The automotive industry has been transformed through technological progress during the past decade. Vehicles are equipped with multiple computing devices that offer safety, driving assistance, or multimedia services. Despite these advancements, when an incident occurs, such as a car crash, the involved parties often do not take advantage of the technological capabilities of modern vehicles and attempt to assign liability for the incident to a specific vehicle based upon witness statements. In this paper, we propose a secure, decentralized, blockchain-based platform that can be employed to store encrypted position and velocity values for vehicles in a smart city environment. Such data can be decrypted when the need arises, either through the vehicle driver’s consent or through the consensus of different authorities. The proposed platform also offers an automated way to resolve disputes between involved parties. A simulation has been conducted upon a mobility traffic dataset for a typical day in the city of Cologne to assess the applicability of the proposed methodology to real-world scenarios and the infrastructure requirements that such an application would have. Technology advancement has enabled the embedding of computing capabilities to existing devices and machines. One of the sectors in which we have experienced great technological progress during the last decades is the automotive industry. A high number (30–50) of embedded computer systems are installed in most cars  currentlThe currently existing computing capabilities make it easy for vehicles to record data regarding their position and velocity. Such technology is already widely implemented in the US, where every vehicle manufactured since 2014 is outfitted with an event data recorder (EDR), or “black box”, that records a wide range of data to be used (if necessary) in court . HoweverGiven that the technology that senses data is already embedded in vehicles, and the initial attempts to transmit such data to remote locations have been recorded, the next step is to conduct data monitoring in an efficient, global, secure, and privacy-preserving way. Constructing a device that monitors the data provided by sensors embedded in vehicles, encrypts those appropriately, and sends the produced records to a remote secure storage resource is a feasible target. The main requirements would be internet connectivity and sufficient processing resources to perform the encryption of the data.Recent findings point to a significant rise in the urban population by 2030, which will trigger an increase in vehicular incidents occurring in urban areas. This has motivated researchers to focus on the development of a variety of technologies pertaining to automatic incident detection and management . Such inBlockchain is a distributed ledger technology that enables the immutable storing of information on cryptographically linked blocks. All records are stored on the network’s peer nodes, making modification of information and identity impersonation impossible. It enables interaction on a zero-trust ecosystem, which lacks a central authority, while also providing resilience to single-point-of-failure scenarios. Two main blockchain approaches exist , public The combination of the aforementioned technologies, powerful embedded systems, and blockchains, could have multidimensional benefits. When an incident (such as a car crash) takes place, authorities would no longer have to rely on drivers or descriptions of passersby estimations to conclude which party should be blamed for the incident. At the same time, drivers would feel comfortable and in control regarding the use of their personal information and also be sure that a fair settlement would be more easily achieved by authorities.In this paper, we present a blockchain-based forensics framework for vehicular related incidents in a smart city environment. The main concept of the framework is to continuously collect vehicle data and store it in an encrypted form on a distributed system that ensures data integrity. Whenever the need for access to the data arises, authorities can request the encryption key from the driver, or retrieve it through a secret sharing scheme, given that a set of organisations  agree. The framework also offers an automated way (through smart contracts) to document the incident and liability workflow by the drivers or by assigning liability by the police. The framework is designed upon the Hyperledger fabric platform  that offA technically mature approach for decentralized storage and retrieval of vehicles’ data.A system that focuses on utilizing gathered data for incident cataloguing, reliable resolving and liability attribution regarding violations involving one or multiple parties.The incorporation of a privacy protection layer that enables the system’s adoption with minimal privacy loss for vehicle owners.A formal security analysis of the proposed protocol.An estimation of the load that such a system would have to cope with if applied in a real world urban environment.The main contributions of the present paper are:The rest of the paper is structured as follows. Various similar approaches exist in the literature that either focus on vehicular forensics or aim at providing such functionality for the general smart city ecosystem.The authors of  propose Block4Forensic, introduced in , is a frThe authors of  furthereThe authors in  introducThe authors of  have extThe forensic chain presented in  aims at The BIFF framework, introduced in , provideThe majority of existing works related to vehicular/digital forensics fail to extensively predict and guard against malicious scenarios. Most frameworks are not secured against malevolent internal activity, and some are entirely lacking an approach devoted to handling unwanted behaviour/incidents.Few of the papers discussed have tested the proposed approaches to present a detailed analysis of the performance yielded. Most efforts lack performance evaluating metrics that are very significant for the successful application of the presented schemes. The capacity of such systems, with respect to the number of connected devices, data submission rate, and blockchain infrastructure, should be studied, as it is common for blockchain-based systems to be inefficient, costly, or even inapplicable in a real-world setting.The majority of authors of the aforementioned works have opted for creating custom blockchain systems instead of using an existing, established one. Such an approach usually facilitates implementation, since it minimizes the requirement of adjusting the proposed system to the capabilities of an existing blockchain network, and eliminates any scalability problems or potentially high costs. On the other hand, it partially sacrifices security and stability, features offered by established blockchain platforms, which are of utmost importance, especially when it comes to handling data that are used for law enforcement purposes.Assess the actual load (in terms of transactions and network traffic) that such an approach would have. The case of the real-world application of the proposed system for a medium-sized city has been extensively studied to simulate the operation of the system and conclude on the infrastructure requirements.Provide a formal security analysis of the proposed system. The security properties of the protocol are analyzed, by using an established formal security analysis approach. Existing similar research efforts either completely neglect to take into account required security properties or insufficiently discuss them.The present paper proposes a forensics framework for vehicular related incidents. It provides a fair, fast, and automated way to resolve disputes between owners of vehicles and/or insurance companies. The proposed system is based upon existing mature technologies and provides security and trust to participating actors. To the extent of our knowledge, it is the first research proposal in the literature that attempts to:Hyperledger fabric ,20 is onThe ability to form channels is arguably fabric’s most notable characteristic. It allows the formation of subgroups between participating organisations and the creation of private transaction ledgers for those subgroups. Access to such ledgers is controlled by policies attached to the corresponding channels. There is no limitation regarding the number of channels that can be formed in a fabric network.Fabric smart contracts are known as chaincodes, and the terms are often used interchangeably. Currently, supported programming languages include Go, NodeJS, and Java. Chaincodes are invoked by clients that are not part of the blockchain network, in order to interact with the ledger. The code of the chaincodes defines and enforces the specifications of such interactions.The fabric ledger is made up of two separate parts. One is the world state, essentially a database that maintains the current state, and the other is the transactions’ log, a blockchain that records all committed transactions that have driven the ledger to its current state. Each channel comes with its own ledger which is distributed to all the participating peers of organisations that have access to it.Peers (or peer nodes) contribute a great deal in a fabric network. Ledgers and smart contracts are hosted by them, and they act as necessary intermediaries for out-of-network clients that wish to interact with a chaincode. Many different kinds of peers can exist in a network, with the most important ones being committing and endorsing peers. Regardless of its type, every peer belongs to, and is maintained by, an organisation.Organisations are the main entities that form a collaboration and maintain a shared fabric network. Each organisation provides its MSP for identity management and maintains a number of peers and ordering nodes. MSP is provided through trusted Certificate Authorities (CAs), which are operated by each organisation separately, and issue X.509 compliant certificates for all the identities of the organisation that are going to interact with the network. CAs play an integral role as the aforementioned certificates enable the establishment of access control mechanisms on the network.In Hyperledger Fabric, a set of ordering nodes is in charge of forming blocks of transactions. Those make up what is called the ordering service of the system. The nodes comprising the service can come from any number of different organisations/members of the network. The ordering of the transactions maintains the sequence in which the transactions arrive. A single ordering service exists per network and handles transactions for all its channels. Blocks generated by the ordering service are indisputable, thanks to the deterministic nature of the algorithms used by fabric for this process.Finally, private data collections play an important part in Hyperleger fabric as they allow the exclusive and private exchange of information between a subgroup of channel members. The private data is stored by authorised organisations’ peers in a private state database, and all other peers, orderers included, are incapable of viewing it. However, a hash of the private data is publicly stored in everyone’s ledger, to ensure private data integrity.The Interplanetary File System (IPFS)  is a peeIn IPFS, data are stored as IPFs objects, which are data blocks that do not exceed 256 KB in size. In order to construct structures for larger files, or even directories, such blocks may be connected through links that enable the connection of multiple blocks together. The objects that are connected together form a Merkle DAG. In IPFS, if one node is down, other nodes in the network can serve files. Thus, data blocks still exist on the network as long as there is at least one node that stores it. IPFS also eliminates content duplication, as files with exactly the same content are stored only once. Distributing the data blocks of a large file to multiple different peers, facilitates the efficient retrieval of the file.In general, IPFS offers an efficient and secure storage resource of theoretically unlimited size that is characterized by very high availability. The storage nodes operate on a peer-to-peer basis, and no node is able to tamper with the stored data. Because of such characteristics, IPFS is commonly proposed to be used along with blockchain systems (that have storage limitations) and to serve as a storage back-end that will guarantee the integrity of the stored data.Secret-sharing is a methodology that enables an entity to create a number of shares out of a secret system, a predefined number of which can be used for the reconstruction of the initial secret . The mait out of n secret shares required to reconstruct the initial secret. The main properties such a system shall hold are:Correctness: The secret can be determined by any combination of t shares out of the complete set of n shares. There exists an algorithm that efficiently computes the secret from the t shares.Privacy: Access to any n shares gives no information about the value of the initial secret.Such schemes are usually described as Secret sharing schemes are mainly used as part of secure protocols, in order to enhance their resilience to secret leakage attacks .In the present Section a high-level description of the system, the actors, and the various processes that take place are given, while no actual algorithms or technical decisions for the system are discussed. In the next Section all the implementation details for the proposed system are covered, such as the choice and configuration of the blockchain platform and storage network along with the selection of cryptographic algorithms used in the system.The present paper introduces a blockchain-based forensics framework for vehicular related incidents in a smart city environment. Incident-related data are recorded in a secure, private way that guarantees integrity and availability. Through fast, immutable, and decentralised procedures, the proposed scheme enables a privacy-preserving approach that can provide valuable information for a vehicular related incident, such as a car crash, when required. It serves as a storage resource for critical information while allowing access to said information only when necessary and solely for entities that have the proper rights to it.The main concept of the framework is that vehicle movement data are continuously encrypted and stored on a distributed network that ensures data integrity. Whenever a car crash incident happens, access to such data can facilitate the fast and automatic resolving of a dispute between the involved vehicle owners and the corresponding insurance companies. Access to collected data can normally be achieved through the consent of the vehicle owners. In cases where this is not feasible, regulatory authorities can decrypt stored data, given that there is a strong consensus between them. Decryption by a single entity (other than the driver) is not allowed—in order to avoid potential privacy violations. Authorities are able to conduct sample checks by requesting access to past data, to check if vehicles are reporting in a valid way. This can happen through cross-correlating submitted data with data from either other vehicles or other sources , but the actual cross-checking is out of the scope of the present paper.The proposed system is based on three main components, a blockchain network, a distributed file storage system, and an IoT device installed in vehicles.The blockchain network of the system has been designed and developed using the Hyperledger fabric ,20 platfDirectly storing large volumes of collected data on the blockchain is an inefficient choice, especially for the use case under consideration. Instead, we have opted for the Inter-Planetary File System (IPFS)  to be utThe last component of the implementation is an IoT device, that is installed into every licensed vehicle in the smart city. This device’s main functionalities are data collection from the vehicle’s sensors (such as its location and velocity), data encryption, and data uploading to the IPFS. The device also renews encryption keys periodically and is responsible for key management and transfer to the IPFS network. Finally, this device ultimately commits the required data to the fabric blockchain. For the present paper, the device has been emulated by a software agent, to design the general framework. A capable hardware implementation of the device will be proposed in our future work.The framework is designed to function for the benefit of various different entities, all of which are involved in vehicular related incidents. Each of the actors holds a private/public key pair that is used to selectively allow them to access the publicly available data in the storage component of the system.All owners of vehicles in the smart city environment have access to the information gathered by their own vehicles’ sensors and can use such data to speed up the process following an incident by sharing them with the authorities. In all cases, they benefit from the fast settlement of incidents that the scheme provides and can depend upon the integrity of the evidence stored in the system.Insurance companies are brought in for the purpose of providing the required infrastructure for the set up of the fabric network. They are given access to data for the incidents their clients are involved in, and can use them to carry out their vehicle insurance procedures. Since the data stored in the system cannot be tampered with, the information can be trusted and used as fair decisions for all parties involved.This category includes an abundance of different agencies such as law enforcement, traffic police, judicial authorities and the municipality, all grouped together and referred to as authorities for the sake of simplicity. Authorities are the closest to an administrative entity, as they have administrative rights over the fabric network. Authorities gain access to vehicle-related data when deemed essential, to handle a case. Additionally, through the use of smart contracts, they generate additional incident-related data  and store those in the system. Authorities also participate in a secret sharing scheme that functions as the last resort procedure that enables key retrieval, required to access critical encrypted data, even if vehicle owners do not consent to that retrieval.The interactions of each system actor in the platform are depicted in Authority organisations and insurance companies are also responsible for maintaining the nodes of the distributed platform and thus guarantee the integrity of stored data. Each one of those organisations maintains a node in the blockchain network and a node in the IPFS network, while the insurance companies are responsible for maintaining the data of their vehicles in their IPFS node.The main functionality of the system can be split into three distinct phases, data collection, key management, and data retrieval, which are analyzed in the present Subsection.m and n that can support large smart city areas are around 20 bits, and thus, 48 bits are sufficient for any use case.The operations the device performs using the data are depicted in (1)The data collected are encrypted to prevent exposure to third parties. Encryption happens through the use of a symmetric session key that is periodically refreshed, as described in the next Subsection.(2)The encrypted data are stored on the (IPFS) network. A hash that points to the IPFS file where the data can be found is retrieved by the device.(3)The IPFS hash, along with a timestamp that defines when the data were collected, are stored on the fabric blockchain for future use.Data collection, through embedded sensors in the vehicle, is the main procedure taking place. The location and velocity of vehicles are constantly recorded by the IoT device of the scheme. The collected data are encoded as a bit array depicted in Equation This course of action takes place every second to ensure that relevant data is always accessible when required and no information is lost. Hence, even in the worst-case scenario when an incident takes place and the device is destroyed due to severe damage, data up until the previous second will be available on the system’s storage. For efficiency reasons, we have opted to store a data point to the infrastructure of the system only if the velocity of the vehicle has changed from the previous data point. A vehicle moving with a constant speed enables an accurate estimation of its metrics by the system and thus the corresponding data submission is omitted and the data point is replaced by its estimation if it needs to be retrieved. This approach enables a more efficient operation of the system, with minimal accuracy deviation.In order to protect the users’ privacy, the vehicle device produces a new session key For every Furthermore, to enable an emergency alternative for cases when a vehicle’s owner is disinclined or unable to provide the keys to authorities, we apply a secret sharing scheme. Secret sharing is the method of dividing a secret between various participants while making sure each individual share cannot be used to retrieve any information about the secret, but that a combination of a predefined number of shares can reveal it. In this case, participants will be high-level authorities  and the secret is the session key. When the device produces a new session key it creates shares and each of the individual shares is encrypted with the corresponding authority’s public key Similar to the vehicle-related data, encrypted keys and encrypted key shares are stored on the IPFS. The corresponding hashes are stored on the blockchain, along with a timestamp defining the moment the keys became active, to facilitate retrieval of a specific time slot’s session key for a vehicle.If circumstances demand it, a predefined majority of authorities can collaborate, retrieve, and decrypt a number of shares that can enable the session key reconstruction. For the purposes of the paper, we opted for requiring more than half the authorities of the ecosystem to collaborate through share joining, in order to retrieve a session key.Incident: In the case of an incident, it is necessary to gain access to the information stored by the involved vehicles’ devices, in order to facilitate the process of determining the liable party/ies.Validity control: As it is possible for vehicle devices to not operate in a proper way, either due to malfunction or being tampered with by the vehicle owner, a control process is required to check the validity of the data being submitted or to detect the deactivation of the device (the absence of data). The responsible authority  may ask vehicle owners to retrieve, decrypt, and send past session keys, for checking the validity of the submitted data. Detecting inconsistencies that come up by observing approximate vehicle data, or cross-correlating reported data with other sources  will enable the identification of malfunctioning vehicle devices. The methodology of validity control is outside the scope of the present paper.The process of retrieving the encrypted data from the system is a matter of gaining access to the proper encryption keys, as access to stored data is granted for all. The ability to get access to the active or past session keys will be required by the aforementioned authorities for two purposes:There are two different procedures through which an authority can gain access to encrypted data for a specific vehicle, depending on whether the vehicle owner provides their consent.The first option is to get access through the consent of the user and the corresponding process is depicted in the sequence diagram of In cases where the vehicle owner is not willing or able to provide the requested The default procedure to retrieve the vehicle data is the first one. Given the consent of the user, the authority organisation can retrieve the required data in most cases. Only in extreme cases, where the user is not willing/able to collaborate with the authority organisation, is the second procedure activated. This procedure has an increased communication overhead and also creates privacy violation implications, and thus, cannot be used as the default option. The rest of the organisations agree to collaborate by sharing their secret shares only when accessing the vehicle’s data is fully justified and the first procedure is impossible.In case of the occurrence of an incident, it is necessary to have all the pertinent details documented. This is achieved through the use of the Incident contract.An incident contract is instantiated by the authority on the site of the incident. Since such a contract will not be frequently interacted with, the load it will induce to the hosting blockchain network chain is not significant. Nevertheless, it is important that this contract can be easily located when needed, hence it is suggested that it is stored in a separate fabric installation solely dedicated to the purpose of maintaining incident contracts, but any scheme preferable to the system’s users is feasible.Following instantiation, the incident contract needs to be filled in. This is also performed by authorities that collect the necessary keys, either from the involved parties willingly share them, or receive through the secret sharing scheme. The information is then retrieved from the data contracts and transferred onto the new incident contract.This process may initially seem like it is placing trust on the authorities responsible for the logging of data on the incident chaincodes. However, this is an inaccurate assumption. The immutability of the blockchain ledger guarantees that any information on the incident contract can always be cross-referenced with the original entry on the data contract that is unaltered.In addition to the information related to the incident, an incident contract also holds the outcome or liability distribution amongst involved parties. Any one of them has the option of assuming complete or partial responsibility directly in the contract through the use of their private keys, or liability, can be assigned at a later time by the relevant authority or insurance company.An instantiated and filled-in incident contract serves as a reference point for a vehicular incident occurring in the monitored area, gathering all relevant input and outcomes in a single immutable and accessible storage point.The present Section discusses the implementation of the proposed system. The main component of the framework is a Hyperledger fabric blockchain network, which is integrated with an IPFS distributed file storage network. On top of that, encryption and secret sharing schemes are deployed, to facilitate the implementation of an access control mechanism for the data produced by the vehicles’ devices.The structure of the Hyperledger fabric network is depicted in In As discussed, every participating organisation maintains its own Certificate Authority, colored according to the organisation it belongs to. CAs serve the network by issuing certificates for all identities connected to their organisation. Insurance companies manage the identities of their personnel but are also responsible for the identities of vehicle owners that are contracted to them. AUTH organisation’s CA (CA4) only manages the identities of the authority organisation personnel.The main actors/systems that interact with the platform, are the devices of the vehicles that are contracted to the aforementioned insurance companies and the personnel of both the insurance companies and the regulatory authority. For each vehicle, there is a vehicle device (client) that senses data during vehicle operation and submits those to the chain. In During the initial deployment of the network, as seen in For each vehicle, there is a smart contract deployed to the single channel. An IoT device equipped in each vehicle monitors data, encrypts data, and stores the corresponding file to the IPFS network. In order to facilitate the retrieval of such data, the hash (IPFS address) of each data file, and the corresponding timestamp, need to be stored in a secure way; data contracts are the means to that end. For each vehicle that participates in the framework, a new data contract is instantiated on the common channel and installed on all peers.In storeData: This function accepts the timestamp and IPFS address of the encrypted data as input and stores them to a mapping in the contract. The function can only be called by the vehicle device the contract belongs to.storeKeys: This function accepts the timestamp, IPFS address of the encrypted session key, and a set of pairs of authority organisations ids and IPFS addresses of the corresponding session key shares as input. It is called in one-hour intervals to store the newly generated session key information and is only accessible by the identity of the device of the vehicle the contract belongs to.retrieveData: This function is used to retrieve the IPFS address of the vehicle-related data for a specific timestamp.retrieveSessionKey: This function is used to retrieve the IPFS address of the files containing the session key and session keys shares for a specific time interval.The functions of the smart contract that enable the aforementioned functionality are the following:For each vehicular incident, a new smart contract (Incident contract) needs to be instantiated to the channel. Incident contracts serve the purpose of managing the collection, storage, and viewing of incident-related information. The responsible authority organisation  sets up the new incident contract in case of an event and stores in it the details of the case.Apart from the typical case data, incident contracts include a private data collection that is only accessible by the organisations of the two insurance companies the two involved vehicles are contracted to and for the authority organisation. This private data collection is destined to store the session keys As depicted in The data structure for PDC1 is only stored in the peers of the involved organisations I1, I2, and AUTH, to prevent access to data of the incident for organisations that are not related to the incident . PDC1 is not present in the peer P3. The use of private data collection enables access control on a per organisation basis . Access control on a per identity basis (members of organisation) is achieved through fine tuning the implementation of the functions of the smart contract .An incident smart contract has a two-folded use; it serves as the storage of the incident data and also enables interacting parties to settle with regards to the liability pertaining to the incident. The data stored in the contract are the actual session keys for the two vehicles, that were active during the incident. The two session keys enable participants to decrypt the actual monitored data of the two vehicles. The incident smart contract also enables the two vehicle owners  to assume liability for the incident on a 0–100 scale. Given that the two parties assume liabilities that sum up to 100, the incident is marked as resolved. In the case where this is not possible, the authority organisation can assign the liability scores to the two parties, without their consent.assumeLiability: Enables one of the involved parties  to assume liability, thus facilitating the resolution of the incident. This can only be called by the vehicle owners’ identities or the corresponding insurance companies’ personnel.assignLiability: Allows the authorities  to disperse liability amongst the vehicle owners, in the case the latter cannot reach a consensus by themselves. This function can be called by the traffic police personnel.shareKey: Parties (vehicle owners or authorities), that have access to the session keys retrieveKey: Allows participants to retrieve the session keys of the two vehicles. This is only accessible by the vehicle owners or the authorities’ personnel.A short overview of the functions implemented in the Incident Contracts:An important component of the network is the IPFS storage infrastructure. Each insurance company takes part in the formation of the IPFS network by providing at least one node. The authorities organisation that administers the fabric network has a central role in the IPFS network as well, as it maintains one or more bootstrapping nodes. These nodes publish a bootstrap list of peers that enables the IPFS daemon to learn about other peers on the network.The nodes of each insurance company are obliged to pin (keep stored) the information submitted by the vehicles  that are contracted to the company for a predefined time period. Failing to properly retrieve such data during data retrieval triggers penalties for the corresponding insurance company. The integrity of the submitted data is secured as the address of each file in IPFS equals the hash of the file securely stored in the smart contract of each vehicle during monitoring. The insurance company, or any other participant, cannot tamper with the content of the files, as such an event would be easily detected.A sample architecture of the IPFS network is presented in First of all, C1 and C2 probably require retrieval of the submitted data. On top of that, C3, on behalf of the AUTH organisation and clients  are also going to retrieve the data. The flow of data between the client and the IPFS nodes is also depicted in A symmetric encryption algorithm for the encryption of the submitted data;A public key encryption algorithm for managing data exchange between participants;A secret sharing scheme to enable the retrieval of data, without the driver’s intervention, if it is required.As discussed in previous sections, the proposed system requires three cryptographic algorithms to be set-up, in order to protect the privacy of vehicle owners. Those algorithms are:With regards to the symmetric encryption of data, there is a strong requirement for fast performance. This is because the encryption operation has to be conducted in every time slot of the monitoring process (which has been set to one second). Out of all symmetric encryption algorithms, AES has been proved to offer the best combination of security and performance in the restricted hardware environments ,27. Becan is the number of authorities, as one session key share is encrypted for each authority aside from the session key generated. This happens once every hour, so there is no significant overhead. The only consideration that has to be taken into account is that the chosen algorithm shall be capable of encrypting the session key and the corresponding session key shares, which are 256 bits long. The algorithm chosen was RSA-4096, as it is capable of encrypting the required information, while also offering a great level of security.The public key encryption algorithm is used by the devices only when a new session key is generated. During session key generation, Finally, with regards to the secret sharing scheme, we opted for the Shamir Secret Sharing Scheme , which eIn this Section, a security analysis of the proposed framework is conducted, to prove that it protects all interacting parties from the malicious behaviour of their counterparts.In order to prove the validity of the system from a security point of view, we have opted for describing the procedures of the proposed protocol through the High Level Protocol Specification Language (HLPSL) , which iWe assume that vehicle owners, insurance companies, or authorities may become malicious and attempt to either tamper with data to deny liability or violate the privacy of others. On top of that, we assume that it is possible for actors to collude, in order to tamper with or access data they should not.A vehicle owner colludes with their insurance company to escape liability by altering IPFS files;A vehicle owner colludes with authorities to escape liability;Authorities collude with insurance companies to frame a vehicle owner.Specifically, a vehicle owner may attempt to lie about their vehicle data, deny revealing their session key, or tamper with the on-vehicle device to report false data. Insurance companies may not follow up with previous consent about responsibility for an accident, attempt to violate users’ private location data, or attempt to delete files to avoid covering liability costs. An authority may attempt to violate users’ private location data, with no proper reasoning. Additionally, on top of the aforementioned cases, we also assume a couple of collusion scenarios:The proposed protocol has been expressed in CAS+ as three distinct processes: Listing 1 depicts the data collection process, Listing 2 depicts the data retrieval with vehicle owners consent, and Listing 3 depicts the data retrieval without the vehicle owners consent. In the protocols, an assumption that three authorities exist has been used. The roles used are VO for the vehicle owner, B for the blockchain system, and A for one authority . Data variable stands for the data record of the vehicle, and Ks is the symmetric session key used, while Ks1, Ks2, Ks3 are the session key shares produced for the authorities. Finally, Kp is the public key of the vehicle owner and Kp1, Kp2, Kp3 are the public keys of the three authorities.Given the fact that data integrity is ensured by the blockchain network, the OFMC symbolic model-checker tests the privacy requirements for the aforementioned processes. It is required that access to data submitted by vehicles is not permitted for the intruder at any step of the three workflows.Listing 1. CAS+ definition for data collection processes.protocol data_collection; identifiers VO, B, A1, A2, A3  : user; Data          : number; Ks           : symmetric_key; Ks1,Ks2,Ks3       : number; Kp,Kp1,Kp2,Kp3     : public_key; messages 1. VO -> B  : {Ks}Kp 2. VO -> B  : {Ks1}Kp1 3. VO -> B  : {Ks2}Kp2 4. VO -> B  : {Ks3}Kp3 knowledge VO   : Data,Ks,Ks1,Ks2,Ks3,Kp,Kp1,Kp2,Kp3; session_instances ; intruder_knowledge vo,b,kp,kp1,kp2,kp3; goals secrecy_of DataListing 2. CAS+ definition for data retrieval process (with consent).protocol data_retrieval_consent; identifiers VO, B, A  : user; Data     : number; Ks      : symmetric_key; Kp      : public_key; messages 1. B -> VO   : {Ks}Kp 2. B -> VO   : {Data}Ks 3. VO-> A    : Dataknowledge B  : Data,Kp,Ks;session_instances ; intruder_knowledge vo,b,kp; goals secrecy_of DataListing 3. CAS+ definition for data retrieval process (without consent).protocol data_retrieval_no_consent; identifiers VO, B, A1, A2, A3  : user; Data      : number; Ks      : symmetric_key; Ks1,Ks2,Ks3   : number; Kp,Kp1,Kp2,Kp3   : public_key; messages 1. B  -> A1  : {Ks1}Kp1 2. B  -> A2  : {Ks2}Kp2 3. B  -> A3  : {Ks3}Kp3 4. A2 -> A1  : {Ks2}Kp1 5. A3 -> A1  : {Ks3}Kp1 6. B -> A1   : {Data}Ks knowledge B   : Data,Kp1,Kp2,Kp3,Ks; session_instances ; intruder_knowledge vo,b,a1,a2,a3,kp,kp1,kp2,kp3; goals secrecy_of DataIt is obvious that a system like the one proposed will suffer under high workloads. Theoretically, in a smart city environment, thousands of vehicles move around concurrently, and thus, on-boarding all vehicles to the platform will require a high transactions rate during the data collection phase. The performance of the fabric network must be discussed in terms of both transaction throughput (how many transactions can go through per second) and latency .For the purposes of the specific system, latency is not very critical, as the data committed to the data collection chaincodes are only retrieved at a later stage, if at all. Even additional latency, which may be added because of unreliable vehicle network connections, will not create issues.On the other hand, transaction throughput is very critical. The blockchain systems’ main performance bottleneck is the rate at which new transactions can be committed and appended to the ledger. For the presented system, the submitted transactions arrival rate depends on the number of vehicles moving around. When this surpasses the actual transaction rate that the fabric network will be able to process, a queue of pending transactions is going to be created, and its size may gradually become an issue that will hinder the system from providing the designed functionality. As has been shown by recent bench-marking efforts ,33,34, oData collection chaincodes hold all monitored data for all vehicles, but such data is not directly retrieved from those to be stored for incident contracts. When required, the authority organisation will manually fetch data from two or more data chaincodes to populate the incident chaincode. As no direct connection is required, more than one instance of Hyperledger fabric installations may be used to provide the appropriate transaction rate for a large smart city environment. This can either be static (by maintaining multiple Hyperledger fabric instances and permanently assigning each vehicle to a specific one) or dynamic . This would allow for better resources management.When an incident happens, it will probably be required to fetch data from different fabric installations to populate the incident chaincode, but this will create minimal overhead. In terms of security, the use of multiple blockchain installations does not raise significant concerns because of the flow of information. The vehicles’ data are kept in the data contracts, which are installed in a number of blockchain networks, each one of which guarantees the security of the corresponding data. When an incident happens, the authority has to transfer data from the data contracts of the involved vehicles to the incident contract. The validity of the data transfer can be easily checked by vehicle owners who can raise a dispute in case of malicious authority activity. After that point, the security of data of the incident contracts is guaranteed by the blockchain network to which it is deployed. The immutability of every single installation is not affected by the existence of additional fabric installations, and that holds true for all the privacy and security properties of the blockchain.In order to assess the applicability of the proposed solution to real-world cities, an extensive simulation has been conducted. A 24-h traffic dataset for the greater urban area of the city of Cologne, Germany, was used as the basis of the simulation ,36. The For the purposes of the current paper, we have used detailed data for each vehicle to create a realistic load of transactions for the proposed system. The main metric to be calculated was the transaction rate required to be served, especially during rush hours when peaks in vehicle commuting volume through urban areas are expected.In order to reduce the transaction rate demand, the proposed system was based on an alternative approach to the continuous record submission by vehicles. For significant parts of its course, a vehicle maintains stable direction and velocity. During those parts, it is feasible for the system to accurately estimate the vehicle’s position, even if it is not submitted.Vehicles monitor their course, and if the velocity does not deviate significantly from the average velocity of the previous five seconds, the current location submission is omitted. If the data records for such points in time are required to be retrieved, then the missing values are estimated by the previously submitted ones. The deviation limit under which this happens may vary. Of course, when the alternative approach of dynamically omitting location submissions is used, the estimated location records deviate from the real ones. Through the conducted simulation, we aimed to estimate the magnitude of this deviation. With respect to the optimal value for the velocity limit parameter, the 5% option seems to be the better one. It significantly reduces the transaction rate from 11,500 tr/s to 5500 tr/s. Because of this, it demands far less infrastructure for the operation of the system. It can be efficiently served by 6 Hyperledger fabric installations (based on the assumption of 1000 tr/s for each fabric network), instead of the 12 that would be required if all values were submitted. The position error, in this case, is bearable, as the average error barely exceeds 0.15 m, while the maximum error values observed are around 2 m.On top of that, we have also estimated the network traffic that will be generated by the system. Given the assumption that vehicles are connected to mobile operators’ networks, we have studied the traffic load induced for each of the cellular base stations in Cologne. We have taken for granted that each vehicle is connected to its nearest base station. This assumption may not be completely accurate, but it efficiently approximates the real distribution of the vehicles to base stations and consequently the distribution of traffic to the deployed base stations. In general, the bandwidth overhead for the base stations is not significant and the system is not expected to create any network issues, at least for a city of the size of Cologne.Finally, the storage requirements for the data collected have been calculated for the case of Cologne city. It is obvious that for a city of a different size, such requirements will be different. Each transaction corresponds to an encrypted single data point of the form depicted in Equation , and theThe results depicted in A decentralized framework to support the semi-automatic, secure settlement of vehicular incidents has been proposed. The system is based on a Hyperledger fabric and an IPFS, and supports the secure and safe storage of position and velocity data of vehicles in a smart city environment. It facilitates an easier and fairer workflow during the process of assuming or assigning liability for the incident. The system could also be used for other forensics purposes  under the strong precondition that a set of authority organisations agree on the fact that the proposed purposes are sufficient, to give access to the vehicle’s data.The system enables the aforementioned functionality without violating the vehicle owners’ privacy. The data submitted by the vehicles remain strongly encrypted and can only be accessed either by the vehicle owner, or by an authority organisation, which is supported by the majority of other authority organisations in the system. The collection of vehicle data (velocity and location), both regarding the immediate moments before an incident and a span of time earlier than that, will be helpful in the process of liability assignment and in the scope of an investigation. This information can function either as a critical indicator for various violations or a blame absolving factor. Such data may not lead to complete resolution of every case but can greatly help towards that end in most of the cases.A realistic traffic dataset, for a medium-sized city, has been used to assess the performance requirements for the proposed system under realistic loads. It has been proven that the application of the system is feasible as the infrastructure costs along with the communication overhead are bearable.The proposed framework has been described in detail, but there are some points that will be further studied in our future works. The main one is the development of the on-vehicle device, for which the present paper has assumed functions in a reliable and efficient way. The actual hardware used has to be tested, along with any supplementary mechanisms that will be required with respect to connectivity reliability . On top of that, the cross-checking scheme that will be used for validating the data submissions from vehicles has to be defined and tested, as the validity of collected data is crucial for the system proposed.The described system is the basis for constructing a general framework that can serve for a fair, fast, automated, and privacy-preserving workflow with respect to the resolution of liability assignment in vehicular incidents. Such a system would greatly benefit all involved actors, and will be a necessity in the near future with the uprising adoption of autonomous vehicles.


Lymphatic drainage is the main form of therapy for lymphedema, as it affects the pathophysiology of this clinical condition. The two main objectives of lymphatic drainage are the formation and drainage of lymph. In recent years, Godoy & Godoy developed a novel concept of mechanical lymphatic drainage involving a device denominated RAGodoy®, which performs passive exercises of the lower and upper limbs as a form of lymphatic drainage. The aim of the present study was to address the concept of this therapy as well as perform a literature review on its forms of use and the results obtained. All studies analyzed show that this technique used as monotherapy enables the treatment of lymphedema, but superior results are achieved when combined with compression mechanisms. Lymphedema is a clinical condition that leads to a specific type of edema, the cause of which is a failure in the formation or drainage of lymph -2. CliniRAGodoy® performancePhysiological lymphatic drainage performed by the body itself uses mechanisms that promote a pressure differential in the intravascular and extravasated fluid environment. The main pressures used by the lymphatic vessels are the pressures vis front, vis latere, and the contraction of the lymphangions. The vis latere pressure is generated by the compression of the artery under the lymphatic during cardiac systole, muscle activity, and peristalsis, and the vis-front pressure is caused on the forehead during breathing movements .The space between one valve and another in the lymphatic vessels constitutes a functional unit in which it performs a “lymph pumping” effect similar to the heart. It follows the same principles of cardiac contraction where filling triggers contraction as well as external compression. Another way to stimulate the venous and lymphatic displacement is through muscular work that performs an external compression having an effect of “pressure vis latere.” Muscle work is essential to help the venous and lymphatic systems overcome the “negative” effect of gravitational pressure.Gravitational pressure can have an opposite or favorable effect on lymphatic drainage, and this depends on the individual's posture. Lifting the limb favors this return, and the bipedal position makes it difficult to return.Knowledge of these physiological drainage mechanisms allowed the development of an electromechanical device known in Brazil as RAGodoy®, which performs plantar flexion and extension Figures -3 and exFirst, the device developed was for lower limbs with the aim of reproducing the physiological movements of lymphovenous drainage by muscle contraction, thereby simulating the movements of walking, including plantar flexion and extension, but in the supine position. Thus this appliance, with the help of gravity, physiologically but passively, increases lymph drainage. In fact, this is a passive exercise. The second time, the apparatus was developed for improving lymphatic drainage in the upper limbs; this is the same mechanism reproducing the physiological movements of lymphovenous drainage by muscle. The RAGodoy® device for the upper limbs works by contraction of the biceps and triceps muscles and passive movements, with 15 cycles (movements-flexion-extension-elbow) per minute.Scientific studyThe scientific literature has 40 studies addressing the use of this device (RAGodoy®) as monotherapy 10 studies) or combined with other forms of treatment for lymphedema of the lower and upper limbs. The first study was published in 2004 and involved an evaluation with lymphoscintigraphy, which revealed that the device stimulates the mobilization of macromolecules . The sec studies In 2011, the RAGodoy® device was investigated in a combination of therapies for the treatment of cellulite . In 2012In 2014, the RAGodoy® device was used on a child with lymphedema and intellectual disability, and another study showed a significant reduction in edema when combined with a compression mechanism -18. In 2In 2017, studies were conducted evaluating the use of the RAGodoy® device in the treatment of cellulite, the treatment of lymphedema as a sequela of poliomyelitis, the intensive treatment of elephantiasis in a child, and the maintenance of the results for treatment for lymphedema -25. MoreIn 2018, the RAGodoy® device was evaluated regarding the change in body mass index during intensive treatment, the treatment of post-traumatic lymphedema, and the mobilization of fluids during intensive treatment -29. In 2The upper limb device has had slower evolution. The first study was published in 2009 and showed a reduction in volume when the device was used as monotherapy . In 2011In 2013, a study was conducted evaluating three hours of treatment, revealing a greater reduction in the first hour and a smaller reduction in the third hour . This fiThese publications show the reproducibility of treatment and the possibility of using the RAGodoy® device as monotherapy or in combination with other therapies. The device constitutes an important mechanical lymphatic drainage mechanism. Indeed, intensive treatment (eight hours per day) is nearly impossible without the use of the device, making it an important contribution to the treatment of lymphedema. The use of the device as monotherapy is possible for milder forms of lymphedema, but the results are superior when used in combination with compression mechanisms.All studies analyzed show that the use of the RAGodoy® device for mechanical lymphatic drainage for lymphedema treatment of the lower limbs and upper limbs considerably assists in both the treatment and the maintenance of the results. Another point in relation to these devices is that mechanical lymphatic drainage as monotherapy reduces edema, but better results are achieved when combined with compression mechanisms.


It is still undetermined if the main infection route of severe acute respiratory syndrome coronavirus 2 (SARS‐CoV‐2), the virus that leads to coronavirus disease 2019 (COVID‐19), is infection through droplet, contact, or airborne transmission. However, confined spaces with poor ventilation are cited as a risk factor for group outbreaks, and there is growing interest in the effects of intervention through the appropriate operation of air‐conditioning and sanitary equipment to reduce the risk of airborne transmission. This study first offers an outline of the characteristics of the novel coronavirus disease and the cluster outbreak case reports that have been clarified until now. Subsequently, we describe the appropriate operating conditions for building equipment that are effective in reducing the risk of infection and also highlight specificities for each building use based on the guidance provided by healthcare institutions and with reference to the standard recommendations by Western academic societies related to building equipment. Effective use for building equipment for SARS‐CoV‐2 infectious disease control  It is recommended that the required ventilation rate is maintained even in restaurants that do not fall under the specified building types described in the Act on Maintenance of Sanitation in Buildings; moreover, the necessary ventilation rate can be achieved by reducing the number of people in the room if the ventilation rate is insufficient.Meanwhile, the Ministry of Health, Labour and Welfare published a document titled “Ventilation to improve closed spaces with poor ventilation in commercial and other facilities”On March 29, 2020, the World Health Organization (WHO) initially stated that the primary infection routes of this virus were droplet transmission and contact transmission,Based on the findings obtained to date, aerosol particles that contain the virus and are ejected by the infected person may remain active for more than 3 h in a suspended condition in air, and the active virus is not easily observed in patient isolation rooms with a high air change rate. Therefore, it is almost certain that maintaining the highest possible ventilation rate will lead to a decreased infection risk, under the assumption that the ventilation recommended by the Ministry of Health, Labour and Welfare is properly implemented.Heating, ventilation, and air‐conditioning (HVAC) systems are normally operated with the objectives of optimizing resident comfort, workplace productivity, and energy conservation; however, it is speculated that these objectives could be downplayed for a certain amount of time and the operation could be adjusted to reduce infection risk as a countermeasure against COVID‐19.The Federation of European Heating, Ventilation and Air Conditioning Associations (REHVA)This paper is based on “Operating of air‐conditioning equipment and other facilities for severe acute respiratory syndrome coronavirus 2 infectious disease control (revised second edition)” as compiled by the authors and was published on the SHASE homepage on September 7, 2020,1.11Recent findings on the infection route and infectivity of SARS‐CoV‐22Risk of infection due to the return of air3Droplet size, air filter capture performance, and maintenance management4Natural ventilation by opening windows5Visualization of indoor air environment6Benefits of face masks7Flushing the toilet with the lid closed and the enforcement of ventilation8Adjustment of temperature and humidity by air conditioning9Effective use of an air purifier10Germicidal ultraviolet (GUV)11Notes of caution for resuming equipment12Hand hygiene and peripheral hand‐washing equipment13Recommended operating methods for building equipment for each building applicationaPrinciples of measures to reduce risk of airborne diseasesbOffices cOffices (unit air‐conditioning system)dResidenceseSchoolsfCinemas /theatersgIzakaya /Karaoke bars2Between January and February 2020, a study was conducted on virus activity in the isolation rooms of three patients at a COVID‐19 outbreak center in SingaporeThe virus was detected in several surface samples collected from the isolation rooms of the patients before cleaning, including samples from the bathroom and the stools of the patient. The virus was not detected in the air samples, but it was detected on the surface of the air exhaust outlets. The virus was not detected in any of the samples collected from the isolation rooms after cleaning. These study results showed that indoor surfaces in the residences of COVID‐19 patients are extensively contaminated; however, sufficient disinfection and sterilization can remove the contamination. Furthermore, aerosol particles containing the virus can move to exhaust outlets, but sufficient ventilation effectively dilutes the virus concentration in the air. Finally, the stools of infected patients may be an infection route.A research team at the National Institutes of Health also conducted a comparative experiment on the activity maintenance of the severe acute respiratory syndrome (SARS) coronavirus (SARS‐CoV‐1) and SARS‐CoV‐2 in aerosol particles and on surfaces such as plastic, stainless steel, copper, and cardboard.50/mL) of SARS‐CoV‐2 of 6.8, which indicates the infectious titer, was maintained constant for 14 days, and its infectious titer was measured at the time points of 1, 5, 10, and 30 min, 1, 3, 6, and 12 h, as well as 1, 2, 4, 7, and 14 days. While considering the factor of temperature, high stability was observed at 4°C, with hardly any change in infectious titer until 14 days later. Infectivity was maintained for 7 days and 24 h at 22 and 37°C, respectively, but the infectious virus was no longer detected after 30 and 5 min at 56 and 70°C, respectively. While considering the factor of surface types, the infectious virus was detected on paper and tissue paper surfaces for up to 30 min, but was not detected after 3 h. The infectious virus was detected in one out of three wooden and cloth surfaces for one day; however, the virus was not detected in any of the samples on the second day. Meanwhile, the infectious virus was detected on banknotes for up to two days (but were not detected after 4 days) and stainless/plastic surfaces for up to 4 days (but were not detected after seven days). While considering surgical masks, although the infectious titer was 1/1000 of the initial value, an infectious virus was present on the interior for up to 4 days  and on the exterior for up to seven days (log TCID50 was 5.78 at 0 min and 2.79 after 7 days).Chin et al.Next, we discuss the outbreak cases that could be used as a reference when considering measures for HVAC systems. First, we focus on an infection cluster generated within a group at a choir practice in the United States.2/person with shared desks having low partitions; the staff were convivial and had lunch together while chatting in the meeting room; fingerprint authentication was used for work process management; moreover, the operation of the total heat exchanger was suspended despite the combination of a unit‐type air conditioner and total heat exchanger in the building.The cluster infection that occurred at a call center in Seoul, South Korea, in March is important for considering infection prevention measures for office buildings.Next, the cluster infection that occurred at a worship event in Zhejiang ProvinceFinally, we discuss the cluster infection that occurred at a restaurant in Guangzhou. A family who returned from Wuhan on January 23 and entered Guangzhou had a meal at a restaurant the next day, with one of them developing symptoms on that night. There were nine cases of secondary infection among the guests, which included the table where the family ate and the two adjacent tables, i.e., a total of three tables. The minimum length of overlap in time when the first infected individual and the secondary infection cases were present was 46 min, and camera records in the restaurant showed that the possibility of contact transmission was low. The report that first addressed this event3 was significantly low at 2.7‐3.7 m3/h per person. It was concluded that the cause for the spread of infection was the circulating airflow formed by the fan coil air‐conditioning unit and the low dilution of the virus owing to minimal ventilation. This case is important as its results suggest the risks of operating only the air conditioner in a crowded environment in a poorly ventilated state or an environment that is ventilated intermittently rather than continuously.In a subsequent study,Next, we considered the infection risk conveyed by virus‐loaded aerosol particles in the toilet plume that occurs in the toilet space and drainage pipes when cleaning the sewage containing infectious viruses or microorganisms, which has long been indicated as an infection route.In particular, a REHVA report3We also considered the case of the passenger ship Diamond Princess, which was the scene of an outbreak, to analyze the risk of infection in a central air‐conditioning system that circulates return air. Under normal operating conditions, the guest room compartments of the Diamond Princess have a circulating air‐conditioning system with 30% outside air and 70% return air, which is similar to a general central air‐conditioning system.Almilaji et al.Additionally, Azimi et al.Meanwhile, a report by Xu et al., who also investigated and analyzed the aforementioned case of the Guangzhou restaurantIt is speculated that these reports did not adequately reflect the status of circulated air during the quarantine period and did not analyze or consider the impact it would have on the spread of infection aboard the Diamond Princess. As mentioned above, the operation of the circulating air‐conditioning system was suspended during the quarantine period, and the guest rooms were controlled by positive pressure; consequently, there was no recirculation of air between the rooms, and it is unlikely that the air‐conditioning system was the cause of the spread of infection. Clarifying whether the spread of infection was caused by the circulated air requires an investigation of cases where the infection was considered to occur before February 5, which was when the quarantine period began, as well as considering the possibility of droplet and contact transmission. Therefore, the Diamond Princess case does not appear to provide evidence that the return air increases the risk of infection.Bill Bahnfleth, who chairs the Epidemic Task Force of ASHRAE, said that thousands of papers have been published since the start of the pandemic, and there have been no reports of space‐to‐space infection spreading through air conditioning; conversely, it is considered that the air‐conditioning system provides ventilation and filtration, which reduces the risk of infection.The infectious virus contained in the return air may spread from one room to another, but its concentrations can be maintained at a sufficiently low level if proper ventilation and air filters are installed. Therefore, the risk of spreading infection between rooms through an air‐conditioning system is considered to be significantly low in a normal air‐conditioned space.450 to evaluate the viral activity.Previous research has reported that the particle size of active droplets derived from the human respiratory system is predominantly < 5‐10 μm.Next, the air filter captures suspended particles through the filter media by one or more of the following mechanisms of gravitational settling: inertial impaction, interception, diffusion, and electrostatic attraction. The capture mechanism differs depending on the particle size, with impaction and diffusion having a high‐collection efficiency for large and small particle sizes, respectively; however, the collection efficiency is the lowest for particles with a size of approximately 0.2 µm. Table Here, the collection efficiency of MERV 13 by particle size  as recommended by ASHRAE and the previously mentioned single‐pass collection efficiency of MERV 13 for the influenza virus, as determined from the composition ratio of the influenza virus by particle size by Noti et al., was 78%. The ventilation rate including recirculated air in a general office building is 6 ACH , resulting in a circulation of air every 10 min. Thus, it is estimated that 78% of infectious viruses with the same composition ratio by particle size were removed from the room every 10 min. Furthermore, the ventilation rate of 6 ACH, including the recirculated air, is equivalent to a clean air supply of 5.1 ACH (2 + 4 × 78%). High‐efficiency particulate air (HEPA) filters (with a particle collection rate of 99.97% or more for particles with a rated air volume of 0.3 µm) are used for rooms where air cleanliness is highly needed, such as in hospital operating rooms.The maintenance of the air filter can be performed as usual for full outside air operation; however, for the return air operation, it is recommended that the differential pressure of the filter should be checked frequently and that the filter should be replaced earlier than usually required so as to not decrease the air volume due to the particles collected by the filter and prevent the penetration of the collected particles.Static electricity is one of the principles of particle capture by a filter, and the electrostatic air filter strengthens this effect. When either or both the particles and the fibers of the air filter medium are charged, an electrostatic force acts between the particles and the fibers, which results in a significant increase in collection efficiency. The electret filter has a semi‐permanently polarized filter in the interior of the fiber and stable charge state, and a significantly high collection efficiency can be expected for fine particles.5In addition to school classrooms and detached houses, there are also certain recently built high‐rise buildings in which windows or outlet openings for natural ventilation can be opened in consideration of the business continuity plan measures for the improvement of energy conservation performance. It is recommended that such openings be opened in addition to operating mechanical ventilation as long as it does not cause a draft or thermal discomfort. In particular, opening windows are recommended because securing a draft  will achieve indoor air cleanliness equivalent to the level of outside air within a few minutes ; therefore, it is desirable to regularly perform this action. It is important to achieve a wind pressure difference acting on the outlet opening to secure a large ventilation rate; consequently, opening outlets on different sides of the building is necessary. If there is a door between the outlets, securing an opening area equivalent to the outlet opening area is necessary so that the door will not block the ventilation.2 to exhaust the indoor air, a ventilation rate of 500 m3/h can be achieved under the conditions of no wind and one opening and 800 m3/h when there are two openings .A fan can be installed at the outlet opening to forcibly exhaust the indoor air and ventilate the room if achieving a wind pressure is difficult. In a case where a fan is installed on the indoor side at approximately 40 cm from the opening surface in a room with a floor area of approximately 60 m62 concentration and visualize the extent of ventilation sufficiency. This allows us to directly confirm whether a CO2 concentration of 1000 ppm or lower, which is the standard recommended in the Act on Maintenance of Sanitation in Buildings, is satisfied; moreover, if the standard concentration is satisfied in a steady state, then the ventilation rate would be secured at over 30 m3/h per person. CO2 monitors can be purchased online at a wide range of prices; however, some of them are entirely unreliable in terms of measurement accuracy at approximately 1000 ppm. Therefore, their performance should be verified based on the device specifications, and a device that can accurately measure approximately 1000 ppm using the nondispersive infrared method is ideal. It should also be noted that CO2 monitors cannot evaluate the reduction effect in infection risk for air purifiers and air filters.The state of ventilation in a room is difficult to sense for a person as one would with temperature or humidity; therefore, it is desirable to measure the indoor CO7According to the findings up to February 2021, He et al.8E. coli, Salmonella, Staphylococcus epidermidis, and other bacteria. A toilet bowl equipped with a virus sterilization device is expected to be developed in the future.There is a possibility that aerosol particles containing the active virus are generated when an infected individual defecates in a toilet and flushes the water to dispose of the waste. In the previously mentioned research report, the flushing method and drainage characteristics of the toilet bowl were not clearly understood. However, reports using actual toilet seat surfaces showed that aerosols flew up to 25 cm away from the surface when the test toilet bowl was flushed, and computational fluid dynamics analysis showed that aerosols flew up to 106.5 cm away from the floor surface on which the toilet bowl was installed.The perfect water seal of the toilet should be regularly checked, and it should be noted that an unusual odor will emerge from the drain if the trap seal is broken. Additionally, the exhaust fan of the bathroom should be operated at all times so that aerosol particles that may cause infection do not leak out and contaminate other spaces. If there is a window in the toilet area, it must not be opened because there is a risk that the air in the toilet area that contains the aerosol particles may leak outside when the window is on the upwind side.9The effects of indoor temperature and humidity, especially in terms of limiting the spread or resolving the COVID‐19 infection, can be enhanced as these parameters may affect the activity of SARS‐CoV‐2 and the transmission distance in the air. It was reported at an experimental level that SARS‐CoV‐2 activity on the surface of an object decreased when the temperature (24–35°C) and relative humidity (20%–80%) were high.Indoor temperature and humidity have a major effect on the transmission distance of SARS‐CoV‐2. It was reported that the distance of droplet transmission in air at a low‐temperature/high‐humidity environment was more than three times longer than that in a high‐temperature/low‐humidity environment. However, droplets in a high‐temperature/low‐humidity environment dried more quickly, forming many aerosols. These formed an aerosol particle cloud, which reached a greater distance and were suspended in air for a long period of time.It is also widely known that low‐temperature/low‐humidity environments adversely affect the defense mechanisms of the respiratory trachea in humans10Air purifiers for suspended particles are approximately divided into filtration and electrostatic‐collection types . There are other types of recently developed air purifiers such as those that release ions; however, it has been reported that these technologies demonstrated inferior performance when compared with the existing filtration technology with regard to reducing the effects of active viruses suspended in airη, but also to its air flow rate q and room volume V. The air purification performance of the filtration‐type air purifier is determined by the equivalent ventilation volume qη/V, which is equivalent to the capacity converted to the amount of outdoor air.The filtration principle of the filter‐type air purifier is the same as that of the above‐mentioned air filter, but in the case of the air filter installed in the air conditioner, most of the air supply is delivered to the room through the air filter, even though there is a marginal leak. Meanwhile, the air purifier has a mechanism for filtering the suspended particles in the air while circulating the air in the room. Therefore, the purification performance of the filtration‐type air purifier is related not only to the filter capture efficiency 3/min need to be used. The air purifier should be installed within a range of 10 m2 (six tatami mats) from where people are.” The capture efficiency of infectious aerosols is almost 100% if there are no leaks; therefore, the equivalent outdoor air supply becomes 12 ACH if the room volume is 25 m3. This value is more than double the recommended value of REHVA.The Ministry of Health, Labour and Welfare and REHVA stated that HEPA filters are required when considering the filter capture efficiency of air purifiers.11I (mW/m2) and the irradiation time t (s). The survival rate of the virus under UVC sterilization is given by the following equation. The k value of the coronavirus, including SARS‐CoV‐1, was reported as 1.106 cm2/mW·s (0.1106 m2/J), and its 90% sterilization dose was 2.1 mW·s/cm2 (21 J/m2).2, then it is predicted that 90% of the virus would be inactivated in 21 s of irradiation. It can be observed that the coronavirus on a surface is easily sterilized by UVC under these time conditions. Meanwhile, when installed in an air conditioner, sterilization of viruses with UVC takes longer because the time required for the air to pass through once is short. No consensus has been reached at this time for the k value of SARS‐CoV‐2.tS: Survival rate (‐), k: Sterilization coefficient (cm2/mW·s), I: UV intensity (mW/cm2), t: Irradiation time (s)The absorption spectrum of biological deoxyribonucleic acid (DNA) is around 254 nm (ultraviolet‐C (UVC) wavelength region: 100–280 nm); therefore, the irradiation of bacteria, fungi, and viruses with UVC rays results in DNA damage and eliminates DNA replication abilities. UVC sterilization utilizes this principle. Additionally, base sequences of single‐stranded ribonucleic acid viruses such as the influenza A virus and SARS‐CoV‐2 are destroyed and they lose their replication functions when exposed to UVC rays.GUV has been recommended owing to its effectiveness by WHO,12Legionella spp. growth and the risk of developing legionellosis have been indicated upon resumption of operations.The extensive spread of SARS‐CoV‐2 has resulted in the shutdown of several building equipment systems. If there is stagnant water in the air‐conditioning system  or hot water supply system , then the possibility of 13Daily handwashing is one of the measures for preventing contact transmission. The “Q&A on SARS‐CoV‐2” by the Ministry of Health, Labour and Welfare stated that the number of viruses attached to hands was reduced to 1/100 when hands are washed with water for 15 s and to 1/10,000 when water is run over the hands for 15 s after washing with soap for 10 s.The appropriateness of using a jet dryer that dries hands after washing  has also been questioned, and many buildings prevent its use.Many previous studies on the diffusion of droplets and sterilization effects of hand dryers have compared the number of water and bacteria droplets that are diffused during use and the sterilization effects of high‐speed air, warm air, and paper towels. Cases in other countries have shown that the number of bacteria scattered in the surrounding air after hand drying was 4.5 times higher for the high‐speed air dryer (70.7 colony‐forming units (cfu)) than for the warm air dryer (15.7 cfu) and 7 times higher than that for paper towels (2.6 cfu); moreover, it was considered advantageous to use paper towels, which have fewer droplets.14This clause shows the desirable building equipment operation method for reducing the infection risk of the Covid‐19 in different type buildings. Although the object assumes the building and air‐conditioning / ventilation system in Japan, it is applicable also to other countries and areas in case of same climate conditions as Japan when it had the same equipment.14.1P: Infection probability (‐), I: Number of infectors (‐), q: Quantum generation rate (1/h), p: Breathing rate (m3/h), t: Exposure time (h), Q:Ventilation rate (m3/h)The Wells–Riley modelI = 1 should be set in the Wells–Riley model, and the absolute value of the exponential part of the equation should be set as close to zero as possible. The principles for doing so are as follows.q:Reduce Source control of infectious aerosols is important. It is said that the number of droplets generated increases proportionally with the loudness when speaking. Certain rare cases are known to exist in individuals who are super‐emitters and generate a large number of droplets, which is an order of magnitude higher than that of othersp:Reduce The respiratory rate is determined by the metabolic rate. Therefore, it is best to avoid exercising in a public indoor space and to stay quiet without being excited.t:Reduce Reduce the time spent at a location as much as possible. Avoid long stays in risky spaces.Q:Increase Q is the sum of the amount of outside air taken in and the amount of circulating air filtered by an air filter or air purifier. The risk of infection decreases with increased ventilation.Here, The percentage of infected individuals in Japan is not currently well understood; however, if it is assumed that it is approximately 1 in 1000 people, then in most cases, people will not be present indoors with an infected person, and the issue is related to how the risk of secondary infection can be reduced in the rare case where an infected person is present. To do so, 14.2As a general principle, adjustments should be made to increase the intake of outside air. Attention should be paid to the air balance and the opening of the volume damper of the outside air supply fan and exhaust fan should be increased. If the air volume is controlled by an inverter, then the current utilized by the air supply and exhaust fans is increased, and the inverter is used to increase the rotation speed. The automatic control of the outside air volume should be removed, and a constant air volume system should be opened and fixed outside the air system. Alternatively, for fans driven by a motor through a pulley, the pulley diameter on the motor side is increased. The ventilation rate is increased by setting the operation mode to a particularly vigorous operation within a range that does not interfere with the generated noise. Changing the filter of the outside air system may also lead to an increase in the air volume.2 concentration control, the ventilation rate increases when the indoor CO2 concentration setting value  is lowered (the ventilation rate reaches a maximum when it is lower than the outside air concentration). When outside air‐cooling exists, the upper temperature limit of the outside air‐cooling condition is raised, its lower temperature limit is lowered, and adjustments are made so that the outside air‐cooling operation is prioritized. Additionally, if there is a timer‐based operation control, then adjustments should be made to extend the ventilation operation time beyond the time spent in the room, start the operation several hours earlier than usual, and delay the stop time in consideration of cases where the occupants are staying, with continuous 24‐hour operation if possible.For ventilation equipment in a building with COIf there is a total heat exchanger, the static‐type heat exchanger is handled similar to the subsequently described unit air‐conditioning system. In case the exchanger is the rotary type with a purge sector, if the pressure balance is properly adjusted , then the risk of virus leakage is considered to be low. Therefore, assuming that the operating status is confirmed and adjusted appropriately, the operation is implemented in a mode where the effective ventilation rate (airflow obtained by subtracting the leakage amount from the supply air volume) is large.If the air volume is adjusted by a variable‐air‐volume (VAV) system, then it is speculated that the external air volume may decrease in proportion to the internal air volume. Certain buildings may install a VAV system or motor damper (air‐volume adjusting damper) in the air duct connected to the air conditioner and introduce a control that can secure the external air volume, even at the lower limit of the air supply in the VAV system on the indoor side. However, when this is not the case, it is possible to adjust the general minimum opening of the air supply of the VAV system on the indoor side of 30% to a larger opening ratio to secure the external air volume, or as an ultimate measure, to set the air volume to a constant level without controlling the air volume.14.3Adjustments should be made such that the air flow of the outdoor air conditioner and total heat exchanger is as large as possible. It is important to confirm that the ventilation system is operating in coordination with the air‐conditioning system and air conditioning alone without ventilation must be avoided. Furthermore, the air‐conditioning system must be operated at a constant air volume instead of in the automatic operation mode to achieve a circulating air volume in the indoor unit. Similar to the central air‐conditioning system, a longer operating time of the ventilation system should be set, and it should be set to a 24‐hour operation, if possible.In the case of a static total heat exchanger (heat exchange‐type ventilation fan), the risk of virus leakage through the heat exchange element is low, and only 5% of the virus leakage stems from the outside air and return air; consequently, there is no problem in operating in the heat exchange mode; however, the instruction manual should be checked for the appropriate operation mode in which the effective ventilation rate increases by increasing the processing airflow.The performance of the air filter is often inferior to that of the central‐type air‐conditioning system; moreover, it is difficult to substantially increase the airflow through filtration. Therefore, in case of a concern, an additional filtration‐type portable air purifier can be installed or the indoor air filter performance can be upgraded by using a medium‐efficiency filter .Additionally, when the drain generated from the indoor unit during the air‐conditioning operation is treated along with the common drainage system, ventilation may exist between the rooms and the drainage system after merging through the drainage pipe, resulting in the diffusion of contaminated air. Installing a check valve for airflow in the drainpipe of an indoor unit is effective in preventing this.14.414.4.1It is important to avoid contracting an infection outside as well as bringing the virus into the home to prevent domestic infections. According to He et al.,If the risk of infection at home is low, then special measures need not be taken at home if measures to counteract infection have already been taken outside and hand hygiene is performed when returning home. However, infection countermeasures at home should be strengthened if there is a risk of infection, such as when there are family members or visitors who may have been infected outside the home. Additionally, special measures are required if infected individuals are cohabiting or if they have been in close contact with sickbeds in a medical institution owing to urgent circumstances.14.4.2Even in cases where the infection risk is low, a constant 24‐hour ventilation system should be maintained. The ventilation fan of the bathroom or toilet should always be operated in the absence of a 24‐hour ventilation system. Filter maintenance must be performed. When there is a risk of infection, the ventilation volume should be increased by using window ventilation, an air purifier, or a kitchen ventilation fan in addition to the constant operation of the ventilation equipment. For ventilation through open windows, a method to open windows that uses heating and cooling equipment should be devised so that the indoor environment does not deteriorate and the different weather conditions  and external environment  are considered, as shown in Figure As a general rule, infected people should be isolated in hotels and hospitals. However, there are times when people have to take care of themselves at home, such as when waiting for polymerase chain reaction test results or until hospitalization arrangements are completed. The AIJ has introduced a method of using plastic curtains to separate the living space between infected persons and their families, as well as establishing negative pressure in the zone of the infected individuals by using the exhaust fan of the toilet; moreover, all precautions should be taken to further reduce the risk of aerosol infection.14.52 monitor. If possible, the ventilation rate should also be adjusted to below 1000 ppm based on the Act on Maintenance of Sanitation in Buildings, or at least below 1500 ppm under the current school environmental hygiene standards.Classrooms in schools are important because they are rooms where people stay for long periods of time. Sufficient ventilation measures must be taken after implementing social distancing. Consequently, classrooms should be utilized to only half its capacity; however, if this is difficult to incorporate, then measures such as masks, face shields, and room partitions are required. If the building is not specified by the Act on Maintenance of Sanitation in Buildings, the ventilation rate of the mechanical ventilation equipment is often insufficient, and window ventilation is required. The AIJ provides information on the relationship between the open area of the windows/doors for single‐corridor or mid‐corridor classrooms and classroom capacity based on the actual measurements of the total open area of the windows/doors of the classroom and the ventilation rate14.62; however, it is speculated that the number of droplets would be small if the film is watched quietly. Acquiring a larger occupied area would be effective in ensuring a sufficient ventilation rate and social distancing per person. Furthermore, the risk can be reduced by providing a large amount of ventilation at the time of rotating people in and out of the area.In closed spaces such as cinemas and theaters, the occupied area per person is crowded at 0.5–1 m14.7The act of yelling and singing has the risk of generating a large number of droplets; consequently, taking protective measures against droplets is important. Efforts to reduce droplet concentration are made by providing a large amount of ventilation, and ensuring social distancing is a basic measure. Microphones and music selection controllers are likely to be sources of contact transmission and require frequent disinfection.153/h of outside air per person recommended by the Ministry of Health, Labor and Welfare should be ensured, and further measures should be taken to reduce the risk of infection. Specifically, it is recommended to consider the following points.The air conditioning system should be operated and adjusted to increase the amount of outside air as much as possible.Use an air filter or air purifier with as high performance as possible.Open windows for natural ventilation as long as possible unless there is problem in terms of draft and thermal environment.2 monitor. However, CO2 monitors cannot evaluate the risk reduction effect of air filters and air purifiers.Visualize the ventilation conditions with a COThorough universal masking in the room and use surgical masks if possible.Toilet should be flushed with the lid closed, the exhaust fan should be operated at all times, and the water seal should be checked regularly.The room temperature and humidity should be kept within a comfortable range for the occupants, and the relative humidity in the room should be controlled to 40%–60%.Note that there is a possibility of Legionella spp. Propagation due to water stagnation when the building operation is resumed.Keep in mind the hygiene of hands and fingers by washing them and pay attention to ensuring the hygiene of handwashing machines and peripheral devices.In this paper, in order to reduce the risk of infection with COVID‐19 in the buildings, we summarized the desirable operation methods of air conditioning and sanitary equipments based on the knowledge about the characteristics of SARS‐CoV‐2 and the outbreak cases that have been obtained so far. The target is assumed to be a Japanese building, it is applicable also to other countries and areas in case of similar climate conditions as Japan when it had the same equipment. From the findings obtained so far, it is almost certain that the risk of outbreaks is high in a closed space with poor ventilation, so at least 30 mThe authors have no conflict of interest.No funding information is provided.


We have read the letter from Jon Deeks with care. We are sorry that the writers are unhappy with the design of the School and Armed Forces studies (Phase 4 studies). The main evaluation of the lateral flow devices is reported in the Phase 3 studies. The Phase 4 studies were designed to determine the feasibility of using lateral flow devices in different settings. As the disease prevalence at the time of these studies was very low, the Phase 4 studies were not powered to undertake a standard prospective evaluation of both positive and negative cases.We are happy to confirm that all the samples shown in Table 2 had both a negative PCR test and a lateral flow test allowing the false positive rate to be estimated. PHE Porton tested the PCR samples collected from the school and armed forces studies. We agree that for the Phase 2 and 3 studies, lateral flow tests were done in laboratory conditions but overall 5942/6954 (85.4%) of the tests were done following the manufacturing instructions (rather than the 1852 suggested by the writers).The writers refer to a personal communication providing Prof Deeks preliminary with the results then available. The current publication provides a cleaned version of the results. The specificity results from the very small Armed Forces study was included as we were interested in the false positive rate, at a time of lower disease prevalence. We apologize for not including in this paper the sensitivity results which we sent directly to Prof Deeks for the Cochrane Review. These show that the numbers  were 8/8 (CT < 25); 3/4 (CT > = 25 to 28) and 2/34 (CT > = 28). As the disease was waning in the population at the time, the prevalence of low viral loads is not surprising and the low positive rate in such a population is expected and fits with the more complete Phase 3a results presented in our paper.We do not consider that an overall ‘sensitivity’ of the test against a categorical PCR result, without accounting for viral load, is a useful measure of LFD performance as all studies confirm that the LFD test is normally negative in individuals with low viral loads. The author's quoting of a sensitivity of only 28% and a positive predictive value of 18% at low disease prevalence is misleading, as already discussed as it assumes that the PCR test is a reliable test for infectiousness.Since this study was undertaken, lateral flow tests have been widely used in the UK and elsewhere. Many thousands of infectious individuals have been identified and subsequently isolated successfully, breaking the chain of transmission. For many, the return to a semblance of normal life has been facilitated by lateral flow tests.  There is no practical alternative as the PCR test has poor specificity in identifying infectious cases, is inaccessible, expensive and has a slow turn-around rate.The authors do not have any conflicts of Interest