Structured unitary space-time autocoding constellations We recently showed that arbitrarily reliable communication is possible within a single coherence interval in Rayleigh flat fading as the symbol-duration of the coherence interval and the number of transmit antennas grow simultaneously. This effect, where the space-time signals act as their own channel codes, is called autocoding. For relatively short (e.g., 16-symbol) coherence intervals, a codebook of isotropically random unitary space-time signals theoretically supports transmission rates that are a significant fraction of autocapacity with an extremely low probability of error. However a constellation of the required size (typically L = 2 80 ) is impossible to generate and store, and due to lack of structure there is little hope of finding a fast decoding scheme. In this paper we propose a random, but highly structured, constellation that is completely specified by log 2 L independent isotropically distributed unitary matrices. The distinguishing property of this construction is that any two signals in the constellation are pairwise statistically independent and isotropically distributed. Thus, the pairwise probability of error, and hence the union bound on the block probability of error, of the structured constellation is identical to that of a fully random constellation of independent signals. As part of this work we have established a subsidiary result that is interesting in its own right: the square (or for that matter, any integer power greater than one) of an isotropically random unitary matrix is not isotropically random, with two exceptions: 1) a one-by-one complex unitary matrix, and 2) a two-by-two real orthogonal matrix. Research in multiple antenna wireless entered an exciting phase with [3, 13] , which predict spectacular capacities (both Shannon and outage) for single-user multiple-antenna wireless links operating in Rayleigh flat-fading, where the receiver knows the propagation matrix. In particular, the capacity grows linearly with the smaller of the number of transmit or receive antennas with no extra bandwidth or total power. Moreover, [3] discloses a practical scheme referred to as BLAST (Bell Labs Layered Space Time) for realizing a significant fraction of the capacity with small outage probability, using a divide-and-conquer strategy based on ordinary modulation and coding techniques.. BLAST, as well as certain other space-time codes [12] , requires the receiver to know the propagation matrix between the transmit and receive antennas. This knowledge can be acquired by sending known training signals. The required training interval is proportional to the number of transmit antennas [8] , and for many potential applications, training is an acceptable burden. However, in TDMA applications with fast fading, for example, both training and data transmission may have to occur during a relatively short interval.. Because both the training interval and capacity increase linearly with the number of transmit antennas, the total throughput is maximized by choosing the number of transmit antennas such that half of the interval is used for training, and half for data transmission [8] .. Ideally one would like to achieve BLAST-like transmission rates with multiple antennas while circumventing training and channel estimation. Some steps in this direction are described in [1, 9, 5, 14] , based on a piecewise constant model for fading (also called block fading [10, 2] ). Here the random propagation matrix (which nobody knows) remains constant for a T symbol coherence interval, after which it jumps to a new independent value where it remains for another T symbols, and so on. This constitutes a memoryless channel from one coherence interval to another for matrix-valued signals, which permits a direct application of Shannon theory implicitly involving coding over many coherence intervals. During every coherence interval a T M complex matrix is transmitted and a T N complex matrix is received, where M and N are the number of transmit and receive antennas respectively. It was shown [9] that capacity cannot be increased by making M > T, and that the capacity attaining signals are equal to the product of two independent matrices: a T M isotropically distributed unitary matrix, and a M M diagonal, real, nonnegative matrix. This structure motivates the use of unitary space-time modulation [5] involving a constellation of L T M unitary matrices f 0 ; ; L?1 g, where y` `= I M , chosen according to a design criterion that differs markedly from the familiar maximum-Euclidean-distance criterion.. Some small (L = 64) unitary space-time constellations are designed in [5] using a simple iterative algorithm. A systematic approach is pursued in [7] , where an initial T M unitary matrix is successively rotated L?1 times to generate the entire constellation of signals. The rotation matrix is T T diagonal, with its diagonal elements equal to Lth roots of unity, and with the initial signal comprising M columns from a T T discrete Fourier transform unitary matrix. Using iterative random search, the roots that characterize the rotation matrix are chosen to give a low raw (uncoded) block probability of error for the constellation, based on pairwise probabilities of error. The search is facilitated by the fact that the correlation between the signals, which determines the pairwise probabilities of error, has a circulant structure. Using this approach, constellations larger than L = 2000 have been designed. However it was not established how restrictive the circulant structure is, or whether significant improvements in performance are possible by relaxing this structure.. The recent space-time autocoding effect [6] implies that arbitrarily reliable communication can be achieved within a single coherence interval if T and M simultaneously become large. There is a positive autocapacity, such that for any rate R less than the autocapacity, the block probability of error for a single coherence interval goes to zero as T and M grow large, with no knowledge of the propagation matrix available to anybody. In effect, temporal diversity -which is unreliable for stop-and-go mobiles -is replaced by spatial diversity. Thus, autocoding says that we may avoid channel coding that is normally performed over many independent coherence intervals, and shift the problem of achieving reliability to the problem of designing an effective constellation of T M signals.. Achieving autocapacity theoretically requires unbounded M and T, but the autocoding effect manifests itself for relatively small T and M, and transmission rates that are a significant fraction of autocapacity can theoretically be supported with extremely small probabilities of error. For example, using M = 7 transmit antennas and N = 4 receive antennas, and with an expected SNR of 18 dB, a single user can theoretically transmit 80 bits during a single T = 16 symbol coherence interval (rate 5 bits/symbol) with a block probability of error less than 10 ?9 , all without any training or knowledge of the propagation matrix.. These performance predictions are obtained by applying a union bound and an expression for pairwise probability of error to a hypothetical codebook of L = 2 80 independent isotropically random 16 7 unitary matrices.. A constellation of 2 80 independent matrices is impossible to generate exhaustively or to store, and because of its lack of structure there is little hope of ever finding a fast decoding scheme. This note proposes a unitary space-time constellation that, although random, is structured, and has exactly the same union-bound performance as a constellation of independent signals. Section 2 reviews the signal model, unitary space-time modulation, space-time autocoding, and the earlier systematic construction. Section 3 explains the new construction. Section 4 reinterprets earlier systematic constructions such as [7] in light of this new construction. The mathematical results required for many of the conclusions of this paper are developed in the appendices: Appendix A obtains the eigenvalue distribution for isotropically distributed unitary matrices, and Appendix B shows that any power (larger than one) of an isotropically distributed unitary matrix is not isotropically distributed. In fact a limiting distribution is obtained for large enough finite powers. The realization of the space-time autocoding effect requires two things: 1) a good, extraordinarily large, constellation of unitary space-time signals, and 2) a decoding algorithm that avoids exhaustive search over the constellation. We have addressed the first problem with a construction that is random but highly structured. The L signals are specified by log 2 L isotropically distributed T T unitary matrices. A random constellation of this sort has, in a deterministic sense, no guaranteed performance. However, due to the size of the constellation, we expect that any given realization will have a performance very close to the average performance of the fully random constellation, which we have shown to be provably good.. These constellations can support transmission rates that are a significant fraction of the autocapacity with extremely low probabilities of error, and their low complexity makes them practical for the transmitter to employ. Their ultimate utility, however, depends entirely on the discovery of a good decoding algorithm.

O O B I O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Secure and efficient key management in mobile ad hoc networks Abstract-In mobile ad hoc networks, due to unreliable wireless media, host mobility and lack of infrastructure, providing secure communications is a big challenge in this unique network environment. Usually cryptography techniques are used for secure communications in wired and wireless networks. The asymmetric cryptography is widely used because of its versatileness (authentication, integrity, and confidentiality) and simplicity for key distribution. However, this approach relies on a centralized framework of public key infrastructure (PKI). The symmetric approach has computation efficiency, yet it suffers from potential attacks on key agreement or key distribution. In fact, any cryptographic means is ineffective if the key management is weak. Key management is a central aspect for security in mobile ad hoc networks. In mobile ad hoc networks, the computational load and complexity for key management is strongly subject to restriction of the node's available resources and the dynamic nature of network topology. In this paper, we propose a secure and efficient key management framework (SEKM) for mobile ad hoc networks. SEKM builds PKI by applying a secret sharing scheme and an underlying multicast server group. In SEKM, the server group creates a view of the certification authority (CA) and provides certificate update service for all nodes, including the servers themselves. A ticket scheme is introduced for efficient certificate service. In addition, an efficient server group updating scheme is proposed. Mobile ad hoc networks are special type of wireless networks in which a collection of mobile hosts with wireless network interfaces may form a temporary network, without the aid of any fixed infrastructure or centralized administration. In mobile ad hoc networks, nodes within their wireless transmitter ranges can communicate with each other directly (assume that all nodes have the same transmission range), while nodes outside the range have to rely on some other nodes to relay messages. Thus a multi-hop scenario occurs, where the packets sent by the source host are relayed by several intermediate hosts before reaching the destination host. Every node functions as a router. The success of communication highly depends on the other nodes' cooperation.. While mobile ad hoc networks can be quickly and inexpensively setup as needed, security is a critical issue compared to wired or other wireless counterparts. Many passive and active security attacks could be launched from the outside by malicious hosts or from the inside by compromised hosts [10] [12].. Cryptography is an important and powerful tool for security services, namely authentication, confidentiality, integrity, and non-repudiation. It converts readable data (plaintext) into meaningless data (ciphertext). Cryptography has two dominant flavors, namely symmetric-key (secret-key) and asymmetrickey (public-key) approach. In symmetric-key cryptography, the same key is used to encrypt and decrypt the information, while in the asymmetric-key approach, different keys are used to convert and recover the information. Although the asymmetric cryptography approach possesses versatileness (authentication, integrity, and confidentiality) and simplicity for key distribution, symmetric-key algorithms are generally more computation-efficient than the public-key approach. There is a variety of symmetric or asymmetric algorithms available, such as DES, AES, IDEA, RSA, and EIGamal [1] [2] [11] . Threshold cryptography [3] is a scheme quite different from the above two approaches. In Shamir's (k, n) secret sharing scheme, a secret is split into n pieces according to a random polynomial. The secret can be recovered by combining k pieces based on Lagrange interpolation. Secret splitting, reconstruction, and verification is quickly reviewed in Section 3. These cryptography tools are widely used in wired and wireless networks, obviously they could also be used in mobile ad hoc networks.. Key management is a basic part of any secure communication. Most cryptosystems rely on some underlying secure, robust, and efficient key management system. Key management deals with key generation, storage, distribution, updating, revocation, and certificate service, in accordance with security policies. Key management primitives and a trust model are presented in Section 3. The outline of key management is described below. First, secrecy of key itself must be assured in the local host system. Second, secure network communications involve key distribution procedure between communication parties, in which the key may be transmitted through insecure channels. Key confidentiality, integrity, and ownership must be enforced in the whole procedure. Third, a framework of trust relationships needs to be built for authentication of key ownership. While some frameworks are based on a centralized Trusted Third Party (TTP), others could be fully distributed. For example, a Certificate Authority is the TTP in PKI, Key Distribution Center (KDC) is the TTP in the symmetric system, meanwhile in PGP, no such a trusted entity is assumed.. Fourth, the key could be expired or have been revoked within its valid period.. We introduce here a secure and efficient key management scheme (SEKM). In SEKM, the system public key is distributed to the whole network. Like some schemes described in Section 2, in SEKM, the trust of the central authority (CA) is distributed to a subset of nodes (not all nodes), which could be nodes with normal or better equipment. The major contribution of our scheme is that SEKM is designed to provide efficient share updating among servers and to quickly respond to certificate updating, which are two major challenges in a distributed CA scheme. The basic idea is that server nodes form the underlying service group for efficient communication.. For efficiency, only a subset of the server nodes initiates the share update phase in each round. A ticket based scheme is introduced for efficient certificate updating. Normally, because of share updating, recently joining servers could be isolated from the system if they carry outdated certificates. Our scheme does not isolate new servers, and is open for regular nodes for easy joining and departing. SEKM creates a view of CA and provides secure and efficient certificate service in the mobile and ad hoc environment. The framework of SEKM is described in Section 4.. This paper is organized as follows: Section 2 reviews related work. Section 3 discusses key management and trust model in mobile ad hoc networks. Details of the SEKM scheme are described in Section 4. In Section 5, we conclude the paper and discuss possible future work. Throughout the paper, we use terms node and host interchangeably. Security is an important issue for mobile ad hoc networks. For security we mainly consider the following attributes: availability, confidentiality, integrity, authentication, authorization and non-repudiation. Certain security mechanisms and protocols have been designed and proposed for ad hoc wireless network. Key management is a the central aspect of the security of mobile ad hoc networks, and it is still a weak point. In this paper we propose a key management scheme, SEKM, which creates a PKI structure for this type of networks in mobile ad hoc networks. In SEKM, server nodes form a mesh-based server group. SEKM is based on the secret sharing scheme, where the system secret is distributed to a group of server nodes. The server group creates a view of CA. The advantage is that in SEKM it is easier for a node to request service from a well maintained group rather than from multiple "independent" service providers which may be spread in a whole area. It is much easier for servers to coordinate within the group rather than with the entire network during the secret share updating phase.. A detailed SEKM framework and operational phases are described in this paper. In SEKM, the server group provides certificate update service for all nodes including the servers themselves. A ticket scheme is introduced for efficient certificate service. Meanwhile, an efficient server group periodical updating scheme is proposed. In our future work we will evaluate the performance of SEKM by simulation, and we will extend SEKM to multiple server groups in large networks and in partitioned networks. Recently, security has become a hot research topic in mobile ad hoc networks. Several secure routing protocols have being proposed in the literature. For example, SRP [22] , SEAD [20] , and SAODV [19] address security attacks in routing protocols and propose different means to counter particular threats. However, almost all of them rely on the existence of a public key management system. Even in TESLA [21] , delivery and authentication of the first element in hash chain requires the asymmetric key management framework. So the existence of an effective key management framework is fundamental to secure routing protocols. There are some other research papers which focus on either secure data transmission, intrusion detection, or key management in mobile ad hoc networks. Although these topics are closely related, however we emphasize key management and ignore the rest of these topics here, we will address those topics in the future work.. Zhou and Hass [7] propose a secure key management scheme by employing (t, n) threshold cryptography. The system can tolerate t − 1 compromised servers. However, this scheme doesn't describe how a node can contact t servers securely and efficiently in case the servers are scattered in the whole area. A share refreshing scheme is proposed to counter mobile adversaries. However, efficient and secure distributions of secret shares are not addressed.. Luo, Kong, and Zerfos [9] propose a localized key management scheme called URSA. In this scheme all nodes are servers. The advantage of this scheme is efficiency and secrecy of local communication as well as system availability; on the other hand, it reduces the system security especially when nodes are not well protected. One problem is that in case the threshold k is much larger than the network degree d, nodes will have to keep moving to get certificates updated. The second critical issue is the convergence in the share updating phase. The third critical issue is that too much offline configuration is required before accessing the networks.. Yi, Naldurg, and Kravets [8] propose a scheme called MOCA key management. In their approach, certificate service is distributed to Mobile Certificate Authority (MOCA) nodes, which are physically more secure and powerful than other nodes. In their scheme, a node could locate k+α MOCA nodes either randomly, through the shortest path, or based on freshest path in its route cache. But the critical question is how nodes can discover those paths securely since most secure routing protocols are based on the establishment of a key service.. Capkun, Buttyan, and Hubaux [17] propose a fully distributed scheme. It has the advantage of configuration flexibility. However, it lacks of any trusted security anchor in the trust structure. Lots of certificates need to be generated. Every node should collect and maintain up-to-date a certificate repository. Certificate chaining is used for authentication of public keys. The certificate graph, which is used to model this web of trust relationship, may not be strongly connected, especially in the mobile ad hoc scenario. In that case nodes within one component may not be able to communicate with ones in different components. Certificate conflicting is just another example of a potential problem in this scheme. A scheme with improved certificate repository maintenance could be introduced.. Recently, Yi and Kravets [18] propose a composite trust model. In their scheme they combine the central trust model and the fully distributed trust model. This scheme takes advantage of the positive aspects of two different trust systems. Actually, it is a compromise between security and flexibility. Some authentication metrics, such as confidence value, are introduced in order to glue two trust systems. However, assignment of confidence value properly is a challenge and problematic.. In summary, the schemes proposed in [7] [8] [9] are based on the secret sharing technique. Zhou focuses on the share updating procedure, Yi's scheme emphasizes efficient communications among MOCA nodes. Luo's approach addresses the problem of share updating and certificate service in a localized environment. Capkun discusses the problem of key repository maintenance and certificate chaining in a fully distributed way.

O O O B I O B I I I O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O B O B I I I O B I I I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B I I I O O O O O O B I O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I I O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I I B I O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I I I O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O B I O O O O O O O B O B I I I O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I I I O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I I I O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O B I I I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Occurrences of palindromes in characteristic Sturmian words This paper is concerned with palindromes occurring in characteristic Sturmian words cα of slope α, where α ∈ (0, 1) is an irrational. As cα is a uniformly recurrent infinite word, any (palindromic) factor of cα occurs infinitely many times in cα with bounded gaps. Our aim is to completely describe where palindromes occur in cα. In particular, given any palindromic factor u of cα, we shall establish a decomposition of cα with respect to the occurrences of u. Such a decomposition shows precisely where u occurs in cα, and this is directly related to the continued fraction expansion of α. The fascinating family of Sturmian words consists of all aperiodic infinite words having exactly n + 1 distinct factors of length n for each n ∈ N. Such words have many applications in various fields of mathematics, such as symbolic dynamics, the study of continued fraction expansion, and also in some domains of physics (crystallography) and computer science (formal language theory, algorithms on words, pattern recognition). Sturmian words admit several equivalent definitions and have numerous characterizations; in particular, they can be characterized by their palindrome or return word structure [10, 16] . For a comprehensive introduction to Sturmian words, see for instance [1, 2, 23] and references therein.. Sturmian words have exactly two factors of length 1, and thus are infinite sequences over a two-letter alphabet A = {a, b}, say. Here, an infinite word (or sequence) x over A is a map x : N → A. For any i ≥ 0, we set x i = x(i) and write x = x 0 x 1 x 2 · · · , each x i ∈ A. Central to our study is the following characterization of Sturmian words, which was originally proved by Morse and Hedlund [21] . An infinite word s over A = {a, b} is Sturmian if and only if there exists an irrational α ∈ (0, 1), and a real number ρ, such that s is equal to one of the following two infinite words: (n ≥ 0) * E-mail: amy.glen@adelaide.edu.au. The irrational α is called the slope of s and ρ is the intercept. If ρ = 0, we have s α,0 = ac α and s. where c α is called the characteristic Sturmian word of slope α (see [2] ). Our focus will be on palindromic factors of c α . In general terms, a palindrome is a finite word that reads the same backwards as forwards. Palindromes are important tools used in the study of factors of Sturmian words (e.g., [6, 8, 9, 10] ), and they have also become objects of great interest in computer science. The aim of this current paper is to completely describe where palindromes occur in c α (and hence s α,0 , s ′ α,0 ). In order to do this, we shall make use of some previous results concerning factorizations of c α into singular words, which are particular palindromes. Singular words were first defined for the Fibonacci word f (a special example of a Sturmian word) by Wen and Wen [25] , who established a decomposition of f with respect to such words. This result was later extended by Melançon [19] to characteristic Sturmian words. More recently, Levé and Séébold [17] have generalized Wen and Wen's 'singular' decomposition of f , by establishing a similar decomposition for each conjugate of f into what they called generalized singular words. This last result has now been further extended by the present author [14] to c α (and c 1−α ), where α has continued fraction expansion [0; 2, r, r, r, . . .] for some r ≥ 1.. It is well-known that any Sturmian word s is uniformly recurrent, i.e., any factor of s occurs infinitely often in s with bounded gaps [5] . Accordingly, any palindromic factor u of c α has infinitely many occurrences in c α and, as we shall see later (Corollary 5.2), the distance between any two adjacent occurrences of u is bounded above by an integer depending on u. Given any palindromic factor u of c α , we shall establish a decomposition of c α with respect to the occurrences of u. Such a decomposition shows precisely at which positions u occurs in c α , and this is directly related to the continued fraction expansion of the irrational slope α.. This paper is organized as follows. In Section 2, after some preliminaries on words and morphisms, we will recall some facts about c α and consider some of its singular decompositions (Section 2.2). Then, in Section 3, we consider the structure of palindromic factors of c α with respect to its singular factors. We also recall the important notion of a return word and the concept of overlapping occurrences of a word in c α . Section 4 contains the lemmas we need in order to establish the main result of this paper, which appears in Section 5. Lastly, using results of Section 4, we obtain decompositions of c α that show precisely where a given factor of length q n occurs in c α (where q n is the denominator of the n-th

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Hermite Spline Interpolation on Patches for Parallelly Solving the Vlasov-Poisson Equation This work is devoted to the numerical simulation of the Vlasov equation using a phase space grid. In contrast to ParticleIn-Cell (PIC) methods, which are known to be noisy, we propose a semi-Lagrangian-type method to discretize the Vlasov equation in the two-dimensional phase space. As this kind of method requires a huge computational effort, one has to carry out the simulations on parallel machines. For this purpose, we present a method using patches decomposing the phase domain, each patch being devoted to a processor. Some Hermite boundary conditions allow for the reconstruction of a good approximation of the global solution. Several numerical results demonstrate the accuracy and the good scalability of the method with up to 64 processors. This work is a part of the CALVI project. The Vlasov-Poisson equation describes the evolution of a system of charged particles subjected to the effects of a self-consistent electric field. The unknown f is a distribution function of particles in the phase space which depends on time t ≥ 0, the physical space x ∈ R d and the velocity v ∈ R d , where d is the dimension, d = 1, 2, 3. This kind of model can be used for the study of beam propagation, collisionless or gyrokinetic plasmas.. The numerical solution of Vlasov-type equations, which depend at least on 6 variables plus time, is most often performed using particle methods (Particle In-Cellmethods) , where the plasma is approached by a finite number of macro-particles. The trajectories of these particles are computed using the characteristic curves given by the Vlasov equation, whereas the self-consistent electric field is computed on a fixed grid (Birdsall and Langdon, 1991) . Even though these methods produce satisfactory results with relatively few particles, for some applications (in particular, when particles in the tail of the distribution function play an important physical role, or when one wants to study the influence of density fluctuations which are at the origin of instabilities), it is well known that the numerical noise inherent in the particle methods becomes too significant. Consequently, methods which discretize the Vlasov equation on a phase space grid have been proposed (see (Feix et al., 1994; Filbet et al., 2001; Filbet and Sonnendrücker, 2003; Ghizzo et al., 1996; Ghizzo et al., 1990; Shoucri and Knorr, 1974; for plasma physics and (Bermejo, 1991; Staniforth and Coté, 1991) for other applications). Among these Eulerian methods, the semi-Lagrangian method consists in computing directly the distribution function on a Cartesian grid of the phase space. The computation is done by integrating the characteristic curves backward at each time step and interpolating the value at the beginning of the characteristics by some interpolation techniques (e.g., Lagrange, Hermite or cubic splines). We refer the reader to for more details on the semi-Lagrangian method and to (Filbet and Sonnendrücker, 2003) for a comparison of Eulerian solvers dedicated to the Vlasov equation.. Eulerian methods have proven their efficiency on uniform meshes in the two-dimensional phase space, but when the dimensionality increases, the number of points on a uniform grid becomes very important, which makes numerical simulations challenging. Two kinds of strategy have been recently developed to simulate four-dimensional problems. Some adaptive methods decrease the computational cost by keeping only a subset of all grid points. Such methods use moving distribution function grids well suited to manage data locality. For more details, we refer the reader to (Campos-Pinto and Merhenberger, 2004; Gutnic et al., 2004; Sonnendrücker et al., 2004) . On the other hand, some parallelized versions of codes were implemented to simulate high-dimensional problems (Coulaud et al., 1999; Filbet and Violard, 2002) . Generally, the numerical schemes are based on time-splitting schemes which can be parallelized very efficiently on a moderate number of processors using a global transposition between each split step. Apart from this transposition that can be overlapped with computations, there is no communication between the processors. However, when heterogeneous grids and several hundreds or more processors are targeted (Grandgirard et al., 2006; Kim and Parker, 2000) , a global transposition involves a huge amount of data beeing transferred and this may become very inefficient. For these reasons, in this paper we develop a local spline interpolation technique that avoids any global transposition.. This work is devoted to the parallel implementation of the semi-Lagrangian method by using the cubic spline interpolation operator. In order to check the method, we have designed the parallel software LOSS (LOcal Splines Simulator). Even though cubic spline interpolation seems to be a good compromise between accuracy (small diffusivity) and simplicity, it does not provide the locality of the reconstruction since all the values of the distribution function are used for the reconstruction in each cell. To overcome this problem of global dependence, we decompose the phase space domain into patches, each patch being devoted to one processor. One patch computes its own local cubic spline coefficients by solving reduced linear systems. Hermite boundary conditions are imposed at the boundary of the patches to reconstruct a global C 1 numerical solution.. In fact, our strategy consists in getting a parallel version of the code, the results of which are as close as possible to the results of the sequential version. Even if the methodology remains slightly different from the sequential case (essentially due to the local determination of the cubic spline coefficients versus the global solution), our main efforts consist in recovering the global resolution in the best possible way. Thanks to an adapted treatment of the Hermite boundary conditions, the obtained numerical results are then in good agreement with those obtained with the sequential version of the code. Moreover, some communications between processors have to be managed in a suitable way. Indeed, as particles can leave the subdomain, their information must be forwarded to the appropriate processor that controls the subdomain in which the particles now reside. Such interprocessor communications would involve a relatively huge amount of data exchange, but a condition on the time step allows us to control the shifts so that the communications are performed only between adjacent processors. Hence, this communication scheme enables us to obtain competitive results from a scalability point of view. Let us mention that even though a uniform grid is used here, the methodology could be extended to sets of lines which are not equally spaced (e.g., adaptive meshes).. This work contributes to the improvement of a fivedimensional semi-Lagrangian gyrokinetic code which simulates the turbulent transport in magnetized fusion plasma. This high-dimensional problem is very demanding in terms of numerics and, therefore, the code is devoted to be massively parallelized. A time-splitting algorithm allows us to reduce the problem into a sequence of one-dimensional and two-dimensional advections. Our method enables us to accurately solve this advection part using parallel computations (see (Grandgirard et al., 2006) for more details).. The paper is organized as follows: First, we draw up some basic properties of the Vlasov-Poisson model. Then, we recall the main steps of the semi-Lagrangian method. Next, we propose the Hermite spline interpolation on patches before illustrating the efficiency of the method by presenting several numerical results. In this paper, we introduced a local semi-Lagrangian method which has been applied to the Vlasov-Poisson equation. The methodology seems to present a good behaviour when tested on standard plasma configurations. Indeed, the numerical results demonstrade the good efficiency of our code for the two-dimensional case and its good scalability with up to 64 processors.. Using the method introduced here, we developed a Fortran 90 module to locally interpolate any advected function on a two-dimensional domain. This module will then enable us to deal with many problems occuring in plasma physics using the semi-Lagrangian methodology. Future extensions will be devoted to the paraxial Vlasov model. Moreover, coupling this methodology with the moving grid strategy can also be envisaged. Finally, a new algorithm that overcomes the restriction on the time step has to be developed later on.

O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Rank aggregation via nuclear norm minimization The process of rank aggregation is intimately intertwined with the structure of skew-symmetric matrices. We apply recent advances in the theory and algorithms of matrix completion to skew-symmetric matrices. This combination of ideas produces a new method for ranking a set of items. The essence of our idea is that a rank aggregation describes a partially filled skew-symmetric matrix. We extend an algorithm for matrix completion to handle skew-symmetric data and use that to extract ranks for each item. Our algorithm applies to both pairwise comparison and rating data. Because it is based on matrix completion, it is robust to both noise and incomplete data. We show a formal recovery result for the noiseless case and present a detailed study of the algorithm on synthetic data and Netflix ratings. One of the classic data mining problems is to identify the important items in a data set; see Tan and Jin [2004] for an interesting example of how these might be used. For this task, we are concerned with rank aggregation. Given a series of votes on a set of items by a group of voters, rank aggregation is the process of permuting the set of items so that the first element is the best choice in the set, the second element is the next best choice, and so on. In fact, rank aggregation is an old problem and has a history stretching back centuries [Condorcet, 1785] ; one famous result is that any rank aggregation requires some degree of compromise [Arrow, 1950] . Our point in this introduction is not to detail a history of all the possible methods of rank aggregation, but to give some perspective on our approach to the problem.. Direct approaches involve finding a permutation explicitly -for example, computing the Kemeny optimal ranking [Kemeny, 1959] or the minimum feedback arc set problem. These problems are NP-hard [Dwork et al., 2001 , Ailon et al., 2005 , Alon, 2006 . An alternate approach is to assign a score to each item, and then compute a permutation based on ordering these items by their score, e.g. Saaty [1987] . In this manuscript, we focus on the second approach. A key advantage of the computations we propose is that they are convex problems and efficiently solvable.. While the problem of rank aggregation is old, modern applications -such as those found in web-applications like Netflix and Amazon -pose new challenges. First, the data collected are usually cardinal measurements on the quality of each item, such as 1-5 stars, received from voters. Second, the voters are neither experts in the rating domain nor experts at producing useful ratings. These properties manifest themselves in a few ways, including skewed and indiscriminate voting behaviors [Ho and Quinn, 2008] . We focus on using aggregate pairwise data about items to develop a score for each item that predicts the pairwise data itself. This approach eliminates some of the issues with directly utilizing voters ratings, and we argue this point more precisely in Section 2.. To explain our method, consider a set of n items, labeled from 1 to n. Suppose that each of these items has an unknown intrinsic quality si : 1 ≤ i ≤ n, where si > sj implies that item i is better than item j. While the si's are unknown, suppose we are given a matrix Y where Yij = si − sj. By finding a rank-2 factorization of Y (there is no rank-1 skewsymmetric factorization), for example. we can extract unknown scores. The matrix Y is skewsymmetric and describes any score-based global pairwise ranking. (There are other possible rank-2 factorizations Existing principled techniques such as computing a Kemeny optimal ranking or finding a minimize feedback arc set are NP-hard. These approaches are inappropriate in large scale rank aggregation settings. Our proposal is (i) measure pairwise scoresŶ and (ii) solve a matrix completion problem to determine the quality of items. This idea is both principled and functional with significant missing data. The results of our rank aggregation on the Netflix problem (Table 2) reveal popular and high quality movies. These are interesting results and could easily have a home on a "best movies in Netflix" web page. Such a page exists, but is regarded as having strange results. Computing a rank aggregation with this technique is not NP-hard. It only requires solving a convex optimization problem with a unique global minima. Although we did not record computation times, the most time consuming piece of work is computing the pairwise comparison matrix Y . In a practical setting, this could easily be done with a MapReduce computation.. To compute these solutions, we adapted the svp solver for matrix completion [Jain et al., 2010] . This process involved (i) studying the singular value decomposition of a skewsymmetric matrix (Lemmas 1 and 2) and (ii) showing that the svp solver preserves a skew-symmetric approximation through its computation (Theorem 3). Because the svp solver computes with an explicitly chosen rank, these techniques work well for large scale rank aggregation problems.. We believe the combination of pairwise aggregation and matrix completion is a fruitful direction for future research. We plan to explore optimizing the svp algorithm to exploit the skew-symmetric constraint, extending our recovery result to the noisy case, and investigating additional data. We implemented and tested this procedure in two synthetic scenarios, along with Netflix, movielens, and Jester joke-set ratings data. In the interest of space, we only present a subset of these results for Netflix. Figure 2: An experimental study of the recoverability of a ranking vector. These show that we need about 6n log n entries of Y to get good recovery in both the noiseless (left) and noisy (right) case. See §6.1 for more information.

B I O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Vulnerability of MRD-Code-based Universal Secure Network Coding against Stronger Eavesdroppers SUMMARY Silva et al. proposed a universal secure network coding scheme based on MRD codes, which can be applied to any underlying network code. This paper considers a stronger eavesdropping model where the eavesdroppers possess the ability to re-select the tapping links during the transmission. We give a proof for the impossibility of attaining universal security against such adversaries using Silva et al.'s code for all choices of code parameters, even with a restricted number of tapped links. We also consider the cases with restricted tapping duration and derive some conditions for this code to be secure. The notion of network coding, proposed by Ahlswede et al. [1] , has been attracting much attention. On a conventional routing network, each node is only allowed to relay the received packets to the next node, while on a network with network coding support, each node is allowed to perform some data processing using the received packets and send the result to the next node. It is known that the use of network coding offers many advantages over the use of conventional network, such as achievement of higher rate in multicast communications or better energy efficiency in wireless communications [2] .. Secrecy of communication, or more specifically, information-theoretically secure communication in the presence of an adversary capable of tapping a fixed number of links of its choice, is considered as one of such advantages of network coding. Such a scheme, referred to as secure network coding, consists of the following two components: the network code which determines how packets are coded at intermediate nodes, and the outer code which is a pre-coding done at the source before transmission. Several secure network codes have been proposed, such as the one by Cai et al. [3] . However, these codes require the reconstruction of the network code, or the reconstruction of the outer code in order to attain security for a given set of tapped links. Such a property causes problems, such as difficulty when securing random network codes [4] , where network codes are constructed randomly. Silva et al. proposed a universal secure network coding method [5] based on MRD codes [6] and coset coding scheme [7] . This code can be applied on top of any alreadyconstructed network code to attain security. However, due to its use of vector outer code which requires that each symbol be transmitted over multiple time slots, it must assume that the tapped links are fixed during the transmission period.. We consider a stronger eavesdropping model where the eavesdroppers possess the ability to re-select the tapping links during the transmission. Such a model is worth consideration because the conventional non-universal secure network codes (e.g. [3] , [8] ) are guaranteed to be secure against it. Moreover, this model corresponds to some practical situations where random network coding is used and the coding vectors are time-varying, such as the robust random network coding scheme proposed by Chou et al. [9] . Also, the current standard of the IP protocol allows the network to split a packet into multiple fragments and carry them through multiple distinct routes, as explained in [10, Section 11.5] . Thus, the stronger eavesdropping model considered here has practical importance when Silva et al.'s method is used over the current Internet.. This paper aims to clarify the security of Silva et al.'s universal code against this eavesdropping model, and is organized as follows. In Section 2 we define some notations and briefly review some of the existing results of secure network coding, and describe Silva et al.'s universal secure network code. In Section 3 we introduce our stronger eavesdropping model. In Section 4 we prove the vulnerability of this universal code against our model for all code parameters. We also prove that the code is vulnerable even with a limited number of tapped links. Moreover, the cases with shorter tapping duration are considered, and sufficient conditions and necessary conditions for the code to be secure are given. In Section 5 we state our conclusion and the future tasks. We proposed an eavesdropping model where the adversary is able to re-select the tapping wires at each time slot during the communication. We proved the impossibility of securing against this model using the universal secure network code proposed by Silva et al. for all choices of code parameters, even with a restricted number of tapped links. Moreover, we considered the case with shorter tapping duration, and derived a necessary condition for this code to be secure. The future tasks include improving this condition to a necessary and sufficient one.

O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Post-game estimation of game client RTT and hop count distributions In first person shooter (FPS) games the round trip time (RTT) between a client and server influences player decisions on which server to join. Game servers do not accurately log the RTT of potential clients who only probed the server. We describe a simple, active method of estimating the RTT and hop-count between server and client when armed only with each client's IP address. For rough approximations this scheme works days or weeks after client IP addresses were collected. We illustrate using data gathered from a Wolfenstein Enemy Territory server operating in Australia, providing after-the-fact comparisons between the RTT and hop-count distributions of clients who probe a server versus clients who actually join a server and play. First Person Shooter (FPS) games are currently a popular form of multiplayer networked game. Game clients probe game servers for information such as the current map, the number of current players on the server and the current network round trip time (RTT) between client and server. Potential players use this information to find suitable games and servers to join. The RTT (or 'lag') between a client and server strongly influences enjoyment in such fast-paced interactive games [1] [2] [3] [4] [5] .. Server operators and Internet service providers (ISPs) can find it useful to characterize the RTT tolerance of clients who frequent their servers. This requires measuring the RTT experienced by clients who probe and join, and clients who probe and never join. FPS servers are usually incapable of logging RTT estimates for clients who probe without joining [6] . An external packet sniffer program such as tcpdump provides only IP addresses.. We describe an active method of estimating the RTT between a server and its clients when armed only with each client's IP address. For rough approximations this scheme works days or weeks after client IP addresses were collected. As jitter tends to be influenced by router hops we also discuss how to estimate the probable hop count towards each client IP address. Our proposal copes with clients going offline after they have played, IP addresses being reassigned to entirely different customers after being seen and logged by the game server, and network-layer filtering of ICMP traffic at (or near) the client end.. We demonstrate this technique by estimating the distribution of RTT and hop count for game clients previously seen contacting a Wolfenstein Enemy Territory server based in Melbourne, Australia [7] . The results provide insights into the geographic and topological distributions of clients who chose to play and those who chose not to play on this particular server. The rest of the paper is organized as follows: section 2 describes the proposed measurement methodology. Section 3 demonstrates the use of this methodology on client IP addresses gathered from a specific game server. Section 4 concludes the paper. It is difficult to log the RTT experienced (or perceived) by clients who simply probe a game server without playing. We describe a technique to establish RTT and hop-count estimates, after the fact, to game clients who may no longer be attached to the Internet. We assume that each client IP address is most likely associated with a consumer Internet connection, and thus assert the RTT and hop-count to every client IP address under a common CIDR prefix will be approximately the same. This step reduces millions of IP addresses to thousands for active probing.. As clients may come and go, and ping's ICMP echo request/reply packets are often blocked by personal firewalls near the target host, it may be necessary to use traceroute to identify an IP router close to a target client IP address. The distance between a traceroute-derived last hop and the actual target client IP address may be indirectly inferred when large numbers of client IP addresses are available.. We demonstrate using client IP address data collected from a Wolfenstein Enemy Territory (ET) server based in Melbourne, Australia. Roughly 2.4M client IP addresses were reduced to a sample set of 330K IP addresses, representing clients who played or probed the ET server. We found 26-28% of client IP addresses could be pinged directly, we could ping the traceroute-derived last hop router in 62-63% of cases, and in 9-12% of cases we had to use traceroute's own estimate of RTT to the last hop. We found evidence that traceroute generally reached within one hop of clients who had been logged playing on the server, and within two hops of clients who had simply probed the server. The resulting RTT and hop-count distributions illustrated the topological and geographical characteristics of clients that played on our Melbourne-based ET server, compared to those who simply probed the server.. There are limitations: The Internet's topology is not strictly static, measurements taken today do not necessarily reflect the RTT and hop-count prevailing at the time each client connected, and ISPs may move IP address space between their dial-up, cable modem and ADSL access offerings. Our technique establishes a broadly indicative set of RTT and hop-count distributions based solely on client IP addresses found in game server logs, and provide insights into the RTT tolerance of players through the RTT distributions of clients who probed, but did not play, a monitored game server.

B I O O O O O B I O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Influence of Speech Codecs Selection on Transcoding Steganography Abstract. The typical approach to steganography is to compress the covert data in order to limit its size, which is reasonable in the context of a limited steganographic bandwidth.TranSteg (Trancoding Steganography) is a new IP telephony steganographic method that was recently proposed that offers high steganographic bandwidth while retaining good voice quality. In TranSteg, compression of the overt data is used to make space for the steganogram.In this paper we focus on analyzing the influence of the selection of speech codecs on hidden transmission performance, that is, which codecs would be the most advantageous ones for TranSteg. Therefore, by considering the codecs which are currently most popular for IP telephony we aim to find out which codecs should be chosen for transcoding to minimize the negative influence on voice quality while maximizing the obtained steganographic bandwidth.Key words: IP telephony, network steganography, TranSteg, information hiding, speech codingSteganography is an ancient art that encompasses various information hiding techniques, whose aim is to embed a secret message (steganogram) into a carrier of this message. Steganographic methods are aimed at hiding the very existence of the communication, and therefore any third-party observers should remain unaware of the presence of the steganographic exchange. Steganographic carriers have evolved throughout the ages and are related to the evolution of the methods of communication between people. Thus, it is not surprising that currently telecommunication networks are a natural target for steganography. The type of modern steganography that utilizes network protocols and/or relationships between them as the carrier for steganograms to enable hidden communication is called network steganography.IP telephony is one of the most important services in the IP world and is changing the entire telecommunications landscape. It is a real-time service which enables users to make phone calls through IP datanetworks. An IP telephony connection consists of two phases, in which certain types of traffic are exchanged between the calling parties: signaling and conversation phases. In the first phase certain signaling protocol messages, for example SIP (Session Initiation Protocol) messages [27] , are exchanged between the caller and callee. These messages are intended to set up and negotiate the connection parameters between the calling parties. In the latter phase two audio streams are sent bidirectionally. RTP (Real-Time Transport Protocol) [29] is most often utilized for voice data transport, and thus packets that carry voice payload are called RTP packets.The consecutive RTP packets form an RTP stream. Due to the popularity of IP telephony, as well as the large volume of data and the variety of protocols involved, it is currently attracting the attention of the research community as a perfect carrier for steganographic purposes [18] .TranSteg (Transcoding Steganography) is a new steganographic method that has been introduced recently in[39]. It is intended for a broad class of multimedia and real-time applications, but its main foreseen application is IP telephony. TranSteg can also be exploited in other applications or services (like video streaming), wherever a possibility exists to efficiently compress (in a lossy or lossless manner) the overt data. The typical approach to steganography is to compress the covert data in order to limit its size (it is reasonable in the context of a limited steganographic bandwidth). In TranSteg, compression of the overt data is used to make space for the steganogram. TranSteg is based on the general idea of transcoding (lossy compression) of the voice data from a higher bit rate codec (and thus greater voice payload size) to a lower bit rate codec (with smaller voice payload size) with the least possible degradation in voice quality.In [39] a proof of concept implementation of TranSteg was subjected to experimental evaluation to verify whether it is feasible. The obtained experimental results proved that it offers a high steganographic bandwidth (up to 32 kbit/s) while introducing delays lower than 1 ms and still retaining good voice quality.In this paper we focus on analyzing how the selection of speech codecs impacts hidden transmission performance, that is, which codecs would be the most advantageous ones for TranSteg. Therefore, the main contribution of the paper is to establish, by considering the codecs for IP telephony which are currently most popular, which speech codecs should be chosen for transcoding to minimize the negative influence on the hidden data carrier (voice quality) while maximizing the obtained steganographic bandwidth.The rest of the paper is structured as follows. Section 2 presents related work on IP telephony steganography.Section 3 describes the functioning of TranSteg and its hidden communication scenarios. Section 4 presents the experimental methodology and results obtained. Finally, Section 5 concludes our work.IP telephony as a hidden data carrier can be considered a fairly recent discovery. The proposed steganographic methods stem from two distinctive research origins. The first is the well-established image and audio file steganography [6] , which has given rise to methods which target the digital representation of voice as the carrier for hidden data. The second sphere of influence is the so-called covert channels, created in different network The first VoIP steganographic methods to utilize the digital voice signal as a hidden data carrier were proposed by Dittmann et al. in 2005 [9]. The authors evaluated the existing audio steganography techniques, with a special focus on the solutions which were suitable for IP telephony. This work was further extended and published in 2006 in [17] . In [40] , an implementation of SteganRTP was described. This tool employed the least significant bits (LSB) of the G.711 codec to carry steganograms. Wang and Wu, in [34] , also suggested using the least significant bits of voice samples to carry secret communication, but here the bits of the steganogram were coded using a low rate voice codec, like Speex. In [ proved to give better results in terms of voice quality than the LSB-based method. An interesting study is described in [26] , where Nishimura proposed hiding information in the AMR-coded stream by using an extended quantization-based method of pitch delay (one of the AMR codec parameters). This additional data transmission channel was used to extend the audio bandwidth from narrow-band (0.3-3.4 kHz) to wide-band (0.3-7.5 kHz).Utilization of the VoIP-specific protocols as a steganogram carrier was first proposed by Mazurczyk and Kotulski in 2006 [19]. The authors proposed using covert channels and watermarking to embed control information (expressed as different parameters) into VoIP streams. The unused bits in the header fields of IP, UDP, and RTP protocols were utilized to carry the type of parameter, while the actual parameter value is embedded as a watermark into the voice data. The parameters are used to bind control information, including data authentication, to the current VoIP data flow. In [21] and [22] Mazurczyk and Szczypiorski described network steganography methods that can be applied to VoIP: to its signaling protocol, SIP (with SDP), and to its RTP streams (also with RTCP). They discovered that a combination of information hiding solutions provides a capacity to covertly transfer about 2000 bits during the signaling phase of a connection and about 2.5 kbit/s during the conversation phase. In [22] , a novel method called LACK (Lost Audio Packets Steganography) was introduced; it was later described and analyzed in [20] and [18] . LACK relies on the modification of both the content of the RTP packets and their time dependencies. This method takes advantage of the fact that, in typical Steganography is an ancient art that encompasses various information hiding techniques, whose aim is to embed a secret message (steganogram) into a carrier of this message. Steganographic methods are aimed at hiding the very existence of the communication, and therefore any third-party observers should remain unaware of the presence of the steganographic exchange. Steganographic carriers have evolved throughout the ages and are related to the evolution of the methods of communication between people. Thus, it is not surprising that currently telecommunication networks are a natural target for steganography. The type of modern steganography that utilizes network protocols and/or relationships between them as the carrier for steganograms to enable hidden communication is called network steganography.. IP telephony is one of the most important services in the IP world and is changing the entire telecommunications landscape. It is a real-time service which enables users to make phone calls through IP data networks. An IP telephony connection consists of two phases, in which certain types of traffic are exchanged between the calling parties: signaling and conversation phases. In the first phase certain signaling protocol messages, for example SIP (Session Initiation Protocol) messages [27] , are exchanged between the caller and callee. These messages are intended to set up and negotiate the connection parameters between the calling parties. In the latter phase two audio streams are sent bidirectionally. RTP (Real-Time Transport Protocol) [29] is most often utilized for voice data transport, and thus packets that carry voice payload are called RTP packets. 2 The consecutive RTP packets form an RTP stream. Due to the popularity of IP telephony, as well as the large volume of data and the variety of protocols involved, it is currently attracting the attention of the research community as a perfect carrier for steganographic purposes [18] .. TranSteg (Transcoding Steganography ) is a new steganographic method that has been introduced recently in [39] . It is intended for a broad class of multimedia and real-time applications, but its main foreseen application is IP telephony. TranSteg can also be exploited in other applications or services (like video streaming), wherever a possibility exists to efficiently compress (in a lossy or lossless manner) the overt data. The typical approach to steganography is to compress the covert data in order to limit its size (it is reasonable in the context of a limited steganographic bandwidth). In TranSteg, compression of the overt data is used to make space for the steganogram. TranSteg is based on the general idea of transcoding (lossy compression) of the voice data from a higher bit rate codec (and thus greater voice payload size) to a lower bit rate codec (with smaller voice payload size) with the least possible degradation in voice quality.. In [39] a proof of concept implementation of TranSteg was subjected to experimental evaluation to verify whether it is feasible. The obtained experimental results proved that it offers a high steganographic bandwidth (up to 32 kbit/s) while introducing delays lower than 1 ms and still retaining good voice quality.. In this paper we focus on analyzing how the selection of speech codecs impacts hidden transmission performance, that is, which codecs would be the most advantageous ones for TranSteg. Therefore, the main contribution of the paper is to establish, by considering the codecs for IP telephony which are currently most popular, which speech codecs should be chosen for transcoding to minimize the negative influence on the hidden data carrier (voice quality) while maximizing the obtained steganographic bandwidth.. The rest of the paper is structured as follows. Section 2 presents related work on IP telephony steganography. Section 3 describes the functioning of TranSteg and its hidden communication scenarios. Section 4 presents the experimental methodology and results obtained. Finally, Section 5 concludes our work. TranSteg is a new steganographic method dedicated to multimedia services like IP telephony. In this paper the analysis of the influence of the selection of speech codecs on the performance of TranSteg hidden transmission was presented. By considering the codecs which are currently most popular for IP telephony we wanted to find out which codecs should be chosen for transcoding to minimize the negative influence on hidden data carriers while maximizing the obtained steganographic bandwidth.. The obtained experimental results show that TranSteg is most effective when G.711 is used for the overt transmission. We think that this is caused by several factors:. • high G.711 bitrate, so there is more space for hidden data;. • high speech quality offered by G.711;. • G.711 performs well if transcoded more than once (see Table II ), which we think is due to the fact that G.711 is a waveform codec; that is, it preserves the waveform shape;. • while being a waveform codec, G.711 behaves well if further transcoded with other codecs, especially CELP-based ones (AMR, Speex in mode 7). Therefore, when it is possible to select an overt codec (e.g., by imposing it in codec negotiation in scenario S3), G.711 is the best option. In contrast, Speex in the low mode (4) and G.723.1 as the overt codecs turned out to provide too low overall quality when cascaded with any of the covert codecs, and therefore should be avoided in TranSteg in overt transmission.. not complement each other well. For example, Speex in mode 7 works significantly better (in terms of voice quality) with AMR than with GSM 06.10, even though the two TranSteg configurations result in similar steganographic bandwidths. A similar phenomenon was observed in other research projects, for example in speaker recognition from coded speech, in situations where there was a mismatch between the codec used in voice transmission and the codec used to create speakers' models [15] .. The choice of a covert codec depends on an actual application, or more precisely, on whether priority is given to higher steganographic bandwidth or better speech quality. We recommended 10 pairs of overt/covert codecs which can be used effectively in TranSteg in various conditions depending on the required steganographic bandwidth, allowed steganographic cost, and the codec used in the overt transmission. We grouped those pairs into three classes based on the steganographic cost. The pair G.711/G.711.0 is costless; nevertheless it offers a remarkably high steganographic bandwidth, on average more than 31 kbps. However caution must be taken, as the G.711.0 bitrate is variable and depends on an actual signal being transmitted in the overt channel.. Codec AMR working in 12.2 kbps mode proved to be very efficient as the covert codec in TranSteg. This is a low bitrate codec which does not significantly degrade the quality: the steganographic cost ranged between 0.36 and 0.46 MOS.. In this research we showed results for scenario S4, which is the worst case scenario in terms of the speech quality, as it requires triple transcoding. If TranSteg scenarios S1-S3 were applied, we would avoid one or even two (in scenario S1) transcodings, and therefore steganographic cost would be lower than presented in this study.. Future work will include the development of the TranSteg-capable softphone, which will include results related to speech codec selection presented in this paper. Moreover, effective and efficient TranSteg detection methods will be pursued. IP telephony as a hidden data carrier can be considered a fairly recent discovery. The proposed steganographic methods stem from two distinctive research origins. The first is the well-established image and audio file steganography [6] , which has given rise to methods which target the digital representation of voice as the carrier for hidden data. The second sphere of influence is the so-called covert channels, created in different network protocols [1] , [24] (a good survey on covert channels, by Zander et al., can be found in [37] ); these solutions target specific VoIP protocol fields (e.g. signaling protocol -SIP, transport protocol -RTP, or control protocol -RTCP) or their behavior. Presently, steganographic methods that can be utilized in telecommunication networks are jointly described by the term network steganography, or, specifically, when applied to IP telephony, by the term steganophony [18] .. The first VoIP steganographic methods to utilize the digital voice signal as a hidden data carrier were proposed by Dittmann et al. in 2005 [9] . The authors evaluated the existing audio steganography techniques, with a special focus on the solutions which were suitable for IP telephony. This work was further extended and published in 2006 in [17] . In [40] , an implementation of SteganRTP was described. This tool employed the least significant bits (LSB) of the G.711 codec to carry steganograms. Wang and Wu, in [34] , also suggested using the least significant bits of voice samples to carry secret communication, but here the bits of the steganogram were coded using a low rate voice codec, like Speex. In [31] presented an adaptive steganography scheme based on the smoothness of the speech block. Such an approach proved to give better results in terms of voice quality than the LSB-based method. An interesting study is described in [26] , where Nishimura proposed hiding information in the AMR-coded stream by using an extended quantization-based method of pitch delay (one of the AMR codec parameters). This additional data transmission channel was used to extend the audio bandwidth from narrow-band (0.3-3.4 kHz) to wide-band (0.3-7.5 kHz).. multimedia communication protocols like RTP, excessively delayed packets are not used for the reconstruction of the transmitted data at the receiver; that is, the packets are considered useless and discarded. Thus, hidden communication is possible by introducing intentional delays into selected RTP packets and substituting the original payload with a steganogram.. Bai et al. [4] proposed a covert channel based on the jitter field of the RTCP header. This is performed in two stages: firstly, statistics of the value of the jitter field in the current network are calculated. Then, the secret message is modulated into the jitter field according to the previously calculated parameters. Utilization of such modulation guarantees that the characteristic of the covert channel is similar to that of the overt one. In [8] ,. Forbes proposed a new RTP-based steganographic method that modifies the timestamp value of the RTP header to send steganograms. The method's theoretical maximum steganographic bandwidth is 350 bit/s.. The TranSteg technique that was first introduced in [39] is a development of the last of the discussed groups of steganographic methods for VoIP, originating from covert channels. Compared to the existing solutions, its main advantages are a high steganographic bandwidth, low steganographic cost (i.e. little degradation of voice quality), and difficult detection.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I B B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O