# A New Model for Testing IPv6 Fragment Handling

Edoardo Di Paolo, Enrico Bassetti, Angelo Spognardi

<EMAIL_ADDRESS>
###### Abstract

Since the origins of the Internet, various vulnerabilities exploiting the IP
fragmentation process have plagued IPv4 protocol, many leading to a wide range
of attacks. IPv6 modified the handling of fragmentations and introduced a
specific extension header, not solving the related problems, as proved by
extensive literature. One of the primary sources of problems has been the
overlapping fragments, which result in unexpected or malicious packets when
reassembled. To overcome the problem related to fragmentation, the authors of
RFC 5722 decided that IPv6 hosts MUST silently drop overlapping fragments.

Since then, several studies have proposed methodologies to check if IPv6 hosts
accept overlapping fragments and are still vulnerable to related attacks.
However, some of the above methodologies have not been proven complete or need
to be more accurate. In this paper we propose a novel model to check IPv6
fragmentation handling specifically suited for the reassembling strategies of
modern operating systems. Previous models, indeed, considered OS reassembly
policy as byte-based. However, nowadays, reassembly policies are fragment-
based, making previous models inadequate. Our model leverages the commutative
property of the checksum, simplifying the whole assessing process. Starting
with this new model, we were able to better evaluate the RFC-5722 and RFC-9099
compliance of modern operating systems against fragmentation handling. Our
results suggest that IPv6 fragmentation can still be considered a threat and
that more effort is needed to solve related security issues.

##  1 Introduction

Internet standards allow the use of fragmentation when a router has to
transmit an IP packet larger than the next link’s Maximum Transmission Unit
(MTU), i.e., the maximum number of bytes that the link can transmit in a
single IP packet. The fragmentation process consists of dividing the packet
into smaller units, called fragments, so that the resulting pieces can pass
through a link with a smaller MTU than the original packet size.

Initial IPv4 specifications, RFC 791[19], describes a reassembly algorithm
that allows new fragments to overwrite any overlapped portions of previously-
received fragments [22]. Unfortunately, this algorithm enabled bypassing
filtering solutions and resulted in the operating system adopting different
policies to reassemble fragments [18]. Over the years, various vulnerabilities
that exploit the fragmentation process have been discovered, mainly using
overlapping fragments, exposing the Internet to several types of attacks:
Denial of Service (DoS), Traffic Modification, Traffic Interception, Intrusion
Detection Systems (IDS)/Intrusion Prevention Systems (IPS) evasion, Firewall
evasion [7, 24].

IPv6 brought about significant changes to handling fragmentation compared to
its predecessor, IPv4. It introduced a specific extension header and aimed to
address the shortcomings of IPv4 fragmentation. RFC 5722 [15] tackles the
fragmentation problem by explicitly forbidding overlapping fragments. However,
despite these efforts, extensive literature and previous studies have
demonstrated that IPv6 fragmentation still poses security risks. In
particular, it has been shown that many operating systems are not entirely RFC
5722 compliant, accepting some sequences of IPv6 overlapping fragments, being
exposed to several forms of detection evasion [2] and traffic hijacking [7].

Numerous studies have been conducted to assess the vulnerability of IPv6 hosts
to overlapping fragments and related attacks. However, some of the existing
methodologies have not been proven to be complete or accurate enough. Some
others, like the Shankar and Paxson model, were proposed in the past, but they
are obsolete due to recent changes in the reassembly strategies, as we will
demonstrate in this work. Therefore, we propose a novel model specifically
designed to evaluate the handling of IPv6 fragmentation, taking into account
the reassembling strategies employed by modern operating systems.

To prove the usefulness of our model, we thoughtfully tested it over widely
used operating systems. We also compared the results achieved using the
Shankar and Paxson model over the same targets. As shown later, our model was
able to capture the non-compliance of all operating systems that we tested,
whereas the Shankar and Paxson model indicates full compliance on IPv6
fragmentation.

Additionally, to demonstrate that IPv6 fragmentation has still to be
considered a real threat, we implemented a Traffic Modification attack. The
attack requires the ability to predict the IP identification number (IP-id):
IP-id prediction has been considered quite critical since a long time ago, and
some successful attempts are present in literature [29, 28, 27, 10, 23]. In
the attack, we take advantage of the partial or non-existing compliance of RFC
5722 to alter the legitimate traffic between two hosts, again exploiting the
use of overlapping fragments [2].

Thus, we show that vulnerabilities inherent to IPv6 fragmentation persist.
Despite numerous recommendations, attacks on IPv6 fragmentation remain
feasible, necessitating more effort to eliminate all flaws in implementations.

The paper is structured as follows: the next section provides a brief
background on IP fragmentation and past work on the topic. Section 3
introduces two well-known models for testing IPv6 fragmentation issues, and
discusses their limitations. Section 4 reports our experiments performed to
evaluate the RFC 5722 compliance of modern operating systems. Section 5
reports our findings on RFC 9099 compliance. Section 6 report our experiment
results for the Traffic Modification attacks. Finally, Section 7 summarizes
the contributions of our work and provides some further comments to help fix
the IPv6 fragmentation flaws.

##  2 Background and Related Works

In this section, we briefly introduce some details about IP fragmentation that
provide the background for the experimental section. Then, we report a quick
survey about the main contribution related to IP fragmentation
vulnerabilities, focusing on IPv6.

###  2.1 IP Fragmentation in Internet

An essential property of an Internet link is the number of bytes it can
transmit in a single IP packet, namely the Maximum Transmission Unit (MTU).
The MTU may differ between different networking technologies. IPv4 requires
every link to support a minimum MTU of 576 bytes, as recommended by RFC 791
[19], while IPv6 requires every link to support an MTU of 1280 bytes or
greater (RFC 2460 [5]). When an endpoint has to transmit an IP packet greater
than the next link MTU, IP calls for fragmentation, which is the process of
separating a packet into units (fragments) smaller than the link MTU. The
receiving host performs fragment reassembly to pass the complete (re-
assembled) IP packet up to its protocol stack.

The fragmentation process is handled differently in IPv4 and IPv6. In IPv4, an
IP packet can be fragmented by the source node or intermediate routers along
the path between the source and the destination. However, intermediate routers
may avoid fragmenting IPv4 packets by dropping the packet and forcing the Path
MTU by the source host. In IPv6, only end-to-end fragmentation is supported;
intermediate routers cannot create fragments. To discover the best MTU size,
both IPv4 and IPv6 leverage on the Path MTU Discovery, provided by Internet
Control Message Protocol version 4 (ICMP) or 6 (ICMPv6).

In order to reassemble all the fragments related to the same packet, IP
protocol uses some information present in the header, namely: the
identification field (shared among all the fragments of the same packet), the
fragment offset (that specifies which is the starting fragment position in the
original packet) and the More Fragments flag, set to 1 for all fragments
except for the last one. IPv4 and IPv6 differ mainly on the identification
field length (16-bit long in the former, 32-bit in the latter), and that IPv6
uses a specific extension header to hold the above information.

While not predominant, statistics show that IP fragmentation is still used in
the Internet and, notably, for security protocols like IKE [13] or DNSSEC [1],
that typically rely on large UDP packets for cryptographic material exchange
[7].

###  2.2 Related Works

IP Fragmentation has been exploited to make many different types of attacks,
as anticipated by Mogul and Kantarjiev back in 1987 [12]. Most of them allow
realizing denial of services [14] or IDS/firewall evasion [24] or operating
system fingerprinting [2]. Besides those based on IP fragmentation, many other
attacks rely on the possibility of predicting the IP identification field of
the victim[29]. For this reason, there has been a flurry of works focusing on
the feasibility of predicting IP-id field [16, 20, 21, 4]. While most studies
about IP fragmentation are related to IPv4, only a few specifically focus on
IPv6. As it will be further explored in Section 3, IPv6, among the other
vulnerabilities [25] mitigations, has been revised to specifically fix the IP
fragmentation issues, firstly with RFCs 3128 [17], 5722 [15], 6946 [8] and,
later, with an updated version of the IPv6 specification, namely RFC 8200 [6].
Moreover, RFC 9099 [26] discusses extension headers with a special focus on
fragments stating that, if not handled properly, they could lead to bypassing
stateless filtering.

In [14], the authors exploit the IP fragmentation to prevent legitimate IKE
handshakes from completing. The main idea is to flood one of the endpoints
with fragments to consume all the memory resources dedicated to the fragment
buffers, realizing a fragment cache overflow. The overflow prevents legitimate
hosts from completing the IKE handshake because the reassembling becomes
impossible. Another type of attack has been described in RFC 4963 [11],
consisting of a fragment misassociation. The idea is that the attacker can
poison the fragment cache of a host, sending some spoofed fragments so that
when the fragments of the victim reach the poisoned host, they will be
misassociated and, consequently, maliciously altered.

The most influential work for our research has been done by Gilad and Herzberg
[7]. They present a DoS attack inspired by a traffic injection technique based
on IP fragmentation, proposed by Zalewski111Michal Zalewski, A new TCP/IP
blind data injection technique?, https://seclists.org/bugtraq/2003/Dec/161 and
appeared in the seclist mailing list in 2003. The idea is to inject the second
fragment of TCP connections since the IP-id was highly predictable. Following
this intuition, the authors in [7] propose performing a DoS attack against a
communicating host, targeting the NAT-ing host behind which the destination
endpoint resides. This type of attack allows the authors to realize a very
effective DoS attack, causing more than 94% of packet loss without leveraging
any fragment cache overflow.

Another pivotal work that inspired this paper has been done by Atlasis [2]. In
his paper, the author performs an exhaustive battery of tests to verify the
effective behavior of several operating systems when overlapping IP fragments
are present. In particular, the experiments verified the different reassembly
strategies and how those can be exploited to perform various evasion attacks.
The methodology used in Atlasis’ paper for understanding the different
reassembly policies is the driving factor for realizing our Traffic
Modification attack, as detailed in Section 6. Moreover, Atlasis in [3] shows
how high-end commercial IDPS devices could be evaded by the use of IPv6
extension headers.

##  3 IP Fragmentation Handling in the Wild

In this section, we evaluate RFC 5722 compliance of different operating
systems. We introduce two established methodologies adopted in the literature
to evaluate the IP fragmentation reassembly strategies that we discovered to
be obsolete. Then, we propose a new methodology, based on the presented ones,
and we discuss the results we obtained by testing widely used operating
system.

###  3.1 Shankar and Paxson Model

Figure 1: Shankar and Paxson model.

Figure 2: Three Fragments Model

The first methodology we consider is the one we call Shankar and Paxson model
[24]. In their paper, the authors introduce a model consisting of six
fragments of different lengths and offsets, as shown in Figure 2, creating a
diversified combination of fragment overlap and overwrite. In the figure, each
fragment is represented by a block labeled with a character (e.g., ‘A’, ‘B’,
‘C’), and the payload of each fragment is a sequence of bytes encoding the
corresponding character. The vertical axis marked as “time” represents the
temporal succession of the transmitted fragments. For example, the first
fragment in Figure 2 has offset 0 in the final (reassembled) payload, a length
of 32 bytes, and contains the ICMPv6 header plus 24 ‘A’s.

For each two adjacent fragments, X and Y, the Shankar and Paxson model
guarantees that there is [24]:

  * •

At least one fragment (X) wholly overlapped by a subsequent fragment (Y) with
identical offset and length;

  * •

At least one fragment (X) partially overlapped by a subsequent fragment (Y)
with an offset greater than fragment X;

  * •

At least one fragment (X) partially overlapped by a subsequent fragment (Y)
with an offset smaller than fragment X.

By using six fragments, five different fragment reassembled sequences were
found [18]: BSD, that favors an original fragment with an offset smaller or
equal to a subsequent fragment; BSD-right, that favors a subsequent fragment
when the original fragment has an offset smaller or equal to the subsequent
one; Linux, that favors an original fragment with an offset that is smaller
than a subsequent fragment; First, that favors the original fragment with a
given offset; Last, that favors the subsequent fragment with a given offset.

In our experiments we discovered that modern operating systems don’t use parts
of a fragment: they assemble fragments by using or discarding them entirely,
as discussed in Section 4.1. Due to this new behavior, the Shankar and Paxson
model is no more suitable for IPv6 fragment overlapping tests as the
reassembly phase may never finish in some occasion (more on this in Section
4.1).

###  3.2 Three Fragments Model

Besides the Shankar and Paxson model, another methodology named “3-fragments
model” was proposed by Atlasis [2]. They used this methodology to evaluate a
host behavior with the fragmentation overlapping. Their model is based on
several tests in which only three fragments are exchanged, and only the header
and payload of the second fragment change, as shown in Figure 2.

The model is defined by these three fragments:

  * •

The first fragment has always offset 0, and More Fragments flag (M-flag from
now on) set to 1. It consists of an ICMPv6 Echo Request (8 bytes) with 16
bytes of payload for a total length of 24 bytes;

  * •

The second fragment has variable length and offset, and within the different
tests, it also varies in the value of the M-flag;

  * •

The third fragment has always offset 24, M-flag always set to 0, and a length
of 24 bytes, carrying part of the payload.

The model comprises 11 different combinations of length and offsets for the
second fragment while varying the value of the M-flag for the second fragment
and reversing the sending order of the three fragments (from 1 to 3 and from 3
to 1). This shuffling leads to a total of 44 tests.

While this test was successfully used to investigate the IP fragmentation
reassembly [2], the model is now obsolete because it assumes that IPv6
endpoints may reassemble the packet using a fragment partially. As discussed
in Section 4.1, modern operating systems assemble fragments by using or
discarding them entirely.

##  4 A New Model for Testing IPv6 Fragment Handling

This section proposes a new model to check RFC 5722 compliance on IPv6
fragmentation. We discuss how operating systems handle IPv6 fragments
nowadays, and then we present our proposal for a model for testing overlapping
fragments based on the Shankar and Paxson model. Finally, we discuss the
results obtained from the different experiments performed.

###  4.1 Overlapping Fragments Today

Previously proposed models for testing overlapping fragments proved to be
obsolete in our experiments. We noted that all operating systems in Table 1
discard entire overlapping fragments. Which fragment is discarded depends on
the operating system policy, which may include the arrival time or offset
position. Figure 3 shows an example of this problem with the Shankar and
Paxson model when the operating system drops overlapping fragments that
arrived late. Since fragments “D” and “E” overlap with “A”, “B” and “C”, they
are discarded by the operating systems, thus producing a “hole” between
fragments “A” and “B”.

Figure 3: Overlapping fragments discarded by operating systems may create hole
and prevent a correct reassembly. In this example, the operating system
decided to discard “D” and “E” fragments due to its reassembly policy, leaving
a hole between “A” and “B”.

The gap between “A” and “B” (caused by dropping “D”) does not allow the
machine to reassemble the packet correctly and reply to the “ICMPv6 Echo
Request”, since it is missing information between offsets 32 and 40. The
machine waits for a predetermined time (ip6frag_time, which in some systems is
set to 30 seconds by default) and then deletes the fragments received up to
that time from memory. Thus, these machines seem compliant with the RFC 5722,
as there is no way to know externally whether the packet has been discarded
because of the gap or because they dropped the packet and all fragments (which
is the action required by the RFC).

###  4.2 A New Model for Testing IPv6 Fragment Handling

Our approach is based on the well-known Shankar and Paxson model, which
provides a comprehensive framework for analyzing the reassembly process of
fragmented packets. However, we modify the original model by reducing all
fragment offsets by one, resulting in an offset reduction of 8 bytes. Also,
although we display the model using the same time sequence as the Shankar and
Paxson model, our model is meant to be tested by shuffling the sequence. In
other words, multiple tests should be done, and the fragments should have
different arrival times on each test but the same offsets and content. The
model is shown in Figure 4.

The primary motivation behind the offset mutation is to have some combinations
where the packet reassembly is done by using or discarding entire fragments,
as modern operating systems do. Previous models could not expose issues in the
fragmentation handling due to the problem discussed in Section 4.1.

It is important to note that the ICMPv6 header is excluded from this overlap.
We excluded the “next header” in the payload as no operating systems allow
overwriting it in any combination of fragments.

A significant contribution of our modified model lies in identifying two
combinations of fragments, AAABBCCCFFF and AAABBEEEFFF, that do not create any
holes during reassembly. These fragment combinations are particularly
interesting, as they present scenarios where fragments can be reassembled even
when partial overlapping fragments are dropped.

To avoid issues with different checksums created by different ways of
reassembling fragments, we also re-defined the payload of the fragments as
shown in Table 3 and presented in Section 4.4. By doing so, we have that any
combination of fragments in our model has the same checksum.

Figure 4: The new model we are proposing. It is based on the Shankar and
Paxson model but it has different offsets to better fit current reassembly
policies. Figure 5: One of the permutation is when the first fragment is the
latest one to arrive. This particular arrangement might result in a different
reassembled packet.

###  4.3 Model Validation and Results

We performed a series of experiments to assess the usefulness of our model and
to catch anomalies in the reassembly procedure in operating systems. For some
tests, we also compared our model with Shankar and Paxson, demonstrating that
our model is able to capture the non-compliance where the Shankar and Paxson
model suggests that the operating system is RFC 5722-compliant. We also tested
all possible permutations of the arrival time of the fragments (720
permutations). Although some may be superfluous due to previous tests, we
checked the complete set of permutations to create a dataset for further
analysis. Overall, the total number of tests in our dataset is 2226222The
complete list of tests can be found in the GitHub repository. for each
operating system listed in Table 1.

Table 1: Operating systems, versions tested and Vagrant box version. Operating System | Kernel Version | Vagrant box version
---|---|---
GNU/Linux Arch | 6.3.2-arch1-1 | 3.23.0522
GNU/Linux Debian 11 | 5.10.0-22-amd64 | 11.20230501.1
GNU/Linux Ubuntu 23.04 | 6.2.0-20-generic | 20230524.0.0
OpenBSD | 6.9 GENERIC.MP#473 | 4.2.16
FreeBSD | 13.1-RELEASE | 4.2.16
Microsoft Windows 10 | 10.0.19041.2965 | 2202.0.2305
Microsoft Windows 11 | 10.0.22621.1702 | 2202.0.2305

All tests were performed in a small laboratory created by Vagrant by
Hashicorp, an open-source software that helps and simplifies the management of
reproducible virtual machine environments. The lab network contains one
attacker, a Debian 11 virtual machine with our fuzzer, and one victim, which
rotated between all operating systems listed in Table 1. The victim and the
attacker are directly connected, as in a LAN, to avoid side effects by other
network elements. We performed tests multiple times to reduce the number of
errors due to some transient situation in the victim.

We can summarize the tests in:

  1. 1.

Single ICMPv6 packet fragmented using multiple permutations of fragments;

  2. 2.

Single ICMPv6 packet fragmented using multiple permutations, but fragments are
sent multiple times;

  3. 3.

Multiple ICMPv6 packets fragmented using multiple permutations.

In the first test, a single packet is fragmented and sent to the victim for
each different permutation in our model. In the second test, the same occurs,
but all frames are sent again (in the same order) 4 more times, to simulate a
network retransmission or a malicious act by the attacker. In the third test,
for each different permutation, five different ICMPv6 packets are created and
sent. Note that, while both the second and the third tests are sending five
packets, in the second test all fragments have the same fragment ID (as they
belong to the same packet), while in the third test fragments are grouped by
the fragment ID, which is different for each packet.

Table 2: ICMPv6 Echo replies received while testing the Paxson and Shakar model and our model. A RFC-compliant host should never reply to these tests. |  Shankar and Paxson | Proposed model
---|---|---
OS / Test |  |  1 |  2 |  3
GNU/Linux Arch |  0 |  35 |  37 |  1634
GNU/Linux Debian |  0 |  35 |  37 |  1634
GNU/Linux Ubuntu |  0 |  35 |  37 |  1634
OpenBSD |  0 |  0 |  24 |  373
FreeBSD |  0 |  0 |  20 |  1609
Windows 10 |  0 |  0 |  20 |  1800
Windows 11 |  0 |  0 |  20 |  1800

Table 2 shows a summary of the results we obtained by running the proposed
model in the virtual environment. These results not only demonstrate that all
listed operating systems are violating the RFC 5722 by replying to overlapping
fragments, but also that the way they handle overlapping fragments (the
“reassembly policy”) may pose some risk, as in the case when different
reassembly policies are used between an IDS/IPS/firewall and the victim.
Different reassembly policies may result in a different reassembled packet: an
attacker can exploit this difference to provide a different packet to the
IDS/IPS/firewall than the one reassembled by the victim, bypassing the
IDS/IPS/firewall protection.

We performed the same set of tests using the Paxson and Shakar model. As shown
in Table 2, the Paxson and Shakar model ended with no replies for all tests,
which may indicate RFC 5722 compliance. However, we know that ICMPv6 Echo
Replies are missing not because of discarding overlapping fragment (RFC
requirement), but due to missing payload pieces in the reassembly created by
the new policy of fragment reassembly (as explained in Section 4.1).

###  4.4 On IPv6 Checksum and Overlapping Fragments

IPv6 header does not contain a checksum [6], shifting the duty of checking the
integrity of the transmission to the upper layers. The choice was made to
speed up the packet forwarding: IPv6 intermediate devices, like routers, do
not check the integrity of the datagram (except for security systems like
IDS). Upper layers protocols, like ICMPv6, UDP, and TCP, may require a
checksum, which is computed and verified by the transmission endpoints.

When the checksum is required (e.g., ICMPv6), the first fragment contains the
checksum of the entire packet inside the upper layer header. Overlapping
fragments might create a situation where the final checksum of the packet is
incorrect since hosts can have different reassembly policies [2]. This, in
turn, might cause the victim to discard the packet and not reply to our ICMPv6
ping tests, invalidating the results presented until now.

To rule out that packets are dropped because of the checksum mismatch, we re-
defined the payload of the fragments as shown in Table 3. This new definition
exploits the commutative property of the checksum: by definition, the checksum
contains the sum of 2 bytes pair of the entire IPv6 packet [9]. Given that the
sum has the commutative property, any combination of fragments in our model
has the same checksum.

Table 3: New payload definition. This payload exploits the checksum’s commutative property to avoid re-assembly errors. The “odd” version is also used in tests with one packet, whereas both “odd” and “even” are used in tests with multiple packets. Shankar and Paxson | Odd/single packet | Even
---|---|---
A | 11223344 | 44113322
B | 11332244 | 44331122
C | 22113344 | 44332211
D | 22331144 | 11224433
E | 33112244 | 11334422
F | 33221144 | 22114433

###  4.5 Denial of Service due to RFC 5722 Compliance

The RFC 5722 requires dropping packets with overlapping fragments. This rule
creates a vulnerable surface for a Denial-of-Service attack by a malicious
third host, the “attacker”. For the attacker to exploit the vulnerability, the
transmission between two parties should use fragments, and the attacker should
be able to predict the IP-id field and spoof the source IP address.

The attack strategy involves the attacker sending a spoofed fragment to the
target host (the transmission receiver) before it can reassemble all the
fragments received from the victim (the transmission source). By using the
same source address as the victim and the same IP-id value, the attacker
creates an overlap during the fragment reassembly phase, causing the entire
packet to be discarded and preventing the victim from receiving a reply.

This Denial-of-Service vulnerability exposed by the RFC is exploitable only in
certain conditions. Also, it is the desired effect as fragment handling
exposes higher security issues. So, in our opinion, it does not present a real
threat due to the practical difficulties of satisfying prerequisites and the
low gain of such attacks.

##  5 RFC 9099 Compliance

This section presents the study on RFC 9099 [26] compliance, which mainly
focuses on IPv6 Extension Headers. We briefly introduce the requirements
stated in RFC 9099 [26]. Then, we describe the experiments we performed to
verify the compliance of operating systems.

###  5.1 IPv6 Fragment Headers and RFC 9099

IPv6 extension headers are additional data structures that can be included in
the IPv6 packet header to provide extra functionality or options beyond what
is defined in the IPv6 protocol. These headers are placed between the IPv6
header and the upper-layer protocol data, allowing for features such as
fragmentation, authentication, encryption, routing, and mobility.

IPv6 uses a specific extension header named “Fragment Header” to handle a
fragmented packet where the packet is too big for the Maximum Transfer Unit of
underlying links [6]. While not strictly required, RFC 9099 [26] suggest that
security devices in the middle of the transmission (such as firewall, IDS,
IPS) and the destination endpoint should drop first fragments that do not
contain the entire IPv6 header chain (which include the transport-layer
header). The reason for this requirement is to avoid issues when dealing with
stateless filtering [6].

Some IPv6 extension headers can be expressed multiple times in a single
datagram; others do not. Also, these headers are linked together in a chain,
and the RFC 8200 [6] suggests an order for headers to optimize the computation
and avoid processing issues. RFC 9099 strongly recommends that the correct
order and the maximum number of repetitions of extension headers are enforced
in endpoints and in any security device in the path. Non-conforming packets
should be dropped[26].

In the context of fragmented IPv6 packets, a malicious actor may try to send
additional headers in different fragments, or they might try to overwrite the
upper layer header in the payload from the first fragment using a subsequent
overlapping fragment. In both cases, the packet must be discarded.

###  5.2 Fragment Headers Experiments and Results

We designed our experiments around the two requirements from RFC 9099: the
first experiment checks the requirement of having all extension headers in the
first fragment, and the second experiment is on overlapping the upper layer
header using an overlapping fragment.

In the first experiment (Table 4), we send a packet divided into three
fragments: the first contains the ICMPv6 Header and no payload, the second
contains the payload, and the last contains a Destination Options header.
These fragments are not overlapping, but no response is expected as the first
fragment does not contain the complete IPv6 headers chain [26].

In the second experiment (Table 5), we send a packet divided into three
fragments: the first contains no headers and no payload, the second contains
the ICMPv6 Echo Request header (offset for this fragment is zero, as the first
fragment), and the last contains a payload. The first and the second fragments
do not overlap because the first fragment is empty. Nevertheless, no response
is expected as the first fragment does not contain the complete IPv6 headers
chain [26].

Table 4: First experiment for RFC 9099 compliance. No response is expected: the first fragment should be dropped because it does not contain all the extension headers. # | Type | Offset | More Fragment | Payload
---|---|---|---|---
1 | ICMPv6 Echo Request | 0 | 1 | /
2 | Fragment | 1 | 1 | AAAAAAAA
3 | IPv6 Fragment & Dest. Options | 2 | 0 | BBBBBBBB
Table 5: Second experiment for RFC 9099 compliance. No response is expected: the first fragment should be dropped because it does not contain the full IPv6 headers chain. # | Type | Offset | More Fragment | Payload
---|---|---|---|---
1 | IPv6 Fragment | 0 | 1 | /
2 | ICMPv6 Echo Request | 0 | 1 | /
3 | IPv6 Fragment | 1 | 0 | BBBBBBBB

We tested a subset of the operating system in Table 1, namely Debian 11,
FreeBSD, and OpenBSD.

In the first experiment, we received an ICMPv6 Echo Reply from all the
operating systems, even if the first fragment did not have the destination
options header. The correct response was to discard the first fragment or the
entire packet.

In the second experiment, all operating systems recognized the malformed
packet; however, only FreeBSD and OpenBSD silently dropped the received
packet. Debian, instead, the victim responds to the attacker with an ICMPv6
packet with code 3, which stands for “IPv6 First Fragment has incomplete IPv6
Header Chain”.

The results of the first experiment show that the systems tested, at present,
are not compliant with RFC 9099 since they are not dropping the first
fragments or packets when extension headers are spread through fragments.
Also, since test 1 contains the “Destination Options” extension header after
the Fragment Header (while the RFC 8200 recommends the opposite), those
systems are not dropping non-conforming packets, while RFC 9099 suggests
discarding them.

Moreover, it is possible to recognize an operating system using the fragmented
packet as described in Table 5 (second experiment): the different behavior
between operating systems could lead an attacker to perform fingerprinting
against victims. While RFCs 9099 and 5722 do not specify whether a host should
silently discard these packets, we believe a silent discard is the safest
option, and an RFC should mandate it.

##  6 Modification Attacks with Overlapping Fragments

This type of attack has been firstly performed, in a different context, by
Gilad et al. [7]: the attacker aims to modify the content of the communication
between the victim and a legitimate host, namely host X. We leverage the RFC
5722 non-compliance: since the victim accepts overlapping fragments, the
attacker can change with another fragment the bytes sent by the host X.

In the Modification Attack, the attacker must send one or more fragments and
ensure that when these fragments are reassembled with the legitimate ones, the
result is a correct packet (not malformed) and that the final packet payload
is the desired one. For this reason, to perform a successful modification
attack, the attacker has to calculate the correct checksum to avoid the
discard of a packet because of a checksum mismatch (Section 4.4).

We demonstrate that the modification attack is possible by altering the
content of a syslog UDP transmission from host X to the victim.

###  6.1 Implementation of Modification Attack with Scapy

We present the implementation of the Modification Attack in a specific
scenario where both host X and the victim are running the rsyslog, an open-
source software for managing logs and forwarding log messages between
machines. The host X is configured to send syslog messages via UDP to the
victim.

This attack requires the malicious actor to know (or guess) the IP
identification field value, the payload of the IPv6 packet (in this case, the
log message) host X sends to the victim, and requires spoofing the host X
address. The IP ID requirement can be easily satisfied: guessing the IP
identification value has already been demonstrated in literature by Salutari
et al. [23]. The packet payload, instead, should be predictable (for example,
a TLS Client-Hello) or known in advance. Spoofing is still a problem,
especially in local area networks [23].

We will alter the log line regarding a successful SSH authentication in this
case. In particular, we will try to alter the fragment containing the
attacker’s IP address. The original line is Jun 1 20:47:08 git sshd[88459]:
Accepted publickey for git from 10.10.10.100 port 49240 ssh2: ED25519
SHA256:vNTXCU7b6C6mqvcaH7j1/uRC5unllTpG5kCtd01xxoc

The host X sends the log line in three fragments:

  1. 1.

the first fragment with the UDP header, the syslog severity and facility code,
and the first 51 bytes of the message:
<43> Jun 1 20:47:08 git sshd[88459]: Accepted publickey ;

  2. 2.

the second fragment with 56 bytes of the message:
for git from 10.10.10.100 port 49240 ssh2: ED25519 SHA25;

  3. 3.

the third fragment with the rest of the log line:
6:vNTXCU7b6C6mqvcaH7j1/uRC5unllTpG5kCtd01xxoc;

To successfully perform the attack, the malicious actor should send a spoofed
second fragment with a different payload before or after the second fragment
from the host X to the victim (depending on the reassembly policy used by the
victim). When the victim re-assembles the final packet, the new payload for
the second fragment will be used.

However, a different payload will likely result in a different checksum: the
victim will drop the packet as corrupted. To work around this problem, the
attacker exploits the commutative property of the sum in the checksum by
shuffling the payload. The shuffle should swap groups of two bytes as the
checksum is calculated by a series of 16-bit sums.

Another technique for keeping the same checksum is to calculate the difference
between the correct checksum and the checksum of the new final packet and then
add this difference to the spoofed fragment payload. Thanks to the commutative
property of the sum, the result will be the original checksum.

###  6.2 Modification Attacks Results Discussion

In our test environment, we used two GNU/Linux Debian machines (the same
version listed in Table 1). We tested this attack by sending the following
payload in a spoofed second fragment to the victim just before the original
second fragment: 0 0. Efromr 9225HAgi.12: 110fo55po10D240rt19t 0. 4sh S s.
This string is a permutation of the payload of the original second fragment,
so the final payload (after the reassembly) will remain the same as the
original one.

Since the RFC 5722 states that datagrams with overlapping fragments must be
silently discarded, we should not expect any log in the victim machine.
However, as the victim is not RFC 5722 compliant, we found the modified
payload in the log file, as shown in Figure 6.

Figure 6: The string in the log file. The log line contains the attacker’s
modified payload.

These attacks can be prevented mainly by implementing RFC 5722 recommendations
of dropping the entire packets in the presence of overlapping fragments. IPSec
may provide additional protections.

##  7 Conclusions

In conclusion, this work addresses the ongoing issues associated with packet
fragmentation in IPv6, explicitly focusing on the issue of overlapping
fragments. Despite the requirement listed by different RFCs for hosts to drop
overlapping fragments silently, our work indicates that the problem persists.
Also, changes in the fragment reassembly policies by operating systems from
byte-based to fragment-based made current models for testing IPv6
fragmentation issues (such as the Shankar and Paxson model) obsolete.

To address these issues, the authors propose a novel model that exploits the
fragment-based strategy in modern operating systems when handling IPv6
fragmentation. By leveraging the commutative property of the checksum, the
authors simplify the assessment process and propose a more accurate evaluation
methodology.

Using this new model, the authors evaluate the compliance of modern operating
systems with RFC-5722 and RFC-9099, which pertain to fragmentation handling in
IPv6. The evaluation was performed both using ICMPv6 Echo Request/Reply, and
by performing a real attack named “Modification Attack”, where a fragmented
transmission was altered.

The results of the evaluation reveal that IPv6 fragmentation remains a
significant threat, and further efforts are required to address the related
security issues. These findings underscore the need for ongoing research and
development to enhance the security measures and mechanisms associated with
IPv6 fragmentation.

Taking the necessary countermeasures to deal with fragmentation attacks and
secure IPv6 would still be appropriate since adopting IPv6 is an irreversible
and ever-growing process, especially with new technologies based on the
Internet of Things.

We released the dataset and all scripts developed to run our experiments in a
public GitHub repository at
https://github.com/netsecuritylab/ipv6-fragmentation.

## Acknowledgments

This work was partially supported by project ‘Prebunking: predicting and
mitigating coordinated inauthentic behaviors in social media’ project, funded
by Sapienza University of Rome; by the Italian Ministry of Defense PNRM
project “UNAVOX”, by project SERICS (PE00000014) under the MUR National
Recovery and Resilience Plan funded by the European Union – NextGenerationEU.

## References

  * [1] R. Arends.  DNS security introduction and requirements.  IETF RFC 4033, 2005.
  * [2] A. Atlasis.  Attacking IPv6 Implementation Using Fragmentation.  In Black Hat Europe Conference, 2012.
  * [3] A. Atlasis and E. Rey.  Evasion of high-end IPS devices in the age of IPv6.
  * [4] J. Bethencourt, J. Franklin, and M. Vernon.  Mapping internet sensors with probe response attacks.  In Proceedings of the 14th Conference on USENIX Security Symposium - Volume 14, SSYM’05, page 13, USA, 2005. USENIX Association.
  * [5] S. E. Deering and R. M. Hinden.  Internet Protocol, version 6 (IPv6) specification.  IETF RFC 2460, 1998.
  * [6] S. E. Deering and R. M. Hinden.  Internet Protocol, version 6 (IPv6) specification.  IETF RFC 8200, 2017.
  * [7] Y. Gilad and A. Herzberg.  Fragmentation considered vulnerable.  ACM Transactions on Information and System Security, 15(4):1–31, Jan 2013.
  * [8] F. Gont.  Processing of IPv6 ”Atomic” Fragments.  IETF RFC 6946, 2013.
  * [9] M. Gupta and A. Conta.  Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification.  RFC 4443, Mar. 2006.
  * [10] M. Göhring, H. Shulman, and M. Waidner.  Path MTU Discovery Considered Harmful.  In 2018 IEEE 38th International Conference on Distributed Computing Systems (ICDCS), pages 866–874, July 2018.
  * [11] J. Heffner, M. Mathis, and B. Chandler.  IPv4 reassembly errors at high data rates.  IETF RFC 4963, 2007.
  * [12] C. A. Kantarjiev and J. C. Mogul.  Fragmentation considered harmful.  In Proceedings of the ACM Workshop on Frontiers in Computer Communications Technology, SIGCOMM ’87, page 390–401, New York, NY, USA, 1987. Association for Computing Machinery.
  * [13] C. Kaufman and P. Hoffman.  Internet Key Exchange Protocol Version 2 (IKEv2).  IETF RFC 5996, 2010.
  * [14] C. Kaufman, R. Perlman, and B. Sommerfeld.  Dos protection for UDP-based protocols.  Proceedings of the 10th ACM conference on Computer and communication security - CCS 03, 2003.
  * [15] S. Krishnan.  Handling of overlapping IPv6 fragments.  IETF RFC 5722, 2009.
  * [16] Z. Li, A. Goyal, Y. Chen, and V. Paxson.  Automating analysis of large-scale botnet probing events.  In Proceedings of the 4th International Symposium on Information, Computer, and Communications Security, ASIACCS ’09, page 11–22, New York, NY, USA, 2009. Association for Computing Machinery.
  * [17] I. Miller.  Protection Against a Variant of the Tiny Fragment Attack (RFC 1858).  IETF RFC 3128, 2001.
  * [18] J. Novak.  Target-based fragmentation reassembly.  Sourcefire, Columbia, MD, 2005.
  * [19] J. Postel.  Internet Protocol.  IETF RFC 791, 1981.
  * [20] Z. Qian and Z. M. Mao.  Off-path TCP sequence number inference attack - how firewall middleboxes reduce security.  2012 IEEE Symposium on Security and Privacy, 2012.
  * [21] Z. Qian, Z. M. Mao, and Y. Xie.  Collaborative TCP sequence number inference attack.  Proceedings of the 2012 ACM conference on Computer and communications security - CCS 12, 2012.
  * [22] D. Reed, P. S. Traina, and P. Ziemba.  Security Considerations for IP Fragment Filtering.  IETF RFC 1858, 1995.
  * [23] F. Salutari, D. Cicalese, and D. J. Rossi.  A closer look at IP-ID behavior in the wild.  In R. Beverly, G. Smaragdakis, and A. Feldmann, editors, Passive and Active Measurement, pages 243–254, Cham, 2018. Springer International Publishing.
  * [24] U. Shankar and V. Paxson.  Active mapping: resisting NIDS evasion without altering traffic.  Proceedings 19th International Conference on Data Engineering (Cat. No.03CH37405), 2003.
  * [25] J. Ullrich, K. Krombholz, H. Hobel, A. Dabrowski, and E. Weippl.  IPv6 security: attacks and countermeasures in a nutshell.  In 8th $\\{$USENIX$\\}$ Workshop on Offensive Technologies ($\\{$WOOT$\\}$ 14), 2014.
  * [26] E. Vyncke, K. Chittimaneni, M. Kaeo, and E. Rey.  Operational Security Considerations for IPv6 Networks.  RFC 9099, Aug. 2021.
  * [27] M. Zalewski.  Strange attractors and TCP/IP sequence number analysis, 2001.
  * [28] M. Zalewski.  A new TCP/IP blind data injection technique?, 2003.
  * [29] M. Zalewski.  Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect Attacks.  No Starch Press, USA, 2005.


# Background contribution in the electron-tracking Compton camera aboard
SMILE-2+

Tomonori Ikeda<EMAIL_ADDRESS>Atsushi Takada  Taito
Takemura  Kei Yoshikawa  Yuta nakamura  Ken Onozaka  Mitsuru Abe  Toru
Tanimori  Graduate School of Science, Kyoto University Kitashirakawa
Oiwakecho, Sakyo, Kyoto, Kyoto, 606-8502, Japan  Yoshitaka Mizumura  Institute
of Space and Astronautical Science, Japan Aerospace Exploration Agency
Yoshinodai 3-1-1, Chuou, Sagamihara, Kanagawa, 252-5210, Japan

###### Abstract

The Mega electron volt (MeV) gamma-ray observation is a promising diagnostic
tool for observing the universe. However, the sensitivity of MeV gamma-ray
telescopes is limited due to peculiar backgrounds, restricting the application
of MeV gamma rays for observation. Identification of backgrounds is crucial
for designing next-generation telescopes. Therefore, herein, we assessed the
background contribution in the electron-tracking Compton camera (ETCC) on
board the SMILE-2+ balloon experiment. This assessment was performed using the
Monte Carlo simulation. The results revealed that the background below 400 keV
existed due to the atmospheric gamma-ray background, the cosmic-ray/secondary-
particle background, and the accidental background. On the other hand, the
unresolved background component, which was not likely to be relevant to direct
Compton-scattering events in the ETCC, was confirmed above 400 keV. Overall,
this study demonstrated that the Compton-kinematics test provides a powerful
tool to remove the background and principally improves the signal-to-noise
ratio at 400 keV by an order of magnitude.

††preprint: APS/123-QED

##  I Introduction

Mega electron volt (MeV) gamma-ray observation can address various unresolved
topics of modern astrophysics, such as the particle acceleration processes of
relativistic jet and outflow sources [1], the origin and propagation of low-
energy cosmic rays associated with the star formation [2], and the
nucleosynthesis and chemical enrichment of our galaxy [3]. In particular, the
morphology of a bright gamma-ray $e^{+}e^{-}$ annihilation line cannot be
easily explained using conventional astrophysical sources, such as type ${\rm
I}$a supernovae, massive stars, microquasars, and X-ray binaries, thereby
persisting as an issue in the sub-MeV observation [4, 5]. Recently, Advanced
LIGO and Virgo established the foundation of gravitational wave astronomy [6].
In addition, IceCube [7] has detected astrophysical neutrinos. The
astrophysical sources of the gravitational waves and high-energy neutrinos are
expected to emit high-energy gamma rays [8, 9]. Therefore, a coincidence
observation with the gamma-ray signals in time and space is desired to obtain
complete knowledge and complementary information for the new astronomy in the
multimessenger epoch.

The Compton telescope COMPTEL onboard the Compton gamma-ray observatory has
been the most successful experiment in MeV gamma-ray observations [10]. The
novel tools employed for the background reduction in COMPTEL can measure the
time-of-flight (ToF) and the pulse shape discriminator (PSD). The ToF aids in
distinguishing forward-scattered events from backward-scattered events, and
the PSD enables the rejection of neutron scattering events in an organic
scintillator [11]. Although the COMPTEL exhibits an ingenious contrivance, its
sensitivity is moderate owing to the unexpected background contamination. In
practice, the achieved sensitivity requires an observation period that is 4.5
times longer than the predicted duration. Arguably, the next-generation
Compton telescopes must include other comparable tools such as the consistency
checks of the Compton kinematics for measuring the direction of the Compton
electron [12].

Therefore, we proposed the sub-MeV/MeV gamma-ray imaging loaded-on-balloon
experiment (SMILE) [13]) using an electron-tracking Compton camera (ETCC),
which can record all the information on Compton kinematics, including the
direction of the Compton electron. The ETCC enables gamma-ray imaging based on
the geometrical optics [14]. The second balloon experiment, hereafter referred
to as SMILE-2+, was conducted to observe the Crab Nebula in 2018. We
successfully detected a significance of 4.0${\sigma}$ in the energy range
0.15–2.1 MeV [15] and acquired the data of approximately one day at high
altitudes, which were utilized for the background validation.

The ETCC comprises the scatter and absorption medium similar to the medium of
the conventional Compton camera. We expect that the gamma-ray initially loses
the partial energy in the scattering medium via Compton scattering
interaction, followed by complete absorption in the absorption medium,
hereafter referred to as the ideal Compton event. However, several undesired
events existed within the double Compton scattering event, the back-scattering
event in which the gamma-ray was initially scattered on the absorption medium,
and the accidental event in which two photons interacted in each medium. The
ETCC provides a powerful tool to discriminate the ideal Compton event from an
undesired event, involving the consistency check of the Compton kinematics,
owing to the direction information of the recoil electron. We can calculate
the differential angle $\alpha$ between the scattering gamma $\mathbf{g}$
111$\mathbf{e}$ and $\mathbf{g}$ are unit vectors. and the recoil electron
$\mathbf{e}$ in two ways; the geometrical calculation, given by

$\cos\alpha_{{\rm geo}}=\mathbf{g}\cdot\mathbf{e},$ (1)

and the Compton kinematics calculation as follows,

$\cos\alpha_{{\rm kin}}=\left(1-\frac{m_{{\rm
e}}c^{2}}{E_{\gamma}}\right)\sqrt{\frac{K_{{\rm e}}}{K_{{\rm e}}+2m_{{\rm
e}}c^{2}}},$ (2)

where $m_{{\rm e}}$ denotes the electron mass, $E_{\gamma}$ indicates the
energy of the scattering gamma-ray and $K_{{\rm e}}$ represents the kinetic
energy of the recoil electron. The difference value
$\Delta\cos\alpha~{}(=\cos\alpha_{{\rm geo}}-\cos\alpha_{{\rm kin}})$ is
crucial for identifying the ideal Compton event such that it yields
$\Delta\cos\alpha=0$. Practically, because the measurement of such parameters
involves uncertainties associated with the resolution, the $\Delta\cos\alpha$
distribution of the Compton event is broadened. In the ETCC of SMILE-2+, the
dominant origin broadening the $\Delta\cos\alpha$ distribution exhibits a poor
determination accuracy of the recoil direction for the low-energy electron
[16]. However, the shape of $\Delta\cos\alpha$ distribution offers sufficient
information to ensure the Compton-scattering event.

In this study, we reanalyze the SMILE-2+ data and elucidate the background
contribution using the Monte Carlo simulation. Furthermore, we confirm that
the additional parameter $\Delta\cos\alpha$ can help in identifying the ideal
Compton event. The remainder of this paper is divided into four sections. In
Sec.II, the SMILE-2+ balloon flight is introduced, and the background dataset
to compare the simulation results is defined. In Sec.III, the SMILE instrument
and the mass model used in the Monte Carlo simulation are briefly described.
Furthermore, the radiation environment at the balloon altitude and the general
characteristics of the background component are specified. In Sec.IV, the
experimental data and background simulations are compared, and background
contribution in SMILE-2+ is discussed. Finally, the Compton kinematics test is
validated in Sec.V.

##  II SMILE-2+ balloon flight and dataset

The flight trajectory of the SMILE-2+ balloon is shown in Fig 1. The balloon
was successfully launched from the Australian balloon launch station, Alice
Springs, on April 7, 2018, at 06:24 Australian Central Standard Time (ACST).
The balloon attained a float altitude of 39.6 km after an ascent time of 2 h
and the operation was terminated at 10:53 ACST on April 8, 2018. The total
duration of the high-altitude observation was approximately 26 h.

Figure 1: Flight trajectory of the SMILE-2+ balloon from Alice Springs 06:24
ACST on April 7, 2018, until the end of the operation at 10:53 ACST on April
8, 2018. The orange line shows the selected dataset as the steady background
observation. The contour lines show the cutoff rigidity calculated via PARMA.

The atmospheric depth and the vertical cutoff rigidity slightly varied while
the balloon floated at high altitudes. Figure 2 shows the time variation of
the zenith angle of bright sources, the atmospheric depth, vertical cutoff
rigidity calculated by PARMA [17], and the measured count rate in the energy
range of 150–2100 keV. The drop in altitude (an increase in atmospheric depth)
from 12:00 to 08:00 ACST can be attributed to sunset. Fluctuation in the
atmospheric depth and the cutoff rigidity can alter the number of atmospheric
gamma, cosmic rays, and secondary particles induced by the interaction between
cosmic rays and the atmosphere. In reality, the measured rate adopted the
gamma-ray selection [15] in the field of view (FoV), corresponding to the
zenith angle below 60∘, includes the atmospheric gamma-rays and background
gamma rays induced by the cosmic rays and the secondary particles. It
correlated to the air mass and cutoff rigidity. Therefore, the dataset
obtained from 09:00 to 12:00 on April 7, 2018, was defined as the steady
background data and analyzed for background validation. This duration included
no bright source such as the Crab Nebula and the galactic center in the FoV.
The time-averaged altitude, atmospheric depth, vertical cutoff rigidity, and
count rate of the steady background data were 39.5 $\pm$ 0.06 km, 2.98 $\pm$
0.06 g/cm2, 8.69 $\pm$ 0.05 GV, and 0.65 $\pm$ 0.01 count/sec, respectively.

Figure 2: The first panel indicates the zenith angle of bright sources. The
second panel shows the time variation of the atmospheric depth. The third and
fourth panels indicate the time variation of the altitude and vertical cutoff
rigidity calculated via PARMA, respectively. The last panel presents the
measured count rate with the gamma-ray selection in the FoV. The orange-shaded
region indicates the dataset selected as the steady background observation.

##  III Background simulations

Background simulations were performed using the Monte Carlo simulation based
on Geant4 [18]. The simulation tool was optimized for SMILE-2+. The detector
response of the ETCC, such as the effective area and the point spread
function, reproduced the experimental data [15]. We implemented the deep-
learning method to improve the reconstruction accuracy of the recoil direction
of the electron and the scattering position [16]. The point spread function
was improved by 32% compared with the traditional method. In addition, we
adopted the ANNRI-Gd model to simulate the gamma-ray energy spectrum of the
thermal neutron captured on 157Gd and 155Gd [19, 20]. In this section, we
describe the mass model in the simulation and the environmental radiations
related to the simulated particles. Finally, the types of background events
triggering the ETCC detector are categorized for convenience.

###  III.1 Instrument and mass model

The description of the SMILE-2+ instrument, including the detector
performance, is detailed in Ref [15]. Briefly, the ETCC detector of SMILE-2+
comprises a time projection chamber (TPC) functioning as a Compton-scattering
target and pixel scintillator arrays (PSAs) acting as gamma-ray absorbers. The
TPC is filled with an argon-based gas (95%Ar $+$ 3%CF4 $+$ 2%iso-C4H10). A
micropattern gas detector, $\mu$-PIC [21] with 768 $\times$ 768 strips, is
mounted on top of the TPC. The detection volume of the TPC is 30 $\times$ 30
$\times$ 30 cm3. The TPC is surrounded by 108 PSAs. Each PSA is made of
Gd2SiO5:Ce (GSO) scintillators of 8 $\times$ 8 pixels with a pixel size of 6
$\times$ 6 mm2. The thicknesses of bottom and side PSAs are 26 mm and 13 mm,
respectively.

We developed a detailed mass model corresponding to the SMILE-2+ instrument to
obtain a reliable detector response from the Monte Carlo simulation. Figure 3
shows the schematic of the constructed SMILE-2+ mass model. An aluminum outer
vessel is located on an aluminum gondola. To remove the charged cosmic ray, a
5 mm–thick plastic scintillator composed the veto system and was placed on top
of the TPC. The inside vessel, composed of stainless steel and aluminum,
covered the gas TPC and GSO scintillators. The GSO scintillators were
supported by aluminum and Teflon frames. Two lithium batteries were installed
under the inner vessel. A ballast of iron sand was placed at the bottom of the
gondola (this is not described in Fig. 3) to maintain the floating altitude.
Table 1 summarizes the primary instrumental materials and masses. The total
mass of the constructed model was 729.2 kg, which varies by 9.1% from the
measured mass.

Figure 3: SMILE-2+ mass model.  Table 1: Instrument materials in the mass model Component | Material | Mass (kg)
---|---|---
Outer vessel | Al | 65.24
Aluminum gondola | Al, Mg, and Si | 53.33
Inner vessel | Cr, Ni, and Al | 90.84
Aluminum supporters | Al | 10.77
Aluminum frame | Al, and Mg | 59.20
Lithium batteries | Li10Ni4Mn3Co3O20 | 79.20
Ballast | Fe | 325.98
Plastic scintillator | C9H10 | 2.14
Gas TPC | Ar, CF4, and iso-C4H10 | 0.10
GSO scintillators | Gd2SiO5, and Ce | 28.94

###  III.2 Radiation environment

Because the atmospheric opaque to gamma-ray photons obstructs the observation
of the comic MeV gamma rays, the detectors must be placed at the top of the
Earth’s atmosphere by the balloon or into space. The instrument is exposed to
variable radiations in such a high-altitude environment. The main constituents
of radiations include cosmic rays, secondary particles from the Earth’s
atmosphere, atmospheric gamma rays, and internal radiation from the primordial
radioactivity of the detector materials. Furthermore, the radiation
environment is concisely described below, followed by the background
categorization.

####  III.2.1 Cosmic rays and secondary particles

Protons and helium nuclei are the most abundant components of cosmic rays,
followed by electrons. Although such primary cosmic rays come from the
exterior of the solar system, the solar wind magnetic field, commonly referred
to as solar modulation, decelerates the incoming low-energy charged particles.
In addition, the Earth’s geomagnetic field prevents the incidence of the
charged particle. Therefore, the intensity of the primary cosmic rays depends
on solar activity and cutoff rigidity. Moreover, such primary cosmic rays can
produce secondary elementary particles, such as protons, neutrons, electrons,
positrons, and photons, through atmospheric interactions. Because the
intensity of the secondary particles is affected by the intensity of primary
particles and atmospheric density, considerable computation time is inevitably
involved.

Therefore, the intensity and the incident angular distribution of the cosmic
rays and secondary particles were estimated using the PARMA4.0 software [17].
PHITS-based analytical radiation model in the atmosphere (PARMA) was
constructed using numerous analytical functions whose parameters were fitted
to reproduce the results of the extensive air shower simulation performed by
PHITS [22]. Therefore, PARMA instantaneously provides terrestrial cosmic-ray
fluxes at various locations, altitudes, and solar activities. The direction-
dependent cutoff rigidity in the SMILE-2+ environment is shown in Fig 4 using
the COR tool [23] and is roughly asymmetric with respect to the azimuth angle.
The vertical cutoff rigidity of 8.7 GV was consistent with that calculated
using PARMA. The azimuth and zenith dependence of the cutoff rigidity is
considered in PARMA by assuming that the Earth’s magnetic field is a simple
dipole. The calculated flux of protons, including the secondary and the
secondary particles of the neutrons, electrons, and positrons in the SMILE-2+
background observation, is shown in Fig. 5. For the proton spectrum, the
cosmic-ray proton creates a bump at approximately 10 GeV.

Figure 4: Direction-dependent cutoff rigidity in the SMILE-2+ environment.
West is toward the left, and South is toward the bottom of the image. Figure
5: Particle fluxes calculated using PARMA with a cutoff rigidity of 8.69 GV,
an atmospheric depth of 2.98 g/cm2, and the Wolf number of 16.5. Red, cyan,
green, and purple lines indicate protons, neutrons, electrons, and positrons,
respectively.

####  III.2.2 Atmospheric gamma rays

Atmospheric gamma rays are produced in the Earth’s atmosphere by the cosmic
rays. Low-energy continuum radiation below 10 MeV has been studied by Ling
[24] and Schöenfelder [25]. High-energy radiation above 30 MeV has been
investigated by Stecker [26] and Thompson [27]. Theoretically, the photon
spectrum beyond 50 MeV is predominantly produced by the decay of neutral pions
induced in the nuclear collisions of cosmic rays. Below 50 MeV, the dominant
process is the bremsstrahlung radiation of the relativistic electrons produced
by charged pions and pair production [28]. The intensity model from the
atmospheric gamma rays developed by Ling [24], Costa [29], Morris [30], and
Sazanov [31]. Ling’s model has been used in several balloon experiments, and
it is compatible with experimental data [25, 32, 33]. Thus, we employed Ling’s
model to estimate the atmospheric gamma-ray flux. However, notably, the upward
gamma-ray flux of Ling’s model differs from the measurement owing to Ling’s
assumption of an isotropic gamma-ray source function in the atmosphere [25].
Furthermore, the energy range of the model is below 10 MeV. Therefore we used
not only Ling’s model but also the PARMA model. The PARMA model is derived
from the air shower simulation, while Ling’s model is calculated by the
semiempirical method based on measured gamma-ray fluxes. This difference
between the models presents the uncertainty of the detected spectrum and is
discussed in Sec.IV.

We extracted the atmospheric gamma-ray component from Ling’s model. Although
the intensity of the atmospheric gamma rays depends on the cutoff rigidity and
solar modulation, Ling’s model is independent of these values. Considering
such discrepancy between our and Ling’s environment, we estimated the
correction factor from Sazanov’s model with a correction factor of 0.89. The
calculated atmospheric intensity in the SMILE-2+ environment is shown in Fig
6.

Figure 6: Intensity of atmospheric gamma-rays calculated by Ling model. The
purple, green, cyan, and red lines correspond to the intensity of the zenith
angle of 180∘, 120∘, 60∘, and 0∘, respectively.

####  III.2.3 Internal radiation

It is a well-known fact that many materials contain natural radioactive
isotopes such as 238U and 232Th (U/Th). Especially, if materials in the
vicinity of the detector or in the detector itself contain considerable
amounts of radioactive isotopes, the alpha, beta, and gamma rays in their
decay series emitted by these isotopes can create a PSA trigger. Using a high-
purity germanium detector, we identified that certain amounts of U and Th
radioactive isotopes contaminated the GSO crystal of the PSA detector. The
radioactivities of the U upper series and 176Lu corresponding to 3.4 $\pm$ 0.4
Bq/kg and 89 $\pm$ 5 mBq/kg, respectively, were detected. Because the U middle
series, U lower series, and Th were not observed significantly, the
90%-confidence level upper limits were obtained as 15 mBq/kg, 8.0 Bq/kg, and
3.7 mBq/kg, respectively.

To investigate the characteristics of the energy spectrum via such radioactive
contamination, we acquired the data on the ground using the self-triggering
mode of the PSA detector with lead shielding. The obtained spectrum is shown
in Fig 7. A bump component at approximately 1 MeV was caused by the alpha
emission from the decay chain of U/Th in the GSO crystal [34, 35]. Moreover,
we detected a 1.4 MeV line of 40K radioactivity. The glass of the
photomultiplier tubes (Hamamatsu Photonics, flat-panel H8500) was suspected as
the source of potassium. The total radioactivity of 40K of the photomultiplier
tubes was determined 10.4 $\pm$ 0.1 Bq.

We simulated the expected spectra of the PSA scintillator from the atmospheric
gamma-rays and the cosmic ray/secondary particles using the self-triggering
mode of the PSA detector (Fig. 7). In the cosmic ray/secondary particle
simulation, the obtained spectrum contains events involving direct
interactions of cosmic rays/secondary particles with the PSA detector as well
as gamma-ray events induced by the interaction between the cosmic
ray/secondary particles and the instrument. We found that internal radiations
were the dominant source creating the PSA trigger at the balloon altitude.

Figure 7: Spectra of a PSA scintillator. The red line shows the internal
radiation obtained by the ground experiment. The cyan and green lines denote
the contributions from the atmospheric gamma rays and cosmic rays,
respectively, including secondary particles and induced gamma rays.

###  III.3 Background event types

Figure 8: (i) Event types of the atmospheric gamma-ray background. Four
interaction cases corresponding to the direct-Compton event, double Compton
event, scattering event, and non-Compton event are described. (ii) Event types
of the cosmic-ray/secondary particle background. Typical interaction processes
such as hadronic shower, the direct incidence of the charged particles, and
thermal neutron capture are described. (iii) Event types of accidental
background. The PSA and TPC are triggered by the internal radioactivity and
atmospheric gamma-rays or cosmic-ray/secondary particles, respectively.

The radiations discussed in Sec.III.2 produced coincident interactions in the
TPC and PSAs that passed the electronic criteria for a valid gamma event. The
identified backgrounds were classified into the following types:

  1. (i)

Atmospheric gamma-ray background: The atmospheric gamma rays were observed via
several interaction cases (Fig. 8(i)). The direct-Compton event, corresponding
to the ideal Compton event, indicates the full absorption event in the PSAs
after the direct-Compton scattering in the TPC. The double-Compton event
represents the case where the Compton gamma rays scattered in the TPC deposit
a part of the energy in the PSAs. The atmospheric gamma rays scattered off the
instrumental material before entering the TPC, and such an event is called the
scattering event. The atmospheric gamma rays interacted with the GSO
scintillator before scattering off the TPC. Consequently, the scattering gamma
rays are absorbed or scattered in the TPC. Otherwise, the primary photon can
generate characteristic X-rays of gadolinium which are absorbed in the TPC.
Such events do not cause Compton scattering in the TPC and can be categorized
as the non-Compton events.

  2. (ii)

Cosmic-ray/secondary particle background: As the charged cosmic rays and
secondary particles can deposit energy in the TPC and PSAs, they directly
satisfy the electronic criteria of the ETCC. In addition, high-energy protons
and neutrons produce multiples of photons via complicated nuclear reactions
such as the spallation of a nucleus and the initiation of a shower. The
bremsstrahlung photons are emitted by relativistic electrons and positrons,
which results in the simultaneous absorption in the TPC and PSA. In the GSO
scintillator, gadolinium exhibits a large capture cross section for thermal
neutrons owing to the contributions of the isotopes 155Gd and 157Gd. The
Gd($n,\gamma$) reaction between the thermal neutron and gadolinium produces
four gamma rays on average [36], and thus, the ETCC can possibly trigger the
activation. The schematic of the interaction process is shown in Fig 8(ii).

  3. (iii)

Accidental background: The coincidence window of the PSAs and TPC reserves 9.5
$\mu$s. The isolated trigger events in the PSAs and TPC within the coincidence
window produce the ETCC trigger signal with no physical correlation between
them. Thus, we consider only the case in which the PSA is triggered by the
internal radiation, dominating the trigger event in PSA. By contrast, the
atmospheric gamma rays and cosmic-ray/secondary particles were evaluated based
on the TPC trigger. The schematic is presented in Fig 8(iii).

##  IV Results

We selected the gamma-ray events from the obtained simulation data. The
selection criteria were the same as those reported in Ref [15]. However, the
Compton-scattering kinematics was not adopted to assess the $\Delta\cos\alpha$
distribution.

The simulated spectra of the atmospheric gamma rays in the FoV are shown in
Fig. 9. Below 400 keV, the spectrum primarily constituted the scattering and
non-Compton events, whereas, above 400 keV, the spectrum was dominated by the
non-Compton events. To reflect the effective area, the direct-Compton event
was considerably reduced above 400 keV.

Figure 9: Energy spectra of the atmospheric gamma-ray simulation. The red,
cyan, green, and purple solid lines indicate the direct-Compton, double-
Compton, scattering, and non-Compton events, respectively. The black solid
line indicates the total spectrum.

The $\Delta\cos\alpha$ distribution is described in Fig 10. The distribution
of the direct-Compton and scattering event exhibited peaks near
$\Delta\cos\alpha=0$, indicating the “Compton-like” event. Because the high-
energy recoil electron improved the accuracy of the geometrical calculation of
$\cos\alpha_{{\rm geo}}$, a sharp distribution was observed in 400–2100 keV.
Conversely, the double-Compton and non-Compton events exhibited broadened
distributions, suggesting that $\Delta\cos\alpha$ enabled the identification
of the Compton-like event.

Figure 10: The top (bottom) panel shows the $\Delta\cos\alpha$ distribution in
150–400 keV (400–2100 keV). The red, cyan, green, and purple solid lines
indicate the direct-Compton, double-Compton, scattering, and non-Compton
events, respectively. The total distribution is shown by the black line.

The spectra of the cosmic-ray/secondary-particle background are shown in Fig.
11, where we describe the spectra of each selection criterion. The event
selection of “Fiducial” and “dE/dx” play a role in eliminating the charged
particles passing through the TPC to ensure that these selections can identify
the electron track completely contained in the TPC. We successfully reduced
96.7% of the direct cosmic-ray/secondary particles. The neutrons, electrons,
and positrons equally contributed to the remaining spectrum, whereas the
neutron background dominated beyond 700 keV. In particular, the 35.3% and
31.1% of the neutron background were produced by the thermal neutron capture
of gadolinium, and the nuclear interaction cascades in GSO scintillators,
respectively. In the proton background, the hadronic shower constituted the
largest proportion of the interaction process, i.e., 49.1%. Bremsstrahlung was
the dominant process in the electron and positron backgrounds, corresponding
to 69.8%, and 59.7%, respectively.

Figure 11: Simulated energy spectra of the cosmic-ray/secondary-particle
background. The black dotted, dashed, dot-dashed, and solid lines denote the
triggered spectrum and those after the event selection of the fiducial, dE/dx,
and zenith$<60^{\circ}$, respectively. The red, cyan, green, and purple
spectra denote the proton, neutron, electron, and positron backgrounds,
respectively.

Figure 12 shows the accidental background spectrum. We described the
contribution of the interaction between the atmospheric gamma rays and cosmic
rays, including the secondary particles and induced gamma rays in the TPC. The
accidental event from the atmospheric gamma rays was dominant. The
characteristic of the spectrum at approximately 1 MeV appeared because of the
internal background of the alpha particles in the GSO crystals.

Figure 12: Simulated energy spectra of the accidental background. The red and
cyan lines indicate the contribution from the atmospheric gamma and cosmic
rays, respectively, triggering the TPC. The black line represents the total
spectrum. Figure 13:  Left and right figure show the energy spectra and
$\Delta\cos\alpha$ distributions of background simulations and the
experimental data. The points with error bars denote the experiment spectrum
of SMILE-2+. The red, cyan, green, and black spectra exhibit the simulation
results of the accidental, cosmic-ray, atmospheric gamma-ray, and total
background, respectively.

Finally, we compared the simulated background spectrum and the experimental
spectrum of the steady background data. Figure 13 shows the total background
spectrum and the $\Delta\cos\alpha$ distribution using the experimental data.
Herein, we estimated the systematic uncertainty of the atmospheric gamma rays
using the PARMA model, which included the high-energy gamma rays above 10 MeV.
Below 400 keV, the simulation results were consistent with the experimental
results within the systematic uncertainty. However, slight discrepancies of
17% were observed above 400 keV. The $\Delta\cos\alpha$ distribution in
150–400 keV was consistent with the experimental results. In addition, we
confirmed that one-fourth distribution was contributed by the Compton-like
event, comprising the direct-Compton and scattering events of the atmospheric
gamma rays, affecting the distribution around $\Delta\cos\alpha=0$. Meanwhile,
the $\Delta\cos\alpha$ distributions obtained from the experiments at 400–2100
keV did not exhibit any peak, implying that the primary contributions included
the non-Compton event of the atmospheric gamma rays, the cosmic-ray/secondary
particle, and accidental backgrounds. Furthermore, this implied that an
unexplained component of $-1<\Delta\cos\alpha<-0.3$ is unlikely a Compton-like
event.

Herein, we discuss the comparison of the results of the present study with
those of a previous study [15]. The previously simulated energy spectrum did
not reproduce the bump structure around 1 MeV. In contrast, we could replicate
the spectrum considering the accidental background. In previous simulated
spectrum, although Ling’s model contained the atmospheric and cosmic diffuse
gamma rays, this study did not include the cosmic diffuse gamma rays. Even if
we considered the cosmic diffuse gamma rays, the total spectrum was within the
systematic uncertainty of the atmospheric gamma rays evaluated in this study.
Also, the previous study removed the unexplained component effectively thanks
to the event selection of $-0.5<\Delta\cos\alpha<0.5$.

##  V Discussion

We discuss the remained background candidates comprising 17% in 400–2100 keV.
We found that the cosmic diffuse gamma rays can contribute 8% of the
experimental spectrum when we used Ling’s model is applied. However, the
remainder of the background does not potentially contain the cosmic diffuse
gamma rays because the corresponding $\Delta\cos\alpha$ distribution exhibits
a peak around zero.

Herein, we focus on the accidental background that was evaluated via the
simulation and experimental data (Appendix A). The calculated count rate in
400–2100 keV was higher than the simulated rate, and the differential rate was
21 $\pm$ 4% of the total experiment data. Accordingly, the remainder of the
background can be fully explained. Moreover, the $\Delta\cos\alpha$
distribution toward the negative value was reproduced. Thus, the remaining
background was expected to be a non-correlation event between the TPC and
PSAs.

Finally, we discuss the validity of the alpha kinematics test, assuming the
direct-Compton event of atmospheric gamma rays as the signal. By contrast,
other events, such as the non-Compton events of atmospheric gamma rays,
cosmic-ray background, and accidental background, were treated as the noise.
Because the determination accuracy of the electron-recoil direction by the
SMILE-2+ detector is poor, the $\Delta\cos\alpha$ distribution of the direct-
Compton event is broadened as shown in Fig.10. However, the alpha kinematics
test principally provides a strong discrimination of the signal from the
noise. Assuming that the energy resolution of the PSA and TPC is the same as
the SMILE-2+ and the true electron-recoil direction is obtained, the
calculated $\Delta\cos\alpha$ distribution is displayed in Fig.14. The
selection of $\Delta\cos\alpha$ can effectively extract the signal. The
signal-to-noise (S/N) ratio in the FoV with and without the selection of
$\Delta\cos\alpha$ ($|\Delta\cos\alpha|<0.05$) is shown in Fig.15. The S/N
ratio reached 100% at 400 keV and was improved by an order of magnitude.
Nonetheless, the high background contamination still deteriorated the S/N
ratio in the high-energy region. The background reduction from other
perspectives, such as selecting the detector materials to reduce the thermal
neutron capture and the low-radioactive materials to reduce the accidental
background is needed. In addition, employing the anti-counter to remove the
cosmic-ray/secondary particle background associated with charged particles,
and implementing the gamma-ray shields on the bottom of the detector to
suppress the non-Compton event of the atmospheric gamma rays is effective.

Figure 14: $\Delta\cos\alpha$ distributions of the background simulation
assuming that the true electron-recoil and same energy resolution of SMILE-2+.
The red-filled histogram indicates the direct-Compton event of the atmospheric
gamma rays. The black line shows the total background of the atmospheric gamma
rays, cosmic rays, and accidental events. Figure 15: Signal-to-noise ratio in
the FoV. The black (red) line is calculated without (with) the selection of
$\Delta\cos\alpha$.

##  VI Conclusion

This study conducted the Monte Carlo simulation based on Geant4 and estimated
the background components in the ETCC of SMILE-2+. Although the atmospheric
gamma rays, cosmic-ray/secondary particles, and the accidental backgrounds
reproduced the experimental spectrum below 400 keV, we detected an unexplained
background of 17% of the total above 400 keV, suggesting an unlikely Compton-
like event based on the $\Delta{\rm cos}~{}\alpha$ distribution. In addition,
we indicated that the Compton-kinematics test principally improved the S/N
ratio by one order of magnitude. The ETCC detector, which has the inherent
ability to discriminate the Compton-like event, is expected to extend the
scope of MeV gamma-ray astronomy.

##  Appendix A Calculation of the accidental background

The ETCC trigger is formed by requiring a coincidence of the signals from the
PSAs and TPC. A gate called a coincidence window is opened after the PSA
trigger and should be adequately long to compensate for the maximum drift
length. In SMILE-2+, we reserved the coincidence window of 9.5 $\mu$s
considering the operated drift velocity of 3.9 cm/$\mu$s. Figure 16 shows the
distribution of acquired events with respect to the maximum value of the hit
timing in TPC. Peaks appeared at approximately 1 $\mu$s and 8 $\mu$s,
corresponding to the minimum drift length of the TPC bottom and the maximum
drift length of the TPC top, respectively. The random window was identified
above 9.0 $\mu$s, and the accidental background could be calculated using the
experimental data considering the events within this window.

The spectrum of the accidental background was calculated using the steady
background data within the random window and shown in Fig. 17 while being
compared with the simulation results. The count rate above 400 keV was 322
$\pm$ 23 counts/s, which was considerably different from the simulation value
of 190 $\pm$ 1 counts/s (only statistic error). The count rates of the
experiment and the simulation below 400 keV were 167 $\pm$ 17 counts/s and 111
$\pm$ 1 counts/s, respectively.

The $\Delta\cos\alpha$ distribution above 400 keV of the accidental background
is shown in Fig. 18 with the simulation. The simulation favored the positive
part of the experimental data. By contrast, the negative part of the
simulation is inefficient compared with the experiment. This finding implies
the existence of unexpected events, which is unlikely to be relevant to
Compton-like events.

Figure 16: Distribution of the maximum value for the hit timing in the TPC.
Peaks observed at approximately 1 $\mu$s and 8 $\mu$s indicate the TPC bottom
and TPC top, respectively. The random window is defined as the duration
between 9.0 $\mu$s and 9.7 $\mu$s. Figure 17: Spectra of the accidental
background. The red line denotes the simulation results. The black points and
error bars indicate the experimental results using the random window. Figure
18: $\Delta\cos\alpha$ distribution above 400 kev of the accidental
background. The red line denotes the simulation results. The black points and
error bars indicate the experimental data of the random window.

###### Acknowledgements.

This study was supported by Japan Society for the Promotion of Science (JSPS)
KAKENHI Grant-in-Aids for Scientific Research (Grant Numbers 21224005,
20244026, 16H02185, 15K17608, 23654067, 25610042, 16K13785, 20K20428,
16J08498, 18J20107, 19J11323, and 22J00064), a Grant-in-Aid from the Global
COE program “Next Generation Physics, Spun from Universality and Emergence”
from the Ministry of Education, Culture, Sports, Science and Technology (MEXT)
of Japan, and the joint research program of the Institute for Cosmic Ray
Research (ICRR), The University of Tokyo. The balloon-borne experiment was
conducted by Scientific Ballooning (DAIKIKYU) Research and Operation Group,
ISAS, JAXA. Some of the electronics development was supported by KEK-DTP and
Open-It Consortium. Further, we would like to thank Shunsuke Kurosawa for the
insightful discussion.

## References

  * Chiaberge  _et al._ [2001] M. Chiaberge, A. Capetti, and A. Celotti, Monthly Notices of the Royal Astronomical Society 324, L33 (2001).
  * Grenier  _et al._ [2015] I. A. Grenier, J. H. Black, and A. W. Strong, Annual Review of Astronomy and Astrophysics 53, 199 (2015).
  * Diehl [2013] R. Diehl, Reports on Progress in Physics 76, 026301 (2013).
  * Prantzos  _et al._ [2011] N. Prantzos, C. Boehm, A. M. Bykov, R. Diehl, K. Ferrière, N. Guessoum, P. Jean, J. Knoedlseder, A. Marcowith, I. V. Moskalenko, A. Strong, and G. Weidenspointner, Rev. Mod. Phys. 83, 1001 (2011).
  * Siegert  _et al._ [2016] T. Siegert, R. Diehl, G. Khachatryan, M. G. Krause, F. Guglielmetti, J. Greiner, A. W. Strong, and X. Zhang, A&A 586, A84 (2016).
  * Abbott  _et al._ [2016] B. P. Abbott _et al._ (LIGO Scientific Collaboration and Virgo Collaboration), Phys. Rev. Lett. 116, 061102 (2016).
  * Aartsen  _et al._ [2016] M. G. Aartsen _et al._ , The Astrophysical Journal 824, 115 (2016).
  * Takami  _et al._ [2014] H. Takami, K. Kyutoku, and K. Ioka, Phys. Rev. D 89, 063006 (2014).
  * Kadler and et al. [2016] M. Kadler and et al., Nature Physics 12, 807 (2016).
  * Schönfelder  _et al._ [1993] V. Schönfelder _et al._ , Astrophysical Journal Supplement 86, 127 (1993).
  * Weidenspointner, G.  _et al._ [2001] Weidenspointner, G., Varendorff, M., Oberlack, U., Morris, D., Plüschke, S., Diehl, R., Kappadath, S. C., McConnell, M., Ryan, J., Schönfelder, V., and Steinle, H., A&A 368, 347 (2001).
  * Schönfelder [2004] V. Schönfelder, New Astronomy Reviews 48, 193 (2004).
  * Tanimori  _et al._ [2015] T. Tanimori _et al._ , The Astrophysical Journal 810, 28 (2015).
  * Tanimori  _et al._ [2017] T. Tanimori _et al._ , Scientific Reports 7, 41511 (2017).
  * Takada  _et al._ [2022] A. Takada _et al._ , The Astrophysical Journal 930, 6 (2022).
  * Ikeda  _et al._ [2021] T. Ikeda _et al._ , Progress of Theoretical and Experimental Physics 2021, 10.1093/ptep/ptab091 (2021), 083F01.
  * Sato [2016] T. Sato, PLOS ONE 11, 1 (2016).
  * Agostinelli  _et al._ [2003] S. Agostinelli _et al._ , Nuclear Instruments and Methods in Physics Research Section A: Accelerators, Spectrometers, Detectors and Associated Equipment 506, 250 (2003).
  * Hagiwara  _et al._ [2019] K. Hagiwara _et al._ , Progress of Theoretical and Experimental Physics 2019, 10.1093/ptep/ptz002 (2019), 023D01.
  * Tanaka  _et al._ [2020] T. Tanaka _et al._ , Progress of Theoretical and Experimental Physics 2020, 10.1093/ptep/ptaa015 (2020), 043D02.
  * Takada  _et al._ [2007] A. Takada _et al._ , Nuclear Instruments and Methods in Physics Research Section A: Accelerators, Spectrometers, Detectors and Associated Equipment 573, 195 (2007).
  * Sato  _et al._ [2008] T. Sato, H. Yasuda, K. Niita, A. Endo, and L. Sihver, Radiation Research 170, 244 (2008).
  * Gecášek  _et al._ [2022] D. Gecášek, P. Bobík, J. Genči, J. Villim, and M. Vaško, Advances in Space Research 70, 1153 (2022).
  * Ling [1975] J. C. Ling, Journal of Geophysical Research (1896-1977) 80, 3241 (1975).
  * Schoenfelder  _et al._ [1977] V. Schoenfelder, U. Graser, and J. Daugherty, The Astrophysical Journal 217, 306 (1977).
  * STECKER [1973] F. W. STECKER, Nature Physical Science 242, 59 (1973).
  * Thompson  _et al._ [1981] D. J. Thompson, G. A. Simpson, and M. E. Ãzel, Journal of Geophysical Research: Space Physics 86, 1265 (1981).
  * Beuermann [1971] K. P. Beuermann, Journal of Geophysical Research (1896-1977) 76, 4291 (1971).
  * Costa  _et al._ [1984] E. Costa, E. Massaro, M. Salvati, and A. Appolloni, Astrophysics and Space Science 100, 165 (1984).
  * Morris [1984] D. J. Morris, Journal of Geophysical Research: Space Physics 89, 10685 (1984).
  * Sazonov  _et al._ [2007] S. Sazonov, E. Churazov, R. Sunyaev, and M. Revnivtsev, Monthly Notices of the Royal Astronomical Society 377, 1726 (2007).
  * Bowen  _et al._ [2007] J. D. Bowen, M. E. Bandstra, S. E. Boggs, A. Zoglauer, C. B. Wunderer, M. S. Amman, and P. N. Luke, in  _2007 IEEE Nuclear Science Symposium Conference Record_, Vol. 1 (2007) pp. 436–444.
  * Takada  _et al._ [2011] A. Takada _et al._ , The Astrophysical Journal 733, 13 (2011).
  * Wang  _et al._ [2002] S. Wang, H. Wong, and M. Fujiwara, Nuclear Instruments and Methods in Physics Research Section A: Accelerators, Spectrometers, Detectors and Associated Equipment 479, 498 (2002).
  * Kamae  _et al._ [2002] T. Kamae, Y. Fukazawa, N. Isobe, M. Kokubun, A. Kubota, S. Osone, T. Takahashi, N. Tsuchida, and H. Ishibashi, Nuclear Instruments and Methods in Physics Research Section A: Accelerators, Spectrometers, Detectors and Associated Equipment 490, 456 (2002).
  * Chyzh  _et al._ [2011] A. Chyzh _et al._ , Phys. Rev. C 84, 014306 (2011).


For clarity, although $\phi_{T}$ is not actually an input parameter in
algorithms 2 and 4 due to the use of a fixed TPS kernel, we include it as an
input for the sake of consistency with other two RBF-based algorithms.