Quentin Monnet
email: quentin.monnet@lacl.fr

Lynda Mokdad
email: lynda.mokdad@u-pec.fr

Jalel Ben Othman

Data protection in Multipath WSNs

Keywords: Wireless communication, Sensor networks, Network-level security and protection

Used in areas such as pollution measurement or data gathering over battlefields, wireless sensor networks have attracted more and more attention over the last years. The deployment of such a network is accompanied by several security issues, including data confidentiality. Robust encryption algorithms addressed to network communication exist, but they do not always match the low resources restrictions -low processor, memory, limited energy -set upon the sensors. To overcome this, other, simpler solutions have been proposed, such as the Securing Data based on Multi-Path routing method, or an application of the Shamir's Secret Sharing Scheme, which both use distinct paths in the network to send pieces of data obtained by splitting the original message. This paper addresses the two methods named above, and proposes a solution based on traffic classification, using alternatively the Securing Data based on Multi-Path routing method, the Shamir's Secret Sharing Scheme, and strong encryption algorithms.

I. INTRODUCTION

Wireless sensor networks, often abbreviated WSNs, consist in sets of self-deployed small devices used to perform measurement on their immediate environment, and to forward collected data to a so-called base station through wireless communication. Sensors are supposed to have low computation capabilities, few available memory, and limited energy -to spend with care (in most cases batteries won't be reloaded). Over the last decades, the use of those networks have been introduced into a variety of application domains, including, but not limited to: pollution measurement, detection of forest fires, monitoring of thresholds of nuclear radioactivity, military communication over battlefields.

Amongst the deployed WSNs, some need to afford guaranties regarding data confidentiality. When the requirements are high, the use of strong cryptography to cipher the messages becomes unavoidable. But let's imagine an application which produces some messages of critical importance, along with trivial data. Is it worth encrypting the whole thing, knowing that encryption consumes both computational and memory resources, and costs processing time? In this article we expose in detail two existing methods based on multi-path routing and providing several degrees of confidentiality, the Securing Data based on Multi-Path routing (SDMP) and a Threshold Sharing Scheme: Shamir's Secret Sharing Scheme (SSSS). We also propose a solution based on traffic classification to assign one of the three methods -the two mentioned above, and encryption -to each packet in the network according to its level of required confidentiality (that is, to the criticalness of its content).

Each of those methods have already been presented for use in wireless networks, and in particular in WSNs. A Threshold Sharing Scheme, for example, consists roughly in splitting the message into n shares such that k or more shares out of the n leads to the message reconstruction, whereas any set of k -1 shares is unexploitable. Although the scheme was originally designed for sharing a secret between several participants, it has also been proposed for securing network transmissions. A recent suggestion is that MPLS networks security, for example, could be enhanced with this method [START_REF] Alouneh | A novel path protection scheme for MPLS networks using multi-path routing[END_REF]. By sending the n shares through n distinct paths, often available in networks based on this protocol, the transmitter ensures that an attacker observing the traffic on at most k -1 paths between the nodes will not be able to recover the message content. Similar proposals had been made for securing wireless ad-hoc networks, without MPLS, but still relying on distinct paths [START_REF] Zhou | Securing ad hoc networks[END_REF], [START_REF] Mao | A feedback-based multipath approach for secure data collection in wireless sensor networks[END_REF].

The general use of cryptography to ensure multiple aspects of privacy in WSNs has of course drawn interest from researchers, and led to the creation of many protocols, for both confidentiality [START_REF] Alzaid | Secure data aggregation in wireless sensor network: a survey[END_REF] and authentication [START_REF] Simplicio | Comparison of authenticatedencryption schemes in wireless sensor networks[END_REF]. Resistance to "denial of service" attacks, coming from the outside as well as from the inside of the network, is also a deeply investigated topic concerning WSNs security. For instance we propose in [START_REF] Ballarini | Modeling tools for detecting DoS attacks in WSNs[END_REF] a solution for detecting and reacting to compromised nodes trying to saturate bandwidth in clustered networks. To this aim, some nodes are assigned a monitoring role, which is periodically renewed so as to distribute the energy load evenly among the cluster. Also, the solution is modeled in terms of Markov chains and Petri networks. More generally, most of the identified attacks regarding WSNs and protocols designed to circumvent them are resumed in several stateof-the-art articles [START_REF] Singh | A survey on network security and attack defense mechanism for wireless sensor networks[END_REF], some being dedicated to multi-path routing solutions [START_REF] Stavrou | A survey on secure multipath routing protocols in WSNs[END_REF]. In this paper we propose a solution based on traffic classification, using alternatively the Securing Data based on Multi-Path routing method, the Shamir's Secret Sharing Scheme, and strong encryption algorithms.

The organization of the rest of the article comes as follows: in section II we present our solution based on traffic classification, and explain in detail how the application of the SDMP (subsection II-B) and SSSS (subsection II-C) methods may ensure confidentiality in WSNs. Some aspects of those methods, along with the use of "classical" encryption, are compared in section III. Finally, we conclude and give future research perspectives in section IV.

II. PROPOSED SOLUTION

A. Traffic classification

The proposed solution relies on classification of the packets according to their respective importance. The emitting node must use a traffic shaper so as to mark the packets as of low, middle or high importance. Distinction between the degrees of importance is set by the user; it may depend on the packet type (protocol in use, destination port, et caetera) as well as on the nature of carried data. Each node of the network should embed a shaper to determine the category to which its enqueued packets belong.

Once the degree of importance of an outgoing packet has been determined, it is sent with the associated method:

• for low importance packets: weak (but fast) SDMP method (see subsection II-B); • for middle importance packets: Shamir's Secret Sharing Scheme (see subsection II-C); • for high importance packets: ciphering (see subsection II-D).

B. Low importance traffic: SDMP method 1) Sending:

The SDMP (Securing Data based on Multi-Path routing) method [START_REF] Ben-Othman | Enhancing data security in ad hoc networks on based multipath routing[END_REF] basically consists in:

1) dividing the packet into n pieces; 2) "hiding" nearly all pieces with a logical exclusive OR (that is, a XOR) operation; 3) sending the pieces to the target node via n distinct paths. Of course this method requires n distinct paths to be available between the emitting node and the recipient of the packet.

The actual packet splitting for SDMP is very simple: a message of length l m is split into n pieces of length l p = ⌈ l m n ⌉. We want all the pieces to have the same length. So if l m n is not an entire value, padding must be added to the message before splitting. We obtain n pieces p 1 , p 2 , . . . , p n . Each piece p i is then "hidden" by applying to its content a XOR operation with the content of the p i+1 piece (and p n is XORed with p 1 ). There is one exception: a single piece p k , with k being a random number such as 1 ≤ k ≤ n, remains clear and will act as a "key" to recover the original message. We now have n pieces

p ′ 1,2 = p 1 ⊕ p 2 , p ′ 2,3 = p 2 ⊕ p 3 , . . . , p ′ k-1,k = p k-1 ⊕ p k , p k (unchanged), p ′ k+1,k+2 = p k+1 ⊕ p k+2 , . . . , p ′ n-1,n = p n-1 ⊕ p n , p ′ n,1 = p n ⊕ p 1 .
Each piece p i is sent over one of the n distinct paths in the network.

2) Receiving: The target node will not be able to recover the whole message unless it receives all the pieces. Starting with p k -which was sent in clear text -and p ′ k-1 , the target node will retrieve p k-1 , then p k-2 , et caetera, until all pieces p i are recovered. The last step is the reconstruction of the original message by concatenating the different pieces.

An attacker trying to intercept the exchanged message will not be able to recover the full content of the message unless it catches every single piece, which means that all the paths that were used are compromised.

3) New header: Actually, if one wants to implement SDMP, a few supplementary information must be sent along with the pieces. For each piece, the number i of the piece must be sent, so that the target node may be able to know in which order the recovered pieces must be concatenated. If padding was added to one or more pieces, it should also be indicated. A two (for instance) byte-long header containing those numbers should be added at the beginning of each piece to send.

The Figure 1 shows a concrete example of the effectuation of the SDMP method.

4) Signaling: Furthermore, the recipient node also needs to know:

• how many pieces constitute the original message;

• what the number of the "key" piece is. The number of pieces and the designation of the "key" piece form what we call the signaling for this method. It could be fixed. That is to say, the user could initially choose one value n in which to split all the messages, and one value k that would represent the "key" piece for each set of pieces resulting from a splitting. But all nodes in the network do not have the same connectivity index, and it is very likely that some couple of nodes will have more distinct paths available to communicate between them than some other couples. So n should depend on the number of available distinct paths, and must be sent for each message. Regarding the k value, it indicates which piece of the original message is sent in clear text; so it should be chosen at random for each message, to improve security.

k and n are both necessary for the reconstruction of the original message. Hence those values should be sent with a minimum of caution, as they would help an attacker to reconstruct the message, were they to get captured. There are two ways to transmit signaling from the emitting node to the recipient:

• out-of-band signaling: the first way consists in sending the n and k values in a specific packet, different from the pieces containing the data. In no case it should be sent through the same path than the "key" piece of data.

At least it should be sent through a distinct path; if possible, it is ciphered (encrypting the "key" piece only would require less resources than encrypting the whole message). • in-band signaling: the second way to transmit signaling values is by including it to the pieces containing the data. Two associated fields must be added at the beginning of those pieces. n and k should not be inserted into each piece of the original message; instead, it should be "divided" so that the recipient node needs to combine several pieces to get the signaling values. So the n and k values are split into several sets of bits, each being included in a different piece of data. The recipient node retrieves n and k by XORing all n and k fields from the Figure 1. SDMP method: concrete example, with n = 4, key = p 2 different pieces. But the node can not be sure that all the sets of bit reached it, since it ignores how many pieces should be received. So a third field must be added to the pieces of data, containing a mask for the bits which are actually sent in this piece.

Note that for more clarity, signaling was not represented on Figure 1.

5) Possible ameliorations:

Two improvements with regards to the original SDMP method are proposed to enhance the security: . It would make it more difficult for an attacker ignoring the order of reconstruction to recover the content of the pieces.

• sending p ′′ k,
Of course, each one of these improvements implies more signaling data to send.

C. Middle importance traffic: Shamir's Secret Sharing Scheme

1) Principle:

The SDMP solution is good for low importance packets, mostly because it is very fast to reconstruct the original message. But if a single piece of the message gets lost, retrieving the whole set of data becomes impossible. On the other hand, if an attacker manages to grasp the "key piece" and several other pieces which content may be retrieved, a large amount of data will leak. Hence we propose to use a (k, n) Threshold Sharing Scheme for middle importance packets.

A Threshold Sharing Scheme (TSS) is an algorithm used so as to share a secret between several participants. Each of the n participants is given a personal secret share (or shadow) in such a way that any k of them (1 < k ≤ n) may combine their shares to retrieve the original secret, whereas k -1 participants will not obtain any information about it. There are several existing schemes. Some, for instance, are based on matrix projection [START_REF] Wang | A multiple secret sharing scheme based on matrix projection[END_REF]. Here we only present a wellknown TSS: a variation of Shamir's Secret Sharing Scheme [START_REF] Shamir | How to share a secret[END_REF]. This approach is based on the Lagrange interpolation formula for polynomials. Let p be a prime number and f be a polynomial function of degree k -1 such as:

f (x) = (a k-1 x k-1 + • • • + a 2 x 2 + a 1 x + a 0 ) mod(p) (1)
The coefficients a 0 , . . . , a k-1 are elements over a finite field Z p . According to Shamir's original scheme, a 0 is the shared secret, and all other coefficients are chosen at random. If one knows k distinct couples of values (x i , y i ) with y i = f (x i ), then the Lagrange linear interpolation formula makes it possible to represent the polynomial function in another way:

f (x) = k ∑ i=1   yi ∏ 1≤ j≤k j̸ =i x -x j x i -x j    (2)
and hence to retrieve the coefficients. Note that every operation is made over the finite field A basic analogy of this method with geometry would be the following: thanks to Lagrange formula, two points on a plan are enough to determine the 1-degree polynomial function associated with a straight line. Note that three aligned points would also enable us to retrieve the polynomial, but two are enough. In this case, the shared secret is the 0 degree coefficient of the coefficient of the polynomial. Each of the n participants will be given the coordinates of one point of the straight line. A single participant alone is totally enable to retrieve the polynomial (there are an infinity of lines passing by a given point). There must be at least k = 2 cooperating participants to obtain the coefficients of the polynomial, and thus to retrieve the shared secret. In the same way, Lagrange interpolation makes it possible to find the polynomial function associated with a parabola from three points, with a hyperbola from four points, et caetera.

When applied to network communication, original Shamir's Secret Sharing Scheme introduces much overhead. To bypass this a slight modification is realized: in the rest of this article the shared secret is no more constituted only by the 0 degree coefficient (a 0 ) of the polynomial function. Instead, it embeds the whole set of coefficients (i.e. a k-1 , . . . , a 1 , are part of the original secret, as well as a 0 , and are no more chosen at random). As we are working with bytes (values from 0 to 255), we choose p equal to 257 (the lower prime number strictly greater than 255).

2) Message sending: As for the SDMP method, the original packet M is padded (if necessary) and n shares are created before being sent. A set containing any k shares over the n created will be necessary to retrieve the full-length message. So as to enhance the security of the communication, we will choose k equal to n. In that way the recipient node must receive each one of the different shares to achieve the reconstruction process; were the attacker to lack a single share, the attack would remain unsuccessful.

Contrary to the pieces of the SDMP method, the shares created with the TSS method do not result directly from the original message splitting. Instead of being divided into n pieces of equal length, like for SDMP, M is at first divided into several chunks of length k. Let l be the number of chunks created. Each chunk i (over the l chunks) contains the k coefficients a i,k-1 , . . . , a i,1 , a i,0 , which form a polynomial function f i (x) = a i,k-1 x k-1 + • • • + a i,1 x + a i,0 . Each share j (over the n shares) is then created by choosing a unique value x j for x: the values f 1 (x j ), . . . , f l (x j ) are computed and concatenated to form a share of length l.

There is no need to "order" the different shares before sending them. But it is necessary to indicate for each share the value x j that was chosen to compute its y i = f i (x j ) values. The minimal number (k) of shares needed to reconstruct the original message M must also be added; otherwise, the receiver node would not know whether it should attempt to retrieve M or whether it lacks some shares. It may also be necessary to indicate the amount of padding bytes that were added to M.

Once complete, each share is then sent through the network via a distinct path.

Here is a concrete example of the creation of the shares. We want to send the thirteen following (decimal) bytes over three distinct paths, using Shamir's secret share: 72 101 108 108 111 44 32 119 111 114 108 100 33. Here are the different steps to do so:

1) We have three distinct paths, so we choose n = 3. As mentioned earlier, we choose k = n, so k = 3. We also have p = 257 (lowest prime number greater than the maximal byte value, 255).

2) The message has a length of 13 bytes. It should be a multiple of k, so we add two bytes for padding: 0 and 1. 3) We split the padded message into chunks of length k. We obtain four chunks: 72 101 108, 108 111 32, 44 119 111, 114 108 100 and 33 0 1. 4) We get the five following polynomial functions:

           f 1 (x) = (72x 2 + 101x + 108) mod(257) f 2 (x) = (108x 2 + 111x + 32) mod(257) f 3 (x) = (44x 2 + 119x + 111) mod(257) f 4 (x) = (114x 2 + 108x + 100) mod(257) f 5 (x) = (33x 2 + 1) mod(257) (3)
5) We choose n distinct and non-zero values for x. For instance, x 1 = 1, x 2 = 3, and x 3 = 4. 6) We compute the shares' content. The first share (s 1 ) is made of f 1 (x 1 ), f 2 (x 1 ), f 3 (x 1 ), f 4 (x 1 ) and f 5 (x 1 ).

We compute and concatenate these values. So the data of s 1 is 24, 251, 17, 65, 34. The other shares s j are computed in the same way, by using the associated x j value. Their content is displayed in Table I. After inserting a new header containing x j , k and the number of padding bytes, we get the shares s j (for s 1 , the header is: 1, 3, 2). (Note that each share contains data about each one of the bytes from the original message. There is no ordering between the shares, none "comes last", so the number of padding bytes is the same for every share). 7) Headers of the lower layers are added, and the shares are sent through the network, each one over a distinct path.

3) Message reconstruction: Before attempting to reconstruct the original message M, the recipient node must check that it has received enough shares (i.e. that it has received at least k shares). Otherwise the retrieved data will not be consistent. This verification is easy to realize if k has been inserted in a new header for the shares, as explained for the shares' construction. Then, any set of k shares (among all the one received for a message M) may be used with Lagrange linear interpolation formula (see equation 2) so as to get back the coefficients a i , hence the data of M.

Let us get back to our concrete example. The examination of the k-value field of the shares' headers tells us that three different shares are needed to proceed to the reconstruction. Once the three shares received, we will apply Lagrange formula to the f 1 (x j ) values (1 ≤ j ≤ 3). Here is the resulting expression:

f 1 (x) = i=3 ∑ i=1    f 1 (x i ) ∏ 1≤ j≤3 j̸ =i x -x j x i -x j    (4)
So we have:

f 1 (x) = (t 1,1 (x) + t 1,2 (x) + t 1,3 (x)) mod(257) (5)
where

               t 1,1 (x) = f 1 (x 1 ) • x -x 2 x 1 -x 2 • x -x 3 x 1 -x 3 = 24 • x -3 1 -3 • x -4 1 -4 t 1,2 (x) = f 1 (x 2 ) • x -x 1 x 2 -x 1 • x -x 3 x 2 -x 3 = 31 • x -1 3 -1 • x -4 3 -4 t 1,3 (x) = f 1 (x 3 ) • x -x 1 x 3 -x 1 • x -x 2 x 3 -x 2 = 122 • x -1 4 -1 • x -3 4 -3 (6)
hence:

             t 1,1 (x) = 24 • (x -3)(x -4) 255 • 254 = 24 • 6 -1 • (x -3)(x -4) t 1,2 (x) = 31 • (x -1)(x -4) 2 • 256 = 31 • 255 -1 • (x -1)(x -4) t 1,3 (x) = 122 • (x -1)(x -3) 3 • 1 = 122 • 3 -1 • (x -1)(x -3) (7) so      t 1,1 (x) = 24 • 43 • (x 2 + 250x + 12) = 4 • (x 2 + 250x + 12) t 1,2 (x) = 31 • 128 • (x 2 + 252x + 4) = 113 • (x 2 + 252x + 4) t 1,3 (x) = 122 • 86 • (x 2 + 253x + 3) = 212 • (x 2 + 253x + 3) (8
) and finally we sum up all t 1,i to find:

f 1 (x) = 72x 2 + 101x + 108 (9)
The three coefficients (a 2 = 72, a 1 = 101 and a 0 = 108) of this polynomial are the first three bytes of our original message. By applying the same procedure to the other f i (x) from the shares, we would get the remaining bytes from the initial message. In the end, the only step that would remain would be the removal of the two padding bytes from the three bytes obtained with f 5 , to get the full original message.

D. High importance traffic: ciphering

For important packets that embed data expected to remain confidential whatever happens in the network, none of the above solutions is able to provide enough guaranties in terms of security. The only way to ensure that data remains confidential is to use a well-tried strong encryption algorithm. We do not either present or recommend any particular algorithm in this paper. Several algorithms among the many that exist have been specifically designed for WSNs.

III. COMPARISON OF THE DIFFERENT METHODS

A. Confidentiality

While a good encryption algorithm is expected to provide a very good confidentiality level even if most, or all, packets are captured by an attacker, the SDMP and TSS methods are not as efficient to protect data. This is why these methods are proposed for middle and low importance packets.

The security of the SDMP method is even lower than for the Threshold Sharing Scheme, especially if the "key" piece is sent in clear text. If captured, this piece will instantly reveal its content to the attacker. Moreover, it would also permit to retrieve the content from other pieces (for instance, if the key piece p k , and the pieces p ′ k-1,k and p ′ k-2,k-1 are caught, all of them are easy to retrieve). Lacking signaling may delay the retrieval of data: if the attacker does not know which piece is the key, it may take longer to extract the original message (although there are not enough possible combinations to resist to a "brute force" reconstitution). This is why signaling should be handled with care. Finally, it is worth noticing that single XOR operations between pieces are not a very efficient way to encrypt it, and that it would probably not resist to statistical analysis. Some byte patterns could indeed appear repeatedly in the pieces, or from one piece to another.

Shamir's Secret Sharing Scheme offers a better protection. If we choose k and n such that k = n, a single missing share prevents an attacker to get any information about the content of the original message. As a consequence, an attacker must be able to listen over each of the distinct paths that are used to forward the shares. Due to the wireless aspect inhering in WSNs, this condition can be bypassed if the attacker is located close enough to its target. In this case, the attacker is able to intercept all the emitted shares, before they are routed to distinct paths. And note that again, repeated patterns in the original data could produce similar patterns in the share, and provide matter for successful statistical analysis.

B. Complexity

The SDMP method is by far the easiest method to implement. Each piece results directly from the splitting of the original message, and only needs a new header and a single XOR operation before sending.

The secret sharing scheme is also simple, but requires more operations to create the shares. The total number of operations (additions, multiplications and modulos) grows exponentially with k (complexity in O(k 2 )). Nevertheless it remains few demanding in resources for low values of k. As the number of available distinct paths for a given node will seldom reach high values, k should remain low, causing the algorithm to remain cheap and fast.

A strong encryption protocol, by contrast, is far more demanding in resources, and more complex to implement. This is the price for a better confidentiality.

C. Overhead

Let l m be the length of the original message. With the SDMP method, the message is split into n pieces of length l p = ⌈ l m n ⌉ (once padded). To each piece we must add the piece number and the padding length l pad in a new header. Signaling must also be taken into account. Out-of-band signaling produces less signaling data, but requires a full packet with lower layers headers. For in-band signaling, we will count four supplementary fields (k, n, and respective masks -see II-B4 and explanations about the signaling for SDMP). So the final length for data, signaling and inserted headers is (in the case of in-band signaling): n • (l p + 6) = l m (+l pad ) + 6n; in other words, 6n bytes of overhead are created. Lower layers headers (e.g. link layer, network layer) will constitute the greatest part of the overhead: they will be multiplied by n (one per piece to send). This is quite similar for Shamir's Secret Sharing Scheme: we basically have n shares of length ⌈ l m k ⌉ (once the message is padded, and with k = n), to which we add a new header containing k and the padding length. The final length for data and inserted headers is: l m (+l pad ) + 2n. Overhead is slightly lower than for the SDMP method, but the lower layers headers are again multiplied by n, so the difference for the two methods is insignificant.

Encryption algorithms often add new headers and initialization vectors which end up in consequent overhead. On the other hand, the packets are not split into pieces or shares, which prevent the replication of lower layers headers. Therefore, the method which adds the greatest overhead will depend on the value of n and on the amount of overhead that the chosen encryption algorithm will create for each packet.

D. Fault resistance

The SDMP method offers no fault resistance. The pieces are created through a kind of chained encryption process. If one link of the chain is missing, i.e. if one piece is lost, all the following pieces in the chain become useless and can not get unencrypted. This is even worse with the Threshold Sharing Scheme: since we chose k = n, should a single share get lost, it would cause every other share to become worthless. Remember that this is the principle of the secret sharing: with k -1 participants, no information can be obtained about the shared message. This method introduces a very interesting mechanism for fault tolerance, however, when k is lower than n. In this case, all the data is retrieved even if any nk shares are lost; but this is beyond the scope of our analysis.

IV. CONCLUSION

If sensor nodes in a WSN have to send packets with different levels of importance, it may be worth to avoid to use systematically heavy encryption algorithms. We propose in this paper a solution using a traffic shaper to determine the degree of criticalness of each packet to send. According to this degree and to the number of available distinct paths between the sender and the target node, one of three securing methods is used: the Securing Data based on Multi-Path routing method, Shamir's Secret Sharing Scheme, or strong cryptography. We have detailed the operation and provided concrete examples for the first two methods, before comparing which confidentiality guaranties, which complexity, which additional overhead and which fault resistance come with each one of the three methods (SDMP, SSSS, and regular encryption).

Future works include simulating the solution over the ns-3 simulator, in order to evaluate the gain in performance and in energy provided by this model.

  Z p . Practically, it means that additions and subtractions are made modulo p, subtracting b from a is adding b's opposite (pb) to a, and dividing a into b comes to multiply a with b's inverse in Z p (the inverse is c such as (b • c) mod(p) = 1, it does exist since p is prime).

  k+1,k+2 instead of p k as a "key piece". That is, the "key piece" should be created by XORing p k and

	p ′ k+1,k+2 (for example) so as not to send p k in clear text. When receiving both p ′ k+1,k+2 and p ′′ k,k+1,k+2 , the
	recipient node will be able to recover p k ;
	• changing the XORing (and recovering) order for the
	pieces. For instance, if n is equal to 5, instead of sending
	p ′ 1,2 , p ′ 2,3 , p ′ 3,4 and p ′ 4,5 , one could create and send p ′ 1,4 , p ′ 4,2 , p ′ 2,3 and p ′ 3,5


Quentin Monnet
email: quentin.monnet@lacl.fr

Lynda Mokdad
email: lynda.mokdad@u-pec.fr

Jalel Ben-Othman

Energy-balancing method to detect denial of service attacks in wireless sensor networks

Keywords: Wireless sensor networks, Reliability, availability, and serviceability, Energy-aware systems, Simulation

The use of sensor networks has increased rapidly over the last years. Due to their low resources, sensors come along with new issues regarding network security and energy consumption.

Focusing on the network availability, previous studies proposed to protect the network against denial of service attacks with the use of traffic monitoring agents on some nodes. But if the control nodes go down or get compromised, they leave the network unprotected. To better fight against attacks, we try to enhance this solution by introducing an energy-aware and secure method to select these monitoring nodes (called cNodes) in a clustered wireless sensor network. Our election process is done in accordance to their remaining reserves: nodes with the higher residual energy are selected. We discuss limitations of this deterministic process concerning security and cluster coverage, and suggest as a workaround to designate new control nodes (called vNodes). Those vNodes are responsible for monitoring the cNodes by periodically enquiring about their remaining energy and ensuring that they do not lie during the election process (in attempt to keep their cNode role). Finally, we present some experimental results obtained with the ns-3 simulator in order to analyze the impact of our proposal on the energy repartition in the network.

INTRODUCTION

Traffic regulation or pollution measurement in water are example activities which require the constant presence of measuring agents over wide -and sometimes hard to accessareas. In such cases, as it is not feasible to send people on site to run measurements, wireless sensor networks are used. They are made of small devices, sometimes dropped on the spot by helicopter, tasked with gathering data on their physical environment. Sensors are able to exchange data through wireless communications. Useful data is typically centralized by a base station, which acts as an interface between the network and the user.

As they are often used in hostile environments with no human assistance, sensors are generally able to self-organize and to form a consistent network. But they also embed cheap hardware, as it may be hard, if possible at all, to fetch them once their life cycle is over. Consequently, they have restricted resources: low computational capabilities and low available memory. They also have limited energy [START_REF] Bernard | Slot scheduling for wireless sensor networks[END_REF] in a single-use battery.

Wireless sensor networks are used for many applications [START_REF] Ramassamy | Classification of usual protocols over wireless sensor network[END_REF], [START_REF] Fouchal | Distributed backtracking algorithm based on tree decomposition over wireless sensor networks[END_REF], some of them being crucial. For instance there is a lot at stakes when sensor networks are used for watching forests for fires, for measuring the nuclear activity degree in sensitive areas, or for military operations over battlefields. In this context, bringing security guaranties -including availability -to the network becomes essential.

Based on former studies (see Section I), the present one relies on the use of monitoring nodes (or "cNodes") to protect a wireless sensor network again various denial of service attacks. Actually, it focuses on the election process of those control nodes. Our approach consists in taking energy into account at this step, in order to obtain an even better load balancing. We propose to designate the sensors for the cNode position according to their residual energy, but we show that several problems occur with deterministic election. Indeed compromised nodes could see a flaw to exploit in order to take over the cNode role and decrease the odds of being detected by announcing high residual energy. We address this issue by introducing a second role of surveillance: we choose "vNodes" responsible for watching over the cNodes and for matching their announced consumption against mathematical model. We also recommend that every node in the cluster be monitored by at least one cNode to prevent all the cNodes to be elected inside the same spatial area of the cluster at each election iteration.

The rest of the paper is organized as follows: first we present a quick overview of related work in Section I. After we introduce a new cNode selection method in Section II, we describe and discuss the simulation of the algorithm that we have done using ns-3 in Section III. Last Section summarizes the main contributions of the paper and gives some directions of future work.

I. RELATED WORK

For sensitive operations involving the deployment of a wireless sensor network, all security aspects of the network must be reviewed. WSN-addressed protocols to provide data privacy [START_REF] Ozdemir | Secure data aggregation in wireless sensor networks: a comprehensive overview[END_REF] and authentication [START_REF] Simplicio | Comparison of authenticatedencryption schemes in wireless sensor networks[END_REF] have been subject to deep research investigation, and led for example to the proposal of mechanisms for secure data aggregation without persistent cryptographic operations [START_REF] Wu | Secure data aggregation without persistent cryptographic operations in wireless sensor networks[END_REF] or for authenticated broadcast such as µTESLA [START_REF] Perrig | SPINS: Security Protocols for Sensor Networks[END_REF]. But cryptography is of no use if the network is down: in this paper we focused on resistance against denial of service (DoS) attacks.

Indeed there are many existing attacks able to compromise the good working of a wireless sensor network [START_REF] Zheng | Wireless sensor networks: a networking perspective[END_REF]. Several mechanisms have been proposed to detect it and to provide countermeasures [START_REF] Singh | A survey on network security and attack defense mechanism for wireless sensor networks[END_REF], [START_REF] Sedjelmaci | An efficient intrusion detection framework in cluster-based wireless sensor networks[END_REF]. Many consist in the implementation of trust based mechanisms [START_REF] Momani | Survey of trust models in different network domains[END_REF], [START_REF] Fernández-Gago | A survey on the applicability of trust management systems for wireless sensor networks[END_REF] with agents applying set of rules [START_REF] Rohbanian | Watchdog-LEACH: a new method based on LEACH protocol to secure clustered wireless sensor networks[END_REF] on traffic to attribute a trust value to each of the nodes in the network. In particular, Lai and Chen [START_REF] Lai | Detecting denial of service attacks in sensor networks[END_REF] proposed to elect control nodes to monitor the traffic in clustered networks and to detect and react to denial of service attacks. Clustered networks are partitioned into clusters via algorithms such as LEACH [START_REF] Handy | Low energy adaptive clustering hierarchy with deterministic cluster-head selection[END_REF]. One cluster head (CH) per cluster is responsible for gathering data from its peers, for aggregating and sending it to the base station. The CHs are the only nodes to use long range (and expensive) transmissions to reach the base station. Clustering enables to preserve energy for the sensing nodes and offers an easier management of the nodes. In our case, all nodes of a cluster can reach their cluster head directly (1-hop transmission), as on Figure 1. Control nodes are elected among the non-cluster head nodes of a cluster. We will call them cNodes from now on. They are responsible for listening to the traffic and detecting nodes whose emitted traffic exceeds a given threshold value. These abnormal behaviors are reported to the cluster head. On reception of reports from several distinct cNodes (to prevent false denunciation from a compromised node), the CH virtually excludes the suspicious node from the cluster. Although the method is efficient for detecting rogue nodes, the authors do not give details of the election mechanism to choose the cNodes. Also, there is no mention in their study of renewing the election in time, which causes the appointed cNodes to endorse a heavier energy consumption on a long period.

In a first attempt to bring load balancing to this solution, we propose in other papers [START_REF] Guechari | Dynamic solution for detecting denial of service attacks in wireless sensor networks[END_REF], [START_REF] Ballarini | Modeling tools for detecting DoS attacks in WSNs[END_REF] to reiterate the election periodically. Simulations show a better load repartition among the cluster, but at this time our focus was not on designing an energy efficient election process for the cNodes. This is the purpose of the current study.

II. CNODES SELECTION MECHANISM

Using control nodes to watch over the network traffic allows the detection of various types of denial of service attacks. This is achieved with agents in the cNodes applying specific rules on overheard traffic. Each rule is used to fight against one kind of attack: jamming, tampering, black hole attacks, and so on [START_REF] Rohbanian | Watchdog-LEACH: a new method based on LEACH protocol to secure clustered wireless sensor networks[END_REF]. Due to limited size for this paper, we can not described in details the attacks and the associated rules. We will only treat one example in the rest of this study: flooding attacks. The model of a flooding attack is the following: a malicious node sends a high amount of data to prevent legitimate nodes from communicating by saturating the medium, or by establishing too many connections with the receiver node [START_REF] Rehana | Security of wireless sensor network[END_REF]. In wireless sensor networks, it is also used to drain the energy of neighbor nodes. cNodes are responsible for listening to the traffic of their surrounding nodes: if a sensor is to generate more traffic in the network than a predetermined threshold, it is considered as potentially compromised and trying to flood the network. A report is sent to the cluster head. On reception of reports coming from multiple cNodes, the CH considers that traffic from the suspicious node must no more be considered. Information about distrust is passed on to normal nodes which stop listening to the packets coming from the attacker. We work under the following assumptions: firstly, the cluster head is not a compromised node (the use of cNodes to detect a malicious CH is described in [START_REF] Lai | Detecting denial of service attacks in sensor networks[END_REF], but it is not considered in this paper). Secondly, we do not consider the case of several malicious nodes cooperating with one another.

Electing the cNodes is not an easy task. In [START_REF] Ballarini | Modeling tools for detecting DoS attacks in WSNs[END_REF] we expose and compare three ways to elect them:

• pseudo-random election by the base station;

• pseudo-random election by the cluster head;

• pseudo-random election by the nodes themselves. We assumed that election should be random so that compromised nodes would not be aware of which node could control the traffic. In that previous study however we do not consider the remaining energy during the cNodes election. But monitoring the traffic implies to keep listening for wireless transmission without interruption. Hence cNodes will have a greater energy consumption than normal nodes. Given that preserving energy is an essential issue in the network, we prefer to ensure load balancing rather than assuring a pseudorandom election, and thus to consider the residual energy of the nodes during the election. This choice also raises new issues and makes us define a new role for the nodes in the cluster.

A. Using vNodes to ensure a secured deterministic election

The issue with energy measurement is that no agent in the network is able to measure the residual energy of a given node N , but the node itself. The neighbor nodes of N may record messages sent from N and compute a rough estimate, but as they know neither the initial amount of energy of N (at the network deployment) nor the energy N spent for listening, estimates can not be used to obtain values precise enough so as to reliably sort the nodes according to their residual energy.

So the only way to get the residual energy of a node is to ask this node. The election algorithm we propose is described as follows:

1) During first step, each node evaluates its residual energy and sends the value to the cluster head; 2) Having received the residual energy of all nodes in the cluster, the cluster head picks the n nodes with the highest residual energy (where n is the desired number of cNodes during each cycle) and returns them a message to assign them the role of cNode.

It is a deterministic selection algorithm which eliminates any random aspect from the process. The rule is simple: nodes possessing the highest residual energy will be elected.

Given that the cNode role implies consuming more energy (cNodes listen to surrounding communications most of the time), rotation of the roles is theoretically assured. But the deterministic aspect is also a flaw that may be exploited by compromised nodes. This is a crucial issue: we can not neglect compromised nodes as the whole cNodes mechanism is deployed in the sole purpose to detect them! More precisely, the problem may be stated as follows. Compromised nodes will be interested in endorsing a cNode role, as it enables them:

• to reduce the number of legitimate cNodes able to detect them; • to advertise the cluster head about "innocent" sensing nodes to have them revoked.

When a pseudo-random election algorithm is applied, a compromised node (or even several ones) can be elected during a cycle, but it will loose its role further in time, for later cycles.

Even with a self-election process (based on LEACH [START_REF] Handy | Low energy adaptive clustering hierarchy with deterministic cluster-head selection[END_REF] model for instance), compromised nodes can keep their cNode role as long as they want, but they can not prevent other (legitimate) nodes to elect themselves, too. With deterministic election however, they can monopolize most of the available cNode roles. They only have to announce the highest residual energy value at the first step of the election to get assured to win. If there are enough compromised nodes to occupy all of the n available cNode roles, then they become virtually immune to potential detection.

To prevent nodes from lying when announcing their residual energy, we propose to assign a new role to some of the neighbors of each cNode. Those nodes -we call them vNodes, as for verification nodes -are responsible for the surveillance of the monitoring nodes. Once the cNodes election is over, each neighbor to a cNode decides with a given probability whether it will be a vNode for this cNode or not. A given node can act as a vNode for several cNode (in other words, it can survey several neighbor cNode).

If this role consumes too much energy, it is not worth deploying vNodes: we should rather use pseudo-random election for the cNodes. So vNodes must not stay awake and listen most of the time, as cNodes do. Instead they send, from time to time, requests to the cNode they watch over, asking it for its residual energy. They wait for the answer, and keep the value in memory.

Once they have gathered enough data, vNodes try to correlate the theoretical model of consumption of the cNode they survey and its announced consumption, deduced from broadcast messages (during elections) and answers to requests from vNodes. Four distinct cases may occur:

1) The announced consumption does not correlate (at all) with the theoretical model: there is a high probability the node is compromised and seeks to take over cNode role. It is reported to the cluster head; 2) The announced consumption correlates exactly with the theoretical model: the node is probably a compromised node trying to get elected while escaping to detection (in other words, the rogue cNode adapts its behavior regarding to the previous point). It is easy to detect the subterfuge as values received from the rogue node and the ones computed by the vNodes are exactly the same.

It is reported to the cluster head; 3) The announced consumption correlates roughly with the theoretical model, but does not evolve in the same way (regarding to the model) than the real consumption locally observed by the vNodes (local (in time) evolution of the announced consumption does not "stick" to the one of the surrounding vNodes, which should roughly rise or decrease during the same periods). The node is probably compromised, trying to escape detection by decreasing its announced energy with random values. It is reported to the CH; 4) The announced consumption correlates roughly with theoretical model, and evolves in the same way as the traffic observed by vNodes. Whether the node is compromised or not, it has a normal behavior, and is allowed to act as a cNode.

If a given vNode is in fact a malicious node, it could lie about integrity of the cNode it watches. To prevent that, the cluster head must receive multiple reports (their number exceeding a predetermined threshold) from distinct vNodes before actually considering a cNode as compromised. To some extent, this also makes the scheme resilient to errors from the vNodes.

In that way, nodes are allowed to act as cNodes only if they announce plausible amounts of residual energy. Assuming that this role consumes more energy than sensing only, the nodes elected as cNodes will sooner or later see their residual energy drop below the reserve of normal sensing nodes, which implies that they will not get re-elected at the next election. Note that the cases 2 and 3 make a compromised node decrement its announced energy as the time goes by. Even if inconsistency may be noticed and the compromise detected, this simple behavior ensures that the rogue node will stop to get elected at one point in the time.

Thus, the interest of vNodes can be summarized as follows: a compromised node can not ensure the takeover of the cNode role at each cycle without cheating when announcing residual energy, and hence being detected by the vNodes. Detecting rogue cNodes, or forcing them to give up their role for later cycles, are the two purposes of the vNodes. The vNode role does not prevent a node to process to its normal sensing activity (requests to cNodes must not occur often, otherwise it will drain too much power from the vNodes). The state machine of the nodes is presented in Figure 2.

B. Cluster coverage in case of heterogeneous activity

Deterministic election of the cNodes does not only introduce a flaw that compromised nodes could try to exploit. There is a second problem, independent from the nodes behavior, that could prevent the detection of compromised nodes. If a region of the network happens to produce more traffic activity than the other parts of the network, the energy of its nodes will be drawn faster. In consequence, none of the n nodes with the highest residual energy (n being the desired number of cNodes during each cycle) will be located inside this region, and some nodes may not be covered for surveillance as long as traffic do not fade, possibly for all cycles. Figure 3 To address this issue we need to ensure that every node in the network is covered by at least one cNode. So the election process we presented in II-A needs to be modified. The correct version is as follows:

1) During first step, each node evaluates its residual energy and broadcasts the value; 2) The cluster head listens to all values. Other nodes also register all messages they hear into memory; 3) All nodes send to the CH the list of their 1-hop neighbors1 ; 4) The CH picks the n nodes among those with the highest residual energy, such that the n nodes cover all other nodes in range 2 . If needed, it selects some additional nodes to cover all the cluster; 5) The CH returns to selected nodes a message to assign them the role of cNode. Note that some clustering algorithms (such as HEED [START_REF] Younis | HEED: a Hybrid, Energy-Efficient Distributed clustering approach for ad-hoc sensor networks[END_REF] for example) provide other election mechanisms (for cluster heads, but that can also be used for selecting cNodes) based on residual energy. We do not want to use it because energy only takes part in the process as a factor for probability that the nodes declare themselves elected. Instead we prefer nodes to broadcast their residual energy in order to enable surveillance by the vNodes.

C. Observations

cNodes apply a very basic trust based scheme to the cluster: when a sensor node breaks a rule, for example by exceeding a given threshold for transmitted packets, it is considered as untrustworthy. There are many other trust based schemes in literature, most of them more advanced than this one (see Section I). The cNodes could implement several other trust mechanisms (by lowering a score on bad behaviour for each node for instance). As more complex mechanism would create additional overhead, we prefer to limit to this simple method in this study.

III. SELECTION IN PRACTICE: RESULTS FROM SIMULATION

We have undertaken simulation of our proposal regarding the energy consumption in order to compare it with the previous model (using pseudo-random election for cNodes). We used ns-3 software to proceed.

In the new proposal, the vNodes are to model the theoretical consumption of the cNodes they watch over. We have chosen to use Rakhmatov and Vrudhula's diffusion model [START_REF] Rakhmatov | An analytical high-level battery model for use in energy management of portable electronic systems[END_REF] to compute the consumption. This choice was driven by several reasons:

• it provides a pretty accurate approximation of real consumption, taking into account chemical processes internal to the battery such as rate capacity effect and recovery effect; • it is one of the models already implemented in ns-3.

So in our case it is an absolutely perfect theoretical model. It remains "theoretical" as vNodes use this model to compute the expected behaviour of cNodes according to the few packets they sometimes hear. Meanwhile, real cNodes consumption computed by ns-3 core takes into account every packet actually sent or received by cNodes, also including packets that vNodes can not hear (because of distance or sleep schedule). So the values computed by vNodes and ns-3 core will not always be the same, which allows us to use the model. Rakhmatov and Vrudhula's diffusion model refers to the chemical reaction happening inside the battery electrolyte, and is summarized by equation [START_REF] Bernard | Slot scheduling for wireless sensor networks[END_REF].

σ(t) = t 0 i(τ ) dτ l(t) + u(t) t 0 i(τ ) 2 ∞ m=1 exp -β 2 m 2 (t-r) dτ
(1) where:

• σ(t) is the apparent charge lost from the battery at t; • l(t) is the charge lost to the load ("useful" charge); • u(t) is the unavailable charge ("lost in battery" charge); • i(t) is the current at t;

• β = π √ D w
, where D is the diffusion constant and w the full width of the electrolyte. In practice, computing the first ten terms of the sum provides a good approximation (this is also the default behavior of ns-3, by the way).

We launched several simulation instances and chose to focus on the energy consumption and load balancing in the cluster.

To obtain data about detection rate or false positive values of the cNodes scheme, the reader is redirected to our previous work [START_REF] Guechari | Dynamic solution for detecting denial of service attacks in wireless sensor networks[END_REF], [START_REF] Ballarini | Modeling tools for detecting DoS attacks in WSNs[END_REF]. When we implemented our solution, we set the parameters of the simulation as detailed in Table I. We obtained the residual energy values for each node at each minute of the simulation. From this data we draw the average residual energy of the nodes (excluding cluster head) as well as the standard deviation. Average residual energy per minute in the batteries of the nodes is displayed on Figure 4. Increasing values at t = 11 minutes and t = 15 minutes with the use of the proposed solution traduce the recovery effect of the batteries. As expected, our proposal causes an increased global energy consumption. This is due, of course, to the new vNode role. vNodes have to wake up periodically to send requests to Standard deviation of residual energy value in the nodes at each minute of the simulation is presented on Figure 6. During the first minutes of simulation, our solution creates a higher disproportion in load balancing due to the introduction of vNodes (there are more nodes assuming demanding functions). But after the seven first minutes or so, the standard deviation with our method falls below the standard deviation of previous method. This is the consequence of a better load repartition over the nodes with our solution. The difference between standard deviation with and without our simulation may look small: this is due to the model of the simulation we implemented. Given that we have a good pseudo-random numbers generator, when the number of elections get high, all nodes will roughly assume cNode role the same number of times in simulation not using our solution. As sensing nodes all have the same activity, a correct repartition of the cNode roles over the time leads to a good energy balance. But in a situation where sensing nodes have different activity levels -for instance, if there is an area in the cluster when measured events occur much more often than in the other parts of the cluster -the consumption would not be equilibrated between all the nodes with the previous method; whereas our solution would deal well with this case, since cNodes are elected according to residual energy. Thus simulations show that the use of vNodes leads to a higher energy consumption, but electing cNodes on residual energy provides a better load repartition in the cluster. CONCLUSION cNodes are used in clustered wireless sensor networks to monitor traffic of the nodes and to detect denial of service attacks (e.g. flooding, black hole attacks). In this paper, we have proposed a new method to dynamically elect those cNodes, based on their residual energy. The aim of the proposed selection algorithm is to provide a better load balancing in the cluster.

We have addressed several issues related with the use of a deterministic selection. Compromised nodes trying to systematically take over the cNode role are forced to abandon it for later cycle, or get detected, by vNodes. The vNode role is a new role we introduced to survey the cNodes by matching their announced energy consumption with a theoretical model. The issue of areas of the cluster uncovered by cNodes, depending of the activity in the cluster, is addressed by enforcing covering of the whole cluster: the cluster head is to designate additional cNodes if needed. Working with clusters ensures a good scalability of the solution. It is also flexible, as cNodes can endorse various trust-based model, and monitoring rules can be set to fight against several types of denial of service attacks. And the use of vNodes is resilient to a small percentage of compromised vNodes (depending on parameters set by user).

The results we have obtained through simulations show that even though using our simulation causes a higher global consumption of energy in the cluster, it provides a better load repartition between sensors.

Future works include improvements of our solution by adding monitoring of the cluster head, as well as modeling a cluster with areas of different activity levels. Also we would especially like to study the impact of the percentage of designated vNodes on global energy consumption.

Figure 1 .

 1 Figure 1. Clustered wireless sensor networks scheme

Figure 2 .

 2 Figure 2. State machine of the (non-CH) nodes

Figure 3 .

 3 Figure 3. Illustrative scheme: cNodes are elected inside the area with less activity (thus with more residual energy) and do not cover nodes from the opposite side of the network.

Figure 4 .Figure 5 .

 45 Figure 4. Average residual energy of the nodes (excluding cluster head)

Figure 6 .

 6 Figure 6. Standard deviation for residual energy of the nodes

  illustrates this problem.

	area with	cluster
	high activity
	CH
	cNodes
	nodes with low residual energy	cNodes' range does not cover all nodes in cluster

We do not deal with the case of compromised nodes cheating at this step of the process. Indeed they could announce extra virtual neighbors to try to escape from coverage.

The details of the algorithm executed by the cluster head at this step are not given in this study.


M.D. François Simon
email: fsimon05@gmail.com

Serge Ketoff

Benjamin Guichard

Anthony Wolfe

Jean-François Tulasne

Chloé Bertolus

Roman Hossein Khonsari

Jean- François Tulasne

Lower jaw reconstruction and dental rehabilitation after war injuries: the experience of Paul Tessier in Iran in the late 1980s

Keywords: Iran, reconstruction, Tessier, tooth implant, war injury

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

Introduction: The Iraq-Iran war lasted for 8 years and caused more than 200,000 casualties on the Iranian side. This very long conflict affected both the military (75%) and the civilian (25%) populations. Up to 75% of victims were 16 to 25 years of age and mandibular defects were the most common maxillofacial injury (Akhlaghi and Aframian-Farnad, 1997;[START_REF] Salamati | Mortality and injuries among Iranians in Iraq-Iran war: a systematic review[END_REF]. Two organizations are entitled to provide support to war victims: the Foundation of Martyrs Affairs (FMA) and the Janbazan Affairs Organization (JAO). According to the statistics of the JAO in 2007, nearly 400,000 people required prolonged medical care as a consequence of war injuries [START_REF] Zargar | Iranian casualties during the eight years of Iraq-Iran conflict[END_REF][START_REF] Noorbala | The organization and management of medical services to injured soldiers across the country and in the battlefields during the Iran-Iraq War[END_REF]. The effects of the Iraq-Iran war are thus a major health issue in both countries 25 years after the ceasefire [START_REF] Zargar | Iranian casualties during the eight years of Iraq-Iran conflict[END_REF][START_REF] Salamati | Mortality and injuries among Iranians in Iraq-Iran war: a systematic review[END_REF].

Paul Tessier (1917Tessier ( -2008) ) was a prominent, French plastic surgeon who made major breakthroughs in the field of craniofacial reconstruction [START_REF] Wolfe | The influence of Paul Tessier on our current treatment of facial trauma, both in primary care and in the management of late sequelae[END_REF][START_REF] Jones | Paul Louis Tessier: plastic surgeon who revolutionised the treatment of facial deformity[END_REF][START_REF] Watts | Paul Tessier[END_REF]. With a team including Jean-François Tulasne (Paris, France), David Matthews (Charlotte, USA), Joe Murray (Boston, USA), Fernando Ortiz Monasterio (Mexico City, Mexico), Yvon Raulo (Paris, France) and Luigi Clauser (Ferraro, Italy), he led several surgical missions to post-war Iran in order to operate on patients requiring mid-and lower face reconstruction. These missions were funded by the JAO and each member of the team received a reimbursement of $15,000 per week [START_REF] Wolfe | A man from Héric. The life and work of Paul Tessier, MD, father of craniofacial surgery Lulu.com[END_REF].

During these missions, he applied a rigorous protocol based on primary soft-tissue procedures, bone graft and implant placement, characterized by surprisingly extensive bone reconstruction without using free tissue transfers. Here we report the placement of 204 implants in 43 patients with war injuries and detail the procedures used by Tessier and his international team in wartime Iran. We found 43 patients operated on by Tessier in Iran from 1976 to 1993 for war injuries. The collected parameters were: age of the patient, nature of the trauma (when available), previous procedures, number of implants (mandibular and maxillary) placed by Tessier and his team, associated procedures (bone grafts, soft-tissue procedures, orthognathic surgery). The techniques used in the documents were then compared with techniques used today.

Material and methods

Results: A series of 43 patients presenting various maxillofacial war injuries were operated on and implanted using Brånemark System Mk III implants (Nobel Biocare, Zürich-Flughafen, Switzerland). Wounds were mostly bullet and shell injuries (Table 1). The age of the patients ranged from 23 to 47 years (mean age: 28). The injuries occurred between 1979 and 1987 (mean year: 1985). Patients were subjected to three procedures on average (range: 1-7). All patients had undergone 1-12 prior surgeries with other surgical teams. 204 implants were put in place (68 maxillary and 136 mandibular). A total of 24 bone graft procedures were performed on 19 patients (44%); in most cases these were from iliac crest (15) and sometimes parietal grafts (4) (example in Fig. 1). All 204 implants were put in place 6 months after bone grafting. Various soft-tissue procedures were required for 15 patients (Table 2). The lips were chiefly reconstructed with commissuroplasties (7 cases) and the cheek using Baron-Tessier island flaps (3 cases) or rotation flaps (2 cases) (examples in Fig. 2 and3). Other procedures included two parietal expanders, three external canthopexies and one rhinoplasty. Associated orthognathic procedures were also performed: six Le Fort I, one hemi-Le Fort I, three which three benefited from 3D reconstruction. In most patients Tessier used the same protocol with initial soft tissue and bone reconstruction followed by implants 6 months later.

Precise description of the surgical procedure is given for a very complex case, in Tessier's own words, "'une des reconstructions post-traumatiques les plus intéressantes, les plus instructive et les plus completes d'une carrière de 40 ans"' (one of the most interesting, posttraumatic reconstructions, the most instructive and complete case in a 40 year career, Fig. 4).

This patient suffered an unknown injury in 1985 with a comminuted maxillary fracture and was first operated on in Iran 5 years later with maxillectomy, Le Fort III and a tongue flap to reconstruct the palate. Tessier and his team (including Tulasne) planned a multi-stage reconstruction with six operations over two years before the first implants. The most important step was the first, with reconstruction of the nose and orbit using parietal bone grafts and reconstruction of the entire palate using the right temporal muscle and its corresponding external cortical parietal bone in one chimeric pedicled flap. The muscle was sutured upwards to the nasal cavity and the palate mucosa was sutured to the concave parietal bone. Two extra operations were needed at 15 days and 4 months with iliac bone grafts to stabilize the structure. Other operations at 6, 12 and 18 months enabled the reconstruction of the zygomatic bone and arch using parietal grafts, of the premaxilla using iliac grafts and cancellous grafts to further stabilize the maxilla. Finally after 2 years, eight maxillary and four mandibular implants were successfully put in place.

One of the most interesting aspects of Tessier's notes are his comments after each procedure on the techniques he used, what he could have done better and the next steps to be made. For example in this case after the first procedure he emphasizes the importance of having X-rays and photos before each operation, but also how his peroperative decision to remove the zygomatic arch enabled him to better place the chimeric temporal flap. He is also self-critical and lists improvements, such as in this case how the temporal muscle flap was bulging in the

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT

5 orbit and how he should have better separated it from the remaining temporal muscle. Lastly, he also comments on similarities with previous operations, in this case on the chimeric temporal flap and how the bone seems to be directly vascularized by the temporal muscle.

Discussion:

The Iraq-Iran war resulted in numerous severe craniofacial injuries. In the 1990s, lower jaw rehabilitation using implants required an expertise that was brought by Tessier and his team in post-war Iran. At that time, applying a standard protocol based on bone reconstruction and secondary implantation was a pioneering approach. In fact, upper and lower jaw rehabilitation in war-injured patients requires the combination of soft-tissue reconstruction and bone grafts before implant placement [START_REF] Motamedi | Experience with regional flaps in the comprehensive treatment of maxillofacial soft-tissue injuries in war victims[END_REF]Motamedi et al., 1999;[START_REF] Motamedi | Primary management of maxillofacial hard and soft tissue gunshot and shrapnel injuries[END_REF][START_REF] A N U S C R I P T A C C E P T E D Accepted Manuscript 9 Sadda | Maxillofacial war injuries during the Iraq-Iran War: an analysis of 300 cases[END_REF]. This series also emphasizes the need for meticulous anticipation in the reconstruction of these complex defects. It shows how Tessier was able to plan and reason in three dimensions (sometimes with the help of innovative 3D scans) step by step until the final stage, an aspect essential to craniofacial surgery. His post-operative comments and self-criticism were also key to his progress and success as a surgeon.

Tessier's approach was to base all procedures on the reconstruction of bony scaffolds. As quoted from one the patient's notes he operated on in Iran: Le fonctionnel est toujours morphologique donc esthétique (Function always derives from morphology and is thus esthetic). Even large mandibular defects from molar to molar were reconstructed using macroplates and numerous bone grafts. Tessier also believed in craniofacial "'autarchy'", meaning that he considered the head and neck to be self-sufficient for reconstruction, and preferred when possible to use parietal bone grafts and local reconstructions [START_REF] Wolfe | A man from Héric. The life and work of Paul Tessier, MD, father of craniofacial surgery Lulu.com[END_REF]. Indeed, as confirmed by the good results in this series and by other authors, iliac and parietal bone grafts seem to be equivalent to fibula free flaps for bone reconstruction and can provide the necessary structure for implants [START_REF] Mertens | Early bone resorption of free microvascular reanastomized bone grafts for mandibular reconstruction -A comparison of iliac crest and fibula grafts[END_REF].

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT 6
Tessier and his team used mostly conventional local flaps such as heterolabial flaps or muscoal flaps for soft tissue reconstruction. However, two methods need to be discussed. For the inner lining of the cheek, the Baron-Tessier platysma flap is preferred in most cases. This technique, offers a reliable large provision of thin pliable skin and muscle equivalent or superior to free flap reconstruction of the inner cheek [START_REF] Talmant | Use of neck muscle in the correction of facial asymmetry. The Barron-Tessier flap[END_REF][START_REF] Tessier | Platysma-based myocutaneous clavicular island flap for intraoral reconstruction[END_REF]. It is also easy and quick to harvest and does not require a specialized follow-up like free flaps.

The other interesting technique specific to these defects in male patients is the visor scalp flap which is used in each case where reconstruction of the beard region was necessary. It is a reliable flap with good esthetic results for upper and lower lip defects in males wearing a beard or moustache. Other advantages are easy harvesting and direct closure of the donor site [START_REF] Rasse | The platysma myocutaneous visor flap for intraoral reconstruction. A case report[END_REF][START_REF] Hafezi | Nouhi: Facial reconstruction using the visor scalp flap[END_REF].

The major drawback of this series is the lack of long-term follow-up of the patients, although the short-term (and even mid-term) follow-up available to us in Tessier's notes is more than satisfactory.

Conclusion:

Tessier and his team successfully reconstructed this series of patients with craniofacial war injuries in Iran. This was achieved by implementing a strict two-phase protocol starting with bone and soft tissue reconstruction and secondary implant placement 6 months later. Local flaps were always used as well as parietal (if accessible during the operation) or iliac bone grafts. This series emphasizes that humanitarian treatment and especially surgical procedures need to be as simple as possible. • Importance of pre-operative 3D step by step planning;

• Protocol: implants 6 months after soft tissue and bone reconstruction;

• Local flaps preferred to free flaps.

:

  We collected data on the patients operated on by Paul Tessier and his team in post-war Iran from the Paul Tessier collection stored at the Amiens University of the Association Française des Chirurgiens de la Face). Tessier took precise notes of the consultations and surgical procedures including photographs of the patients and radiology.

  genioplasties and one sagittal split of the mandible. Three patients entered an orthodontic rehabilitation program in collaboration with the local dental school. Control radiographs were orthopantomogram and lateral and frontal cephalograms. Fifteen cases had CT-scans, of M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT 4

Fig. 1 :

 1 Fig. 1: Lower jaw reconstruction using parietal bone grafts. (a) Initial presentation after

Fig. 2 :

 2 Fig. 2: Combination of soft-tissue and hard-tissue procedures in lower-jaw

Fig. 3 :

 3 Fig. 3: Combination of soft-tissue and hard-tissue procedures in lower-jaw

Fig. 4 :

 4 Fig. 4: Complex maxilla reconstruction using multiple grafts (see text). (a) Pre-operative

•

  Detailed account of Paul Tessier's approach to post-war maxillofacial injuries;

Table 1 . Wound type

 1

		Shell	Bullet	Grenade	Blunt trauma Not Available
	n	17	7	1	2	16
	%	40	17	2	4	37

Table 2 . Type of reconstruction before implant

 2

		Le Fort 1	Genioplasty	Other hard*	Lip	Cheek	Other soft**	Bone graft
	n	6	3	3	9	4	5	24
	%	14%	7%	7%	21%	9%	11%	56%
		*Includes sagittal split and hemi-Le Fort I; **Includes scar excision, canthopexy and debulking.

Acknowledgement

The authors would like to express their sincere gratitude to the Association Française des Chirurgiens de la Face (AFCF) for granting access to the documents and photos of the Tessier Collection (Centre Hospitalo-Universitaire d'Amiens, Université de Picardie).

Conflict of interest

The authors do not have any commercial or other association that might pose a conflict of interest. The authors did not have any financial support to write this paper. Written patient consent has been obtained to publish clinical photographs. All authors have viewed and agreed to the submission.

M A N U S C R I P T A C C E P T E D ACCEPTED MANUSCRIPT