Matthieu Pigaglio

Joachim Bruneau-Queyreix

Yérom-David Bromberg

Davide Frey

Etienne Rivière

Laurent Réveillère

RAPTEE: Leveraging trusted

Keywords:

published or not. The documents may come

Abstract-Peer sampling is a first-class abstraction used in distributed systems for overlay management and information dissemination. The goal of peer sampling is to continuously build and refresh a partial and local view of the full membership of a dynamic, large-scale distributed system. Malicious nodes under the control of an adversary may aim at being over-represented in the views of correct nodes, increasing their impact on the proper operation of protocols built over peer sampling. State-of-the-art Byzantine resilient peer sampling protocols reduce this bias as long as Byzantines are not overly present. This paper studies the benefits brought to the resilience of peer sampling services when considering that a small portion of trusted nodes can run code whose authenticity and integrity can be assessed within a trusted execution environment, and specifically Intel's software guard extensions technology (SGX). We present RAPTEE, a protocol that builds and leverages trusted gossip-based communications to hamper an adversary's ability to increase its system-wide representation in the views of all nodes. We apply RAPTEE to BRAHMS, the most resilient peer sampling protocol to date. Experiments with 10,000 nodes show that with only 1% of SGXcapable devices, RAPTEE can reduce the proportion of identifiers of Byzantine nodes in the view of honest ones by up to 17%, when the system contains 10% of Byzantine nodes. In addition, the security guarantees of RAPTEE hold even in the presence of a powerful attacker attempting to identify trusted nodes and injecting view-poisoned trusted nodes.

I. INTRO

Peer sampling is a first-class abstraction for the construction of large-scale distributed systems. It is notably used for overlay management [START_REF]T-man: Gossip-based fast overlay topology construction[END_REF], [START_REF] Voulgaris | VICINITY: A Pinch of Randomness Brings out the Structure[END_REF] and information dissemination [START_REF] Eugster | Lightweight probabilistic broadcast[END_REF], [START_REF] Matos | Lightweight, efficient, robust epidemic dissemination[END_REF]. Typically, nodes possess partial knowledge (also referred to as their view) of the global and dynamic system membership. The goal of the peer-sampling distributed service is to bootstrap and continuously refresh this local view so that it corresponds as much as possible to a uniform sample of alive nodes in the system. The implementation of the peersampling service is typically based on gossip protocols leveraging simple, periodic peer-wise exchanges of information. A plethora of protocols have been published and studied [START_REF] Anceaume | Uniform node sampling service robust against collusions of malicious nodes[END_REF], [START_REF] Jelasity | Gossip-based peer sampling[END_REF], [START_REF] Voulgaris | Cyclon: Inexpensive membership management for unstructured p2p overlays[END_REF] under considerations of crash faults, churns, performance, ergodicity, and desirable structural properties such as balanced in-degree, low diameter, and ability to quickly remove departed nodes from the views of alive ones.

The resilience of peer-sampling protocols to Byzantine faults is crucial for the security of applications relying upon it. Indeed, malicious nodes that succeed in becoming overrepresented in the views of honest nodes can gain control of the upper-layer protocols. For example, the peer-sampling protocol of Bitcoin was discovered to be exposed to eclipse attacks [START_REF] Heilman | Eclipse Attacks on Bitcoin's Peer-to-Peer Network[END_REF], opening the door to multiple types of selfish mining and double-spending attacks at the consensus level. In stateof-the-art Byzantine-resilient peer-sampling protocols [START_REF] Anceaume | Uniform node sampling service robust against collusions of malicious nodes[END_REF], [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF], the views of honest nodes can swiftly be poisoned with Byzantine identifiers as the proportion of malicious nodes in the system grows. With BRAHMS [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF], the most Byzantineresilient protocol, the views of honest nodes may contain up to 81% of Byzantine identifiers (IDs) when 18% of the nodes in the system are malicious.

The advent of trusted execution environments (TEEs) has exposed many desirable properties for distributed systems, notably remote attestation, authentication, integrity, and confidentiality of the execution environment. This paper shows how the resilience of peer-sampling protocols to Byzantine behaviors can be improved with these TEE properties. In this paper, we consider Intel's Software Guard Extensions (SGX) [START_REF] Costan | Intel SGX Explained[END_REF] released in 2015, but any TEE technology providing similar code integrity validation properties would be a fit for our approach, e.g., ARM's TrustZone [START_REF] Pinto | Demystifying ARM TrustZone: A comprehensive survey[END_REF].

We present RAPTEE, a novel protocol that integrates trusted communications in the peer-sampling-service operation and interoperates them with BRAHMS. We consider a system composed of honest and Byzantine nodes, along with a small proportion of trusted nodes (i.e., SGX-capable devices). Because trusted nodes cannot act maliciously, RAPTEE accelerates the dissemination of knowledge they possess while slowing down the action of Byzantine nodes and preventing the identification of trusted nodes by an adversary.

In RAPTEE, all nodes execute a modified version of BRAHMS. However, trusted nodes are not bound to strictly execute BRAHMS when interacting with other trusted nodes, even though they can possess Byzantine IDs in their views. Contrarily, when communicating with untrusted nodes, additional Byzantine-tolerance countermeasures are required. They consist of adaptively ignoring part of the IDs sent by untrusted nodes. This voluntary loss of information enables higher resilience. Indeed, it reduces the ability of an attacker to pollute the views of trusted nodes by sending them bulks of malicious IDs, which makes trusted nodes act as sources of less biased identifiers than untrusted nodes.

Because trusted nodes can improve the system's Byzantine resilience, they are of utmost interest for malicious nodes in performing targeted attacks and eclipsing them from the system. It becomes clear that they cannot advertise themselves as trustworthy actors and should remain hidden in the mass. Accordingly, RAPTEE leverages the ability of trusted nodes to learn their mutual trusted capacity without revealing it to others. Ignoring IDs also hampers the dissemination of correct IDs transmitted by honest nodes, which could have a significant impact on system convergence in the time it takes to discover a majority of nodes. To address this problem, RAPTEE makes trusted nodes exchange information in a disseminationefficient way using gossip-based peer-sampling interactions following the framework of Jelasity et al. [START_REF] Jelasity | Gossip-based peer sampling[END_REF].

Our experiments with 10,000 nodes on the Grid 5000 [START_REF] Bolze | Grid'5000: a large scale and highly reconfigurable experimental grid testbed[END_REF] testbed show that with no more than 1% of SGX-capable devices, RAPTEE can reduce the proportion of Byzantine IDs in the views of honest nodes by up to 17% when the ratio of Byzantine nodes in the system is 10%. This resilience gain comes at the expense of a limited overhead of 10% in terms of the required number of rounds to view stability and 12% for system discovery. We assess the security risks of RAPTEE against two types of attack: trusted-node identification and view-poisoned trusted node injection. We show that the identification attack is particularly inefficient before the system converges and is impossible once this point is reached. Considering injecting trusted nodes with polluted views, we show that it has little to no impact on the system's resilience and that trusted nodes can self-heal with RAPTEE. Outline. First, we provide some requisite background knowledge on BRAHMS and on the general gossip-based peersampling framework in Section II. Then, we provide a highlevel overview of RAPTEE with its models and objectives in Section III. We describe RAPTEE and detail how it complements BRAHMS with trusted communications in Section IV. Section V exposes the experimental methodology used to evaluate the performance and resilience of RAPTEE under different configurations and discusses the results. We provide a security assessment of RAPTEE to trusted-node-identification and corrupted-trusted-node-injection attacks in Section VI. We summarize our findings in Section VII and review the state of the art in Section VIII before concluding in Section IX.

II. BACKGROUND

We start by presenting background on gossip-based peer sampling and on the BRAHMS protocol [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF]. Gossip-based peer sampling: Gossip is a mode of operation for large-scale distributed systems based on repeated, periodic peer-to-peer interactions between pairs of peers [START_REF] Riviere | Gossip-based networking for internet-scale distributed systems[END_REF]. Despite the general simplicity of these local interactions, Gossip protocols exhibit very good global robustness properties (i.e., the ability to resist high levels of churn or survive network partitions) thanks to their self-organizing nature [START_REF] Babaoglu | Design patterns from biology for distributed computing[END_REF], [START_REF]T-man: Gossip-based fast overlay topology construction[END_REF]. These properties often depend, however, on the quality of the random process that determines the participants in these peerwise interactions. This selection of communication partners at each period should be as close as possible to a uniform random draw amongst all participating nodes, including newly joined ones and excluding departed or failed ones. The peer-sampling service plays a fundamental role in ensuring this property.

Interestingly, the most efficient way to implement a peersampling service for use by other protocols, gossip-based or not, is to design it as a gossip-based protocol itself. The goal of such a protocol is to equip each node of the system with a view, e.g., a sample of other nodes in the system. The graph formed by the who-knows-whom relations with these views should be as close as possible to a random graph of fixed out degree. As such, it should have balanced in-degrees (to prevent nodes from being under or over-represented in the views of other nodes), a low diameter, and a low clustering coefficient. In addition, these properties must be enforced while quickly including newly joined peers in the views of other nodes (so as to match their in-degree, and therefore the probability of being selected as a gossip partner, to that of existing nodes) and quickly removing departed or failed nodes. Addressing these different requirements simultaneously is, unfortunately, impossible and gossip-based peer-sampling protocols are the result of a compromise between them.

Jelasity et al. [START_REF]T-man: Gossip-based fast overlay topology construction[END_REF] proposed a universal framework for the design of gossip-based protocols that encompasses previous designs with emphasis on a specific property (e.g., balanced in degree and low clustering for Cyclon [START_REF] Voulgaris | Cyclon: Inexpensive membership management for unstructured p2p overlays[END_REF] or efficient dynamic membership for Newscast [START_REF] Tölgyesi | Adaptive peer sampling with Newscast[END_REF]). This framework defines two parameters, H (for Heal) and S (for Shuffling), that drive the exchange of (partial) views of size c between peers, in addition to other parameters such as the policy for partner selection or the policy for the link deprecation in individual nodes' views. On the basis of the recommendations of Jelasity et al. [START_REF]T-man: Gossip-based fast overlay topology construction[END_REF], we apply this framework with the following criteria. (1) Peers initiate an exchange with the peer that has been for the longest time in their view, on the basis of an age parameter associated with its entries. This effectively enables a round robin probing of view neighbors. (2) They exchange half of their view, and the initiator peer inserts a link to itself in the view sent to the gossip partner. (3) The exchange favors the shuffling of the links, i.e., a link sent from the initiator will be kept only by the partner, and vice-versa. BRAHMS: This protocol presented by Bortnikov et al. [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF] is designed for large and dynamic systems prone to Byzantine failures and sybil attacks. With high probability, BRAHMS prevents an attacker from creating a partition between correct nodes, and allows each node's view to converge to a uniform random draw of all participating nodes over time. The main ideas behind Brahms are to use push-pull gossip-based membership with some additional defense mechanisms to prevent local views from being exclusively composed of Byzantine IDs, and to correct bias in the views resulting from attacks. We briefly describe the two components of BRAHMS employed by each node before detailing these defense mechanisms.

BRAHMS has two components. The first is a gossip compo-nent. Each node spreads locally known IDs across the system and maintains a dynamic view V of l 1 entries. The second is a local sampling component that enables each node to maintain a sample list S of l 2 entries uniformly sampled from the received IDs. Uniformity is obtained by a min-wise independent permutation [START_REF] Broder | Min-Wise Independent Permutations[END_REF] technique. Initially, each node possesses a list containing node IDs and addresses obtained from a bootstrap node. Periodically, a BRAHMS node, through the gossip component, selects from its dynamic view V both α × l 1 nodes, to send them push messages containing its own ID, and β × l 1 nodes, to send them pull-request messages in order to retrieve their views. At the end of each round, the sample list S is updated via the sampling component, while the dynamic view V is renewed by randomly selecting: (i) α × l 1 IDs received from push messages, (ii) β × l 1 IDs from pull answers, and (iii) γ × l 1 IDs from the sample list (referred to as the history sample), with α + β + γ = 1, as shown in Figure 1.

⍺l 1 𝛾l 1 𝛽l 1 l 2

Pushed IDs

Pulled IDs Sampling

Sample list S Dynamic View V

History sample

Fig. 1: BRAHMS view computation

As depicted in Figure 2, the sampling component consists of l 2 samplers. It takes as input a stream of identifiers received from push or pull messages and produces a sample list of size l 2 . At initialization, each sampler chooses a hash function at random. A sampler takes an identifier as input and computes its hash. If the calculated hash is smaller than the one corresponding to a previously stored identifier, the sampler produces the new identifier and stores it in its local memory. Otherwise, the sampler outputs the stored ID.

Sample list

Fig. 2: BRAHMS sampling component

The four defense mechanisms that prevent partitioning and allow convergence to uniform sampling are the following: (i) limited pushes, (ii) attack detection and blocking, (iii) controlling the contribution of pulls versus pushes, and (iv) history sampling. We detail these mechanisms in the following. (i) An adversary could forge identities or flood the system with push requests, leaving correct IDs propagated mainly through pulls and diminishing their representation exponentially. BRAHMS assumes a mechanism that limits the message sending rate of nodes, for example, via computational challenges like Merkle's puzzles, virtual currency, etc. (ii) Limiting push messages prevents a simultaneous attack on all correct nodes but does not protect against flooding a targeted node. To do so, BRAHMS blocks dynamic view updates if more than the expected α × l 1 pushes are received. This policy slows down progress but its expected impact in the absence of attacks is bounded, and thanks to limited pushes, some nodes make progress even under attack. (iii) Node views are threatened by pulls from neighbors more than by adversarial pushes. Pushes from correct nodes are correct, but pull answers from correct nodes may contain some identifiers of Byzantine nodes. Hence, the contribution of pushes and pulls to V must be balanced. Brahms updates V with randomly chosen α×l 1 pushed IDs to protect targeted nodes, and β×l 1 pulled IDs to protect the rest.

(iv) The attack detection and blocking technique slows down a targeted attack but cannot prevent it completely. A node victim of targeted pushes will pull more IDs from Byzantine nodes, send fewer pushes to correct ones, causing its systemwide representation to decrease, hence receiving fewer correct pushes. Brahms overcomes such an attack using a self-healing mechanism by incorporating in the view an unbiased historical sample of γ×l 1 IDs from the sample list S. Once some correct ID becomes the permanent sample of the node under attack (or if the node's ID becomes a permanent sample of another correct node) the threat of isolation is eliminated.

Results on Figure 3 show resilience (percentage of Byzantine IDs in the views of correct nodes), time to discovery (number of rounds required for all nodes to discover at least 75% of non-Byzantine IDs) and time to view stability (number of rounds necessary for all non-Byzantine node views to be polluted within 10% of the average proportion of Byzantine IDs in the views non-Byzantine nodes) of BRAHMS under different shares of Byzantine nodes in the system. The Brahms parameters are set as recommended in the original paper [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF], namely α = β = 0.4 and γ = 0.2.

III. MODELS AND OBJECTIVES

We present our system model and objectives, followed by our trust and adversarial models. We consider a system of N nodes composed of a fraction f of Byzantine nodes that can deviate from the protocol in any possible way, a fraction t of trusted nodes, and a fraction h = 1 -f -t of honest (or correct) nodes that execute BRAHMS. Each node is identified by a unique ID, chosen when the node becomes active for the first time. Figures 4 gives an overview of RAPTEE and depicts the interactions between the different types of nodes.

Honest nodes aim to get a uniform sample of the global membership. They execute a modified version of BRAHMS to exchange identifiers. RAPTEE relies on both the pushpull gossip and sampling components of BRAHMS as detailed in Section II, as well as on its defense mechanisms. Push messages include only the sender's identifier, while responses to pull requests contain the full view of the requested node.

Interactions between different types of nodes are designed to slow down the discovery of IDs possessed by untrusted nodes and accelerate the dissemination of IDs possessed by trusted nodes. To do so, trusted nodes filter out pull answers from untrusted ones by evicting part of the received IDs. During trusted communications, trusted nodes exchange view parts following the instantiation of the Gossip-based Peer Sampling framework [START_REF] Jelasity | Gossip-based peer sampling[END_REF] and as detailed in the previous section. To decide on the types of node interactions (e.g., trusted to untrusted, trusted to trusted, etc.), RAPTEE includes a mutual authentication protocol that precedes all pull requests.

B. Trust and adversarial models

We consider an adversary controlling all Byzantine nodes with two objectives: successfully over-representing the systemwide fraction of Byzantine IDs in the partial membership knowledge of all nodes and identifying trusted nodes to evict them from the system. The adversary has access to the system's global membership, including Byzantine and correct nodes, but is unaware of the location or amount of SGXcapable devices. In the original BRAHMS paper [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF], the authors prove that a balanced attack, which spreads faulty pushes evenly among correct nodes, maximizes the expected systemwide fraction of faulty IDs. Additionally, thanks to its history sample mechanism, BRAHMS sustains targeted attacks where the adversary tries to partition the network by targeting a subset of nodes and sending more pushes than in a balanced attack. Because RAPTEE is built on top of BRAHMS and inherits its properties, our adversary exclusively advertises Byzantine IDs to honest ones via answers to pull requests and evenly balanced push messages. We identify two additional attack vectors stemming from the addition of trusted nodes into the system. The first one consists of identifying trusted nodes to isolate them from non-Byzantine nodes, launching targeted attacks on them to pollute their views, and inserting them back into the system. The second one exploits the possibility of purchasing SGX-capable devices and bootstrapping their lifecycle by surrounding them with Byzantine nodes to almost fill their views with Byzantine IDs.

We rule out Sybil attacks [START_REF] Douceur | The Sybil Attack[END_REF] by relying on the Sybil resilience of BRAHMS that limits the message sending rate of nodes via computational challenges like Merkle's puzzles, virtual currency, etc. We assume that trusted nodes can only crash fault. They cannot act maliciously even though Byzantine IDs can bias their view. Our implementation uses specifically Intel SGX [START_REF] Costan | Intel SGX Explained[END_REF]. We trust Intel for the certification of genuine SGX-enabled CPUs, and we assume that the code running inside enclaves is properly attested before being provided with secrets. We assume Byzantine nodes can neither break cryptographic primitives nor read data available in the trusted environment of SGX-capable devices. We also assume that it is impractical for an adversary to extract secrets from the enclave using side-channel attacks, having no physical access or means to colocate a process on a target machine. Communications between any two nodes, including trusted ones, are ciphered with symmetric encryption to protect against an eavesdropping adversary. We consider that an adversary does not have global access to communication links in the network that do not involve itself and cannot, therefore, infer information from communication patterns.

IV. INTEROPERATING TRUSTED COMMUNICATIONS WITH BYZANTINE RESILIENT PEER SAMPLING

We detail in this section the main components of RAPTEE: mutual authentication, which allows trusted nodes to be recognized in the mass; trusted communication, which accelerates the dissemination of knowledge between trusted nodes; and Byzantine eviction, which slows down view poisoning.

A. Mutual authentication

To enable trusted nodes to know whether they are communicating with other trusted nodes, we design a secure mutual authentication protocol that is executed by all nodes before issuing a pull request to a selected neighbor in the dynamic node view. We assume that all nodes have one symmetric secret key. Each untrusted node generates a random secret key during the initialization phase. Conversely, trusted nodes share a common secret key that is provisioned during the remote-attestation phase. The mutual authentication protocol between two nodes A and B operates as follows. First, A generates a pseudo-random number r A and sends it to B via a cryptographic challenge. In turn, B generates another pseudo-random number r B and computes the hash of the concatenation of r A and r B , H(r A • r B ), and encrypts it with its own secret key obtaining

[H(r A • r B )] K B . Then, B sends r B and [H(r A • r B )] K B to A. Upon reception, A computes H(r A • r B ) and deciphers [H(r A • r B )] K B using its own secret key K A .
If the two values are identical (i.e., A and B share the same secret key), A can identify B as trusted. Then, A sends [H(r B •r A )] K A to B. Like A, B deciphers this encrypted hash using its own secret key K B and compares it with H(r B •r A ). If the two are equal, B can also identify A as trusted.

B. Trusted communications

We aim to accelerate the dissemination of identifiers among trusted nodes, and spread these to untrusted nodes. When two trusted nodes authenticate each other in a round, they can trust each other to not deviate from the protocol other than through crash failures. For this reason, trusted nodes perform a trusted peer-sampling phase during the current round, in which they exchange and sample identifiers in a manner different from that described for BRAHMS. During the trusted communication phase, each node follows the two following measures. First, it swaps half of its view with half of the remote node's view. Then, it transmits the received IDs to the list of pulled IDs in the BRAHMS protocol. The first measure allows trusted nodes to gossip more of the IDs they receive from other trusted nodes during the round (via pull messages). The second takes into account the IDs transmitted by other trusted nodes to update the sample list, and renews the dynamic view during the random selection of β × l 1 pulled IDs.

C. Byzantine eviction

Since pull answers from Byzantine nodes contain exclusively Byzantine IDs, one could think that if trusted nodes did not send any pull requests, they could prevent the poisoning of their views. However, this simple approach would open the door for an attacker to identify trusted nodes and eclipse them from the system. Indeed, they would behave differently from untrusted nodes, and monitoring their messages would make them easily identifiable. For this reason, trusted nodes send pull requests in the same way as untrusted nodes and remain hidden from the sight of an eavesdropping adversary.

Nonetheless, they can integrate an additional defense mechanism to protect their views from view-poisoning attacks without revealing themselves to the adversary. At the end of each round, they can ignore part of the pulled IDs from untrusted nodes by not passing them to the BRAHMS sampling component and by ignoring them during the renewal of the pulled β × l 1 entries of the node's dynamic view V .

We refer to the proportion of ignored pulled IDs as the eviction rate. It can be a fixed value (between 0 and 100%) for the entire system. A 100% eviction rate allows the peer sampling service to construct views as if the trusted nodes were not issuing any pull requests. The eviction rate can also be adaptive and local for each trusted node. That is, its value is set according to the proportion of trusted nodes with which the trusted node has exchanged identifiers during the current round. The intuition behind adapting the eviction rate value is that the greater the share of trusted nodes contacted during the current round, the greater the number of IDs received from trusted nodes, and the fewer the attempts to poison their views from pull responses from Byzantine nodes. If a trusted node exchange messages with many other trusted nodes in a round, then it will evict a smaller share of IDs received from untrusted nodes compared to when it contacts a few, if any, trusted nodes. We establish the following adaptive rule to determine the value of the eviction rate. First, we limit its value between 20%, when the proportion of trusted communications is above 80%, and 80%, when it is below 20%. A linear function governs the value of the eviction rate within these two limits.

Although evicting IDs from pull responses leads to fewer poisoned views of trusted nodes compared to non-Byzantine untrusted ones, it also helps an attacker identify trusted nodes. Indeed, Byzantine nodes can compare the composition of pull responses from the nodes they contact and isolate the responses that contain the fewest Byzantine IDs. We assess this identification risk in section VI.

V. EXPERIMENTAL EVALUATION

Our evaluation aims to answer the following research questions: (1) By how much does RAPTEE increase resilience to Byzantine faults compared to BRAHMS? (2) How much does RAPTEE impact the performance of BRAHMS in terms of convergence time to system discovery and to view stability?

The implementation of RAPTEE used for our experiments consists of 1,200 lines of C++ code, shared between trusted and untrusted nodes. The code that runs inside trusted nodes uses the Intel SGX SDK 1 and amounts to about 800 additional lines of C++ code. Cryptographic operations use Intel's OpenSSL SGX port2 , using RSA for asymmetric encryption and the AES-CTR mode for symmetric encryption. The code that runs on untrusted nodes features about 300 additional lines of C++. Since we do not have access to a large infrastructure supporting SGX-capable devices, we first perform a micro-benchmark to evaluate the overhead of running the code of RAPTEE's trusted node in a real SGX environment compared to an emulated SGX environment. It enables us next to calibrate our emulated SGX environment to conduct a representative large-scale experiment involving 10,000 nodes in the Grid 5000 testbed.

A. Overhead of using SGX nodes

Our first set of experiments are performed on a cluster of 40 physical machines. Each machine is an Intel Next Unit of Computing (NUC) Kit with a 2-core 3.50 GHz Intel i7 processor and 32 GB of RAM 3 . We consider a testbed of 200 nodes, with five nodes per machine. We instrumented the RAPTEE's code that runs inside the trusted nodes to measure the CPU-cycle consumption of each of the following functions: pull requests, push messages, trusted communication, sample list computation, dynamic view computation. We also implemented a modified version of the trusted code that emulates SGX and runs on non-capable SGX devices. We then compare the execution time of these functions on both capable and noncapable SGX devices. We run two sets of experiments. In the first set, we deploy 100 untrusted nodes and 100 trusted nodes whose code actually uses SGX capabilities. In the second set, the 100 trusted nodes use the emulated version of the code instead. To start the experiment, each node initiates RAPTEE with a view composed of a uniform random sample of the global membership. A single experiment lasts for 200 rounds of 2.5 seconds each. We empirically set the number of rounds to 200 to ensure protocol convergence. We repeat each experiment 100 times and collect measurements at each iteration. We then compare the running time of operations on the emulated SGX nodes and on the real SGX ones, and compute the associated overhead. Table I shows these running times together with the mean and standard deviation of the CPU-cycle overhead for the functions under consideration. We use this overhead to calibrate our emulated implementation in the rest of our experiments.

B. Large-scale experimental setup

We emulate the behavior of SGX-capable nodes in a larger testbed hosted on Grid 5000. We increase the latency of each function that needs to be executed in SGX by adding a random delay that depends on the mean CPU-cycle overhead and follows its standard deviation, based on the data in Table I. Our emulated testbed consists of 10,000 nodes, running on 20 machines, each with two 16-core CPUs and 192 GB of RAM. The use of 10,000 nodes reflects approximately the sizes of the Tor (∼ 8,000 relays) and Bitcoin (∼ 15,000 nodes) networks.

We evaluate the resilience of RAPTEE and compare it to the nominal value of BRAHMS (see Section II). Resilience improvement is defined as the percentage drop in the number of Byzantine identifiers in the views of correct nodes. We also evaluate the performance of RAPTEE compared to BRAHMS on two other indicators: system-discovery time and viewstability time. As in the case of BRAHMS (Section II), systemdiscovery time is defined as the number of rounds required for 3 One of the models recommended by Intel for experimenting with SGX.

all nodes to discover at least 75% of non-Byzantine IDs. Viewstability time is defined as the number of rounds necessary for all non-Byzantine node views to be polluted within 10% of the average proportion of Byzantine IDs in the views of non-Byzantine nodes. We measure the performance overhead in terms of a percentage of additional rounds.

Each node runs an experiment for 200 rounds of 2.5-seconds each, during which it records the composition of its view in terms of Byzantine and honest IDs. We repeat each experiment 10 times to consolidate the results. An experimental setup consists of selected proportions of Byzantine nodes, f , and trusted nodes, t, and a fixed Byzantine eviction rate. We vary f from 10% to 30% with a step of 2%, t from 1% to 50%, and the eviction rate from 0% to 100%. We also consider the adaptive eviction rate mechanism which does not require setting a specific value. While honest nodes follow the protocol, Byzantine nodes push faulty IDs to correct nodes and always return faulty IDs to pull requests. We set the view size to 200 entries.

Figures 5 to 8 show the results of our experiments for different configurations of the Byzantine eviction rate. Their corresponding subfigures a, b, and c represent resilience improvements, system-discovery overhead, and view-stability overhead as a function of the proportions of Byzantine and trusted nodes, respectively. Finally, Figure 9 shows the benefits of relying on our adaptive eviction rate mechanism.

C. Resilience improvements

As shown in Figures 5a,6a, and 7a, a minimum of 1% of trusted nodes (t = 1%) allows RAPTEE to decrease the proportion of Byzantine IDs in the views of honest nodes by 4% under a 0% eviction rate and by 7% under a 60% eviction rate The incremental increase in t up to 50% provides further improvements in resilience, although sublinearly, up to 15%. Furthermore, the proportion f of Byzantine nodes has no impact on resilience improvements.

Considering an eviction rate of 100% might be a good idea at first glance. Indeed, for as few as 10% of Byzantine nodes, Figure 8a shows that this configuration outperforms the previous ones, providing resilience improvements ranging from 11% to 21%. However, as soon as f increases, the improvements drop, reaching between 0 and 5% percent with a Byzantine ratio of 30%, highlighting the questionable aspect of increasing the eviction rate to such an extent. A 100% eviction rate delays the process by which trusted nodes learn about other trusted nodes since only pushed IDs from the BRAHMS protocol can enter their views. This slowdown favors Byzantine nodes because they can pollute the views of honest nodes faster than trusted nodes could meet.

As shown in Figure 9a, the curves of the adaptive eviction rate have a similar shape to the 100%-eviction-rate case. However, the resilience improvements are better than any of the fixed rate scenarios described above when the fraction of Byzantine nodes is below 26%. With only 10% of Byzantine nodes, RAPTEE offers resilience improvements of between 18% and 25% over BRAHMS.

D. Performance overhead

The overhead in terms of system discovery and view stability of RAPTEE increases when the eviction rate increases. However, relatively high eviction rates provide better protection against view poisoning. The adaptive eviction-rate configuration provides optimal results with overhead close to that of the 0%-eviction-rate configuration as well as the highest level of resilience. Increasing t drives up the overhead to a tipping point when larger shares of trusted communication compensate for the propagation of Byzantine IDs that slow down the discovery of non-Byzantine nodes. The overhead values of system discovery and view stability are closely related, and we can draw similar trends and interpretations. For this reason, we only comment on the system-discovery overhead in the remainder of this section.

Figure 5b shows the system-discovery overhead of RAPTEE with a 0% eviction rate. This overhead is negligible and does not exceed 3% when the number of trusted nodes is very small (t = 1%). Indeed, in this configuration, trusted nodes can hardly find their siblings in the mass, making trusted communication rare and making it unlikely that malicious nodes will send Byzantine IDs to trusted nodes. Moreover, this overhead remains constant regardless of the proportion of Byzantine nodes. In other words, since trusted nodes do not evict any ID from pull responses, discovery time is barely affected by Byzantine attempts to pollute views compared with our baseline results with BRAHMS.

The system-discovery time behaves differently as the share of trusted nodes increases. When f is less than 14-16%, the time required for system discovery is actually lower than in the case of BRAHMS, with a maximum gain of 18% when considering 50% of trusted nodes. With an eviction rate of 0%, trusted nodes can quickly discover their siblings, leaving the field open for trusted communication to take over with efficient dissemination of IDs, sending them back to the honest nodes that run BRAHMS. Nonetheless, when f exceeds 14-16%, attacks by Byzantine nodes to poison the views of honest nodes hinder the benefits of efficient trusted communication, and the protocol suffers an overhead of 3-16% depending on the shares of trusted nodes considered.

A particular pattern of discovery time should be noted. For f greater than or equal to 16%, the most extreme values of t lead ) incur the highest overhead. This bell-shaped pattern results from trusted nodes' having Byzantine identifiers in their views that are advertised by malicious nodes and their sharing them with other trusted nodes. As a result, this rapid dissemination of Byzantine identifiers slows the discovery time of the entire system, which relatively small shares of trusted nodes (i.e., small values of t) cannot compensate for. A tipping point is reached once t exceeds 20%. Overhead decreases, resulting in a higher proportion of trusted nodes broadcasting more non-Byzantine identifiers.

A similar but amplified bell curve is observed in Figures 6b and7b where the eviction rate reaches 40% and 60% respectively. This exacerbated effect results from the fact that the total number of evicted identifiers increases as t increases from 1 to 10-20%, resulting in an additional delay in the discovery of the overall system which again is not compensated for by the relatively small share of trusted nodes.

Another trend is visible on all eviction-rate configurations, except for 0% (Figures 6b,7b,8b,9b). Overhead costs decrease as the proportion of Byzantines increases from less to more than 18-20%. Indeed, increasing f guides both the amount of non-Byzantine nodes and the amount of overadvertised IDs to non-Byzantine nodes. Therefore, fewer non-Byzantine identifiers and more over-advertised IDs have to be discovered, resulting in faster system discovery compared to lower values of f . The adaptive eviction-rate mechanism provides an optimal trade-off between performance overhead and resilience. With t as small as 1%, resilience is improved by 8-18%; system discovery and view stability require only 15-20% more rounds.

VI. SECURITY ANALYSIS

This section provides a security analysis of RAPTEE against two attack vectors: trusted node identification, and viewpoisoned trusted node injection.

A. Trusted node re-identification

In the original BRAHMS paper [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF], the authors prove that an adversary that tries to isolate nodes by launching targeted attacks on them cannot partition the network. However, RAPTEE's use of trusted communications makes trusted nodes a particularly attractive target for the adversary. If the adversary could identify these nodes, it could launch a targeted attack to pollute their views with Byzantine IDs. The adversary would thus have a backdoor to inject Byzantine IDs into the protocol to increase the dissemination speed of Byzantine IDs. This could inhibit the benefits of trusted communications on resilience to Byzantine behaviors and could further increase the time required to reach stability and to discover new peers. To evaluate this attack feasibility, we must distinguish between two cases: after reaching view stability and before.

We recall that view stability is defined as the state in which the maximum difference in view composition between any non-Byzantine node and the average of all non-Byzantine nodes does not exceed 10%. Our experiments show that once this state is reached, the difference in view composition between trusted and untrusted nodes does not exceed 2% on average. This difference is therefore much smaller than the 10% threshold used to define view stability. This makes it very difficult for an adversary to identify trusted nodes even with global knowledge of all views in the system.

On the other hand, before reaching view stability, trusted nodes propagate their views to untrusted nodes via answers to pull requests, which are sometimes (and purposely) significantly different from the views of untrusted nodes. To assess the extent to which this can lead to successful identification, we consider an attack in which each Byzantine node measures the proportion of Byzantine IDs in the pull answers it receives from each non-Byzantine node and provides this information to the adversary. The adversary first computes the average percentage of Byzantine IDs in the views of all honest nodes. Then, for each honest node, it computes the difference between this average percentage and the percentage of Byzantine IDs in the honest node's view. If the difference exceeds the threshold, the adversary labels the node as a trusted node. We experimentally tested several thresholds and the one that maximizes the identification outcome is 10%.

We evaluate the effectiveness of this attack with 10% of Byzantine nodes in Figures 10 and30% of Byzantine nodes in Figure 11. For each Byzantine configuration, we present recall (subfigures (a)), precision (subfigures (b)), and F1score (subfigures (c)) values for different values of evictionrate (denoted ER in the figures) and shares of trusted node. Figure 12 highlights the results with an adaptive eviction rate.

Results show that the effectiveness of the attack grows steadily with the percentage of trusted nodes in the system. It is clear that the more nodes of trust there are, the easier it is for the adversary to identify some of them. However, success rate also depends on the eviction rate. In particular, Figure 10 and Figure 11 show an increase in recall of 0.14 (14%) when the eviction rate is increased from 0 to 100%, and an increase in precision of about 0.12 under the same conditions. An eviction rate of 60%, for example, leads to an identification precision of 50% and a recall of about 30% with 20% of trusted nodes. Moreover, these values increase only slightly with the percentage of Byzantine nodes.

Although the above values may seem high, they are drastically reduced by adopting an adaptive eviction rate. Figure 12 shows that precision varies between 0 and 0.3 when going from 1 to 50% of trusted nodes and does not significantly depend on the proportion of Byzantine nodes. Recall follows a similar pattern, although with a stronger dependence on the percentage of Byzantine nodes. Its values range from 0.01 with 10% of Byzantine nodes, and 0.30 with 30% of Byzantine nodes.

B. View-poisoned trusted node injection

We have shown that trying to identify trusted nodes in order to isolate them bring only limited results for the adversary, especially with an adaptive eviction rate. As an alternative, the adversary can adopt a totally different strategy by purchasing SGX-capable devices and using them as a means of disseminating Byzantine node identifiers to real trusted nodes.

Specifically, the adversary can deploy some SGX-capable nodes in a network that contains only Byzantine nodes, in order to fill their views with Byzantine identifiers. The adversary can then move these view-poisoned trusted nodes into the actual network and wait for them to disseminate the Byzantine identifiers to the actual trusted nodes.

Figure 13 shows the effect of this attack in a network with different initial proportions of trusted nodes, t = 1%, 10%, and 30%. Each plot shows how the resilience-improvement metric varies as a function of the proportion of Byzantine nodes with several percentages of view-poisoned trusted nodes added by the adversary 1%, 5%, 10%, 20%, and 30%. In all the plots, the black line represents the baseline with t honest trusted nodes and no attacks.

When the proportion of honest trusted nodes is small, t = 1%, and for a relatively small proportion of Byzantine nodes, the addition of view-poisoned trusted nodes does not appear to significantly harm resilience. Figure 13a shows that adding a large number of view-poisoned trusted nodes even seems to improve resilience. Indeed, even view-poisoned nodes are forced to work with correct BRAHMS implementations. As a result, all trusted nodes, including view-poisoned ones, end up removing the overrepresented identifiers, and the viewpoisoned nodes end up reinforcing the trusted portion of the network. As the proportion of Byzantine nodes increases (to the right of the plot in Figure 13a), the sampling process becomes less effective at removing Byzantine identifiers from the views, thus decreasing the percentage resilience improvement.

As the proportion of honest trusted nodes increases from t = 10% in Figure 13b to t = 30% in Figure 13c, the benefit of having additional trusted nodes with a small portion of Byzantine nodes disappears as adding a fraction of trusted nodes to a larger set makes less of a difference and instead becomes significantly counterproductive, when t = 30%.

VII. DISCUSSION

Our experimental evaluation in Section V shows that RAPTEE can provide significant resilience improvement over BRAHMS. Its adaptive eviction strategy provides a 17% resilience improvement in the presence of 10% of Byzantine nodes at the minimal cost of 1% of trusted nodes. Even when the proportion of Byzantine nodes increases to 30%, RAPTEE still provides an 8% improvement.

Most importantly, our analysis in Section VI also shows that RAPTEE with 1% of trusted nodes effectively resists attackers that can (i) try to identify the trusted nodes in order to isolate them, or (ii) inject view-poisoned trusted nodes that try to spread malicious identifiers to honest nodes. With respect to (i), an attacker can identify only less than 10% of the trusted nodes with precision below 2% for an F1-score of less than 3%. When it is possible to increase the proportion of honest trusted nodes to 10%, RAPTEE provides even higher levels of resilience improvement above 20%, with trusted nodes becoming only slightly more detectable (precision and F1-score below 15%). With respect to (ii), an attack with 5% of viewpoisoned trusted nodes in a system with 1% of honest trusted nodes even improves resilience to Byzantine nodes when the latter's proportion is not too high (below 20%). Together these results suggest that RAPTEE can serve as an effective overlay for a number of Byzantine-sensitive applications like smartcontract platforms and cryptocurrencies. (c) Attack on a system with t = 30% Fig. 13: Corrupted trusted node injection Support from Intel SGX on personal computers in the future may be unclear. In light of the advent of side channel attacks requiring physical access or process co-location, it is possible that SGX might be available only on server-grade CPUs in the future. This could impact the proportion of SGX nodes that can participate in RAPTEE. We note, however, that even a small number of SGX nodes can provide significant improvement, mitigating the impact of this limitation.

VIII. RELATED WORK

Random peer sampling (RPS) has mostly been studied in non-adversarial environments. Cyclon [START_REF] Voulgaris | Cyclon: Inexpensive membership management for unstructured p2p overlays[END_REF], Newscast [START_REF] Tölgyesi | Adaptive peer sampling with Newscast[END_REF], and the more generic protocol framework for Gossip based peer sampling of Jelasity et al. [START_REF] Jelasity | Gossip-based peer sampling[END_REF] efficiently handle churn and quickly discover other nodes in the network. Our contribution uses such a RPS protocol between trusted nodes. However, these protocols are easily disturbed by Byzantine nodes performing eclipse or poisoning attacks.

A few studies targeted the problem of making RPS tolerant to Byzantine nodes [START_REF]On the power of the adversary to solve the node sampling problem[END_REF], [START_REF] Anceaume | Uniform node sampling service robust against collusions of malicious nodes[END_REF], [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF], [START_REF] Jesi | Secure peer sampling[END_REF]. In the Secure peer Sampling framework [START_REF] Jesi | Secure peer sampling[END_REF], each node uses a detection mechanism to identify and blacklist maliciously acting nodes. This protocol remains, however, vulnerable to rapid flooding attack as correct nodes cannot identify and blacklist attackers before being overwhelmed by them and isolated. RAPTEE reduces for trusted nodes the risk of isolation through such attacks by dropping pull requests answers from untrusted nodes.

Instead of using a detection mechanism, Brahms [START_REF] Bortnikov | Brahms: Byzantine resilient random membership sampling[END_REF] employs push limiting and view sampling in order to mitigate the over-representation of malicious nodes in the view of honest ones. The use of a Trusted Execution Environment in RAPTEE enables better performance than Brahms in terms of resilience against malicious nodes and alleviates some of the significant running time overhead of Brahms.

Anceaume et al. [START_REF] Anceaume | Characterizing the Adversarial Power in Uniform and Ergodic Node Sampling[END_REF] formally analyze the requirements of peer sampling protocols when these need to resist malicious attacks. They observe that a necessary condition lies in limiting the request rates of nodes. RAPTEE complements this measure with its eviction-rate policy. The same authors [START_REF]On the power of the adversary to solve the node sampling problem[END_REF], [START_REF] Anceaume | Uniform node sampling service robust against collusions of malicious nodes[END_REF] employ count-min sketches to unbias a biased stream of identifiers. Adopting a similar technique in RAPTEE could constitute interesting future work.

With respect to resistance to Sybil attacks, HAPS [START_REF] Bouchra Pilet | Foiling Sybils with HAPS in permissionless systems: An address-based Peer Sampling Service[END_REF] uses a prefix tree to limit the number of known identifiers in each IP-address prefix. This effectively limits Sybil attacks under the assumption that honest nodes are uniformly distributed over the IP address space. This idea is orthogonal to our rate-limiting mechanism and it could constitute an interesting addition to RAPTEE a large-scale deployment.

Finally, GossipSub [START_REF] Vyzovitis | GossipSub: Attack-resilient message propagation in the Filecoin and Eth2.0 networks[END_REF] is a recent proposal for strengthening the gossip-based dissemination in the Ethereum 2.0 and Filecoin networks. These open blockchain systems rely on gossip to quickly propagate of transactions and blocks between miners. GossipSub implements an ad hoc mesh construction protocol that maintains a balanced in-and out degree for nodes, as do protocols from the peer sampling family. This protocol does not, however, target diversity, i.e., the constant renewal of peers in the views of each node. This makes it specific for dissemination and unfit for other classes of gossipbased protocols such as overlay construction [START_REF]T-man: Gossip-based fast overlay topology construction[END_REF], [START_REF] Voulgaris | VICINITY: A Pinch of Randomness Brings out the Structure[END_REF] or self-organizing aggregation [START_REF] Jelasity | Gossip-based aggregation in large dynamic networks[END_REF]. GossipSub reduces the risk of attacks by implementing a reputation mechanism. Every node ranks peers in its view, and peers are incentivized to follow the protocol for a long period of time and with the same communication partners.

IX. CONCLUSION

We presented RAPTEE, a novel Byzantine-tolerant random peer sampling protocol that builds and leverages trusted gossip-based communication. RAPTEE interoperates with BRAHMS, the most resilient peer sampling protocol to date, and reduces the impact of a poisoning attack against its nodes. Our experiments show that with only 1% of SGX-capable devices, RAPTEE can reduce the proportion of Byzantine IDs in the views of honest nodes by up to 17% when the system contains 10% of Byzantine nodes, at the cost of very limited overhead. In addition, the security guarantees of RAPTEE hold even in the presence of a powerful attacker attempting to identify trusted nodes and injecting corrupted trusted nodes.

Fig. 3 :

 3 Fig. 3: BRAHMS resilience, time to discovery and time to stability under Byzantine faults

Fig. 4 :

 4 Fig. 4: Overview of the RAPTEE protocol A. System, operating models and RAPTEE's objectives

Fig. 5 :Fig. 6 :Fig. 7 :

 567 Fig. 5: Resilience improvement and performance overhead under a 0% eviction rate

Fig. 8 :Fig. 9 :

 89 Fig. 8: Resilience improvement and performance overhead under a 100% eviction rate

Fig. 10 :Fig. 11 :Fig. 12 :

 101112 Fig. 10: Precision, recall and F1-score of trusted-node identification under 10% of Byzantine nodes

TABLE I :

 I SGX performance overhead (in CPU cycles)

	Peer sampling function	Standard	SGX	Mean overhead	Standard deviation
	Pull request	15,623 18,593	2,970	3 %
	Push message	7,521	9,182	1,661	3 %
	Trusted communications	9,845 11,516	1,671	3 %
	Sample list comput.	13,024 15,364	2,340	4 %
	Dynamic view comput.	12,457 15,076	2,619	2 %

Intel SGX SDK. https://software.intel.com/en-us/sgx/sdk.

Intel SGX SSL. https://github.com/intel/intel-sgx-ssl.


Minh-Chau Nguyen

Peter Bonnaud

Rayane Dibsy

Guillaume Maucort

Sébastien Lyonnais

Delphine Muriaux

Pierre Bon
email: pierre.bon@cnrs.fr

Label-free single nanoparticle identification and characterization including infectious emergent virus

Screening of unknown particles, including viruses and nanoparticles, is key in medicine, industry and pollutant determination. However, existing techniques require sample a priori knowledge or modification (e.g. fluorescence). Here we introduce RYtov MIcroscopy for Nanoparticles Identification (RYMINI), a noninvasive and non-destructive optical approach that is combining holographic labelfree 3D tracking and high-sensitivity quantitative phase imaging into a compact optical setup. Dedicated to the characterization of nano-objects in solution, it is compatible with highly demanding environments such as level-3 biological laboratories. Metrological characterization has been performed at the level of each single object on both absorbing and transparent particles as well as on infectious HIV-1, SARS-CoV-2 and extracellular vesicles in solution. We demonstrate the capability of RYMINI to determine the nature, concentration, size, complex

refractive index and mass of each single particle. We discuss the application of the method in unknown solution without requiring any knowledge or model of the particles' response. It paves the way to label-free nano-object identification in terra incognita.

Main

Having access to metrological parameters on individual nanoparticles (NPs) is key to characterize the production for food, industry and biomedicine [START_REF] Naseer | Importance and health hazards of nanoparticles used in the food industry[END_REF][START_REF] Mourdikoudis | Characterization techniques for nanoparticles: comparison and complementarity upon studying nanoparticle properties[END_REF][START_REF] Chugh | Role of gold and silver nanoparticles in cancer nano-medicine[END_REF] and to identify relevant differences of nature between particles 4 . In this quest, some measurements could unlock unprecedented comprehension on each individual nano-object including the molecular content and the density of matter which involve a knowledge on both dimension and weight of each particle in their native environment. Ensemble measurements using dynamic light scattering (DLS) have been proposed [START_REF] Pecora | Dynamic Light Scattering Measurement of Nanometer Particles in Liquids[END_REF][START_REF] Stetefeld | Dynamic light scattering: a practical guide and applications in biomedical sciences[END_REF] to get access to the size of particles -even in polydispersed solution-but the intrinsic lack of specificity in the measured signals make this method challenging when nanoparticles with identical size distribution but different nature coexist in the same solution (e.g. empty and full extracellular vesicles).

At the single particle level, different techniques have been proposed to measure the object size without sample modification (e.g. fluorescence labeling). Based on light scattering [START_REF] Zhu | Light-Scattering Detection below the Level of Single Fluorescent Molecules for High-Resolution Characterization of Functional Nanoparticles[END_REF] or single-particle tracking (SPT) [START_REF] Lee | Characterizing and tracking single colloidal particles with video holographic microscopy[END_REF][START_REF] Martinez-Marrades | Stochastic 3D optical mapping by holographic localization of Brownian scatterers[END_REF][START_REF] Roose-Amsaleg | Utilization of interferometric light microscopy for the rapid analysis of virus abundance in a river[END_REF][START_REF] Midtvedt | Fast and Accurate Nanoparticle Characterization Using Deep-Learning-Enhanced Off-Axis Holography[END_REF][START_REF] Kashkanova | Precision size and refractive index analysis of weakly scattering nanoparticles in polydispersions[END_REF][START_REF] Lin | Shot-noise limited localization of single 20 nm gold particles with nanometer spatial precision within microseconds[END_REF][START_REF] Turkki | Experimental Evaluation of an Interferometric Light Microscopy Particle Counter for Titering and Characterization of Virus Preparations[END_REF][START_REF] Ortiz-Orruño | Simultaneous Sizing and Refractive Index Analysis of Heterogeneous Nanoparticle Suspensions[END_REF] they can furthermore extract a signal related to the particle refractive index mismatch with the solvent. A priori knowledge about the particle light/matter interaction is then required to sort the particles, making these methods very challenging when applied to both absorbing and transparent nano-objects. Moreover, when working with nanometer-size bio-objects such as vesicles or viruses, having access to the particle refractive index is not enough to perform acute biological interpretations and the development of the technique remains confidential outside of the optical community. At microscopic scale, it has been demonstrated in the 1950s [START_REF] Barer | Interference Microscopy and Mass Determination[END_REF] that lightmatter interaction can be converted into mass measurement for biological samples. This approach has been widely applied on optically resolved samples including eukaryotic cells [START_REF] Rappaz | Noninvasive characterization of the fission yeast cell cycle by monitoring dry mass with digital holographic microscopy[END_REF][START_REF] Aknoun | Living cell dry mass measurement using quantitative phase imaging with quadriwave lateral shearing interferometry: an accuracy and sensitivity discussion[END_REF] and bacteria [START_REF] Mir | Optical measurement of cycle-dependent cell growth[END_REF] . Different methods of NP or virus mass measurement with limited a priori knowledge have been introduced by using electron microscopy [START_REF] Lampert | Herpes simplex virus: dry mass[END_REF][START_REF] Bahr | Variability of dry mass as a fundamental biological property demonstrated for the case of Vaccinia virions[END_REF] , mass spectroscopy [START_REF] Hoffmann | Mass Spectrometry: Principles and Applications[END_REF][START_REF] Nie | Microscopy-Based Mass Measurement of a Single Whole Virus in a Cylindrical Ion Trap[END_REF] , nanometer-scale pores [START_REF] Arjmandi | Measuring mass of nanoparticles and viruses in liquids with nanometer-scale pores[END_REF] . However, these methods are only applicable either as destructive method, or for fixed particles.

We introduce RYtov MIcroscopy for Nanoparticles Identification (RYMINI) as a novel tool to identify each nanoparticle in solution and characterize its size, concentration, optical attenuation and molecular mass without a priori particle optical response knowledge. It unlocks the capability to detect and characterize unknown objects including emergent virus or pollutant. We have combined the capability of holography for (i) imaging in a single 2D image large 3D volume and for (ii) numerical refocusing of each freely diffusing particle [START_REF] Langehanenberg | in digital holographic microscopy[END_REF][START_REF] Bon | Three-dimensional nanometre localization of nanoparticles to enhance super-resolution microscopy[END_REF] , with the high-stability, compactness and sensitivity of selfreference interferometry [START_REF] Bon | Quadriwave lateral shearing interferometry for quantitative phase microscopy of living cells[END_REF][START_REF] Bon | Fast Label-Free Cytoskeletal Network Imaging in Living Mammalian Cells[END_REF] . This grants an access to the size d of each particle (via SPT analysis), its complex refractive index ñ = 𝑛 + 𝑖 • 𝑘 (and thus its electric susceptibility 𝜒 = ñ 2 -1 ) and its mass m (in Dalton or gram). Moreover, the imaging volume, a key element to measure particle concentrations in single-shot, is also precisely determined a posteriori. Since the setup aims at the characterization of infectious viruses, it is designed to be fully-compatible with acquisitions in demanding environments, including biosafety cabinets.

Acquisition and processing method

The core idea of our method is to simultaneously measure the size and the optical intensity & phase responses of each nano-object. These three independent measurements grant signal specificity to determine key metrological information and thus to identify each nanoparticle. To do so, we image freely diffusing nanoparticles (following Brownian motion) in their native solution with an optical microscope. The illumination has a controlled spatial and temporal coherence (super-continuum laser, see methods and SI.2) and each particle -even far from the imaging plane-forms an image on the sensor (Fig 1.a). By using a detector sensitive to both the phase 𝜑 and the intensity 𝐼 of the light, it is possible to numerically compute a 3D image stack from a single 2D hologram. The only requirement is the knowledge of the illumination wavelength λ and the microscope parameters (pixel size in the object space and numerical aperture). In order to keep our localization method independent from the particle nature (i.e. absorbing, transparent or in-between), we have merged the intensity 𝐼 and the phase signal 𝜑 into a novel observable, called Rytov intensity:

𝐼 𝑅𝑦𝑡𝑜𝑣 = |𝐸 𝑅𝑦𝑡𝑜𝑣 | 2 = | 𝑖 𝜆 • 𝑛 𝑚 𝜋 [ ln(𝐼) 2 + 𝑖 • 𝜑]| 2 ,
with 𝐸 𝑅𝑦𝑡𝑜𝑣 the Rytov field (generalized from the polarizability tensor [START_REF] Khadir | Full optical characterization of single nanoparticles using quantitative phase imaging[END_REF] ), and 𝑛 𝑚 the surrounding medium refractive index. The real part (respectively the imaginary part) of the Rytov field is linked to the real part (respectively the imaginary part) of the refractive index difference between the particle and the medium. Even though obtained with a labelfree technique, the Rytov intensity image looks very similar to single fluorescent particle image (see Fig. After DAI, the image SNR increases, theoretically by √N factor (N being the number of tracking frames), which largely improves the characterization of particles.

Since the nanoparticles are diffusing following a Brownian motion, according to the Stokes-Einstein law [START_REF] Qian | Single particle tracking. Analysis of diffusion and flow in two-dimensional systems[END_REF] , the particle diameter d can be obtained via:

𝑑 = 𝑘 𝐵 𝑇 3𝜋𝜂𝐷 ,
with 𝑘 𝐵 is the Boltzmann constant, T the fluid temperature, η the viscosity of the fluid and D the diffusion coefficient. The classical way to measure D is to compute the mean squared displacement (MSD) of each nanoparticle. Our holographic method gives access to the 3D position and thus the mean squared displacement (MSD) is more precise than other methods working in 2D with equivalent localization precision [START_REF] Brasiliense | Correlated Electrochemical and Optical Detection Reveals the Chemical Reactivity of Individual Silver Nanoparticles[END_REF] . The tracking has been performed at high frame rate (400-Hz) to ensure accurate evaluation of diffusion coefficient via MSD and to minimize the contribution from environment instabilities (thermal, vibrations…). We were able to perform measurements even inside a biosafety cabinet of confined level-3 biological laboratory (see Fig. 3.e). To increase size evaluation precision from MSD, we have used a unique characteristic of our method: the Rytov field depends jointly on particle nature and size which allows us to perform correlation between particles which exhibit the similar Rytov field (see SI.4). Moreover, our approach unlocks concentration determination without a priori knowledge on the particle type: the numerically reconstructed imaging volume is automatically adjusted by the signal-tonoise ratio of the detected particles.

Noteworthy, the independent measurements of both the diameter d and the Rytov field

𝐸

Results -Discussions

Characterization of nanoparticle solutions

First we have studied with RYMINI monodispersed solutions containing dielectric (polystyrene, silica, diamond) or plasmonic (gold, silver) particles. Their statistics are summarized in the Table 1.

In Fig. 2.a-c, a solution of 100-nm polystyrene (PS) nanoparticles has been imaged and both the complex refractive index and the size of each particle are presented. The NP diameter is measured to be d = 105 ± 13 nm which agrees with the information provided by the manufacturer, in which the average size is 102 ± 3 nm, with a dispersion of 7.6

nm. PS nanoparticles with size ranging from 60-nm to 200-nm have been studied with the same approach (Fig were studied in Fig. 2.f-i and Movie SI.3.

For plasmonic particles, the light-matter interaction is very dependent on the particle size and nature as well as the working wavelength [START_REF] Khadir | Full optical characterization of single nanoparticles using quantitative phase imaging[END_REF] . Considering the metal particles studied in Fig. 2.f-i (60-nm and 100-nm Au NP, and 100-nm Ag NP), they exhibit a plasmon resonance when illuminated at respectively 530-nm, 570-nm and 480-nm, according to Mie theory [START_REF] Mie | Beiträge zur Optik trüber Medien, speziell kolloidaler Metallösungen[END_REF] . The module of the complex refractive index is maximized when the illumination is at plasmon resonance wavelength and is approaching the refractive index of the bulk material when the illumination is far from resonances. ) with an illumination at 450-nm. This confirms at this illumination wavelength a much higher plasmon effect for Ag particles since the refractive indices of bulk gold and silver are tabulated [START_REF] Johnson | Optical Constants of the Noble Metals[END_REF] have to be performed in confined biological environments of level-3 security. The acquisitions of infectious samples were thus performed inside a biosafety cabinet of a confined level-3 biological laboratory (CEMIPAI, Montpellier, France) as shown in Fig. 3.e (laser-beam safety panels have been removed to take the picture).

For biological samples we have considered as pertinent to measure the size and mass (in Da) of each particle. At first order approximation, virus dry mass can be inferred from the optical phase image and its size (see SI.5). The results for VLP, viruses and EVs are illustrated in Fig. 3.b-d and reported in Table 2. HIV-1 Gag-VLP size analysis first validates the capabilities of our method, with a measured diameter of 141 +35 -17 -nm, which is the expected size of HIV-1 Gag-VLPs produced in higher eukaryotic cells [START_REF] Floderer | Single molecule localisation microscopy reveals how HIV-1 Gag proteins sense membrane virus assembly sites in living host CD4 T cells[END_REF][START_REF] Smith | Human immunodeficiency virus type 1 Pr55gag and Pr160gag-pol expressed from a simian virus 40 late replacement vector are efficiently processed and assembled into viruslike particles[END_REF] . HIV-1

Gag VLP particles enriched in viral RNA (HIV-1 Gag VLP+RNA) showed an increased size of 179 +25 -26 -nm, which correlates with the size modulation of viral RNA on VLP assembly [START_REF] Faivre-Moskalenko | RNA Control of HIV-1 Particle Size Polydispersity[END_REF] . When moving to native, wt-infectious HIV-1 particles, the measured diameter (171 +25 -17 -nm) was higher to that previously reported by CryoEM (145 ± 25nm) [START_REF] Briggs | Structural organization of authentic, mature HIV-1 virions and cores[END_REF] . This is however consistent since the particle size determined by CryoEM are restricted to the outside of the lipid bilayer, therefore omitting the outer shell of the heavily glycosylated Gp160 Env , which should strongly participate in the hydrodynamic radius measured here. This was indeed confirmed by the measured size (139 +23 -14 -nm)

of HIV-1 ΔEnv lacking the surface Gp160 Env trimers. SARS-CoV-2 size was found around 85.2 +6.5 -9.4 -nm, which is consistent with sizes reported so far by CryoEM (91 ± 11nm) [START_REF] Ke | Structures and distributions of SARS-CoV-2 spike proteins on intact virions[END_REF] and AFM (89 ± 19-nm) [START_REF] Lyonnais | Atomic force microscopy analysis of native infectious and inactivated SARS-CoV-2 virions[END_REF] . Finally, samples of extracellular vesicles showed a broader size range (233 +54 -39 nm), as expected from these heterogeneous family of biological particles [START_REF] Willms | Extracellular Vesicle Heterogeneity: Subpopulations, Isolation Techniques, and Diverse Functions in Cancer Progression[END_REF] . Mass variations between all these biological nanoparticles correlate with their variations in size and content, with HIV-1 Gag VLP + RNA > HIV-1 wt > HIV-1 ΔEnv > HIV-1 Gag VLP > SARS-CoV-2. EVs can content various biological material such as proteins and nucleic acids and showed an important heterogeneity in mass accordingly. Interestingly, particles effective densities (in Da 1/3 /nm) confirmed that HIV-1 Gag VLP and the EVs are less packed, while HIV-1 VLP Gag + RNA, HIV-1 wt, HIV-1 ΔEnv and SARS-CoV-2 show equivalent densities, probably reflecting viral fitness to fully pack particles in the 80-140 nm diameter range. Altogether, these results demonstrate that RYMINI is a powerful method to assess virus size, mass and densities;

and can be used in high confinement laboratory for rapid and easy infectious virus analysis.

Automatized identification of NP

We have developed an architecture based on a convolutional neural network (CNN) [START_REF] Lecun | Gradient-based learning applied to document recognition[END_REF] for automatized particle classification. The architecture scheme is presented in Fig. 4.a and detailed in methods and SI.7. To identify each particle, the algorithm uses as input the complex Rytov image, normalized by the particle volume to obtain signals proportional to the complex refractive index. Since the input has complex values, the CNN classifier is adapted for deep complex layers [START_REF] Trabelsi | Deep Complex Networks[END_REF][START_REF] Matthès | Learning and Avoiding Disorder in Multimode Fibers[END_REF] .

Figure 4.b illustrates the normalized confusion matrix which presents the algorithm capability to recognize individual nanoparticle nature. Our CNN can precisely classify dielectric, VLP and metallic nanoparticles: about 80% for the majority of dielectric labels and VLP, and 95% for metallic labels. The main errors are attributed to uncleaned abnormal inputs (see SI.7). For viruses, the accuracy depends on their type: it reaches about 86% for SARS-COV-2 but tends to mix up between HIV-1 wt and HIV-1 ΔEnv. This is comprehensible and predictable since HIV-1 ΔEnv contains 2 populations: one minor interpreted as immature particles (with signature in term of size and mass close to HIV-1 wt) and one major considered as mature particles [START_REF] Floderer | Single molecule localisation microscopy reveals how HIV-1 Gag proteins sense membrane virus assembly sites in living host CD4 T cells[END_REF] . Extracellular vesicles are also classified with moderate certainty, as expected for such heterogeneous class [START_REF] Cocozza | SnapShot: Extracellular Vesicles[END_REF] .

Conclusions

Our full optical RYMINI method unlocks for the first time to our knowledge identification and metrological characterization of any nanoparticle solution at the single particle level without requiring a priori information on the sample nature. It grants access to the type of each detected particle (including viral objects) as well as single-shot concentration, size, complex refractive index and mass (in gram and Dalton). We have demonstrated its capability in monodisperse solutions of metallic and dielectric NP as well as on viral non-purified solutions directly inside a biosafety cabinet of a level-3 confinement laboratory (BSL3). The sample preparation as well as the acquisition are straightforward since large volumetric imaging is obtained in a single-shot manner with the RYMINI technique. Probing sub-pM concentration solutions requires less than one second and only 10µL of solution. Our current sensitivity is compatible with identification and complete characterization of viral species as small as SARS-COV-2 (~88 nm), or NP as small as 40-nm for metallic particles and 60-nm for dielectric particles (PS). The detection sensitivity could be pushed further by a change in the illumination scheme at the price of reducing the accessible imaging volume. Moreover, the label-free intrinsic signature of each particle can be used to quantify the homogeneity of particles in a non-invasive and biosafety-secured manner. The deployment of machine learning tools unlocks automatized identification of each detected particles. We believe that this method could be a key tool for routine pollution analysis, easy and fast biological risk determination, NP metrology during production as well as fundamental biological and non-biological particle studies.

Methods

Optical setup. The setup is based on a home-made microscope using a quadriwave lateral shearing interferometer [START_REF] Bon | Quadriwave lateral shearing interferometry for quantitative phase microscopy of living cells[END_REF][START_REF] Primot | Achromatic three-wave (or more) lateral shearing interferometer[END_REF] to measure the phase and the intensity of the beam. The sample is illuminated by a supercontinuum fibre laser (Leukos, France) filtered by a short-pass 700-nm dichroic and a 450 ± 10 nm optical filter (Thorlabs) to reach 10-mW of illumination power. A Köhler illumination has been made using one achromatic lens (75-mm, Thorlabs) and one aspherical lens (50-mm, Thorlabs). The image is formed with an oil-immersion objective Nikon Plan Fluor 100x NA 1.30 and a 400-mm achromat lens for the tube lens (Thorlabs). The total microscope magnification has been measured to be 205×, using a resolution test target (R3L1S4P, Thorlabs). The interferometer is composed of a Modified Hartmann Mask 47 , a relay lens and a 2Me -full-well capacity CMOS camera (Q-2HFW-hm, Adimec). The system is built on 40×50cm breadboard and has a total height of 50-cm to be easily handled and introduced in a hood or a biosafety cabinet.

Sample preparation. Perforated parafilm on a type 1.5 round coverslip plays the role of a 10µL imaging chamber. The parafilm is first heated up to 80°C so that it is slightly melted and sealed to the glass slide. After adding the solution, the chamber is closed by a second glass slide avoiding possible evaporation or leaks during handling.

Virus preparation. For HIV-1 and EVs production, 12.5 million of Human embryonic kidney cells (293THEK cell) were seeded in 10 ml of DMEM growth media 1 day before transfection.

At 50-70% confluence, cells were transfected with calcium phosphate precipitate method, with 8 µg total quantity of plasmid for either pcDNA3.1 (Mock), pHIV-1Gag [START_REF] De Poret | Extracellular vesicles containing the I-BAR protein IRSp53 are released from the cell plasma membrane in an Arp2/3 dependent manner[END_REF] , pHIV-Psi-viralRNA [START_REF] Zufferey | Multiply attenuated lentiviral vector achieves efficient gene delivery in vivo[END_REF][START_REF] Naldini | In Vivo Gene Delivery and Stable Transduction of Nondividing Cells by a Lentiviral Vector[END_REF] , pHIV-1(NL43) and pHIV-1GagEnv [START_REF] Floderer | Single molecule localisation microscopy reveals how HIV-1 Gag proteins sense membrane virus assembly sites in living host CD4 T cells[END_REF] . Cell culture supernatant containing viral particles was collected 48 hours post transfection. Supernatant was filtred through 0.45 µm and then purified by ultracentrifugation on cushion of 25% sucrose -TNE buffer (10 mM Tris-HCl [pH

  𝑅𝑦𝑡𝑜𝑣 integrated over the whole particle image give access to useful bio-physical parameters for each NP. This includes the NP mass m (in gram or Dalton) and its complex refractive index ñ = 𝑛 + 𝑖 • 𝑛 ′ following: 𝑛 𝑚 ) 𝜌 𝑜𝑏𝑗 2𝜋(𝑛-Re(𝑛 𝑚 )) ∬ 𝜑 • d𝑥d𝑦 𝒙,𝒚 = -𝛽 ∬ 𝜑 • d𝑥d𝑦 𝒙,𝒚 , ñ = √1 + 𝜒 = 𝑛 𝑚 + 3 𝜆 Re(𝑛 𝑚 ) the medium (complex) refractive index, 𝜆 the imaging wavelength and 𝜌 𝑜𝑏𝑗 the bulk material density (see SI.1 for complete discussion).

Figure 1 .

 1 b and Movie SI.1 give an overview of the image processing and information harvesting.

  at ñ 𝐴𝑢 𝑏𝑢𝑙𝑘 @450nm = 1.38 + 𝑖 • 1.92 and ñ 𝐴𝑔 𝑏𝑢𝑙𝑘 @450nm = 0.04 + 𝑖 • 2.65.Particle concentration measurement requires a knowledge on both the imaging volume and the number of objects in this last. Although the 2D field of view (FOV) is fixed by the magnification and the size of the sensor, the depth of the imaging volume is chosen via holographic processing. The maximal depth of FOV is thus related to the signal-tonoise ratio of the system, with a good linearity with the Rytov field amplitude, as shown in Fig.2.k. Therefore, the 3D volume can be tuned and maximized a posteriori without any particles' nature knowledge (see SI.6 for discussion of the 3D volume as a function of different particle Rytov Intensity). For bright particles, such as 100-nm Ag NPs, the depth of field can reach up to 50 µm (from -25 to +25 µm). Our unique capability to numerically fix the imaging volume grants access to single-shot and unbiased particle concentration measurements. In Fig.2.j, concentrations have been measured over different dilutions of a 100-nm PS stock solution of 1 × 10 11 particles/mL (determined with commercial Videodrop, Myriade, France). In a holographic imaging volume of 20-pL (28×28×25 µm 3 ), the concentration is obtained by counting the NP traces in single time sequence acquisition (~300 images acquired at 400-Hz). Concentrations down to 0.5× 10 8 particles/mL, or ≈0.08 pM (about 1 particle per holographic volume) -with a precision of 0.4 × 10 8 particles/mL (0.06 pM)-were measured, in good agreement with the theoretical values, estimated from dilution proportions.Virus identification and characterization at the single particle levelWe next challenged the RYMINI to analyze biological nanoparticles in solutions: (i) artificial HIV-1 Gag virus-like-particles (VLP) and VLP enriched in viral RNA (HIV-1 Gag VLP+RNA)[START_REF] Faivre-Moskalenko | RNA Control of HIV-1 Particle Size Polydispersity[END_REF] (ii) infectious HIV-1 particles (HIV-1 wt) and HIV-1 particles deprived of the surface Envelope Glycoproteins (HIV-1 ∆Env), (iii) infectious SARS-CoV-2, and (iv) extracellular vesicles (EVs) secreted in cell culture in absence of VLP or viral infection (Fig.3.a). While EVs and VLP can be handled and measured without biohazard, measurements of infectious class-3 viruses such as HIV-1 and SARS-CoV-2

Figure 1 :

 1 Figure 1: Principle of experiment. (a) Experimental high-sensitivity holographic setup.

Figure 2 :

 2 Figure 2: Quantification of individual NP in solution. (a, b, c) Analysis of 100-nm PS

Figure 3 :Figure 4 :

 34 Figure 3: Quantification of biophysical parameters of viruses and organic nano-

Table 1 : Number of analysed particles, size, real, imaginary refractive index and electric susceptibility of various nano-particles.

 1

	Particles nature	Number of particles	Hydrodynamic Size (nm)	Refractive index n		Absorption coefficient k	Susceptibility
		123	76.9 +2.6 -2.2		1.526 +0.039 -0.040	-0.034 +0.060 -0.055	+0.121 1.318 -0.125
		170	91.9 +8.5 -6.4		1.552 +0.073 -0.057		0.008 +0.071 -0.057	+0.239 1.402 -0.196
	PS	221	105.1 +8.2 -9.0		1.504 +0.072 -0.060	-0.020 +0.089 -0.087	+0.219 1.252 -0.187
		228	167.8 +20.5 -23.6	1.568 +0.140 -0.083		0.025 +0.089 -0.081	+0.413 1.443 -0.244
		181	200.4 +28.1 -28.0	1.602 +0.137 -0.103		0.039 +0.098 -0.121	+0.416 1.539 -0.327
		105	124.9 +15.7 -10.2	1.476 +0.053 -0.046		0.046 +0.064 -0.058	+0.148 1.174 -0.140
	Si	393	158.8 +15.3 -13.0	1.428 +0.039 -0.029		0.001 +0.039 -0.035	+0.114 1.033 -0.084
	Diamond	208	84.6 +4.0 -6.2		2.241 +0.223 -0.205	-0.052 +0.201 -0.175	+0.967 3.943 -0.881
		201	79.6 +12.1 -7.8		1.805 +0.304 -0.188		2.136 +1.032 -0.629	+1.993 -2.440 -4.529
	Au
		194	117.8 +11.4 -7.1	1.333 +0.159 -0.101		2.014 +0.799 -0.491	+2.016 -3.287 -3.702
	Ag	191	121.9 +13.5 -14.0	1.338 +0.345 -0.268		4.748 +1.950 -1.497	+10.834 -20.980 -22.129
	Particule nature	Number of particles	Hydrodynamic Size (nm)	Mass (MDa)	𝟑 √𝐃𝐞𝐧𝐬𝐢𝐭𝐲 nm -1 )	(Da 1/3 .
	HIV-1 Gag VLP	90		141	+35 -17	57	+15 -17	3.41	+0.27 -0.37
	HIV-1 Gag VLP + RNA	162		179	+25 -26	131	+54 -32	3.59	+0.44 -0.32
	HIV-1 wt		337		171	+25 -17	108	+40 -29	3.48	+0.38 -0.34
	HIV-1 ΔEnv		147		139	+23 -14	68	+24 -17	3.76	+0.39 -0.35
	SARS-COV-2		88		85.2	+6.5 -9.4	18.0	+5.7 -7.4	3.91	+0.38 -0.63
	Extracellular Vesicles	357		233	+54 -39	262	+130 -114	3.50	+0.50 -0.60

Table 2 : Size, number of analysed particles, mass and density of various biological nano-objects including viruses.

 2

Acknowledgment

This work was supported by CNRS. Part of this project was funded by the French National Agency against AIDS and Hepatitis (ANRS). RD is a recipient of a SIDACTION fellowship. This project has received funding from the European Research Council (ERC) under the European Union's Horizon 2020 research and innovation programme (grant agreement No. [848645]).

.4], 100 mM NaCl, 1 mM EDTA) at 100000g, for 1 hour 30 minutes at 4°C, in SW32Ti Beckman Coulter rotor. Dry pellet was resuspended in TNE buffer at 4°C overnight.

For SARS-CoV-2 particle production, the strain BetaCoV/France/IDF0372/2020, was supplied by the National Reference Center for Respiratory Viruses hosted by Institut Pasteur (Paris, France) and headed by Pr. Sylvie van der Werf. The human sample from which strain BetaCoV/France/IDF0372/2020 was isolated has been provided by Dr. X. harvested 72 hours post inoculation. Virus stocks were stored at -80°C and tittered using plaque assays as previously described [START_REF] Lyonnais | Atomic force microscopy analysis of native infectious and inactivated SARS-CoV-2 virions[END_REF] and provided by CEMIPAI facility.

Data acquisition and analysis. A home-made program based on LabView has been developed

for both acquisition and processing. Between 200-300 frames per sample where acquired at 400-Hz with about 1.0 ms integration time (total acquisition time of ≈700-ms) before being analysed for single particle tracking. The analysis algorithm is performed offline with following the workflow: (1) to calculate the phase and intensity from each interferogram (raw camera image);

(2) to generate a 3D stack from each intensity/phase couple using numerical propagation; (3) to compute the Rytov intensity of each image in each stack; (4) to pre-detect each particle on a maximum intensity projection along the propagation axis of the Rytov intensity stack; (5) to 3D superlocalize on the Rytov intensity stack each particle from its predetection using 3D gaussian fitting; (6) to extract a sub-pixel register at-the-focus intensity/phase image for each particle using the measured 3D position; (7) to compute the DAI from the registered images and the particle size using the MSD from the temporal particle trace. Traces shorter than 20 images where deleted from the analysed data to ensure a proper size measurement and DAI.

Competing interests

MCN salary has been financed by the French company Myriade between 01/2020 and 05/2021.