwan Earthquake[END_REF].

Routing Instability

Routing instability can be informally defined as the continuous, and sometimes rapid, change of topological information, so that network reachability fluctuates and cannot be controlled by network administrators: routes become unpredictable. While a small percentage of changes can be expected over all the network -due to normal building and maintenance operations as well as failures -instability may be localized or distributed. When a single router repeatedly withdraws some routes and re-announces them soon after, instability is localized and is then called route flapping. Here, we are considering distributed instability, measured at global or at least regional scale. To measure Internet instability, BGP routing statistics provide important data to work with. BGP statistics describe two aspects: the (global) routing table, i.e., the list of all reachable prefixes, and the number, and rates of change, of the routing information updates, i.e., prefix announcements and withdrawals in BGP UPDATE messages. Each of these aspects, if studied in isolation, offers useful information to quantify instability. Analyzing both aspects in combination can provide additional insights.

-The size of the global routing table gives an overall measure of the reachability in terms of network prefixes that are announced. Keeping in mind that aggregated prefixes will still be announced even if more specific ones are no longer reachable, reachability of specific prefixes is a more reliable indicator of instability than it is reachability of aggregated prefixes. -The number of BGP updates sent out and received per time unit is a fundamental metric in observing the dynamics of BGP, also provideing an indication of whether BGP peers need to exchange fresh information or not, perhaps as a result of changes in reachability of their connected networks or of communication problems between the routers themselves. Sudden increases in the number of BGP updates per time unit indicate an increased signaling activity and this, in turn, suggest that something is happening which is worth investigating. BGP update message may bring two different kinds of routing information: prefix announcements and withdrawals. An announcement is a network reachability message, specifying the presence of a new network (identified by its own prefix) that becomes reachable through a specific route. Each time an available route/path for a particular network changes, eventually also due to traffic engineering/management activities, a new announcement is issued from the node ensuring the reachability for that network and propagated through BGP so far. On the other hand, withdrawals happen when a given path for reaching a particular prefix is no longer preferred or available. When a route fails, in absence of other paths, the BGP peer notifies other peers that the path is no longer valid. Although backup systems or redundant routes/paths are commonly used within the Internet, we expect that a severe outage will have caused some networks to become unreachable due to the sustained nature of the outage, extending beyond backup capabilities or redundancies. BGP sessions that involve networks affected by the outage can thus be broken. When BGP routers peering with BGP routers from affected networks send out explicit withdrawals to notify other BGP routers, it will result in many withdrawal updates. The number of networks affected during the blackout directly affects the number of withdrawal updates. -The average AS-PATH length over the whole Internet is another interesting metric that can be useful to depict the degree of interconnection at the global level. Due to the basic BGP route selection criterion based on preferring the "shortest AS path", when BGP determines the path connecting two different ASes it will select the one going through the least number of hops. Hence as the degree of interconnection between ASes grows, the average AS path tends to become shorter.

While the first two metrics (routing table size and updates count) are related, they do not necessarily agree. Misalignment may result from the superposition of the effects of different events happening simultaneously or from the different frequency of data collection.

Analyzing the Internet Stability Dynamics

The simplest way of understanding the fundamental dynamics characterizing the Internet routing system during critical situations, comes from the careful observation of BGP activities, by spotting its resilience and capacity of reacting to adverse conditions. In this study, BGP data collected by the Routing Information Service (RIS) project 5 from RIPE NCC have been used. The aim of RIS is providing Internet operators information about the global routing system current state and its evolution. Routing information is gathered by means of monitoring points. The RIPE RIS project maintains seventeen monitoring points (Remote Route Collectors) in major exchange points across the world. Ten monitoring points are in Europe, four in the US, one in Brazil, one in Japan, and one in Russia. Each monitoring point is basically a BGP-speaking router that makes no announcement of its own but listens to (and records) announcements from its peers. Both BGP updates and routing table dumps are collected and stored. Recall that routing decisions stem from the combination of several factors, which are dependent of the geographical location, the ASes involved, their relationships with other ASes and Tier-1 providers, and financial agreements. Thus, having more than one monitoring point means being able to observe a multifaceted phenomenon (the routing system) from different perspectives and situations. Analysis of routing information collected at each BGP monitoring point can provide a great deal of information about the view that organizations at the collection point have of the Internet. By studying how this information evolves over time, insights can be obtained on the dynamics of path change, spotting trends, cyclic behavior, and periods of instability. In particular, we are interested in detecting, in correspondence of well-documented catastrophic events, compatibly long periods of growth and decay in the routing table dimensions and prefix announcement/withdrawal rates across multiple observation points, indicating a significant and widespread degradation in the overall connectivity and functional behavior of large sections of the Internet.

The advantage of having the monitoring point at a peering point is that the views of all the participants to peering may be observed and combined together. In particular, routing instabilities, even of considerable extent, that are localized to a single AS can be isolated from global failures that affect large portions of the Internet. The updates are collected with an interval of 5 minutes. The routing tables are instantaneous snapshots of the routing tables saved every 8 hours. The amount of data collected in a single monitoring point ranges from about 30 MByte/day for the updates to about 30-60 MByte/day for the routing tables.

It is useful to have a unified view of both the routing tables and the updates with the same sampling interval. Updates have thus been aggregated over the same interval of the routing tables, i.e., 8 hours. A side effect of this aggregation is that the effects of transient phenomena tend to be diluted, since these phenomena are unlikely to span 8 hours or a significant fraction of that time. Occasional router malfunctions, data losses, link saturation, or router reloads affecting either the BGP speakers or the monitoring point, may in fact produce sudden apparent increases or decreases in the number of updates, thus raising false signals of instability that are unrelated to the disruptive effects of the events under observation. The smoothing effect of aggregation will reduce the influence of short-lived glitches, privileging large-scale changes. In addition, observing on a larger time scale will also reduce the effects of time synchronization issues. Unfortunately, in global-scale BGP analysis the observations are aggregated over all networks, and when the amount of BGP updates associated to the event of interest is only a very limited part of the whole baseline update activity propagating throughout the Internet, the statistical variations in the overall update rate introduced by the event of interest may be difficult to appreciate. In this case, in order to pinpoint the specific update activities related to the prefixes really affected from the event, refocusing out attention by restricting the analysis only on the prefixes of interest, to observe the BGP behavior at the individual prefix level becomes of fundamental importance. This can be accomplished by geographically referencing the update data and observing them on a contextualized scale. That is, the updates have been mapped, depending on their prefixes, on a worldwide map to allow an observation of the involved phenomena based on geographical localization criteria. In order to refine our observations, we analyzed the BGP activity data collected before, during, and after the events of interest, so that the observations before the event can be used as a baseline of the assumed normal behavior. That is, routing tables and updates were collected for analysis over a time window starting three days before the day the critical event occurred and ending three days after. This allows an enough long time to observe the smoothing recovery. Since data have been collected also before critical events, by averaging over three days, it is possible to obtain a more smoothed baseline depicting the state of the network immediately before the event, to be compared with the one visible after the event. So the extent to which the situation returned to normality and the speed of this process can be evaluated. For each event, thus, 21 snapshots of the routing table (i.e., 7 days) and 2016 files containing updates have been analyzed.

The Events of Interest

The catastrophic events analyzed are different in nature, amplitude of the affected region, duration, and presence/absence of alternate routes. For example, a long-lasting blackout determines the outage of large areas and their address blocks, while a cable failure only involves the connected endpoints and the mutual reachability of networks that were using that connection, provided that no other path existed between them. The events analyzed are reported in Table 1. The significance of discussing two events of the same type (earthquakes) is that in one case the effects were more limited, because there were alternative routes available for many networks. Availability of Internet connection had indeed been, in that circumstance, an important factor for speeding up and coordinating rescue efforts to aid people who were affected in the disaster.

Results and Discussion

Earthquake in Taiwan

An earthquake off the southern coast of Taiwan, approximately 22. addition to Taiwan, also Malaysia, Singapore, Thailand and Hong Kong. Telephone and Internet problems were reported in Taiwan, South Korea, China and Japan. Eight submarine cables (see Fig. 1) were severed after the earthquake and its aftershocks, all of which were above magnitude 5 of the Richter scale. Some of the submarine networks affected had backup paths that helped limit the extent of damage. The diversion of all traffic over the backup links caused congestion on these links, with a perceptible slowdown of communications. Links to Europe, in particular the FLAG Europe Asia link, had no such backup available. Communications over that links were thus interrupted and a significant part of Asia near Taiwan and China went back into the pre-Internet era. The effects of these phenomena have been immediately observed on the whole Internet in terms of both BGP update activity and reduction of the available number of prefixes in the routing table (see Figures. 2 and3). After all the strong aftershocks, the number of routes plummeted by about 800 in NY (Fig. 2(a)) and 1500 in Moscow (Fig. 2(b)).

Fig. 4 displays the number of IP addresses that became unreachable and at their geographical location. A yellow tint on a country indicates the loss of a small number of IP addresses originating from that country; orange means a moderate loss, and red a significant loss. The number of IP addresses shown in Fig. 4 are measured from a monitoring point in Europe. Looking in detail at Fig. 4, one may observe how a noticeable number of IP addresses from India became unreachable from Europe, as well as some from other countries along the FLAG Europe Asia cable. A large number of IP addresses lost came from the US. This can be explained because the coloring reflects the absolute, not the relative entity of loss. This, combined with the higher number of addresses originating from the US as compared with other countries, suggests that the US can be expected to exhibit a intense shade in the graphs.

Finally, we remark that, interestingly, the average AS-PATH length has stayed steadily at the value 5 across all the analyzed time span. Looking at data more closely, the average AS-PATH length had been equal to 4 (instead of 5) for two 8-hour intervals (24/12/2006-2355 and 25/12/2006-0755), but these intervals preceded the earthquake. In conclusion, the global degree of network interconnection, as seen at the monitoring point, has undergone no significant variation.

Earthquake in Japan

On March 11, 2011, a tsunami, unleashed by one of the strongest earthquakes ever measured (magnitude 9.0), devastated the eastern coast of Honshu island, in Japan. Waves as high as 11 meters slammed the coastline and surged inland for several kilometers before retreating back to the sea carrying huge amounts of debris. The wave raced forward at speeds up to 800 km/h and was felt on the other side of the Pacific Ocean.

Casualties and property damage were, unfortunately, dramatic. However, from BGP data one may see that most of the local and transit connections to the Internet stayed stable. In particular, observing the routing table size from most of the collectors no significant falls in the number of routes can be observed in correspondence with the heart quake (see the Amsterdam collector data in Fig. 5(b) as an example). In this case, Internet availability might well have been a factor that facilitated rescue operations. The seas around Japan are a major hub Fig. 4. Earthquake in Taiwan: IP addresses unreachable from the monitoring point for undersea telecom cables, and a lot of redundant paths are available for the connections attaining to such area. While some undersea cables were damaged, other links stayed active. Though overloaded, those links provided Internet connectivity between the strained Japan and the rest of the world. However, 1969 distinct routes were withdrawn soon after the event, but within the next 8 hours they became available again, and this effect has only been appreciable on the NY collector (Fig. 5(a)).

While our analysis shows that in some places of the world route reachability metrics were not affected in a perceivable way during the event, a significant BGP update activity, in particular in terms of BGP announcements, mainly due to network engineering/rerouting operations has been observed (see Fig. 6). The number of announcements (Fig. 6(a)) grows much more than the number of withdrawals (Fig. 6(b)). There are two reasons for that. The first reason is that the only cancellations that give raise to withdrawals are those where no alternate path is available, whereas in the other case the backup path is simply advertised for the original prefix, thus substituting the previous route. The other reason is that network engineering activities aimed at restoring connectivity, started soon after the disaster had been detected and spanning the following hours, may have created new paths by temporarily relaxing policy-based constraints. This behavior is similar to the other monitoring points. Graphs displaying withdrawals have been omitted to save space.

By analyzing Figure 7(a), one can see that the number of IP addresses that became unreachable was massive. Japan was heavily struck, with 13,4 million IP addresses through 72 routes unreachable from the monitoring point. Note, however, that the monitoring point for Fig. 7(a) is located in in the US, while

Blackout in the US

The last event that has been selected for the analysis is the blackout that hit Southern California, USA, on September 8, 2011. The reason why the blackout was chosen is that it represents an event of different nature. It is thus interesting to study its effects and the similarities and differences with respect to the earthquakes discussed above. The massive power outage left more than 8 million citizens without power, also disabling the telephone system, and most wireless phone service, putting people at a severe informational disadvantage [START_REF] Cerf | Natural Disasters and Electric Infrastructure[END_REF]. San Diego Gas & Electric claimed that the replacement of faulty equipment at a power substation in Arizona triggered a chain of events that eventually shut down Southwest Powerlink, one of the two major transmission links that connect the San Diego area to the electrical grid for the western United States. Looking at Fig. 8, a plunge of about 2000 routes is evident. In addition, the loss is gradual, especially as compared with the sudden declines visible in Figures 2 and5. Possibly, this behavior is due to portions of the network turning unreachable only after the exhaustion of backup power systems, therefore not immediately after the outage but some hours later. As it has been said earlier, analysis of the updates shows, remarkably, substantially similar results for all the events under consideration. From Fig. 9, it is clearly evident that at the time of the event, the number of withdrawals undergoes a sharp increase, which is unsurprising. However, another peak preceded the event and some oscillatory behavior is visible after it. This suggests that other failures, possibly originated elsewhere in the world, were present at the same time. Also in this case, the average AS-PATH length has not been affected at all by the event, indicating the absence of global degradation in the Internet connectivity within the interested area.

Conclusions and Future Work

An analysis of Internet routing statistics when disasters occur, and immediately after, has been performed in this work. Catastrophic events have been selected for study because they are well documented, and usually there is a wealth of information related to their effects. After gathering BGP statistics and preprocessing data, the number of routes and geo-localization of IP addresses that have become unreachable have been studied. Data show how catastrophic events impact on the reachability of network prefixes, the extent of damages to the Internet global connectivity, the geographical location of the most heavily struck addresses, and the time needed to recover.

Directions for future research include investigation on the degree of correlation, for the same event, between measurements taken at different monitoring points. Moreover, an evaluation of the behavior of BGP updates observed at several time scales would provide interesting insights about the dynamics of the update process.

Fig. 1 .

 1 Fig. 1. Earthquake in Taiwan: Affected undersea cables [10]

Fig. 2 .

 2 Fig. 2. Earthquake in Taiwan: Routing Table Sizes from NY (a) and Moscow (b) collectors

Fig. 3 .

 3 Fig. 3. Earthquake in Taiwan: updates from NY collector: Announcements (a) and Withdrawals (b)

Fig. 5 .

 5 Fig. 5. Earthquake in Japan: Routing Table Sizes from NY (a) and Amsterdam (b) collectors

Fig. 6 .Fig. 7 .

 67 Fig. 6. Earthquake in Japan: updates from NY collector: Announcements (a) and Withdrawals (b)

Fig. 8 .

 8 Fig. 8. Blackout in the US: Routing Table Sizes from NY (a) and Moscow (b) collectors

Fig. 9 .

 9 Fig. 9. Blackout in the US -updates from Moscow collector: Announcements (a) and Withdrawals (b)

Table 1 .

 1 The considered events.

	Type	Location Date
	Earthquake Taiwan 27 Dec 2006
	Earthquake Japan	11 Mar 2011
	Blackout	USA	08 Sep 2011

https://labs.ripe.net/datarepository/data-sets/routing-information-service-ris-rawdata-set

Acknowledgements

The authors gratefully acknowledge Mr. G. Lanciato for his precious support in data collection.


Jung-Chun Liu
email: jcliu@thu.edu.tw

Fang-Yie Yi-Li Huang

Leu

Ilsun You
email: ilsunu@gmail.com

Feng-Ching Chiang

Chao-Tung Yang
email: ctyang@thu.edu.tw

William Cheng

Chung Chu
email: cchu@thu.edu.tw

A Multiple-Key Management Scheme in Wireless Sensor Networks

Keywords: Multi-key management scheme, Key distribution server, Newly joining node, Shared key, Wireless sensor network, An incrementally constructed system

In a wireless sensor network (WSN), in order to provide a secure communication environment for all the sensor nodes, we often securely authenticate network nodes and protect all the messages delivered among them. When a sensor node (or simply a node or a sensor) newly joins a WSN, it is required for the Key Distribution Server (KDS) to distribute those generated security keys to this node and all the existing nodes before they can securely communicate with each other. But due to the wireless nature, when a node broadcasts a message M, all its neighbors can receive M. To securely protect this message, a security mechanism is required. Therefore, in this paper we propose a Multiple-key Management Scheme (MMaS for short), in which a sensor N receives two sets of keys from the KDS when the system starts up. The first set, named communication keys, is used by N to securely communicate with its neighbor sensors; the other, called the individual key, is employed to encrypt messages delivered between N and the KDS. When N would like to communicate with another node, e.g., M, they exchange their IDs with each other so as to correctly identify their common keys (CKs), which are used to individually generate a shared key (SK) on both sides for encrypting/decrypting messages transmitted between them. When N leaves the underlying network, the CKs currently related to N can be reused by a newly joining sensor, e.g., M. However, when M joins the network, if no such used ID is available, M will be given a new ID and CKs by the KDS. The KDS will encrypt the CKs, that will be used by an existing node H to communicate with M, with the individual key of H so that only H rather than M can correctly decrypt the CKs, with which to securely communicate with M. The security analysis shows that the proposed system is secure.

Introduction

Wireless sensor networks (WSNs) are envisioned to be widely applied to commercial and military applications [START_REF] Durisic | A Survey of Military Applications of Wireless Sensor Networks[END_REF], such as target tracking, health-care [START_REF] Shen | A Smart Gateway for Health Care System Using Wireless Sensor Network[END_REF], environmental monitoring [START_REF] Kong | Development of Data Video Base Station in Water Environment Monitoring Oriented Wireless Sensor Networks[END_REF] and homeland security. However, some applications require certain security mechanisms to verify the source of a message and protect the integrity of transmitted data from being maliciously modified. In order to securely authenticate a network entity and deliver messages, a secure communication environment is required.

To build a secure sensor network, Wuu et al. [START_REF] Wuu | Quorum-based Key Management Scheme in Wireless Sensor Networks[END_REF] proposed a Quorum-based Key Management Scheme. But it has a problem in sensor node addition since the number of sensor nodes (or simply sensors or nodes) must be odd. So each time at least two sensor nodes must be added. Furthermore, when two nodes are newly added to a sensor network, the shared keys (SKs) of some existing sensor nodes are changed. We will show this later. This may crash the normal operation of the whole system.

Generally, an asymmetric cryptographic technique generates many large numbers to encrypt keys and delivered messages. But this is infeasible for WSNs, since sensor nodes are often powered by battery and provided with very limited processing capability. Therefore, to achieve high security and support sensor node addition functionality, by which extra nodes can be easily added to a sensor network, in this study we propose a symmetric cryptographic technique, named the Multi-key Management Scheme (MMaS), based on a n × n key matrix K, different parts of which are distributed among sensors. Further, due to the fast advancement of hardware technology, memory equipped in sensors is cheaper than before and the size of a WSN grows rapidly in recent years. This further makes MMaS feasible in practical applications.

Related Works

Various key pre-distribution schemes used to establish secure channels for wireless sensors have been proposed in literature [4][5]. The key pre-distribution scheme of Cheng et al. [START_REF] Cheng | Efficient Pairwise Key Establishment and Management in Static Wireless Sensor Networks[END_REF] used a √n × √n matrix as a key matrix to assign keys to sensors, where n is the total number of sensors in the system. Fig. 1 illustrates an example of a key matrix in which the intended network size is n. The scheme has two phases: the key pre-distribution phase and pair-wise key setup phase. At first, the KDS randomly selects n keys from its key pool, in which there are more than 2 20 distinct keys, and uses the n keys to construct an m x m key matrix K, where m = √n . The KDS assigns an element of this matrix, e.g., Ki,j, as the sensor's ID, and the other entries on the ith row and jth column as the sensor's keys, implying that the matrix is indexed by the IDs of these involved sensors. It also means that this scheme provides the largest maximum supported network size since each element of the matrix represents one sensor node. When a sensor M would like to communicate with another sensor, e.g., N, it identifies the CK indexed by M and N and uses it to encrypt messages. As stated above, Wuu et al. [START_REF] Wuu | Quorum-based Key Management Scheme in Wireless Sensor Networks[END_REF] proposed a Quorum-based Key Management Scheme, in which the KDS as shown in Fig. 2 generates a ⌊n 2 ⁄ ⌋ × n key matrix K and establishes a quorum system S based on K, where each sensor, e.g., j, has the entire column j of matrix K and ⌊n 2 ⁄ ⌋ other elements, each belonging to one of the ⌊n 2 ⁄ ⌋ columns after column j, meaning that each sensor has n -1 elements, i.e., K i,j , 1 ≤ i ≤ ⌊n 2 ⁄ ⌋, and K i,j+i mod n , 1 ≤ i ≤ ⌊n 2 ⁄ ⌋, 1 ≤ j ≤ n. As shown in Fig. 3, after the deployment of sensors, two arbitrary sensors, e.g., A and B, both can individually identify the CKs assigned to them so that they can mutually authenticate and communicate with each other. In this scheme, node addition is feasible only when some existing IDs that are not in use available. Also, when nodes A and B newly join the WSN, as shown in Fig. 4, the SKs of some nodes will be changed. For example, originally the CK of nodes 1 and 5 was K1,1. But after sensors A and B join the network, the CK of nodes 1 and 5 becomes K4,5. After that, the normal operations of the system will be destroyed.

The Proposed Scheme

The MMaS consists of four working phases: the key pre-distribution, shared key establishment, key refreshment, and data transmission phases. In the key pre-distribution phase, the KDS generates a n × n key matrix, in which the keys are random numbers. After that, the KDS assigns these keys to sensors during the deployment of sensor nodes. Before communicating with each other, each pair of sensors needs to identify the other's CKs and then generates the SK in the shared key establishment phase. When the sensor, e.g., M, joins the network, the KDS broadcasts the ID, i.e., M, and the related CKs, and the system enters its key refreshment phase, in which the receiving sensor accordingly updates its key information. In the data transmission phase, sensors transmit data to their neighbors, and check to see whether a received message is sent by a legal sensor or not.

Key pre-distribution phase

Each sensor i has two sets of keys. The first set, named communication keys (row i and column i together are called key-cross i), is used to perform one-to-one communication between two sensors by using the computed SK. The other one, called individual key, e.g., k i,i , is the key employed by sensor i to communicate with the KDS where K i,i is the i th element along the diagonal of the key matrix. The steps of the key pre-distribution phase are as follows:

Step 1: the KDS generates 𝑛 2 random numbers to establish the 𝑛 × 𝑛 key matrix K.

Step 2: the KDS assigns an ID, e.g., i, which is also the index of key K i,i , 1 ≤ 𝑖 ≤ 𝑛, and two common keys K i,j and K j,i (see Fig. 5), 1 ≤ i, j ≤ n, to a sensor. After that, sensors i and j can securely communicate with each other by encrypting those messages exchanged between them with the SK derived from K i,j and K j,i . As stated above, the individual key of sensor i, i.e., K i,i , 0 < 𝑖 < 𝑛, is used to encrypt messages delivered between sensor i and the KDS.

Fig. 5 The KDS generates the n × n key matrix K, in which [K 1,i , K 2,i ,⋯ ,K i,i ,⋯ ,K n,i ] and

[K i,1 , K i,2 , ⋯ , K i,i , ⋯ , K i,n ]
are assigned to sensor i.

Dynamic shared key establishing phase

After the deployment of sensors, when sensor A would like to communicate with sensor B, it sends his own ID, i.e., A, to B. With the two IDs, both side can individually identify the CKs K A,B and K B,A , 1 ≤ A, B ≤ n.

Before authenticating node B (node A), node A (node B) generates an authentication message AuthA (AuthB) which contains the result of a hash function with the concatenation of the CK, i.e., K A,B (K B,A ), and a random number randA (randB) as its parameter where,

AuthA = H(K A,B ||randA) (1)
and

AuthB = H(K B,A ||randB) (2)
After that, A (B) delivers the message it generates, i.e., AuthA (AuthB), and randA (randB) to B (A). On receiving AuthB and randB, node A retrieves K B,A from its own common keys and invokes Eq. ( 2) with the concatenation of the retrieved K B,A and the received randB as its parameter to calculate AuthB, denoted by AuthBc, and then checks to see whether the received AuthB, denoted by AuthBr, is equal to AuthBc or not. If yes, meaning B is a legal one, it retrieves the common keys K A,B and K B,A from its own key array and generates the SK, where

SK = K A,B ⊕ K B,A (3)
In fact, node B does similarly. But the invoked Equation is Eq. ( 1) and the checked equation is AuthA c = AuthA r . If they are equal, B generates SK also by invoking Eq. (3).

Key refreshment phase

There are two cases which call for key refreshment. One is when a sensor leaves or joins the network; the other is when CKs of two sensors have been used in communication over a threshold of number.

When a sensor N leaves the network, the KDS broadcasts N to the remaining sensors. On receiving the information, a sensor will no longer communicate with N. In fact, this ID is now available and can be reused. When a sensor, e.g., M, newly joins the network, it faces two situations: with or without an available used ID in the underlying network.

1. If the situation "with an available used ID" occurs, the KDS assigns the ID to M and generates CKs, denoted by KM,N and KN,M, used by M and an existing sensor N to communicate with each other, 1 ≤ M, N ≤ n, M ≠ N.

2. If the situation "without an available used ID" occurs, the KDS will generate a new ID and the corresponding KM,N and KN,M. After that, the KDS broadcasts a message containing M's ID and those generated KM,N and KN,M, 1 ≤ N ≤ n, to all sensors. In this message, the CKs deliverd to sensor N is encrypted by K N,N so that only sensor N can decrypt the CKs sent to it. In our scheme, the addition of M (maybe M = n + 1 or 1 ≤ M ≤ n) does not change those SKs currently used by existing sensors.

The format of this broadcasted message is shown in Fig. 6, in which a sensor ID, e.g., N, is followed by the common keys, i.e., KM,N and KN,M, needed to be updated by sensor N. Upon receiving this message, sensor N sequentially searches the ID field. When ID = N as the head field of sensor N is identified, sensor N decrypts the common keys conveyed in fields following the head field, and accordingly updates its key matrix.

For example, if ID = 1, the following two fields are K1,1⊕randn+1,1 and K1,1⊕rand1,n+1 where randn+1,1 is Kn+1,1 and rand1,n+1 is K1,n+1. Only the legal KDS has the right individual key to encrypt the two fields, and only the legal sensor, i.e., sensor 1, which has K 1,1 , is able to decrypt the two fields. Moreover, after obtaining rand n+1,1 and rand 1,n+1 , sensor 1 compares the (rand n+1,1 ⊕ rand 1,n+1 ) generated by itself with the fourth field from the head field to see whether they are equal or not. If yes, the message is authenticated. When the number of communication between sensors A and B is over a predefined threshold, due to security consideration, A and B need to refresh the CK in their upper triangle of K, i.e., KA,B (without changing KB,A), by executing the following key refreshment steps under the assumption that A < B.

Step 1: Input the CK, i.e., K A,B , which is in the upper triangle of the key matrix K, to a predefined hash function to produce a new key, e.g., K′ A,B , where

K′ A,B = H(K A,B ) (4)
Step 2: Compute the new shared key SK' where

SK′ = K′ A,B ⊕ K B,A (5)
Step 3: Store the SK' as the new shared key in its local variable.

Data transmission phase

After completing the authentication, two sensors can communicate with each other by sending a message, the format of which is shown in Fig. 7.

ID msg⊕SK HMAC

Fig. 7 The format of a data message When receiving this message, a sensor computes the hash value HMAC = H(ID||msg ⊕ SK, SK)and checks to see whether the value is equal to the one conveyed in the received message or not to ensure data integrity of the message where msg is the data that needs to be sent. Since only a legal sensor has the right SK to produce the correct hash value, if the two values are equal, the message is authenticated, meaning that the sensor sending this message is a legal one.

Security Analysis

By using shared keys and the unique individual key, K i,i , a sensor node and the KDS, or any two sensor nodes can mutually authenticate each other so as to defend attacks launched by hackers. In this section, we analyze three common attacks, including the eavesdropping, forgery KDS, and forgery sensor node attacks, and show that the MMaS can effectively defend these attacks.

Eavesdropping attack

Due to the wireless nature, messages sent by sensor nodes and the KDS can be accessed by a sensor located within the communication area of the sender. As described above, since illegal users cannot decrypt messages protected by the multiple key, i.e., SK and K i,i , the messages delivered in the data transmission phase is secure. So the eavesdropping attack does not work.

Forgery KDS attack

A forgery KDS may send fake messages intending to cheat sensors that some sensor nodes leave or newly join the network. This kind of attack can be prevented by the unique individual key, K i,i , which is only known to the individual sensor and the KDS, and is used to encrypt messages and authenticate the integrity of a message delivered between the node and KDS. Only the legal KDS has the right K i,i and only the corresponding sensors can correctly use it to decrypt the messages issued by the KDS, meaning that the MMaS can effectively defend the forgery KDS attack.

Forgery sensor node attack

If a hacker, e.g., B', disguising itself as the legal sensor B, sends data messages more than the threshold number in order to falsely trigger CK refreshment between A and B' so as to make the CKs between A and B inconsistent. He/she will be defeated by MMaS, since sensors need to authenticate each other before communication. But the faked node does not have the right CKs. The authentication will fail. Thus B' is incapable of identifying the right SK for further interaction with sensor A. By this SK authentication mechanism, legal sensors will not respond to the faked one's CK refreshment attempt used to falsely alter the keys, and the faked one cannot decrypt messages issued by a legal one because it does not own the right SK.

Conclusions and Future Studies

In this paper, we design and analyze a multiple key management scheme, with which to securely protect wireless sensor networks. To increase the resiliency of sensor networks, our scheme supports an efficient sensor-node-addition mechanism to deal with the dilemma in which when a sensor network has no available used IDs, adding extra sensor nodes will change the SKs used by other nodes and may aggravate or even crash the whole system. We also analyze and show that the proposed system can effectively defend three common attacks. The system enhances the security and resiliency of the sensor networks without conducting tremendous amount of computation and complicated asymmetric cryptographic techniques.

In the future, we would like to improve reliability and derive working models for the proposed system. To further enhance performance and reduce the size of a delivered message, we plan to devise an authentication function to substitute for the random number keys and authentication messages. In other words, we only need to invoke a function instead of issuing n authentication messages to authenticate messages. These constitute our future studies.

Fig. 1

 1 Fig. 1 An example of a key matrix

Fig. 3

 3 Fig. 3 Sensors A and B derive a common key

  Format of the message containing sensor IDs, e.g., i, and the common Keys, randn+1,1, and rand1,n+1 needed to be updated by sensor i

	ID=1	K1,1⊕randn+1,1,	K1,1⊕rand1,n+1	randn+1,1⊕rand1,n+1
	ID=2	K2,2⊕randn+1,2	K2,2⊕rand2,n+1	randn+1,2⊕rand2,n+1
			…
	ID=n	Kn,n⊕randn+1,n	Kn,n⊕randn,n+1	randn+1,n⊕ randn,n+1
	Fig. 6

Acknowledgment

The work was partially supported by TungHai University under the project GREENs and the National Science Council, Taiwan under Grants NSC 101-2221-E-029-003-MY3, and NSC 100-2221-E-029-018.