C Cholet

X Oviedo

G Combe

P E Gautier

K Sab

J J Moreau

G Foret

F Josse

L M Cleon

STUDY OF THE MECHANICAL BEHAVIOUR OF THE BALLAST USING DISCRETE APPROACH

Keywords: ballast, granular materials, tamping, settlement

In this paper, we are interested in the study of the ballasted track and specially in two main topics: the mechanisms of degradation in the medium-to-long term and the maintenance of the ballast layer. Both an experimental and a numerical approach have been developed. Numerical simulations are performed using discrete element methods and are validated through comparisons with reference experiments at reduced scale. This principle is the basis of the studies undertaken.

INTRODUCTION

Ballasted track is widely employed because of its mechanical properties and its flexibility. But the behavior of the track and its components, such as the ballast layer, are still a poorly understood phenomenon. The stakes are significant for SNCF: a better comprehension of the mechanisms involved would make it possible to reduce the maintenance costs and to improve the ballast specification. We are interested on two main topics: the mechanisms of degradation in the medium-to-long term and the maintenance of the ballast layer. Several studies were undertaken by SNCF in collaboration with research laboratories. Principle of these studies are described in this paper.

-PRINCIPLE OF THE STUDIES

The ballast behavior can be studied using several approaches. First results were mainly empirical, issued from experience feedbacks of test runs, carried out in situ. These past years, many experimental researches were also carried out on bench facilities, with two different approaches: on one hand, standard tests, based on the soil mechanics, characterize the rheology of material but do not give any information on ballast behavior in track, and on the other hand reference tests represent ballast under conditions that, although they are idealized, should be more realistic [START_REF] Guerin | Prediction of track geometrical defect : a combined experimental and numerical approach[END_REF][START_REF] Bodin | Comportement du ballast des voies ferrées soumises à un chargement vertical et latéral[END_REF].

Ballast is often modeled as a continuous medium for which empirical constitutive laws should be available. Finite Element methods (FE) are then applied to solve the problem. Such a modeling should be relevant when considering the whole track system. However it is necessary to check the relevance of such an approach, since, the thickness of the ballast layer is only one ten grains under the sleepers.

Simulation methods resulting from research on the granular medium, referred as discrete element methods (DE) in opposition to FE methods, are an alternative approach. In this past years, researches on granular medium, especially numerical simulations, yielded significant results [START_REF] Cambou | Micromécanique des matériaux granulaires[END_REF][START_REF] Oda | Mechanics of granular materials[END_REF] which can be applied to railway problems. In DE approaches, the material is modeled grain by grain as a discrete system of rigid bodies in contact. During the evolution of the system, contact between grains can be created or disappear because of the motion of the grains. The interaction between grains follow laws of contact that can differ according to the DE model: in this paper, two DE methods are presented. DE methods enable us to analyze the microstructure of granular materials and to exhibit information which cannot be assessed in experiments or using FE methods: for example, the chains of forces, acting between grains are widely different from the distribution of stresses or strains commonly accepted in continuous media… Numerical simulations however require validation through comparison with some experiments. Reference experiments, which are simpler and less expensive than in situ experiments, are developed. Experimental parameters can be better controlled and more extensive results can be obtained. These numerical and experimental approaches are the basis of studies undertaken, and are a prerequisite to full scale tests.

-APPLICATION TO THE MAINTENANCE OF THE TRACK

Ballast behavior under vibrations, during track tamping, has been studied. Better understanding of tamping mechanisms would enable us to reduce the maintenance costs in the long term. This work was implemented within the framework of a PhD. Thesis [START_REF] Oviedo | Etude du comportement du ballast par un modèle micromécanique -Application aux opérations de maintenance de la voie ferrée ballastée[END_REF] carried out in collaboration with ENPC using both numerical and experimental approaches. A micromechanical model and a DE software has been developed, as well as a reference experiment.

A two-dimensional micromechanical model was developed to simulate the ballast behavior. Ballast is modeled as a two-dimensional assembly of convex polygonal grains. Each grain is assumed to be a rigid body but grains can overlap slightly with each other at contact points. Overlapping is understood as a deformation at the contact. The contact force acting between the grains is explicitly defined using this deformation, also taking into account the effect of friction. Thus, forces acting on each grain due to contacts or other actions such as gravity can be calculated. In computer code, the motion equations for each grain can be solved, thus determining the system evolution. This approach is commonly known as Molecular Dynamic. The micromechanical model was implemented in a DE software and was successfully used to solve Civil Engineering problems such as biaxial tests [START_REF] Oviedo | Etude du comportement du ballast par un modèle micromécanique -Application aux opérations de maintenance de la voie ferrée ballastée[END_REF].

An experimental set-up at a reduced scale (1/3) was carried out in laboratory: in a rigid case, ballast, a portion of sleeper are pilled (see figure 1). This device reproduces the action of tamping on ballast. In this experiment, two types of loading are applied: vibrations of a the tamper (one of the main tamping parameters) and a tightening force applied by continuous displacement of the case (see figure 1). These loading are applied separately (which is different of real tamping) for a better control of the experiment. Other operations such as the tamper going down into ballast are not reproduced in this experiment. Ballast behavior under the sleeper is observed and one measures the settlement of ballast under the sleeper as well as the force applied during the test. We can notice that this reduced scale experiment imposes the respect of law of similarities in acceleration. Experimental studies make it possible to define tamping quality standards, which are: the quality of the contact between the sleeper lower surface and ballast. The surface of contact must be continuous and regular to get a maximum surface of contact thus making it possible to better distribute the efforts.

The sample density under the sleeper. Ballast have to be compacted enough. These two criteria were checked during the experiments in order to determine the set of parameters that would lead to an optimal tamping over time.

In these experiments, we highlight the frequency influence. Three different behaviors were observed depending on the frequency. The curve (figure 2) gives the tightening force versus the test duration (for a better intelligibility, curves are shifted in time). We observe:

a stiff behavior at low frequencies: the grains motion is mainly due to the tightening loading effect, and movement is done by jolt. Vibrations effect are localized around the tamper and not very significant. The surface of contact between the sleeper and ballast is not homogeneous and the sample is not very densified. a liquid behavior at high frequencies: vibrations effects are very significant, ballast opposes therefore little resistance to the tightening loading. Grains undergo great displacements. The surface of contact between ballast and sleeper is relatively homogeneous but the sample is slightly compacted. a viscous behavior at intermediate frequency: for this range of frequencies, vibrations and tightening force have the same importance. Vibrations are sufficiently significant to allow the tamper penetration during tamping. The surface of contact is homogeneous and the sample is better densified than in the other tests. Reference experiments conditions were used to carry out numerical simulations. Simulations make it possible to observe more finely the grain behaviors under vibrations such as convection phenomenon or the formation of vaults (for low frequencies). As in experiments, three different behaviors can be observed according to range of frequencies. This gives a good 0 0,5 An original reference experiment has been developed. We identify that intermediate frequencies give the best quality of tamping according to the two quality standards defined above. Simulations are in good qualitative agreement with experimental results and allow a finer observation of the phenomenon. This shows the relevance of such an approach and establishes the basis of the comprehension of ballast behavior under vibrations

-APPLICATION TO THE PROBLEM OF DEGRADATION OF THE TRACK

A new study has begun using the same principle to study mechanisms that lead to the degradation of the ballast layer. The grains rearrangement are studied, when a great number of cycles of quasi-static loading is applied on a model system, much simpler than real track. In this study, the grains wearing (attrition and damage of points) is not studied. This work is undertaken in collaboration with University of Montpellier and LCPC.

A reference experiment is developed at reduced scale and uses a two-dimensional material: thus, a better quantitative agreement can be expected with two-dimensional numerical simulations. The device is developed on the principle of Schneebeli materials that are often used in Civil Engineering to model the ground. These materials generally consisted on an assembly of piled up circular rolls. The experiment originality is the use of rolls of pentagonal section (with three different sizes) to model ballast grains. Rolls are made in cement with sufficient resistance, thus rolls are not damaged during tests. Grains are piled in a case so as to leave free edges as for a transverse section of track. A concrete sleeper is put on rolls. A layer of elastomer is laid on the case bottom to model the under-ballast layer. Cycles of vertical and lateral loading are applied to the sleeper until reaching the structure collapse. This device is currently in construction (see figure 4). For numerical simulations, a two-dimensional DE sofware, Contact Dynamics, developed at University of Montpellier with grains of polygonal form, is used. Contrary as Molecular Dynamic, there is no overlap at the contact points: grains are perfectly rigid. Contact is modeled using an unilateral contact law with dry Coulomb friction. To solve the unilateral constraint problem, efficient numerical methods were developed that use a time increment much larger than in Molecular Dynamics method [START_REF] Moreau | Numerical dynamics of granular materials[END_REF]. Indeed, the main difficulty in these simulations is to carry out a great number of loading cycles: the calculation cost is then important. Another difficulty is to determine the influence of small disturbances (due to error of modeling or errors numerical) on cycles of loading: if these disturbances are negligible for one loading cycle, it is not necessary the same for a thousand of loading cycles. This study is a preliminary work necessary to determine if DE methods can be applied to calculate evolution of a model granular medium on a great number of loading cycles. It should be then possible to study more complex systems as real track.

CONCLUSION

The studies undertaken showed the relevance of both a numerical and experimental approach using DE methods and reference tests. One in the long term wishes to develop tools, validated on experiments, to understand the mechanisms of ballast. The potential applications are numerous in railway problems as well as in Civil Engineering.

Other studies are also undertaken at SNCF using a continuous approach. In future, we expect to use both DE and FE methods to model infrastructure. BIBLIOGRAPHY

Figure 1 :

 1 Figure 1 : (a) View of the tamping experimental set-up -(b) Rigid case with ballast, a portion of sleeper and a tamper.

Figure 2 :

 2 Figure 2 : Tightening force versus the test duration for different ranges of frequencies.

Figure 3 :

 3 Figure 3 : Numerical simulation of tamping using Molecular Dynamic.

Figure 4 :

 4 Figure 4 : Reference experiment with pentagonal rolls. A quasi-static vertical and transversal loading is applied until the collapse of the structure.

Figure 5 :

 5 Figure 5 : Construction of the numerical sample using Contact Dynamics.

  agreement with experiments results: the DE software developed is twodimensional and experiments are carried out with real grains, comparisons are then limited to qualitative criteria.

		t=0.13					t=0.4					t=1.06	t=1.46
	Fs (kN)	5
	4,5										n34
		4 t=1.73					t=2					t=2.26	t=2.53	n37 n39
	3,5										n18
		3										n9
	2,5										n25
		2										n64 n55
	1,5										n59
		1										n41
												n46
		0	1	2	3	4	5	6	7	8	9	10 11 12 13 14 15 16 temps (s)
		low frequencies			intermediate frequencies	high frequencies
		t=2.8					t=3.06					t=3.33	t=3.6

qualitative


Antoine Chevreuil

Philippe Loubaton

Gaspard Monge

On the detection of low rank matrices in the high-dimensional regime

Keywords: statistical detection tests, large random matrices, large deviation principle

We address the detection of a low rank n×n matrix X0 from the noisy observation X0+Z when n → ∞, where Z is a complex Gaussian random matrix with independent identically distributed Nc(0, 1 n ) entries. Thanks to large random matrix theory results, it is now well-known that if the largest singular value λ1(X0) of X0 verifies λ1(X0) > 1, then it is possible to exhibit consistent tests. In this contribution, we prove a contrario that under the condition λ1(X0) < 1, there are no consistent tests. Our proof is inspired by previous works devoted to the case of rank 1 matrices X0.

I. INTRODUCTION

The problem of testing whether an observed n 1 × n 2 matrix Y is either a zero-mean independent identically distributed Gaussian random matrix Z with variance 1 n2 , or X 0 + Z for some low rank deterministic matrix X 0 , called also a spike, is a fundamental problem arising in numerous applications such as the detection of low-rank multivariate signals or the Gaussian hidden clique problem. When the two dimensions n 1 , n 2 converge towards ∞ in such a way that n 1 /n 2 → c > 0 (the rank of X 0 remaining fixed), known results on the so-called additive spiked large random matrix models have enabled to re-consider this fundamental detection problem (see e.g. [START_REF] Nadakuditi | Sample eigenvalue based detection of high-dimensional signals in white noise using relatively few samples[END_REF], [START_REF] Bianchi | Performance of statistical tests for single source detection using random matrix theory[END_REF], [START_REF] Benaych | The singular values and vectors of low rank perturbations of large rectangular random matrices[END_REF]). It was established a long time ago (see e.g. [START_REF] Bai | Spectral Analysis of Large Dimensional Random Matrices[END_REF] and the references therein) that in the above asymptotic regime, the largest singular value λ 1 (Z) of Z converges almost surely towards 1 + √ c. More recently, under mild technical extra assumptions, [START_REF] Benaych | The singular values and vectors of low rank perturbations of large rectangular random matrices[END_REF] proved that λ 1 (X 0 + Z) still converges towards 1 + √ c if λ 1 (X 0 ) converges towards a limit strictly less than c 1/4 . On the contrary, if the limit of λ 1 (X 0 ) is strictly greater than c 1/4 , then λ 1 (X 0 + Z) converges towards a limit strictly greater than 1 + √ c. This result implies that the Generalized Likelihood Ratio Test (GLRT) is consistent (i.e. both the probability of false alarm and the probability of missed detection converge towards 0 in the above asymptotic regime) if and only if λ 1 (X 0 ) is above the threshold c 1/4 . In order to simplify the exposition, we assume from now on that n 1 = n 2 = n, so that ratio c reduces to 1.

While the detection problem was extensively addressed in the zone λ 1 (X 0 ) > 1, the case where λ 1 (X 0 ) < 1 was much less studied. Montanari et al. [START_REF] Montanari | On the limitation of spectral methods: from the gaussian hidden clique problem to rank one perturbations of gaussian tensors[END_REF] consider the zone λ 1 (X 0 ) < 1 when X 0 is a rank 1 matrix. Thanks to information geometry tools, [START_REF] Montanari | On the limitation of spectral methods: from the gaussian hidden clique problem to rank one perturbations of gaussian tensors[END_REF] prove that, in this region, it is impossible to find a consistent test for the detection of the spike. Irrespective of the standard random matrix tools, this approach is extended in [START_REF] Montanari | On the limitation of spectral methods: from the gaussian hidden clique problem to rank one perturbations of gaussian tensors[END_REF] to the more general case when X 0 and Z are tensors of order d ≥ 3; namely, if the Frobenius norm of the tensor X 0 is stricly less than a threshold depending in d, then the probability distributions of the observation under the two hypotheses are asymptotically undistinguishable, so that any detection test cannot behave better than a random guess. This property, which is stronger than the non-existence of a consistent test, does not hold in the matrix case d = 2: see for instance [START_REF] Onatski | Asymptotic power of sphericity tests for high-dimensional data[END_REF] where a nonconsistent test is exhibited that has a better performance than a random guess. When the spike follows a probabilistic model, the replica method gives an information-theoretic threshold for the estimation problem: see [START_REF] Lelarge | Fundamental limits of symmetric lowrank matrix estimation[END_REF] and the references therein. A connection with spectral methods is provided in section 2.3 of [START_REF] Lelarge | Fundamental limits of symmetric lowrank matrix estimation[END_REF]. In this paper, we focus on the case where X 0 has general rank r. Our contribution is to prove that under λ 1 (X 0 ) < 1, the consistent detection is impossible. While this theoretical result is not unexpected, we believe that it provides a better understanding of the above fundamental detection problem in large dimensions without resorting to the machinery of large random matrices.

II. MODEL, NOTATION, ASUMPTION

The set of complex-valued matrices C n×n is a complex vector-space endowed with the standard scalar product X, Y = Tr(XY * ) and the Frobenius norm X F = X, X . The spectral norm of a matrix X is denoted by X 2 . The spike ("the signal") is assumed to be a matrix of fixed rank r and hence admits a SVD such as

X 0 = r j=1 λ j u j v * j = UΛV * (1)
where λ j = λ j (X 0 ) are the singular values of X 0 sorted in descending order and where Λ is the diagonal matrix gathering the (λ j ) j=1,...,r in the descending order. As X 0 has to be defined for any n, we impose a non-erratic behavior of X 0 , namely that all its singular values (λ j ) j=1,...,r do not depend on n for n large enough. This hypothesis could be replaced by the condition that (λ j ) j=1,...,r all converge towards a finite limit at an ad'hoc rate. However, this would introduce purely technical difficulties.

The noise matrix Z is assumed to have i.i.d. entries distributed as N c (0, 1/n). We consider the alternative H 0 : Y = Z versus H 1 : Y = X 0 + Z. We denote by p 1,n (y) the probability probability density of Y under H 1 and p 0,n (y) the density of Y under H 0 . L(Y) = p1,n(Y) p0,n(Y) is the likelihood ratio and we denote by E 0 the expectation under H 0 . We now recall the fundamental information geometry results used in [START_REF] Montanari | On the limitation of spectral methods: from the gaussian hidden clique problem to rank one perturbations of gaussian tensors[END_REF] in order to address the detection problem.The following property is well known (see also [START_REF] Banks | Informationtheoretic bounds and phase transitions in clustering, sparse PCA, and submatrix localization[END_REF] section 3): if E 0 L(Y) 2 is bounded, then no consistent detection test exists. We however mention that this is a sufficient conditions: E 0 L(Y) 2 unbounded does not imply the existence of consistent tests.

III. EXPRESSION OF THE SECOND-ORDER MOMENT.

The density of Z, seen as a collection of n 2 complex-valued random variables, is p 0,n (z) = n π n 2 exp -n z 2 F . On the one hand, we notice that the study of the second-order moment of the likelihood ratio is not suited to the deterministic model of the spike as presented previously. Indeed, in this case E 0 L(Y) 2 has the simple expression exp 2n X 0 2 F and always diverges. On the other hand, the noise matrix shows an invariance property: if Θ 1 , Θ 2 are unitary n × n matrices , then the density of Θ 1 ZΘ 2 equals this of Z. We hence modify the data according to the procedure: we pick two independent unitary Θ 1 , Θ 2 according to the Haar measure (which corresponds to the uniform distribution on the set of all unitary n × n matrices), and change the data tensor Y according to Θ 1 YΘ 2 . As said above, this does not affect the distribution of the noise, but this amounts to assume a certain prior on the spike. Indeed, this amounts to replace u i by Θ 1 u i and v i by Θ * 2 v i . In the following, the data and the noise tensors after this procedure are still denoted respectively by Y and Z.

We are now in position to give a closed-form expression of the second-order moment of L(Y) . We have

p 1,n (Y) = E X [p 0,n (Y -X)
] where E X is the mathematical expectation over the prior distribution of the spike, or equivalently over the Haar matrices

Θ 1 , Θ 2 . It holds that E 0 L(Y) 2 = E [exp (2nR X, X )]
where the expectation is over independent copies X, X of the spike (R stands for the real part); X and X being respectively associated with

(Θ 1 , Θ 2 ) and (Θ 1 , Θ 2 ), E 0 L(Y) 2 has the expression E exp 2nRTr Θ 1 X 0 Θ 2 Θ 2 * X * 0 Θ 1 * .
As Θ k and Θ k are Haar and independent, then

(Θ 1 ) * Θ 1 and Θ 2 (Θ 2 )
* are also independent, Haar distributed and it holds

E 0 L(Y) 2 = E [exp (2nη)] , (2)
where the expectation is over the independent Haar matrices Θ 1 , Θ 2 and η = RTr (Θ 1 X 0 Θ 2 X * 0 ). The ultimate simplification comes from the decomposition (1) which implies that

η = RTr (ΛΨ 1 ΛΨ 2 ) (3)
where

Ψ 1 = U * Θ 1 U and Ψ 2 = V * Θ 2 V. It is clear that Ψ 1
and Ψ 2 are independent matrices that are both distributed as the upper r × r diagonal block of a Haar unitary matrix.

IV. RESULT

The main result of our contribution is the following

Theorem 1. If λ 1 (X 0 ) < 1 then lim sup E 0 L(Y) 2 ≤ 1 1 -λ 1 (X 0 ) 4 r 2
and it is not possible to find a consistent test.

We remind that we are looking for a condition on X 0 (due to [START_REF] Bai | Spectral Analysis of Large Dimensional Random Matrices[END_REF][START_REF] Banks | Informationtheoretic bounds and phase transitions in clustering, sparse PCA, and submatrix localization[END_REF], this is a condition on Λ) under which E [exp (2nη)] is bounded. Evidently, the divergence may occur only when η > 0. We hence consider

E 1 = E [exp (2nη) I η> ] and E 2 = E [exp (2nη) I η≤ ],
and prove that, for a certain small enough > 0 to be specified later, E 1 = o(1) and that E 2 is bounded.

V. THE E 1 TERM: COMPUTATION OF THE GRF OF η.

It is clear that the boundedness of the integral E 1 is achieved when η rarely deviates from 0. As remarked in [START_REF] Montanari | On the limitation of spectral methods: from the gaussian hidden clique problem to rank one perturbations of gaussian tensors[END_REF], the natural machinery to consider is this of the Large Deviation Principle (LDP). In essence, if η follows the LDP with rate n, there can be found a certain non-negative function called Good Rate Function (GRF) I η such that for any Borel set A of R, 1 n log P (η ∈ A) converges towards sup x∈A -I η (x). The existence of a GRF allows one to analyze the asymptotic behaviour of the integral E 1 . In the next section, we thus justify that η follows a Large Deviation Principle with rate n, and we compute the associated GRF.

A. Computation of the GRF of η

Eq. ( 3) and the Cauchy-Schwarz inequality imply that the random variable η is bounded: |η| ≤ η max with η max = r j=1 λ 2 j . We first recall that for i = 1, 2, the random matrix Ψ i follows a LDP with rate n and that its GRF at the parameter [START_REF] Gamboa | Operator-valued spectral measures and large deviations[END_REF]). Besides, η is a function of the i.i.d. matrices (Ψ i ) i=1,2 and therefore, the contraction principle applies to η (see Theorem 4.2.1 in [START_REF] Dembo | Large Deviations Techniques and Applications[END_REF]): it ensures that η follows a LDP with rate n and its GRF is such that, for each real |x| ≤ η max , -I η (x) is the solution of the following optimization problem:

ψ ∈ C r×r , ψ 2 ≤ 1, is log det (I r -ψ * ψ) (see Theorem 3-6 in
Problem 2. Maximize in C r×r log det (I -ψ * 1 ψ 1 ) + log det (I -ψ * 2 ψ 2 ) . (4)
under the constraints

RTr (Λψ 1 Λψ 2 ) = x (5) ψ i 2 ≤ 1, i = 1, 2 (6)
We provide a closed-form solution of Problem 2. In this respect, we define for each k = 1, . . . , r the interval I k defined by ∀k = 1, ..., r -1 :

I k =] k i=1 λ 2 i -λ 2 k , k+1 i=1 λ 2 i -λ 2 k+1 ] (7)
and

I r =] r i=1 λ 2 i -λ 2 k , η max ].
It is easy to check that (I k ) k=1,...,r are disjoint and that ∪ r k=1 I k =]0, η max ]. The following result holds: Theorem 3. The maximum of Problem 2 is given by

-I η (x) = 2 r k=1 log   k i=1 λ 2 i -|x| k k 1 Π k i=1 λ 2 i   I I k (|x|) (8)
It is easy to check that the function x → -I η (x) is continuous on ]0, η max [. The proof of Theorem 3 is provided in the Appendix.

We illustrate Theorem 3 through the following experiment. The rank of the spike is fixed to r = 3 and the singular values have been set to (λ 1 , λ 2 , λ 3 ) = (1 , 0.7 , 0.2). We have computed millions of random samples of the matrices (ψ 1 , ψ 2 ). Each pair is associated with a point (x, y) defined as x = RTr (Λψ 1 Λψ 2 ) and y = 2 i=1 log det (I -ψ * i ψ i ) . We obtain a cloud of points, the upper envelope of which is expected to be -I η (x). We have also plotted the graph of the function y = -I η (x). In addition, we mention that, in the more general context of tensors of order d, the second-order moment of L(Y) is still given by (2) but the random variable -call it η d -has a more complicated form than (3), see [START_REF] Chevreuil | On the non-detectability of spiked large random tensors[END_REF]; the asymptotics of the term E 1 can still be studied by evaluating the GRF of η d . This GRF is the solution of an optimization problem that, apparently, cannot be solved in closed form for d ≥ 3. In [START_REF] Chevreuil | On the non-detectability of spiked large random tensors[END_REF], an upper bound of the opposite of the true GRF is computed; this upper bound, valid for any d is given for d = 2 by log 1 -|x| ηmax . We thus also represent in Figure V-A this upper bound; clearly, it is not tight.

B. Computation of E 1

The Varadhan lemma (see Theorem 4.3.1 in [START_REF] Dembo | Large Deviations Techniques and Applications[END_REF]) states that

1 n log E [exp (2nη) I η> ] → sup x> (2x -I η (x)
) and hence the E 1 term converges towards 0 when sup x> (2x -I η (x)) < 0. Consider any of the intervals I k defined in [START_REF] Cover | Elements of Information Theory[END_REF]. The derivative of 2x-I η (x) for any x ∈ I k is 2-2k/(λ 2 1 +...+λ 2 k -x) : it is decreasing on I k and the limit in the left extremity of

I k , i.e. ( k-1 j=1 λ 2 j ) -(k -1)λ 2 k , is simply 2 1 -1 λ 2 k . If λ 1 (X 0 ) < 1, then for all the indices k, 1-1 λ 2 k < 0.
This shows that 2x -I η (x) is strictly decreasing on every I k . Hence, for every x ∈]0, η max ], we have 2x -I η (x) < 0 -I η (0) = 0. We have proved that E 1 = o(1).

G G * G -1/2
where the n × r matrix G has i.i.d. entries distributed as N C (0, 1) and G is the top r × r block of G. Obviously, E[ G * G] = nI. It is a standard result that a random variable distributed as a χ 2 (n) is concentrated around its mean. This can be easily extended to the matrix G * G: Lemma 4. For any 0 < δ < 1, there exists a constant c such that

P 1 n G * G -I 2 > δ ≤ c exp -n δ 2 2 .
We take G1 and G2 independent, distributed as G and consider the upper r × r blocks G 1 and G 2 of G1 and G2 . It follows that η has the same distribution as

2RTr ΛG 1 G * 1 G1 -1/2 ΛG 2 G * 2 G2 -1/2
. Take now any δ < 1. We may split the integral E 2 in two parts:

E exp (2nη) I {η≤ }∩B c 1 ∩B c 2 E 2 + E exp (2nη) I {η≤ }∩(B1∪B2) E 2 .
where we have defined the events B i =

1 n G * i Gi -I 2 > δ .
Thanks to the above concentration result, we have

E 2 ≤ exp(2n ) (P(B 1 ) + P(B 2 )) ≤ exp(2n )2c exp -nδ 2 /2
As it is always possible to choose δ and such that δ 2 -4 > 0 and δ < 1 it follows that E 2 = o(1).

Let us now inspect the term E 2 . Since we have, for i = 1, 2,

1 n G * i Gi -I 2 ≤ δ, then there exist ∆ i for i = 1, 2 such that G * i Gi -1/2 = 1 √ n (I + ∆ i )with ∆ i 2 ≤ δ/2. We hence have E 2 ≤ E [exp (2RTr (ΛG 1 (I + ∆ 1 ) ΛG 2 (I + ∆ 2 ))] .
We expand 2RTr (ΛG 1 (I + ∆ 1 ) ΛG 2 (I + ∆ 2 )) as the sum of four terms. Take for instance

T 2 = 2RTr (ΛG 1 ∆ 1 ΛG 2 )
Thanks to von Neumann's lemma [START_REF] Mirsky | A trace inequality of John von Neumann[END_REF], we have

T 2 ≤ 2 r k=1 λ k (∆ 1 )λ k (ΛG 2 ΛG 1 ) ≤ 2 ∆ 1 2 r k=1 λ k (ΛG 2 ΛG 1 ) As r k=1 λ k (ΛG 2 ΛG 1 ) ≤ √ r r k=1 λ 2 k (ΛG 2 ΛG 1 ), it yields T 2 ≤ 2 ∆ 1 2 √ r Tr (ΛG 2 ΛG 1 G * 1 ΛG * 2 Λ).
Invoking the von Neumann's lemma three times, it holds that

T 2 ≤ 2 ∆ 1 2 √ r Λ 2 2 Tr (G 1 G * 1 ) Tr (G 2 G * 2 ) ≤ √ r ∆ 1 2 Λ 2 2 (Tr (G 1 G * 1 ) + Tr (G 2 G * 2
)) Similar manipulations can be done on the other terms of the expansion. so that E 2 is less than

E [exp (2RTr (ΛG 1 ΛG 2 ) + βTr ((G 1 G * 1 ) + Tr (G 2 G * 2 )))] with β = √ r 2 δ(2 + δ) Λ 2 2 .
The above expectation is to be understood as the expectation over (G 1 , G 2 ). As G 1 and G 2 are independent, we consider first the expectation over G 1 . This gives, up to the factor exp (βTr (G 2 G * 2 ))

π -r 2 exp (2RTr (g 1 E) + (β -1) Tr (g * 1 g 1 ) ) dg 1 with E = ΛG 2 Λ.
It is always possible to choose δ such that β < 1. With such a β, the above integral is

(1 -β) -r 2 exp 1 4 2 √ 1 -β 2 Tr (EE * ) As Tr (EE * ) ≤ Λ 4 2 Tr (G 2 G * 2 )
we finally obtain after multiplying by exp (βTr (G 2 G * 2 )) and taking the expectation over G 2 , E 2 is less or equal to

(1 -β) -r 2 π r 2 exp - (1 -β) 2 -Λ 4 2 1 -β Tr (g * 2 g 2 ) dg 2 .
If Λ 2 2 < 1, it is always possible to adjust δ such that the above integral converges. In this condition, we have

E 2 ≤ 1 (1 -β) 2 -Λ 4 2 r 2 .
This must be true for all β arbitrarily small, hence the result.

APPENDIX

We prove Theorem 3 when x > 0. As the function to be maximized converges towards -∞ if ψ 1 → 1 or ψ 2 → 1, any argument (ψ 1 , ψ 2 ) of the maximization problem satisfies ψ i < 1, i = 1, 2. Therefore, the Karush-Kuhn-Tucker (KKT) conditions imply the existence of a scalar Lagrange multiplier µ ≥ 0 such that (ψ 1 , ψ 2 ) is a stationary point of the Lagrangian (ψ 1 , ψ 2 , µ) defined by

2 i=1 log det (I r -ψ * i ψ i ) + µ RTr (Λψ 1 Λψ 2 ) .
As is a real valued function, a stationary point is computed when setting the differential w.r.t. the entries of ψ 1 and ψ 2 to zero. It can be checked that (ψ 1 , ψ 2 ) is a stationary point of when

µ Λψ 2 Λ = ψ * 1 (I -ψ 1 ψ * 1 ) -1 µ Λψ 1 Λ = ψ * 2 (I -ψ 2 ψ * 2 ) -1
In a first step, these equations can be shown to be satisfied only if ψ 1 and ψ 2 are diagonal up to permutations of the columns. Then, is can be deduced that there exists a diagonal matrix 0 ≤ P ≤ I and a matrix of permutation Π such that log det (I r -ψ * 1 ψ 1 ) + log det (I r -ψ * 2 ψ 2 ) = 2 log det(I -P)and RTr (Λψ 1 Λψ 2 ) = Tr(ΛΠ * ΛΠ P). This invites us to consider the following Problem 5. Maximize log det(I -P)

jointly over all the r! permutations Π and over diagonal matrices P verifying 0 ≤ P ≤ I and the constraint

Tr(ΛΠ * ΛΠ P) = x. (10)
In a first step, we set Π = I in the above problem and consider the Problem 6. Maximize

r i=1 log(1 -p i ) (11)
under the constraints that 0 ≤ p i ≤ 1 for each i = 1, . . . , r and r i=1

λ 2 i p i = x. ( 12
)
The maximum is denoted by

J Λ (x).
This is a variant of the celebrated water-filling problem (see e.g. [START_REF] Witsenhausen | A determinant maximization problem occuring in the theory of data communications[END_REF] and Chap. 9 of [START_REF] Cover | Elements of Information Theory[END_REF]) that was solved to evaluate the capacity of a frequency selective Gaussian channel, the difference being that in the latter problem, log(1-p i ) is replaced by log(1 + p i ). In order to solve Problem 6, we assume that the non zero singular values (λ i ) i=1,...,r are distinct. If this is not the case, a standard perturbation argument can be used in order to address the general case. As the function to be maximized is strictly concave on the set defined by the constraints, the maximum is reached at a unique point p * verifying p i, * < 1 for each i. We consider the Lagrangian corresponding to Problem [START_REF] Chevreuil | On the non-detectability of spiked large random tensors[END_REF] given by r i=1 log(1

-p i ) + µ r i=1 λ 2 i p i + r i=1 δ i p i
where µ ≥ 0 and δ i ≥ 0 for i = 1, . . . , r. The partial derivatives w.r.t. parameters (p i ) i=1,...,r are zero at p * . This leads to for i = 1, . . . , r :

1 1 -p i, * = µ * λ 2 i + δ i, * (13)
The first remark is that necessarily, these equations imply that the numbers p i, * are sorted in decreasing order. To verify this claim, we assume that i < j and that p i, * = 0 and p j, * > 0.

Then, it holds that µ * λ 2 i +δ i, * = 1 and that µ * λ 2 j = 1 1-pj, * > 1 because p j, * > 0 implies δ j, * = 0. Therefore, λ 2 i ≤ 1 µ * < λ 2 j , a contradiction because λ 2 i ≥ λ 2 j . We denote by s(x) the number of non-zero entries of p * . Hence, the first s(x) entries of p * are non zero. Morever, the equations µ * λ 2 i = 1 1-pi, * for i = 1, . . . , s(x) imply that p 1, * ≥ . . . ≥ p s(x), * > 0 = p s(x)+1, * = . . . = p r, * .

We now analytically characterize s(x). On the one hand, (13) computed at for i = s(x) and for i = s(x) + 1 both imply

λ 2 s(x)+1 ≤ 1 µ * < λ 2 s(x) (14)
On the other hand, the constraint (12) imposes that 1/µ * verifies

1 µ * = s(x) i=1 λ 2 i -x s(x)
.

Therefore, it holds that

( s(x) i=1 λ 2 i ) -s(x)λ 2 s(x) < x ≤ ( s(x) i=1 λ 2 i ) -s(x)λ 2 s(x)+1 (15)
such that s(x) coincides with the integer k for which x ∈ I k (see [START_REF] Cover | Elements of Information Theory[END_REF] for the definition of these intervals). The maximum s(x) i=1 log(1 -p i, * ) is direcly computed as

J Λ (x) = log   s(x) i=1 λ 2 i -x s(x) s(x) 1 Π s(x) i=1 λ 2 i   (16)
In order to show that the GRF of η is I η (x) = -2J Λ (x), it remains to show that the solution of Problem 5 is reached when the permutation matrix Π is the identity. In this respect, we introduce a nested problem motivated by the following observation. We denote by α and β the r-dimensional vectors whose components are respectively the diagonal entries of Λ 2 and of ΛΠ * ΛΠ arranged in the decreasing order. Evidently, α majorizes β in the sense that for k = 1, . . . , r :

k i=1 α i ≥ k i=1 β i (17)
We thus consider the relaxed problem

β i p i = x (18)
The maximum of Problem 7 is above the maximum of Problem 5 which is itself above the maximum J Λ (x) of Problem 6. We actually show that the maximum of Problem 7 is less than J Λ (x), and that it is reached for a vector β that coincides with α. This will imply that the optimal permutation Π in Problem 5 is I and I η (x) = -2J Λ (x).

We give some elements for solving Problem 7. We consider a stationary point (p * , β * ) of the associated Lagrangian and compute the KKT conditions. We suppose that this stationary point attains the maximum. If s denotes the number of nonzero components in p * , we prove that, necessarily, p 1, * ≥ p 2, * ≥ ... ≥ p s, * > 0 and β 1, * ≥ β 2, * ≥ ... ≥ β s, * . We let j 1 be the first index such that j1 i=1 α i > j1 i=1 β i (this index exists otherwise β * = α and the problem is solved). This implies that β i, * = α i for all indices i = 1, ..., j 1 -1. Notice this fact: if we suppose that the condition j1+k i=1 α i > j+k i=1 β i is true whatever k, then it is possible to add a small > 0, and update β j1, * as β j1, * + in such a way that the majorization constraints still hold, the constraint (18) holds and the updated p * increases the function to maximize. This is in contradiction with the definition of (p * , β * ). This means that there exists an index j 2 (we choose the smallest) such that j1+j2 i=1 α i = j1+j2 i=1 β i, * . It can be shown that it is necessary that all the β i, * are equal for i = j 1 , ..., j 1 + j 2 . After some algebraic gymnastics, it can be shown that it in this case, all the inequalities (17) at β * are saturated hence implying that β * = α. The value of i log(1 -p i, * ) equals J Λ (x).

Fig. 1 .

 1 Fig.1. graph of -Iη(x) seen as an upper envelope. Upper curve: the upper bound computed in[START_REF] Chevreuil | On the non-detectability of spiked large random tensors[END_REF]

Problem 7 .

 7 Maximize log det(I -P) over the diagonal matrices 0 ≤ P ≤ I and over vectors β = (β 1 , ..., β r ) satisfying β 1 ≥ β 2 ≥ . . . β r ≥ 0, the majorization constraint (17), and the equality constraint r i=1


Maryline Laurent

Nesrine Kaaniche

Christian Le

Mathieu Vander Plaetse

A blockchain-based access control scheme

Keywords: access control, data secrecy, blockchain, smart contract, Ethereum

come

INTRODUCTION

Data security and privacy are major challenges in the adoption of remote data storage applications, mainly due to the loss of data control [START_REF] Kaaniche | Data security and privacy preservation in cloud storage environments based on cryptographic mechanisms[END_REF], and thus the possibility for third-party data storage providers to get privacy-sensitive information about users and potentially leak confidential information about the content. Relying on cryptographic mechanisms at the client side is a good alternative to mitigate data secrecy concerns. However, the use of conventional encryption approaches is not sufficient to support the enforcement of fine-grained access control policies and flexible data sharing among dynamic groups of users. Thus, the challenge is to define a comprehensive access control mechanism for outsourced data while both ensuring data confidentiality and protecting users' privacy. This need for designing security mechanisms to ensure privacy-preserving access control schemes to outsourced data files is emphasized by the recent adoption of the new General Data Protection Regulation (GDPR), in 2016 (Regulation(EU), 2016) that will be enforced in every European member state in May 2018. The new key concepts behind the GDPR include the user consent that must be collected by a service provider before processing users' data, accountability which makes mandatory that any service providers prove data processing is compliant to former user's consent.

Recently, various accountable technical systems appeared, namely Bitcoin1 which enables users to transfer cryptocurrencies (i.e. bitcoins) securely with no need for a centralized authority, using a publicly verifiable open ledger, referred to as blockchain. Consequently, blockchain technologies are widely adopted for data accounting and auditing features, thanks to their main intrinsic properties, namely, tamper-proof infrastructure and availability.

In this paper, we propose a new blockchain-based access control scheme, in a data-owner centric manner. That is, access privileges are defined by the data owner, via access control lists associated with auditable smart contracts, and managed by the blockchain infrastructure that supports the authentication of requesting users.

Paper Organization -Section 2 introduces the necessary background about the blockchain technology, reviews blockchain related works for data protection and highlights the security and privacy requirements for designing a secure access control scheme. Section 3 presents our proposed blockchain-based access control mechanisms and details the different procedures. Section 4 provides a security and privacy discussion of the proposed access control scheme. Section 5 discusses the implementation of the defined algorithms, based on Ethereum blockchain environment. Section 6 concludes the paper.

BACKGROUND AND DESIGN REQUIREMENTS

In this section, we first introduce the blockchain technology (subsection 2.1). Then, we detail related work for data protection (subsection 2.2) and highlight the design and security requirements (subsection 2.3).

Blockchain Technology

Bitcoin appeared as an innovative technology enabling users to directly transfer cryptocurrencies in between with no intermediaries. It is considered as the first decentralized cryptocurrency transfer system. It relies on cryptographic proofs of work, digital signatures, and peer-to-peer networking to provide a distributed ledger containing transactions, and referred to as a blockchain [START_REF] Crosby | Blockchain technology: Beyond bitcoin[END_REF], [START_REF] Swan | Blockchain: Blueprint for a new economy[END_REF]. Two approaches, known as permissionless blockchains, have emerged to implement decentralized services and applications. The first approach relies on the existing Bitcoin blockchain and builds a new framework on top of it. The main advantage of this approach is that the Bitcoin blockchain already exists and is adopted by many users, which makes it more secure, transparent and resilient. The disadvantage is that blocks are mined every 10 minutes, and the Bitcoin scripting language is not Turingcomplete [START_REF] Swan | Blockchain: Blueprint for a new economy[END_REF]. The second approach is to build an alternative blockchain with all the desired features, which promises full decentralization, such as Ethereum2 . Additionally to functions already supported by other public blockchain platforms such as bitcoin, e.g. mining of the digital currencies and transaction management, Ethereum also provides a contract functionality known as smart contract.

Transactions submitted to the Ethereum environment are organized into blocks and chained to each other based on a cryptographic hash function, initially relying on a pre-computed genesis block. Once a block is added to the blockchain, it cannot be modified or removed for two reasons: first, a block modification would lead to wrong verification of the chain of hash values, and second, the block modification would require intensive efforts to change every replicate of the blockchain supposed to be hosted on a large number of independent nodes. The verification and addition of new blocks to the blockchain is based on the mining process, which relies on the proof of work feature. Indeed, miners have to solve a cryptographic challenge and winners are rewarded. The main idea behind the cryptographic challenge is the regulation of the new block creation operation.

Blockchain Related Work for Data Protection

The nature of the blockchain is particularly suitable for data accounting and auditing features. It has attracted interest of the research community due to its shared and fault-tolerance database. Indeed, several constructions have been introduced to ensure provenance tracking [START_REF] Fu | Npp: A new privacy-aware public auditing scheme for cloud data sharing with group users[END_REF], [START_REF] Ouaddah | Fairaccess: a new blockchain-based access control framework for the internet of things[END_REF], [START_REF] Zyskind | Decentralizing privacy: Using blockchain to protect personal data[END_REF], [START_REF] Kaaniche | A blockchain-based data usage auditing architecture with enhanced privacy and availability[END_REF].

In [START_REF] Zyskind | Decentralizing privacy: Using blockchain to protect personal data[END_REF], Zyskind et al. presented a personal data management system that combines blockchain, considered as an access control moderator, and off-blockchain storage solution. Designed as unique owners of their personal data, clients are aware of data collected about them by service providers and how they are used. However, the [START_REF] Zyskind | Decentralizing privacy: Using blockchain to protect personal data[END_REF] proposal permits to only define simple permit/deny access policies through a white/blacklisting. Afterwards, Ouaddah et al. proposed, in (Ouaddah et al., 2016), a blockchain based access control framework for IoT applications, referred to as FairAccess. Their proposal relies on the blockchain-based bitcoin technology as an access moderator that permits to distribute authorization tokens, where each authorization token represents the data owner signature of the granted access right. In [START_REF] Fu | Npp: A new privacy-aware public auditing scheme for cloud data sharing with group users[END_REF], Anmin et al. introduced a blockchain-based auditing system for shared data in cloud applications. In order to mitigate the power abuse of single tracing authorities, [START_REF] Fu | Npp: A new privacy-aware public auditing scheme for cloud data sharing with group users[END_REF] presents a threshold approach, where at least t entities have to collaborate to recover the identity of a malicious user, thus ensuring the nonframeability of users. Based on a blockchain architecture, the proposed construction enables group users to trace data changes and recover latest correct data blocks when current data are damaged.

Recently, Neisse et al. discussed design requirements of blockchain-based solutions for data provenance tracking [START_REF] Neisse | A blockchain-based approach for data accountability and provenance tracking[END_REF], namely clientcentric, server-centric and data-centric approaches. The authors also presented an evaluation of their implementation results, in order to give a comprehensive overview of different defined approaches. Later, in [START_REF] Kaaniche | A blockchain-based data usage auditing architecture with enhanced privacy and availability[END_REF], Kaaniche and Laurent presented a blockchain-based platform for data usage auditing while preserving personal data secrecy and ensuring data availability, relying on the use of the hierarchical ID-based cryptographic technique.

Security and Privacy Requirements

Our blockchain-based access control solution has to consider a set of security and functional properties, defined as follows:

• Authenticated access control -the proposed scheme has to ensure an efficient access control to outsourced data, where requesting entities are authenticated.

• Management efficiency -the proposed scheme should offer efficient management processes.

• Privacy through pseudonymity and unlinkability measures -entities' privacy is preserved thanks to the pseudonymity supported by the blockchain and the inability to directly link some data to an entity, or an access session to a requesting user identity. Privacy is strengthened with untraceability in case of one-time blockchain accounts, with one account used per system interaction.

• Auditability -each data owner should have a transparent view over how data are collected, accessed and processed.

A NEW BLOCKCHAIN-BASED ACCESS CONTROL SCHEME

In this section, we first give an overview of our proposed blockchain-based access control scheme in subsection 3.1. Then, we detail the different procedures in subsection 3.2.

Overview

Our proposed access control scheme relies on four different entities defined as follows:

• data storage provider (DSP)it has significant resources to govern distributed remote servers and to host application services. These services can be used by the data owner to manage his data stored in the remote servers. Note that the DSP is not an active client of the blockchain, thus having only read access and not write access to the blockchain.

• data owner (DO)a data owner makes use of data storage provider's resources to store and share data with multiple entities. He is responsible for defining a whitelist of authorized entities with respected access rights for a specific file stored on DSP. The whitelist is stored in a per file smart contract (C) into the blockchain.

• data retriever (DR)data retrievers are able to access the content stored in remote servers, depending on their access rights which are authorizations granted by the DO. As the DR is known as a blockchain client, the blockchain can participate in the authentication of DR with DSPs before granting access to outsourced data.

• blockchain infrastructure (BC)the blockchain is considered as an access control mediator, as it permits to authenticate DRs, to keep traces of each DR access to data and to preserve the access rights history of each DO.

The notations used in this paper are listed in Table 1. Our scheme aims at providing the DO with the capacity of defining the access rights for each of his data resource (file, directory, image...), and of dynamically deleting these rights when needed. Rights are expressed per DR and registered in a smart contract as a whitelist of authorized DRs with a detailed specific access control list. The interest is therefore multifold. First, no one can alter the list of authorized entities to access certain resources, as all blockchainspecific operations are considered as secure and noncorruptible, thus ensuring non-tamper proofs of data access activities. Second, our scheme relies on a data owner-centric model, as the data owner creates a contract for each outsourced data resource, including the access control list w.r.t. data usage. Third, the entire identification system and the robustness of the authentication process rely on BC properties. Indeed, DRs and DOs are known through their BC identifiers, which make them be uniquely identified. Fourth, any DR access is registered in BC, thus leading to later possible auditing activities to take place over the access control system. As such, the use of BC permits to publish a whitelist which remains under the control of the DO, to support efficient identification and authentication processes of DOs and DRs, and to enable auditing activities thanks to useful registered traces (whitelists, access requests). In a nutshell, DO is responsible for creating a smart contract in the BC, adding or removing an address from the whitelist. A DR trying to access the resources outsourced on a DSP has to go through the corresponding smart contract. He is authorized to access a resource based on the authentication protocol played between the DSP and DR with BC support, and the whitelist registered in the BC. Hence, interactions of entities with BC support the following rules:

• The DO is the only entity that might modify the whitelist, as he is the owner of the outsourced data. He must therefore be able to add or remove an authorized address, referring to a specific authorized DR, from this list. Note that the contract has to include the address of the DO, its creator, for assigning modification of right permissions.

• The DR is authorized to issue a transaction w.r.t. the contract to request access to resources. If the transaction is accepted by the BC, it means both that the DR is authenticated, and it is authorized to access the resources. Thus, a successful authentication leads to the smart contract registering into the blockchain the address of DR as a permitted entity. Note that our scheme assumes that the comparison process is performed by the hosting server. As a result, the contract must be passive when it receives users' transactions.

• Any entity including DSP, can read the content of the whitelist, for performing the addresses comparison, for every DR's access request.

Note that although the contract script becomes unchangeable after its deployment on BC, its state may vary. Indeed, variables are defined (i.e; DR' addresses in our case) so that they can be modified by the DO w.r.t. subsequent solicitations. That is, the whitelist can be modified, but the contract script cannot.

Procedures

Whitelist Creation Process

As stated above, each smart contract, created by a data owner, permits to list the addresses of authorized DRs to access a given data file, outsourced on a remote server. Hence, the question is about the definition of the relation between the smart contract (C) and the outsourced data file. For this purpose, we focus on the process of the smart contract creation by DO with the DSP. Note that our blockchain-based access control mechanism requires the deployment of a client interface, such that each DO can easily perform the whitelist creation process. The different steps, depicted by Figure 1, are as follows:

1. DO authenticates with DSP and shares the name of the data file, that he intends to protect, with DSP.

2. DO creates a smart contract. To do so, the DO sends a transaction to the null address. The address of the created contract is given randomly, using the client interface. The smart contract has also to record the whitelist in the BC, in order to keep the history of the whitelists, such that the DSP can retrieve the last valid one. 4. DO sends the address of the created contract to the authorized DRs. In fact, we emphasize that each authorized DR has to communicate the address of the contract, when he wants to access to the corresponding outsourced data file.

5. DO recovers the address of each authorized DR, to be included in the whitelist.

6. DO sets up the whitelist, by introducing the addresses of authorized DRs, via the client interface.

Note that it is also possible to remove an address from the whitelist using the same process used to add a newly authorized address. In fact, the contract is linked to the outsourced file thanks to its address stored in the DSP. A main advantage of our proposed solution is that the whitelist can be modified without any need to interact with the DSP. Indeed, only a hyperlink to the whitelist is stored on the DSP.

Resource Access Process

When an authorized DR wants to access to an outsourced data file, he starts the resource access process with the remote hosting DSP (cf. Fig. 2), as follows:

1. the DR sends an access request to the DSP, via an off-blockchain channel.

2. the DSP sends a randomly generated nonce to the requesting DR. Subsequently, the DSP starts listening to the blockchain by scanning the newly added transactions associated with the corresponding contract and analyzes transactions containing the given nonce. 3. the DR sends a transaction to the contract with the nonce as input data. Recall that the contract remains passive during this step, unlike for the solicitation issued by the DO. This transaction does not result in making the contract react, but instead it leaves a trace on the BC, and it proves the transaction is authentic.

4. Once the generated nonce has been identified by the DSP in the input data field of a transaction associated with the corresponding contract, the DSP selects the address of the entity that issued the transaction. Then, it compares the authorized addresses of the whitelist with the originating address of the transaction.

5. In the case where the originating address of the transaction corresponds to one of the authorized addresses, as defined in the whitelist, the DSP identifies the DR.

Finally, we have to emphasize the necessity of including a randomly generated nonce for each authentication session. That is, the nonce permits to prove the freshness of the transaction to the DSP. This latter makes the link between a received request and a successful authentication by the BC thanks to the generated nonce. Our access control application makes use of a public blockchain technology for decentralized authentication, ensuring data auditability and transparency requirements. In fact, although the list of authorized addresses is publicly verifiable, it is impossible to alter the whitelist, where the DO is the unique entity that can grant privileges to DRs.

SECURITY DISCUSSION

In this section, we first present our threat model. Then, we provide a security discussion of our proposed blockchain-based access control scheme, with respect to the security and privacy requirements detailed in section 2.3.

Threat Model

For designing a secure blokchain-based access control scheme, we consider that an attacker is able to read, send and drop a transaction addressed to the blockchain. The attacker targets data owners, data retrievers, data storage providers as well as the blockchain, as follows:

• based on previous data access requests sessions, as well as provided blockchain data, an attacker tries to impersonate a data owner to afford a honest data storage provider some rights to be logged into the blockchain without the legal data owner's granted privileges. This attack is considered with respect to the authenticated access control and auditability requirements.

• an attacker tries an attack against the privacy property w.r.t. both data owners, while trying to directly link a smart contract to a specific owner, and data retrievers while attempting to link an access session to a requesting entity.

• an attacker attempts to prevent the publication of a legitimate transaction in the blockchain. For example, an attacker may try a DoS attack against an access list modification activity or attempt a flooding attack on the blockchain with invalid information. This attack is considered against the auditability and the availability requirements.

Security And Privacy Analysis

AUTHENTICATED ACCESS CONTROL -our approach ensures an authenticated access control for several reasons here-below listed:

• blockchain-based authentication -our scheme relies on the blockchain infrastructure to enforce the authentication of the participating entities. That is, each entity has to include its blokchain-account address to either outsourcing (i.e; for DOs) or accessing (i.e; for DRs) requests.

• access lists' integrity -in our approach, access control lists are stored in the blockchain as well as on the remote hosting server. That is, as access lists are stored on all blockchain nodes, each entity has a copy of all smart contracts. Thus, in order to afford a honest data storage provider some rights to be logged into the blockchain without the legal data owner's granted privileges, the attacker has to corrupt all blockchain-hosting nodes to tamper access lists.

PRIVACY -The privacy property is ensured thanks to the following technical features:

• one smart contract per outsourced data resource -for each outsourced data resource to a remote server, the DO creates a new smart contract which points out the authorized DRs' addresses. Thus, it is impossible for an attacker to link a smart contract with its DO, mainly in case of one-time accounts, as emphasized in section 2.3.

• a per-access session nonce -for each access session, the remote server generates a random nonce that is used by the requesting DR in its access transaction w.r.t. the smart contract associated to the outsourced data resource, thus proving freshness, and pseudonymity ownership while not revealing the true identity.

AUDITABILITY -Our proposed access control scheme ensures the auditability requirement as:

• tamper-proof architecture -all blockchainspecific operations, such as transaction anchoring activities, are considered as secure and noncorruptible, thus ensuring non-tamper proofs of data access activities.

• transparent usage -our approach is based on a public blockchain infrastructure, that permits public access (i.e; read privilege) to the contract and its associated transactions, to anyone.

Remark 1. As a highly decentralized infrastructure, the blockchain technology helps also in terms of availability. It becomes possible to provide liveness guarantees of data usage. To prevent DOS attacks, our access control mechanism requires that both DSP and DR use a per-session nonce, randomly generated by the remote server, such that the DR has to include the freshly derived nonce in his access request transaction w.r.t. to a given smart contract.

IMPLEMENTATION

In this section, we detail the implementation of our proposed blockchain-based access control scheme, based on the Ethereum environment, w.r.t. the smart creation process (cf. Section 5.1), installation scripts of the blockchain (cf. Section 5.2) and the client interface development (cf. Section 5.3).

For the implementation of our access control scheme, we first point out three different softwares, namely the client software for the DO, the client software for the DR and the DSP software. Then, we define the structure of the smart contract that will contain the whitelist, and its instantiating BC script.

Smart Contract Creation

To implement our smart contract, we are solidity language3 which is a specific Ethereum programming language. We note that there exist several programming languages for smart contract creation, but solidity is a high-level language that perfectly matches our design requirements. To be interpretable by the Ethereum blockchain, the smart contract has to be compiled into bytecodes. For this purpose, we used a compiler called browser-solidity. It is a compiler with a web interface. Hereafter, we detail the code of each created smart contract. First, we define the attributes of our contract, namely owner and whitelist. Then, we define a set of functions, namely the whitelist and get whitelist functions for creating the whitelist and the add(address a) and remove(address a) for adding and removing DR addresses respectively.

owner is an address that maps the address of the entity instantiating the contract and whitelist is an array that is used to store addresses of authorized DRs.

address public owner; address[] whitelist;

The whitelist () function refers to the constructor. We assign the owner attribute to the msg.sender address, such that DO is the unique entity that can get use of the defined constructor. The add (address a) function permits to add a new address to the whitelist. In the following, we detail the different execution of this function. First, a checking line code is added to verify if the entity (msg.sender) trying to modify the existing whitelist is the owner of the contract (owner).

if(msg.sender==owner){

Then, to save storage capacities and avoid redundancy and inconsistency, the add (address a) function verifies whether the new address is not already present in the list. This is particularly important for the deletion step, ensuring that a given address is presented only once at the same whitelist. Similarly, the remove (address a) function first checks whether the requesting entity is the allowed DO (msg.sender). Then, it points out the corresponding address to proceed for its deletion. For adding a new smart contract in the blockchain, several javascript commands from the geth console (i.e; blockchain interface) are defined. The browser-solidity compiler provides a script, generated with bytecode to allow easy integration of smart contracts such as:

var whitelistcontract = web3.eth.contract([{"constant":false,"inputs":[ {"name":"a","type":"address"}],"name":"add", "outputs":[],"payable":false,"type":"function"} ,{"constant":true,"inputs":[],"name":"owner", "outputs":[{"name":"","type":"address"}],"payab le":false,"type":"function"},{"constant":true, "inputs":[],"name":"get_whitelist","outputs": [{"name":"","type":"address[]"}],"payable":fals e,"type":"function"},{"inputs":[],"payable":fal se,"type":"constructor"}]);

Notice that the script creates a variable "whitelistcontract" needed to define the interface of the smart contract such that the web3.eth.contract (...) function takes as input the contract ABI (i.e; Application Binary Interface) corresponding to the signature of all the defined contract functions.

To generate a new contract, the variable "whitelistcontract" receives a contract instantiation, such that:

var whitelist = whitelistcontract.new({

The whitelistcontract.new (...) function takes as input the creator of the instance and the bytecode of contract. It also takes a callback function that displays the address of the contract. Indeed, it is this address that has to be provided to any entity for interacting with the newly created contract. In addition, we added to this script generated by the compiler a function, called search(end), defined as follows: The search(end) function returns the address of the contract to the authorized requesting entity ( "owner").

Installation scripts of the blockchain

Several scripts have been implemented to enable interaction between the blockchain and the created contract. The first script is designed for the DO that needs to protect his outsourced data resources. This script permits to create a whitelist associated with each data file, add and delete addresses as well as save the corresponding whitelist. These functions are accessible through a user-friendly interface, detailed in subsection 5.3, to ease the manipulation of our access control scheme in real-world applications. In addition to these scripts, we defined and implemented a set configuration scripts that allow to deploy and test the consistency of the proposed construction. First, a script is launched to enable connection with the BC:

#!/bin/bash isLaunched=$(ps aux | grep datadir=$1 | head -1)
Consequently, the script checks whether an instance of geth was launched with the corresponding node number. If there is no instance, a new instance has to be created specifying the listening ports to communicate with other nodes. To communicate with the main node, its exact address, referred to as enode, is then required as follows:

if [[ ! $isLaunched =˜geth ]] ; then geth --datadir="$1" -verbosity 6 --ipcdisable --port 303$1 --nodiscover --rpcport 81$1 console 2>> $1.log else geth --datadir="$1" --port 303$1 --nodiscover --rpcport 81$1 attach ipc://$PWD/$1/geth.ipc fi

Similarly to the connection process, the specified options for the creation of a new nodes include the specification of listening ports for our nodes. That is, the init command allows create a node, and "genesis.json" is a file that describes the first block in the chain. In particular, for our implementation, we defined the difficulty for mining, and put it relatively low to speed up operations on our blockchain.

geth --datadir="$1" -verbosity 6 --ipcdisable --port 303$1 --nodiscover --rpcport 81$1 init genesis.json 2>> $1.log Afterwards, we create an account, accessible by "eth.coinbase". This account permits to the created node to perform BC transactions. To do so, we define a default password "test", and send the command to geth using the "connect.sh" script. Subsequently, we recover the enode of the created node to be stored as a result in the "enodes.txt" file. Thanks this script, a new blockchain is created, a base-account is derived and the enode (i.e; identifier) is stored on a text file. Using the same genesis block, multiple nodes, able to cooperatively perform tasks on the same BC, can be created. Finally, a python 4 script is defined, to re-cover the saved enodes in the "enodes.txt" file, and generate an addEnode.js javascript 5 file that permits to connect different nodes once they are launched.

Note that miner.sh script is also designed to launch a node in miner mode, as follows:

#!/bin/bash geth --datadir="$1" --port 303$1 --nodiscover --rpcport 81$1 --mine

User Interface

For our access control scheme, we designed one composite server-interface and two simple user interfaces. Indeed, user interfaces include the DO-interface that permits to the DO to define the authorized accessing entities' addresses, via the creation of a whitelist, as defined in subsection 5.1, and the DR-interface that enables a DR to request access to a given outsourced data file. The composite server-interface is defined w.r.t. two different scripts, where the first script maintains DOs' storing requests and the second script handles DRs' access requests. For ease of presentation -and submission guidelines-, only the DO-interface is detailed, w.r.t. to BC commands. To do so, we first recover the name of the file that will be sent to the remote server. Once recovered, a DO-DSP connection is instantiated and the data file is sent to the remote server, as follows: s = socket.socket() host = socket.gethostname() port = 1234 s.connect((host, port)) s.send((dataf+".dat").encode('ascii'))

The DO then creates a smart contract and retrieves its associated address, as detailed in subsection 5.1. The contract address is then sent to the hosting server such as: s.send (json.dumps(data).encode('ascii'))

Afterwards, the DO updates the whitelist dictionary which corresponds to the new created whitelist as shown hereafter, where "whtext" is a variable that displays the whitelist in the GUI (Graphic User Interface) and "stringFormat" function allows to obtain a string of characters representing the whitelist. Finally, the DO-interface proposes two different functions, as explained in subsection 5.1, namely the addWL function which allows to add an address to the whitelist and the removeWL function that removes addresses from the access list. The definition of both functions is almost similar.

5 https://www.javascript.com/

CONCLUSION

In this paper, we presented a new blockchainbased access control scheme that permits data owners to define access rights for each of their outsourced data resources on remote storage servers, and to dynamically delete these granted privileges when needed. Access rights are expressed per data retriever and registered in a smart contract as a whitelist of authorized users with a detailed specific access control list. Our proposed scheme provides an authenticated access control, conducted via the blockchain infrastructure, and ensures an adequate management process w.r.t. efficient whitelists definition. In addition, thanks to the pseudonymity supported by the blockchain, our access control mechanism enables to preserve entities' privacy. Stronger unlinkability properties can be provided in case of one-time blockchain accounts thus ensuring unlinkability between different access sessions and between different data resources belonging to the same owner.

Figure 1 :

 1 Figure 1: Whitelist Creation Process

Figure 2 :

 2 Figure 2: Access to Resources Process

  The get whitelist () function returns the array of allowed addresses. This function permits to the check if the whitelist contains a given DR's address. function get_whitelist() constant returns (address[]) {return whitelist;}

Table 1 :

 1 Our notations

	Notation Description
	BC	blockchain infrastructure
	DSP	data storage provider
	DO	data owner
	DR	data retriever
	C	smart contract

  Afterwards, the adding function checks if there exists zero entries in the whitelist table. The checking loop aborts if one of the addresses is zero or if it reaches the end of the table. In case of the existence of a zero entry, it is then replaced by the new address otherwise the new address is appended at the end of the table:

	while(i<whitelist.length && whitelist[i] != 0)
	{i++;}
	if(i!=whitelist.length)
	{whitelist[i] = a;}
	else
	{whitelist.push(a);}
	for(i=0; i<whitelist.length; i++){
	if(whitelist[i] == a){
	throw;}}

https://bitcoin.org/en/

https://www.ethereum.org/

https://solidity.readthedocs.io/en/develop/

https://www.python.org/