Maria G Tsoutsouva
email: maria.tsoutsouva@ntnu.no

Thècle Riberi -Béridot

Gabrielle Regula

Guillaume Reinhart

Dr Nathalie Mangelinck-Noël
email: nathalie.mangelinck@im2np.fr

In situ imaging of dislocation expansion in FZ -Si seeds during temperature ramp heating process

Keywords: X-ray Bragg diffraction imaging, dislocations, thermal annealing, FZ Si, directional solidification

The impact of the thermal field in a directional solidification furnace on the generation and propagation of dislocations is investigated in intrinsic floating zone single crystal silicon.

Seeds with different crystallographic orientations are wire-cut from mono-crystalline wafers and dislocation sources are solely left at the edges. Thermal annealing experiments are carried out in situ at the European synchrotron radiation facility and the evolution of the silicon crystalline quality is studied by X-ray diffraction imaging technique. At 1073 K, dislocations nucleate only at the edges and their strain field remains local. At higher temperature (1373 K), dislocations propagate throughout the entire width of the seed via the preferential activation of slip planes, related to the crystallographic orientation of the seed. These results confirm the high importance of seed preparation in monolike silicon growth process. Both mechanical Revised Manuscript 2 and chemical polishing of all seed surfaces, including their edges, are mandatory to prevent dislocation expansion and multiplication.

Introduction

Monolike silicon (ML -Si) growth is an attractive technique because it merges the high quality monocrystalline and the low cost multicrystalline manufacturing processes in a single, improved hybrid version that gives squareshaped ingots at high productivity levels.

In addition, ML -Si has been found to be less sensitive to light-induced degradation than Cz -Si. [START_REF] Gu | Seed-assisted cast quasi-single crystalline silicon for photovoltaic application: Towards high efficiency and low cost silicon solar cells[END_REF] In this technique, the Si grows by directional solidification from a pavement of monocrystalline seeds placed on the bottom of the crucible. Despite that the wafers obtained from these ingots have been shown to result in high efficiency solar cells, [START_REF] Gu | Seed-assisted cast quasi-single crystalline silicon for photovoltaic application: Towards high efficiency and low cost silicon solar cells[END_REF][START_REF] Jay | Advanced process for n-type mono-like silicon a-Si:H/c-Si heterojunction solar cells with 21.5% efficiency[END_REF][START_REF] Mrcarica | Potential for mono-cast material to achieve high efficiencies in mass production[END_REF] several challenges have emerged and prevented the wide spread adoption of ML -Si mass production. Among these are the formations of dislocations initiated at the bottom of the ingot either in the seeds and/or at their junctions, leading to the formation of electrically active small angle grain boundaries. These small angle grain boundaries multiply and propagate during the growth process along the height of the solidified ingot degrading the photovoltaic performance of the obtained wafers.

The generation of dislocations in ML-Si has previously been related to the relative misorientation and the gap between the seeds [START_REF] Tsoutsouva | Monolike silicon ingots grown on low angle misoriented seeds: Defect characterization by synchrotron X-ray diffraction imaging[END_REF][START_REF] Trempa | Influence of grain boundaries intentionally induced between seed plates on the defect generation in quasi-mono-crystalline silicon ingots[END_REF][START_REF] Trempa | Defect formation induced by seed-joints during directional solidification of quasi-monocrystalline silicon ingots[END_REF][START_REF] Ekstrøm | Structure and dislocation development in mono-like silicon[END_REF] as well as the presence of precipitates. [START_REF] Tsoutsouva | Segregation, precipitation and dislocation generation between seeds in directionally solidified mono-like silicon for photovoltaic applications[END_REF][START_REF] Autruffe | The impact of oxygen precipitation on dislocation generation at small angle grain boundaries during seed-assisted directional solidification of silicon[END_REF] Furthermore, the formation of dislocations in the preserved seeds that propagate in the upgrown crystal during the solidification process has also been investigated. [START_REF] Oliveira | Influence of processing parameters on the generation and propagation of electrically active crystalline defects in monolike silicon[END_REF] Their generation has been attributed to different mechanisms: i) thermal stresses induced during heating and cooling down process, [START_REF] Jiptner | Thermal stress induced dislocation distribution in directional solidification of Si for PV application[END_REF] ii) poor surface preparation of the seeds, [START_REF] Ervik | Dislocation formation in seeds for quasi-monocrystalline silicon for solar cells[END_REF] iii) weight and/or indentation by the silicon feedstock, [START_REF] Ekstrøm | Structure and dislocation development in mono-like silicon[END_REF][START_REF] Oliveira | Sub-grain boundaries sources and effects in large mono-like silicon ingots for PV[END_REF] iv) contact points at the interface between adjacent seeds, [START_REF] Ervik | Dislocation formation in seeds for quasi-monocrystalline silicon for solar cells[END_REF] v) indentation by contact points between the seeds and the Si3N4 coating/crucible interface at the bottom of the crucible, [START_REF] Ekstrøm | Structure and dislocation development in mono-like silicon[END_REF][START_REF] Ervik | Dislocation formation in seeds for quasi-monocrystalline silicon for solar cells[END_REF] vi) formation of precipitates (silicides) punching out dislocations, such as SiO2 precipitates formed at high temperature during long annealing. [START_REF] Tempelhoff | Precipitation of oxygen in dislocation-free silicon[END_REF] V.A Oliveira [START_REF] Oliveira | Influence of processing parameters on the generation and propagation of electrically active crystalline defects in monolike silicon[END_REF] investigated the role of SiO2 precipitates on the dislocation formation in the seeds of monolike ingots in FZ (low oxygen content) seed instead of a Cz for the crystallization. The characterization of the seed zone by Xray Bragg diffraction imaging showed that the dislocation density and the cellular dislocation network in the FZ Si seed was quite similar to the one present in the CZ Si seed. This observation proves that SiO2 precipitates have none or very small contribution in the dislocation density inside the seeds of ML -Si ingots. Nevertheless, the principal sources and the mechanism of dislocation formation and propagation in the seed of ML -Si remain unclear. Assumptions have been made after ex situ characterization of the grown ingot but this approach is not able to isolate the dislocation sources and examine the internal spatial deformation distribution to provide an in-depth understanding. Moreover, additional stresses induced in the system during cooling down very likely generate new dislocations and modify those that have already been formed during heating up and solidification making the understanding from the ex situ investigations even more challenging. It becomes clear though that the current research progress is limited by the difficulty of accessing, understanding and controlling the physicochemical mechanisms acting during the heating -meltingsolidification process. This work focuses on the protocol of the heating process of FZ -Si seeds having different crystallographic orientation but a common direction normal to their surface and its impact on the dislocation formation. For this purpose, heating ramp test, at high temperature (up to 1623 K), is performed using FZ -Si seeds in a directional solidification furnace. The uniqueness of our approach is that the dislocation formation in the Si seeds, as a function of the temperature increase, is followed in real time by synchrotron Xray Bragg diffraction imaging techniques. This experiment allows us not only to identify the sources of dislocation generation and follow their evolution during heating but also to determine the activated slip planes with regards to the seed crystallographic orientation. An analysis on the role of seed surface preparation (front, back and edges), the seed holding system, the temperature levels, the temperature gradients (unavoidable or mastered) and crystallographic orientation on the morphology of the formed dislocations is performed.

Experimental Procedure

Heating ramp experiments are carried out in situ inside GaTSBI (Growth at high Temperature observed by Synchrotron Beam Imaging) device at beam line BM05 at the European Synchrotron Radiation Facility (ESRF). GaTSBI is a specially designed experimental installation composed of a high temperature directional solidification (DS) furnace employed in conjunction with synchrotron radiation X-ray imaging techniques. So far, GaTSBI has been used to perform in situ solidification experiments of monocrystalline and multicrystalline silicon to investigate the growth phenomena that occur during the solidification process. A detailed description of the whole equipment and the previously obtained results can be found in references. [START_REF] Tandjaoui | Real Time Observation of the Directional Solidification of Multicrystalline Silicon: X-ray Imaging Characterization[END_REF][START_REF] Tandjaoui | Investigation of grain boundary grooves at the solid-liquid interface during directional solidification of multi-crystalline silicon: in situ characterization by X-ray imaging[END_REF][START_REF] Riberi-Béridot | On the impact of twinning on the formation of the grain structure of multi-crystalline silicon for photovoltaic applications during directional solidification[END_REF][START_REF] Tandjaoui | Twinning occurrence and grain competition in multi-crystalline silicon during solidification[END_REF][START_REF] Tsoutsouva | In situ investigation of the structural defect generation and evolution during the directional solidification of 〈110〉 seeded growth Si[END_REF] In the present work, we take advantage of this unique experimental setup to follow in contains information about the deviation from the perfect crystal structure. This is a powerful technique dedicated to the visualization of defects-induced strain in general and in particular, of dislocations, inclusions, strong impurity gradients present in the monocrystal volume.

Indeed, it is sensitive to long range distortion fields and / or strain fields associated with a crystal deformation. This is made possible, because these distortion fields affect the diffracted intensity, so that a contrast (nonhomogeneous intensity distribution) is created in the recorded image.

Seeds are appropriately cut with a diamond wire (having particles of 60 µm in size) saw from a double-sided mechanochemically polished intrinsic (resistivity beyond 5000 Ωcm) FZ wafer 50.8 mm, {110} in surface orientation provided by SIL'TRONIX Silicon Technologies. No further chemical polishing has been applied afterwards, leaving the edge damage due to sawing.

The FZ -Si seeds are housed inside a pyrolytic BN crucible (Figure 1b) one side of which has a hollow with the following dimensions: length 40 mm, width 6 mm and depth 0.35 mm. The pyrolytic BN has been chosen as the material for the crucible, since it is almost transparent to X-rays, in the range of the used wavelengths, does not give additional diffraction images to the detector, presents stability at high temperatures and can be machined. To limit any stresses that can be introduced in the seed during heating, even though the low difference in thermal expansion coefficient between Si and BN, the seed dimensions have been defined to be (38.0 ± 0.6) mm × (5.8 ± 0.6) mm × (0.30 ± 0.01) mm that are shorter dimensions in length and width as compared to the hollow of the BN crucible. However, the thickness of the seed and the depth of the hollow in the BN are nearly alike, since usually, the seed is partially melted and Si flow along the BN walls should be avoided for further studies of recrystallization from the seed. Noteworthy, the Mo clips allow both part of the crucible being tightly maintained in contact, casually to prevent the melt from flowing in the furnace. The furnace is specially designed to impose a dominant vertical temperature gradient that allows vertical directional solidification while smaller amplitude radial and transverse gradients might exist.

The heating ramp process is the same for all the examined cases and is presented, in figure 2, for the representative case of the seed oriented <100> along the vertical direction (length direction), FZ<100>. The seed is heated by applying the same temperature at the bottom and top resistance of the furnace during 2 hours and 40 minutes, up to 1373 K and then a temperature gradient of 30 K/cm is imposed during 30 minutes of heating. To study the impact of both mechanical and thermomechanical stresses on the generation, multiplication, propagation and interaction of dislocations in FZ -Si seeds, multiple Bragg diffraction images are recorded during the high temperature ramp heating process. Figure 3 shows selected diffraction images recorded during heating for the three {110} seeds voluntarily cut with different crystallographic orientations along the vertical direction corresponding as well to the applied temperature gradient direction.

In all cases, even at low temperature (873 K), both side edges of the seed are darker in comparison to the central part of the crystal, similarly to figures 3a, 3d and 3g. As the temperature increases, the Bragg diffraction images reveal the propagation of dislocations, initiated at the edges, throughout the whole width and length of the seed. These dislocations, which appear as dark parallel straight lines in the images, follow specific crystallographic directions (Peierls valleys, <110>) that are different in each seed and are related to its crystallographic orientation. It is worth noting that this kind of dislocations appear in FZ<100> at 1373K (horizontal dark lines in figure 3b), whereas no temperature vertical gradient is applied. , (d-e), (g-h): no vertical applied temperature gradient; (c), (f), and (i), a 30K/cm vertical gradient Gl is applied.

In the examined seeds, we observe three different morphologies of dislocations that are gathered and presented in magnified images in figure 4. Figures 4a,b,c show the morphology A of dislocations that appear as straight long segments in seeds FZ<100>, FZ<110> and FZ<111> respectively. In addition to this morphology of dislocations, there are also many short-tangled dislocation (morphology B) elongated up to 300 µm from the edges of the specimen (Figure 4d). Moreover, some straight and short scarce "staple-like" shaped dislocation segments (morphology C in figures 4e and f, triangles in orange in figures 3f and 3i) are also present.

The latter seems to interact with morphology A dislocations (see figures 4e and f). The dislocation density in the three examined specimens is not uniform and varies in different areas in the same seed. However, indicative values of the dislocation density can be given according to the contrast of the Bragg diffraction images. In diffraction images, a single dislocation induces a contrast so that in the uniformly grey zones that are free of dark segments or lines, the dislocation density is 0 cm -2 . In areas that appear very dark in the diffraction images, such as the edges of the seeds, the dislocation density is ≥10 6 cm -2 , in areas where individual lines can be distinguished, it is estimated to ~10 4 cm -2 . [START_REF] Burns | HPHT growth and x-ray characterization of high-quality type IIa diamond[END_REF] To evidence the possible {111} slip planes to be activated with regards to the crystallographic orientations of each seed, figure 5 The fact that some gliding systems are activated or not, and some dislocation sets are present or not in the seeds is discussed in part 4. An analysis of the dislocation sources, the role of temperature and of the crystallographic orientation on the generation and propagation mechanisms of dislocations is performed. This analysis focuses on morphology A dislocations that are the most abundant and that propagate all along the width or length of the seeds.

Discussion

FZ -Si is the closest possible to a perfect crystal, with very low impurity concentration and no as grown extended defects, as confirmed in figures 3a, d, g. The dark edges of the seeds, in these Laue spots, prove that these zones are more strained than the internal part of the Si crystal denoting that the wire sawing process introduces local stacked strain in these regions, due to the mechanical interaction of the abrasive grit with the Si. The uniform gray contrast observed in the center of these Bragg diffraction images proves that the central region is "perfect" from the crystalline point of view and regarding strain. Thus, the sole possible source of dislocations found in the seeds is the surface damage induced by the sawing step. Saw damage is well documented as being present in the first few micrometers of an as-cut wafer, [START_REF] Wu | Mechanical Strength of Silicon Wafers Cut by Loose Abrasive Slurry and Fixed Abrasive Diamond Wire Sawing[END_REF] the work hardening depending of course on the diameter of the diamond particles present on the wire. Saw damage induces residual stresses, compressive in nature in the range from -20

MPa to -85 MPa including stresses having a component in both the x-and y-coordinate directions, namely, σxx and σyy. [START_REF] Pogue | Measurement and analysis of wire sawing induced residual stress in photovoltaic silicon wafers[END_REF] When those stresses exceed the Si critical shear stress, they cause plastic deformation and/or micro cleavage. [START_REF] Sopori | 1 National Renewable Energy Laboratory, Golden, CO 80401, USA, Surface characteristics and damage distributions of diamond wire sawn wafers for silicon solar cells[END_REF] However, the presence of this local strain = 0

The values of m for each glide system and each stress direction allows discriminating which glide planes can be activated (if m≠0) or not (if m=0) and which ones are the most probable to release the applied stress, that are the glide systems having the highest m value called primary glide systems. The secondary glide systems can still be activated if their resolved shear stress remains beyond the critical threshold to move dislocations at the studied temperature. The corresponding results are given in table 1.

Table 1: 5a). However, since the dislocation pattern is horizontal, the activated planes can only be (111) or (111 ̅ ). If the uniaxial stress along [001 ̅ ] would have expand morphology A dislocations, all the slip planes would have been activated, which is not the case. The same reasoning holds for the two other seed orientations. Consequently, it is eventually found that the activation of the respective slip planes for the three seeds (Figures 5 a,b,c) can only be caused by an applied external force perpendicular to the largest surface of the seeds, inducing a stress along <110>.

FZ<100>

Wittge et al. [START_REF] Wittge | X-ray diffraction imaging of dislocation generation related to microcracks in Si wafers[END_REF][START_REF] Wittge | Dislocation sources and slip band nucleation from indents on silicon wafers[END_REF] investigated the dislocation sources and slip band nucleation from indents on silicon wafers and they also observed an asymmetry on the slip plane activation that was attributed to the different temperature gradient within their furnace in the vertical and horizontal directions. They also found slip nucleation at the periphery of the wafer which cannot be correlated with the intended points and they did not determine the edge defects that induced such a slip nucleation.

On the one hand, due to the complexity of the set up system in the furnace (BN crucible, Mo tweezers, graphite fixing screw, etc…), it is not possible to simulate the exact thermal gradients that may exist in the sample. On the other hand, the impact of the thermo-mechanical stresses induced in the sample by the heating ramp and/or the applied temperature gradients would require analyzing a three-dimensional, non-linear, multi-body contact and stress simulation, which is out of the scope of this manuscript. However, a simple stress tensor matrix calculation is used to determine the possible activated glide systems (see in the appendix the extended calculations for FZ<100>). It shows that the possible temperature gradients that may exist in the furnace should activate all the glide planes in our samples, which is not observed.

Thus, it is likely that the driving force expanding the dislocations in the seed is related to mechanical stresses induced by the complex crucible / sample holder system.

The present experimental results show that the state of the side surfaces of the seed after wafering process can be the origin of dislocation nuclei. The dislocation velocity depends on the shear stress applied on the different slip planes and on the temperature if we consider thermally activated dislocation glide. Therefore, dislocation nucleation and propagation could be reduced by optimizing the seed surface preparation in order to eliminate the dislocation sources, controlling the crystallographic orientations and / or the mechanical stress in the crucible in such a way that the resolved shear stress applied on the slip glide systems becomes lower than the critical resolved shear stress to develop dislocations.

To further investigate the impact of the saw process on the generation of dislocations during the heating process, an experiment is performed, under the same experimental conditions, using a seed that has been chemically polished, prior HF bath followed by a CP4

polishing with a newly fabricated solution at room temperature during 3 min after the cutting process, in order to smoothen the damaged zone at the edges. Using this process, we attempt to remove all dislocation sources induced by sawing and prevent the dislocation propagation during the temperature ramp. However, the sole chemical polishing is not efficient enough: a fine combination of mechanical and chemical polishing is mandatory. The obtained results (not presented in the present manuscript) as well as the conclusions withdrawn, concerning the relationship between the seed orientation and the preferential activation of slip planes, are identical with those presented in this work. The only remarkable difference is that the dislocation propagation event has been delayed during the heating process with prior chemical polishing. Instead of a dislocation propagation occurrence at 1423 K, this event happens at 1673 K just before the melting started. This fact denotes that the dislocation sources induced during the sawing process have been attenuated by chemical polishing but they have not been fully

removed. Nonetheless, it should also be noticed that both front and back sides of the seed do not allow any dislocation generation during none of the examined experiments, excepted very scarce ones likely due to seed handling. Thus, from the current experimental observations and under the present experimental conditions, it seems that the industrial wafer double sided mechanochemically surface polishing (SIL'TRONIX Silicon Technologies [27] ), efficiently removes all dislocation sources and thus prevents the propagation of dislocations in the seed.

Conclusions

Temperature ramp heating experiments have been carried out in a directional solidification furnace on diamond wire saw FZ -Si seed with different in plane crystallographic orientations. The in situ Xray diffraction imaging investigations performed during the heating process reveal that the wafering process induces dislocation sources via deformation and/or micro-cleavage at the edges of the seed. Lattice distortion, limited only to the edges, appears on the diffraction images even at very low temperature (lower than 873K). When increasing the temperature, the edges become more strained and eventually dislocations nucleate, forming half-loops but always remaining close to the edges. When temperature reaches 1373 K, dislocation propagation occurs throughout the entire width of the seed with, interestingly, the activation of specific crystallographic slip planes depending on the seed crystallographic orientation. This preferential activation of slip systems allows us to essentially attribute it to an applied external stress induced by the crucible holding system, lying along <110>, across the thickness of the seed. When the examined seeds are chemically polished after the cutting process, in order to remove the edge damage and thus the dislocation sources, the dislocation propagation event is delayed during the heating process; it happens at 1673 K. In all cases, dislocation generation is not observed on the front and back side of the wafer denoting that the industrial wafer double sided mechanochemical surface polishing efficiently removes all dislocation sources. Knowing that in the monolike Si process dislocations formed in the seeds during the heating and melting process expand in the growing ingot afterwards during the solidification process, seed cutting and surface preparation is of major importance. Sources of dislocations need to be eliminated both at the surfaces of the seeds that are in contact with the anti-releasing coating of the crucible below, and the silicon feedstock above and their side edges as well, during the cutting and preparation process. A special care must be taken to limit mechanical stresses on the seeds, such as the ones induced by the weight of the feedstock on the top of the seed.

Let us check now that the resolved shear stresses which are  ̿ (Ro). n {111} ⃗⃗⃗⃗⃗⃗⃗⃗⃗⃗⃗⃗⃗⃗⃗ .b ⃗ , where h, k, l are the Miller indexes of the four glide systems and b ⃗ is each of the three Burger vectors belonging to each {111}, is in good agreement with the simple calculation of Schmid factor.

Indeed we find with the letter "a" being the Si lattice parameter: In conclusion, with a shear stress in xy sample plane, all glide systems can be possibly excited and in particular the ones having a common Burgers vector in each couple of either experimentally active glide planes (see figure 3b It is likely that the main stress capable to drive dislocation through the entire crystal is a compression stress along the y axis of the seed.

Figure 1 :

 1 figure 1a. The DS furnace is based on two resistive heating elements (top and bottom) schematically depicted in figure 1a and is operated under a secondary dynamical vacuum (~10 - 6 mbar). X-ray Bragg diffracted images, corresponding to different {hkl} diffracting planes, are regularly recorded on Xray sensitive films (AGFA Structurix D3-SC, 17.6×12.5 cm 2 )

Figure 2 :

 2 Figure 2: Thermal annealing profile, where Tb and Tt are the applied-temperatures

Figure 3 :

 3 Figure 3: Bragg diffraction images of the FZ -Si seeds during heating ramp. 𝒈 ⃗⃗ is the

Figure 4 :

 4 Figure 4: Magnified Bragg diffraction images of the three different morphologies of

Figure 5 :

 5 Figure 5: Stereographic projections of the studied FZ<hkl> -Si seeds. <hkl> is the direction

  remaining after the sawing step can only explain the formation of the morphology B dislocations. It cannot be the origin of the driving force for the propagation of morphology A dislocations while heating, through the crystal width or length, via the activation of different specific slip planes in each case. An external stress beyond the critical shear stress for the activation of the specific slip planes at the corresponding temperature should be applied to the system to explain the propagation length of morphology A dislocations. Let us have a look at the effect of three stress directions, regardless their origin but perpendicular to each seed surfaces ((xy) plane, bottom; (xz) plane, thickness; (yz) plane, front and back surfaces of the seed). This uniaxial stress and thus the Schmid's factor m of the corresponding inducedresolved shear stresses for the three orientations of the seeds can be calculated for each slip system. An example of the Schmid factor calculation in a cubic crystal for a stress applied parallel to[1 ̅ 10], on the slip plane (111), for a slip direction (Burgers vector) [011 ̅ ][START_REF] Schmid | Plasticity of Crystals, with special Reference to Metals, Kristallplastizität: Mit Besonderer Berücksichtigung der Metalle[END_REF] is given by the following equation: 𝒎 [𝟎𝟏𝟏 ̅ ](𝟏𝟏𝟏) = (𝟏 * (-𝟏)+𝟏 * 𝟏+𝟏 * 𝟎) √(𝟏 𝟐 +𝟏 𝟐 +𝟏 𝟐 ) * √((-𝟏) 𝟐 +𝟏 𝟐 +𝟎 𝟐 ) * (𝟎 * (-𝟏)+𝟏 * 𝟏+(-𝟏) * 𝟎) √(𝟎 𝟐 +𝟏 𝟐 +(-𝟏) 𝟐 ) * √((-𝟏) 𝟐 +𝟏 𝟐 +𝟎 𝟐 )

  Schmid's factors m calculated for all FZ <hkl> seeds considering the presence of a uniaxial stress applied along the three perpendicular dimensions of the seeds (width w, length l, thickness t). The column highlighted in red, points out the directions of the seed along which the applied stress corresponds to the experimental observations of morphology A dislocation propagation.



  All is in agreement with simple Schmid factor calculations. Now let us evaluate the resolved shear stress due to a pure shear in the (xy) plane (see table) for instance, due to a vertical temperature gradient Gl (which can be voluntarily applied or being residual even when the top and bottom temperature of the resistors are set equal, which should not happen since the furnace is designed to master their temperature); ̿ (R FZ<100> ) = ( ̿ (Ro) = t (Rz(45°))  ̿ (𝑅 𝐹𝑍<100> ) Rz(45°)

))

  of the submitted paper) such as (111) and (111 ̅ ) with b ⃗ = 𝑎/2[1 ̅ 10] and the non-experimentally active glide planes such as (1 ̅ 11 ̅ )and (1 ̅ 11) with b ⃗ = 𝑎/2[110] : all these four primary glide systems have the same probability to relieve stress. Now let us evaluate the resolved shear stress due to a pure shear in the (xz) plane (see table) for instance, due to a horizontal temperature gradient Gt. In the sample coordinates, the corresponding stress matrix would be written as: and can be written in (Ro) as  ̿ (Ro)= ( Once more, let us calculate the resolved shear stress on the 12 different glide systems: aE/(2√2) If any shear stress existed in xz plane, unless only the primary planes were excited the (1 ̅ 11) and (1 ̅ 11 ̅ ) should also have been excited (unless the resolved shear stress in those planes is still too low to move dislocations). Eventually, let us see the effect of the presence of a shear stress in the (yz) plane of the sample (temperature gradient existing indeed across the width of the seed Gw): and can be written in (Ro) as  ̿ (Ro)= ( The primary glide planes would be in (1 ̅ 11) and (1 ̅ 11 ̅ ) planes having a Burgers vector b ⃗ = 𝑎/2[110] which is not visible in figure 3b of the paper, due to the used diffraction vector. Nevertheless, all other secondary glide systems would have then the same probability to relieve stress, thus both (1 ̅ 11) and (1 ̅ 11 ̅ ) would have contained visible dislocations.

Table 1

 1

	Uniaxial stress	w	l	t
	Applied stress direction	[𝟏 ̅ 𝟏𝟎]	[𝟎𝟎𝟏 ̅ ]	[𝟏𝟏𝟎]
	Slip plane	Burgers vector	Schmid's factors
	(𝟏𝟏𝟏)	[𝟏 ̅ 𝟏𝟎]	0	0	0
	(𝟏𝟏𝟏)	[𝟎𝟏𝟏 ̅ ]	0	-0.408	0.408
	(𝟏𝟏𝟏)	[𝟏𝟎𝟏 ̅ ]	0	-0.408	0.408
	(𝟏𝟏𝟏 ̅ )	[𝟏 ̅ 𝟏𝟎]	0	0	0
	(𝟏𝟏𝟏 ̅ )	[𝟎𝟏𝟏]	0	-0.408	0.408
	(𝟏𝟏𝟏 ̅ )	[𝟏𝟎𝟏]	0	-0.408	0.408
	(𝟏 ̅ 𝟏𝟏)	[𝟎𝟏𝟏 ̅ ]	0.408	-0.408	0
	(𝟏 ̅ 𝟏𝟏)	[𝟏𝟏𝟎]	0	0	0
	(𝟏 ̅ 𝟏𝟏)	[𝟏𝟎𝟏]	-0.408	0.408	0
	(𝟏 ̅ 𝟏𝟏 ̅ )	[𝟎𝟏𝟏]	0.408	-0.408	0
	(𝟏 ̅ 𝟏𝟏 ̅ )	[𝟏𝟏𝟎]	0	0	0
	(𝟏 ̅ 𝟏𝟏 ̅ )	[𝟏𝟎𝟏 ̅ ]	-0.408	0.408	0

underlines that in FZ<100> for example, if a uniaxial stress along

[1 ̅ 10]

were responsible for the propagation of the morphology A dislocations, then (1 ̅ 11) and (1 ̅ 11 ̅ ) glide planes would have been activated. Hence, in that case, a diagonal dislocation pattern would have been observed according to the stereographic projection (see figure

Acknowledgments

This work is funded by the ANR Project CrySaLID (N_ ANR-14-CE05-0046-01). The ESRF (European Synchrotron Radiation Facility) BM05 team is greatly acknowledged for support during the X-ray imaging experiments.

Appendix

Let us determine the matrix components in the crystallographic coordinates system (Ro) of a stress applied along the y axis in (RFZ<100>) (see table below) since this seed does exhibit morphology A dislocations when vertical temperature gradient Gl is still set to zero at 1073K. In this appendix, the activated glide systems are written in bold and the primary ones are in red.

At high temperature, both primary and secondary glide systems are usually activated.

In all the studied seeds dislocations are visible solely in (111) and (111 ̅ ).

Table giving the method to determine the stress matrix for FZ<100> : a) scheme of both coordinate systems (crystallographic (Ro) or linked to the sample (RFZ<100>)); b) to e) determination of the components of the stress matrix in (Ro) due to a stress applied along y in (RFZ<100> ). Note that t (Rz(45°)) is the transposed matrix of (Rz(45°)) which is the rotation matrix of 45° about the z axis.


Nesrine Kaaniche

Maryline Laurent Samovar

SABE: A Selective Attribute-based Encryption for an Efficient Threshold Multi-level Access Control

Keywords: Multi-level Access Control, Ciphertext-policy Attribute-based Encryption, Flexible Access Policies, Data Secrecy

With the emergence of decentralized systems and distributed infrastructures, access control to outsourced data becomes more complex, as it should be flexible and distinguishable among users with different access rights. In this paper, we present SABE, a Selective Attribute-based Encryption scheme, as a new threshold multilevel access control mechanism based on an original use of attribute based encryption schemes. Our proposal is multi-fold. First, it ensures fine-grained access control, supporting multi-security levels with respect to different granted access privileges for each outsourced data file. Second, SABE is proven secure against selective non-adaptive chosen ciphertext attacks in the generic group model. Third, our construction is proven to provide efficient processing and communication complexities, compared to most closely related schemes.

INTRODUCTION

The emergence of decentralized systems and distributed infrastructures has increased the complexity of access control to outsourced data and has given rise to encrypted access schemes. These mechanisms, referred to as Attribute based Encryption (ABE) mechanisms, are used to encrypt data files with respect to an access policy computed on a set of attributes.

Let us take a simple example for illustrating the need for a multi level access tree for ABE. During the reviewing process of scientific papers submitted to a conference, access to the papers can be provided to general chairs, program committee, publicity chairs or to the registration manager for the validation of registered papers. This can be formalized by an access policy based on users' attributes, which assigns different access rights to each part of the scientific paper to the actors. For instance, reviewers should not have access to identifying information of the authors (e.g; name, affiliation, • • • ), registration staff should not have access to the paper contents, while general chairs have access to the whole research paper's content. Thus, to enable access to encrypted data, the encryptor is assumed to create an access structure for each part of the scientific paper which is then encrypted, w.r.t. each group of authorized entities. Depending on the attributes comprising each access struc-ture, there might be a strong overlapping of attributes between access structures, thus leading to duplicated efforts when encrypting and decrypting each part of the data content. In addition, the management of access control policies becomes more complex and the burden of enciphering keys' management rises mainly with the dynamicity of users groups.

In this paper, we present SABE, Selective Attribute based Encryption, a novel and efficient threshold encryption scheme relying on attribute based mechanisms, and provided with the following features:

(1) SABE ensures a selective access to data based on users' granted privileges. A party willing to encrypt a data file only specifies one single access structure and certain security levels assigned to different data blocks of the enciphered file. Thus, a user is next able to decipher a sub-set of data blocks associated to a security level k if the secret keys of that user satisfy the related k l sub-sets of attributes.

(2) SABE is a threshold access-control scheme associated to multi-security levels, i.e. each security level defines the threshold number k l of related sub-sets of attributes that need to be satisfied.

(3) Relying on an attribute based encryption mechanism, users sharing the same access privileges are not required to collaborate to extract the secret encrypting key. Thus, the complexity of key management is minimized, providing an efficient processing and communication overhead, and the definition of access control policies is flexible and distinguishable among users with different privileges to access data. (4) SABE is proven secure against non-adaptive chosen ciphertext attacks.

Paper Organization -Section 2 discusses related works, presents the problem statement and highlights security and functional requirements. Section 3 introduces our definitions and gives background on access structures and Lagrange Interpolation. Section 4 details our system and threat models and section 5 presents the concrete construction.The security of our scheme is discussed in section 6. Finally, The scheme performances are evaluated in section 7 The potential of SABE technique to support security and privacy in concrete networking and computing applications in section 8 before concluding in section 9.

RELATED WORKS AND SECURITY REQUIREMENTS ANALYSIS

Sharing data contents between different involved actors is often an issue, due to the complexity of access control policies' management. This issue becomes more complex when involved actors do not share the same access privileges to each part of the data file.

In the following, we first detail related works in subsection 2.1. Then, we present the problem statement based on a real-world use case, in subsection 2.2. Afterwards, we introduce the security and functional requirements for the design of the SABE mechanism in subsection 2.3.

Related Work

Fine-grained access control based on selective encryption is a novel approach that enables selective access to encrypted data while supporting a compelling key management process. Indeed, different deciphering keys can be distributed to different users that are allowed to access the corresponding data content, with respect to their granted privileges. However, the translation of an access control list into an equivalent multi-level policy remains the main issue of these schemes. To ban access to some parts of the data, some processes propose to cover out or remove these chunks. These mechanisms are known by redaction tools. They generally rely on malleable cryptographic primitives (e.g; chameleon hash functions instead of the conventional hash functions) to enable redactors, based on their own respective private keys to modify some portions of the originally encrypted file. Although these mechanisms allow selective access to some parts of the originally encrypted file, they are also still inefficient with multi-level access privileges. In 2010, Di [START_REF] Vimercati | Encryptionbased policy enforcement for cloud storage[END_REF] introduce a selective authorization policy model based on graph theory in order to ensure read privilege. The authors consider a dynamic group of users sharing data stored in remote cloud servers and assume that each data content may only be accessed by a subset of users. That is, [START_REF] Vimercati | Encryptionbased policy enforcement for cloud storage[END_REF] proposal is based on the use of both a key agreement algorithm and a key derivation function that enable a key to be derived from another key and a public token. The combination of these two algorithms permits to correctly convert access policies defined by data owners into encryption policies. Later, in 2013, Di [START_REF] Di Vimercati | On information leakage by indexes over data fragments[END_REF] propose another approach to support modification of outsourced data files. The main idea of (di [START_REF] Di Vimercati | On information leakage by indexes over data fragments[END_REF] proposal relies on the association of each content with a write tag. The remote server permits a user to perform the write operation on a data file if he correctly shows the corresponding write tag. A crucial concern of the (di [START_REF] Di Vimercati | On information leakage by indexes over data fragments[END_REF] scheme is that the keys used to encrypt the write tags have to be shared between authorized users and the server. Although the attractive advantages of the proposed solutions [START_REF] Vimercati | Encryptionbased policy enforcement for cloud storage[END_REF][START_REF] Di Vimercati | On information leakage by indexes over data fragments[END_REF] to support selective access control, they do not support multi-level access structure on the same data content.

Along with the different emerging techniques supporting selective access control to encrypted data, Attribute based Encryption (ABE) has been often presented as a solution to provide flexible data sharing [START_REF] Sahai | Fuzzy identity-based encryption[END_REF] [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. In order to ensure fine grained access control to outsourced data, several constructions relying on ABE have been proposed [START_REF] Kaaniche | Data security and privacy preservation in cloud storage environments based on cryptographic mechanisms[END_REF], [START_REF] Hur | Attribute-based access control with efficient revocation in data outsourcing systems[END_REF], [START_REF] Yu | Attribute based data sharing with attribute revocation[END_REF], [START_REF] Jahid | Easier: Encryption-based access control in social networks with efficient revocation[END_REF], [START_REF] Horváth | Attribute-based encryption optimized for cloud computing[END_REF], [START_REF] Huang | Secure and efficient data collaboration with hierarchical attributebased encryption in cloud computing[END_REF], [START_REF] Belguith | Pabac: a privacy preserving attribute based framework for fine grained access control in clouds[END_REF]. Indeed, Hur et al. proposed an access control scheme based on CP-ABE in data outsourcing systems such as cloud computing [START_REF] Hur | Attribute-based access control with efficient revocation in data outsourcing systems[END_REF]. Horvath proposed a fine-grained access control scheme for securely sharing data in cloud environments [START_REF] Horváth | Attribute-based encryption optimized for cloud computing[END_REF]. To guarantee an efficient revocation scheme, this construction relies on an identity based user revocation mechanism to manage access rights . The proposed extension is based on multiple independent attribute authorities which makes the revocation of specific users (e.g. based on users' identities) from the system is possible without updates of public and private keys. However, these schemes only focus on data sharing, at one single security level and cannot support selective access privileges to outsourced data.

In [START_REF] Huang | Secure and efficient data collaboration with hierarchical attributebased encryption in cloud computing[END_REF], Huang et al. propose a data collaboration scheme, such that authorized users can share data in a collaborative manner. In fact, the data owner encrypts data with respect to a selected access policy based on CP-ABE, while the cooperative user re-encrypts the modified data and signs a collaboration request with his attributes. As such, only the users whose attributes satisfy the access policy can modify outsourced data. [START_REF] Huang | Secure and efficient data collaboration with hierarchical attributebased encryption in cloud computing[END_REF] employs a delegation mechanism based hierarchical ABE, which contains a central authority and a number of independent domains. Each domain holds a domain authority that requests a secret parameter from the higher level authority and generates attribute secret keys for its domain users. The [START_REF] Huang | Secure and efficient data collaboration with hierarchical attributebased encryption in cloud computing[END_REF] proposal introduces a partial decryption and signing construction, where users are able to outsource most of the decryption and signing computation overhead to the service provider.

Afterwards, Khan et al. presented a multi-level access control scheme, proving a single ciphertext over a global access policy [START_REF] Khan | Owner specified excessive access control for attribute based encryption[END_REF]. The data owner can define limited users' privileges to different chunks of the whole data D. However, the enciphering symmetric key sk is defined as a vector of different sub-keys sk = [s i ] i∈ [1,n+1] , where each s i is the related encrypting key of m i , such that D = {m 1 , m 2 , • • • , m n } and s n+1 is the enciphering key of the whole data D. Thus, the [START_REF] Khan | Owner specified excessive access control for attribute based encryption[END_REF] construction requires heavy computation and communication costs. Recently, in 2017, Kaaniche and Laurent proposed a multi-level access control scheme based on attribute based mechanisms for e-health applications (Kaaniche and Laurent, 2017a). Their construction permits the enciphering party to encrypt a data file, while specifying an access structure and a certain number of security levels. Thus, a user can decrypt a sub-set of data chunks associated to a security level k if that user's private keys satisfy the sub-set of attributes related to the k-security level. Nonetheless, the (Kaaniche and Laurent, 2017a) proposal does not offer a threshold multi-level access, such that the deciphering entity has to satisfy a precise set of attributes to be able to decrypt a given sub-sets of data blocks w.r.t. a given security level. In addition, the encrypting entity has to encipher each sub-set of data blocks associated with a given security level, using on a different secret.

Although these schemes proposed efficient solutions to protect data contents from unauthorized access, they are still inefficient with multi-level access policies, where users must share the same data content with different access rights to distinct data chunks. In addition, these schemes mainly provide interesting computation and communication costs at the receiving entity side, w.r.t to the decryption procedure, while it is important to focus on the processing overhead at the data owner side, responsible for defining different access policies to different parts of outsourced data files.

Problem Statement

In real-world data sharing scenarios, different organisations and actors can be involved. The shared data must be protected from unauthorized access while ensuring fine grained access control for different authorized actors. For preserving data confidentiality against malicious users, encryption should be applied while supporting flexible sharing of encrypted data among dynamic groups of users, with fine-grained access control policies.

Let us consider the case of the reviewing process of scientific papers: the website administrator manages access to the encrypted versions of submitted papers with respect to three different groups of users: reviewers, sub-reviewers and PC chair. Indeed, according to their related credentials, some entities can have access to the paper content as well as the name of authors and their personal information, while others may have access to only anonymized versions of the submitted papers, referred to as blinded papers. Thus, the aforementioned group of users define several access control policies as follows:

• access to the blinded paper - To enable access to encrypted data, the available option related to the use of ABE mechanisms is based on the naive computing approach referred to as NC in the following. In NC, the data owner, i.e; the website administrator, is assumed to create an access structure for each part of the scientific paper which is then encrypted, with respect to every group of authorized users. Concretely, the blinded version of the paper and the whole paper content including identifying information have to be enciphered with respect to different access structures. However, it is worthy noticeable that (i) these access structures share several leaf nodes, corresponding to redundant required attributes and (ii) each data content is encrypted several times under different access policies. In fact, this use-case points out that there might be overlapping between access structures for the same data share, thus leading to complex access structures. In addition, the management of access policies becomes more complex and the burden of enciphering keys' derivation for every data chunk rises mainly with groups of users having different access privileges. That is why we propose a multi-level access control mechanism for the same data content, based on an ABE aggregate access tree.

Security and Functional Requirements

The proposed SABE scheme has to fulfill the following security properties and functional features:

• data confidentialityeven in case of collusions, SABE has to ensure the secrecy of encrypted data contents against malicious entities, namely unauthorized and revoked users.

• multi-level fine grained access control -SABE should support flexible multi-level security policies among groups of users with different granted privileges.

• threshold support -SABE should ensure the threshold feature, such that each defined security level may encompass several sub-trees.

• low processing and communication costs -SABE encrypted data file should be short-sized as the transmission overhead is essential in the emerging infrastructure context. In addition, the encryption and decryption processes should have a low computation cost in order to reduce the impact of heavy cryptographic mechanisms on the efficiency of the intended algorithms.

PRELIMINARIES

Mathematical Background

In this section, we introduce our prerequisites, namely multi-leveled pairing functions, access structures and Lagrange interpolation, defined as follows:

Definition 1. (Leveled Multilinear Maps (Hohenberger et al., 2013) [START_REF] Garg | Attribute-based encryption for circuits from multilinear maps[END_REF])

Let G be a group generator G(1 κ , k), where κ is a security parameter and k is the number of allowed pairing operations. G(1 κ , k) outputs a sequence of

groups such that G = [G 1 , • • • , G k ],
each of prime order p > 2 κ . Let g i be a canonical generator of G i .

We assume the existence of a set of bilinear maps {e i, j :

G i × G j -→ G i+ j |i, j ≥ 1, i + j ≤ k}.
The map e i, j satisfies the following relation: [START_REF] Beimel | Secret-sharing schemes: A IWCC[END_REF])

e i, j (g i a , g j b ) = g i+ j ab , ∀a, b ∈ Z p Definition 2. (Access Structure
Let P = {P 1 , P 2 , • • • , P n } be a set of parties, and a col- lection A ⊆ 2 {P 1 ,P 2 ,••• ,P n } is called monotone if ∀B,C ⊆ 2 {P 1 ,P 2 ,••• ,P n } : if B ∈ A and B ⊆ C then C ∈ A. An access structure is a collection A of non-empty sub- sets of {P 1 , P 2 , • • • , P n } ; i.e. A ⊆ 2 {P 1 ,P 2 ,••• ,P n } \ { / 0}.
The sets in A are called authorized sets, and the sets not in A are called unauthorized sets.

Definition 3. (Lagrange Interpolation) Given a set of (k + 1) distinct points {(x 0 , y 0 ), • • • , (x k , y k )}, the Lagrange polynomial is a linear combination L(x) = ∑ k j=0 y j δ j (x) of Lagrange coefficients δ j (x) = ∏ 0≤i = j≤k x-x i x j -x i .

Cryptographic Assumptions

For our construction, we consider the following complexity assumptions:

• Discrete Logarithm Problem (DLP) -Let G be a multiplicative cyclic group of a prime order p, and g is a generator of G. The DLP problem is, given the public element y = g x ∈ G, there is no efficient probabilistic algorithm A DLP that can compute the integer x.

• Computational Diffie Hellman Assumption (CDH) -Let G be a group of a prime order p, and g is a generator of G. The CDH problem is, given the tuple of elements (g, g a , g b ), where {a, b} R ← -Z p , there is no efficient probabilistic algorithm A CDH that computes g ab .

OVERVIEW

Our Selective Attribute based Encryption (SABE) enables a group of users to access different parts of an encrypted data file in a threshold manner with respect to their different granted privileges. The main idea behind SABE relies on ABE such that users' keys and decryption capabilities are related to the attributes they possess. Indeed, the SABE scheme considers that the plaintext is composed of a set of messages and users' credentials (i.e; certified attributes) settle which subset of data blocks may be deciphered. It provides the ability to strike a balance between security and processing demands.

Accurately, the encrypting entity defines an access structure with respect to n attributes, while specifying multi-threshold levels {k l } l∈ [1,c] , where k l is the k lsecurity level and c is the number of defined security levels. Note that each security level k l corresponds to n l sub-trees that permit to reconstruct a secret key v l required to decipher the subset of data blocks associated to the security level k l .

System Model

A selective attribute-based encryption scheme (SABE) for a message space M and an access structure space G relies on four randomized algorithms, defined as follows:

• setup -it is executed the master entity (i.e; attribute authority) to set up the system. The setup algorithm takes as input the security parameter κ and outputs the public parameters pp and the master key mk.

• encrypt -it is performed by the encryptor. The encrypt algorithm takes as input the public parameters pp, an access structure Γ over the universe of attributes S and the set of security levels

{k l } l∈[1,c] ,
where c is the number of security levels and a message M = {m l } l∈ [1,c] . It encrypts the message M w.r.t. c security levels and outputs a ciphertext CT = {Γ, ∀k l : CT l }, such that l ∈ [1, c] and each security level has to be satisfied by at least n l root subtrees. This algorithm is performed such that only a user that holds a set of certified attributes w.r.t. a security level k l that satisfies the access structure Γ can decipher the encrypted message CT l .

• keygen -it is run by the attribute authority. This algorithm takes as input the public parameters pp, the master key mk and a set of attributes S and outputs the related secret key sk.

• decrypt -it is performed by the deciphering entity. The decrypt algorithm takes as input the public parameters pp, the ciphertext CT , which contains an access policy Γ, the security level k l and the secret key sk associated to the set of attributes

S.

Recall that S has to satisfy Γ, w.r.t. a security level k l , to be able to decrypt the corresponding ciphertext CT l and retrieve the message m l .

The correctness property requires that for all security parameter κ, all universe descriptions S, all (pp, mk) ∈ setup(κ), all S ⊆ S, all M ∈ M , all Γ ∈ G, all sk ∈ keygen(pp, mk, S), all k l ∈ K (K is the security level space) and all CT ∈ encrypt(pp, Γ, M, {k l } l∈[1,c] ), if S satisfies Γ w.r.t. a security level k l , then decrypt (pp,CT, k l , sk) algorithm outputs m l .

Selective CCA-1 Security Model

Let Π = (setup, encrypt, keygen, decrypt) be a SABE scheme for a message space M and an access structure space G. To prove the resistance of SABE against selective chosen ciphertexts attacks, we consider a security game, referred to as G S-CCA (1 κ ), between a challenger C and an adversary A. That is, A defines a challenge access structure Γ * , such that he can ask for any private keys generation of a set of attributes S as well as decryption queries of ciphertexts CT that do not satisfy Γ * . G S-CCA (1 κ ) is formally defined as follows:

INIT -C executes the setup algorithm, gives the public parameters pp to A and keeps secret mk.

QUERIES -A can repeatedly make any of the following queries for each session j:

• obtain : A queries for the secret jets

{sk j } j∈[1,t]
w.r.t. a set of attributes {S j } j∈[1,t] related to the security level {k l, j }.

• cordec : A sends the pair (CT j , S j ) and asks for the decryption of a selected ciphertext CT j , based on the private key associated to the set of attributes

[G S-CCA (1 κ ) = 1] = 1 2 ± ε.
In this section, we first introduce the access tree model (subsection 5.1) before detailing our SABE concrete construction (subsection 5.2).

Access Tree Model

In SABE, we consider that each access structure, referred to as Γ is defined with respect to two levels:

• Level 1 -the first level encompasses the root node and its direct children. The root node is defined as k l -out-of-c security levels. Each security level k l requires at least p l subsets of attributes and n l subtrees of the root node for the reconstruction of the corresponding secret key v l .

• Level 2 -it corresponds to interior nodes as well as leaf nodes. Each interior node of the tree is a threshold gate and the leaves are associated with attributes, as detailed in Bethencourt et al. construction [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF].

Note that the same notation as [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], is used to describe the access tree. Each non-leaf node of Γ is expressed w.r.t. the number of its children num x and a threshold value t x , where 1 ≤ t x ≤ num x . As introduced in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], three additional functions are defined namely parent(x), att(x) and index(x). The parent(x) function denotes the parent of the node x, the att(x) denotes the attributes associated with the leaf node x and the index(x) denotes a number associated with the node. We denote by Γ x the subtree of Γ rooted at the node x. If a set of attributes S = {a i } i∈ [1,l] , where l is the number of attributes and l ≥ t x , satisfies the access tree Γ x , it is referred to as Γ x (S ) = 1. Hence, Γ is rooted by the root node r. For instance, depending on the number of the attributes l and the number of subtrees n l rooted by the root node, the user may decrypt CT l , w.r.t. k l , such that:

if ∃x ii∈[1,n l ] such that Γ x i (S ) = 1, then Γ k l (S ) = 1
where Γ k l is the access tree for the security level k l .

Concrete Construction

SABE construction is based on the following algorithms:

setup(κ) -this algorithm first selects leveled 4linear maps. In fact, it defines two symmetric pairing functions ê1 and ê2 , such that ê1 :

G 1 × G 1 → G 2 and ê2 : G 2 × G 2 → G 3 ,
where G 1 , G 2 and G 3 are three multiplicative groups of prime order p. It also selects three random generators g, h and f of G 1 , G 2 and G 3 , respectively, such as ê1 (g, g) = h and ê2 (h, h) = f . The setup algorithm defines for each security level k i ∈ K (i.e; K is the security level universe), an element X k i such as ∀k i , X k i = ê2 (h, h) α i , where i ∈ [1, n] α i ∈ Z p and n is the maximum number of security levels. The public parameters pp are defined as follows:

pp = {G 1 , G 2 , G 3 , ê1 , ê2 , g, h, f , p, n, {X i } i∈[1,n] }
The master key mk is the set of generators {h α i } i∈ [1,n] .

encrypt(pp, Γ, M, {k l } l∈[1,c] ) -it first selects a polynomial q x for each node x and sets the degree d x of each polynomial, to be less than the threshold value such that d x = t x -1 (i.e; t x is the threshold value of the node x).

Let q r be the polynomial associated to the root node and defined as q r (x) = s + a 1 x + • • • + a d r x d r , where d r = t r -1. In the following, we denote by a 0 the secret s.

Subsequently, for each security level k l , the encrypt algorithm calculates t rn l auxiliary constants such as:

Σ k l = {X k l -a 1 , • • • , X k l -a tr -n l }
The ciphertext is presented as follows:

CT = {Γ, ∀k l : Ck l = m l • X s k l , Σ k l , ∀y : C y = g q y (0) ,C y = H (att(y)) q y (0) }
where Y is the set of leaf nodes and H is a hash function, such that H : {0, 1} * → G 1 .

keygen(pp, mk, S) -it chooses a random r ∈ Z p and a set of random values {r j } ( i.e; j is the number of attributes of S). The private key sk associated to S is defined as:

sk = { ∀k i ∈ K : D k i = h r -1 α i , ∀a j ∈ S : D j = g r • H ( j) r j , D j = g r j }
decrypt(pp,CT, k l , sk) -for the decryption algorithm, we assume that the decryptor satisfies the k lsecurity level with n l sub-trees of Γ being satisfied. This latter proceeds as follows:

• Level 2 -it works in a recursive manner, relying on the DecryptNode function as presented in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], resulting in F x = ê1 (g, g) rq x (0) , for each node x that belongs to Level 2 of Γ.

• Level 1 -Let S r be the set of a n l -sized set of child nodes x of the root node. Referring to the generalization of Shamir's threshold scheme (Shamir, ) [START_REF] Hassler | Unique Keys Enabling Multithreshold Schemes[END_REF], the decryption algorithm computes two vectors y and a, such as

y = {y i } i∈[1,n l ] = {q r (index(x i ))} i∈[1,n l ] = {q i (0)} i∈[1,n l ]
and a = {a j } i∈[0,d r ] , where a j are the coefficients of the root polynomial of degree d r .

Then, the decrypting entity defines a matrix U = {U i j } = {u i j }, such as u i = index(x i ) and y = U • a. Afterwards, the algorithm takes the first and the last n l -1 columns of U and creates a sub-matrix

U s such that U s = {u i j }, where i = 1, • • • , n l and j = 0,t r -n l + 1,t r -n l + 2, • • • , d r .
Afterwards, the decrypt algorithm computes the inverse matrix of U s , referred to as U s -1 = {v i j }. The inverse matrix is then used to form the following modified system of equations:

U s -1 • y = U s -1 • U • a. The first equation of this system is of the form s k l = a 0 + a 1 λ 1 + • • • + a t r -n l λ t r -n l , where s k l = ∑ n l j=1 y j v 1 j .
To extract the deciphering key, the decrypt algorithm computes F R k l such as:

F R k l = ∏ y k ∈S r [ ê1 (g, g) rq k (0) ] v 1k (1) = ê1 (g, g) ∑ y k ∈Sr rq k (0)v 1k (2) = ê1 (g, g) rs k l (3)
The decrypt algorithm can now decrypt the ciphertext with respect to the k l -security level, such as:

Ck l ê2 (D k l , F R k l ) ∏ k∈[1,t r -n l ],z k ∈Σ k l z k λ k = m l • X s k l X k l s = m l (4)

SECURITY ANALYSIS

In this section, we first prove the correctness of our SABE scheme, in section 6.1. Then, we discuss the security of our proposed scheme with respect to the security model detailed in section 4.2.

SABE Correctness

The correctness of our proposition relies on the correctness of Equation 5:

Ck l ê2 (D k l , F R k l ) ∏ k∈[1,t r -n l ],z k ∈Σ k l z k λ k ? = m k , (5)
where

F R k l = ∏ y k ∈S r [ ê1 (g, g) rq k (0) ] v 1k .
Upon receiving the ciphertext CT , the decrypting entity proceeds as follows based on two levels:

• Level 2 -the decrypt algorithm works in a recursive manner, relying on the algorithm Decrypt-Node as presented in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF].

For each non-leaf node x, having z child nodes, the DecryptNode algorithm outputs F x such as :

F x = ∏ z∈S x F z δ i,S x (0) = ê1 (g, g) rq x (0)
where: S x is an arbitrary k x sized set of child nodes z such that F z = ⊥, i = index(z) and S x = {index(z) : z ∈ S x }. We note that if no such S x exists then the node is not satisfied and the function returns ⊥. • Level 1 -after executing the DecryptNode algorithm for all child-nodes of the root node, the decrypt algorithm proceeds as follows: for the first level, we suppose that the deciphering entity satisfies the k l -security level. Recall that for each security level k l , S r is the n l -sized set of child nodes x of the root node r. To extract the deciphering key, the decrypting entity first defines the vectors a and y and the matrices U, U s and U s -1 , with respect to k l as explained in section 5. Then, it defines the equation

s k l = a 0 + a 1 λ 1 + • • •+a t r -n l λ t r -n l , where s k l = ∑ n l j=1 y j v 1 j and com- putes F R k l
as detailed in Equation 1.

For ease of presentation, we denote by the quan-

tity Ck l ê2 (D k l ,F R k l ) ∏ k∈[1,tr -n l ],z k ∈Σ k l z k λ k .
Finally, the decrypt algorithm deciphers the ciphertext with respect to the k l -security level as follows:

= Ck l ê2 (h r -1 α l , ê1 (g, g) rs k l ) ∏ k∈[1,t r -n l ],z k ∈Σ k l z k λ k = Ck l ê2 (h, h) α l s k l ê2 (h, h) -α l ∑ k∈[1,tr -n l ] a k λ k = Ck l ê2 (h, h) α l (s k l -∑ k∈[1,tr -n l ] a k λ k ) = m l • X a 0 k l X k l a 0 , (a 0 = s) = m l

Selective CCA-1 Security

The resistance of the SABE scheme against is selective chosen ciphertexts attacks relies on Theorem 6.1. Theorem 6.1. Our SABE scheme is secure against selective non-adaptive chosen ciphertext attacks in the Generic Group Model (GGM), under the DLP and the CDH assumptions, with respect to the G S-CCA (1 κ ) security game.

Proof. One of the main challenges to design our SABE scheme was to prevent collusion attacks among users. Hence, as our scheme is based on the CP-ABE construction of Bethencourt et al. [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], it randomizes, in the same way, users' private keys such that they cannot be combined. In fact, each secret element D j , related to an attribute j, encompasses a random value r associated to the user, and r j related to the attribute j, which prevents colluding users to override their rights. Subsequently, SABE is resistant to collusion attacks. In addition, to decrypt a ciphertext w.r.t. a security level k l , A must recover We distinguish two different cases for the G S-CCA (1 κ ) game, as follows:

X k l s = ê2 (h, h) α l •s ,
Case 0: we set only one security level k l * , during the INIT phase such as the public parameter n defined by C is equal to 1. That is, all queried secret keys are associated to the set of attributes S i that decrypt ciphertexts, encrypted w.r.t. k l * , for each session i. As such, we notice that the two first steps INIT and QUERIES of the G S-CCA (1 κ ) are similar to the [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] experiment. Additionally, the challenge access structure selected by A is equivalent to the access policy defined by B (i.e; Γ B = Γ * , where all sub-trees of Γ * have to be included in Γ B ).

Case 1: during the INIT phase, C defines several security levels, where n = 1. Thus, we point out two sub-cases as follows:

• Case 1-a : during QUERIES, a single security level is selected, such that all queried cordec have to return response w.r.t. the pre-fixed k l * , whereas queried private keys are encoded under different security levels, for each session i. That is, B has to select Γ B where subtrees ST i required to satisfy each selected security level {k l } * of Γ * have to be included in Γ B .

• Case 1-b: during QUERIES, the attacker A sends cordec queries to the challenger C with respect to different security levels {k l,i } for each different session i and a ciphertext CT i . We note that CT i may be encoded under different security levels.

During the challenge phase, A sends two different messages M 0 and M 1 and asks C to encipher the selected message under a security level k l * that has never been queried during QUERIES. Hence, B chooses Γ B such that identified subtrees ST i required to satisfy the security level {k l } * of Γ * have to be included in Γ B .

In the G S-CCA (1 κ ) security game, including Case 0 and Case 1, the challenge ciphertext has a component Ck l which is either M 0 • X k l s or M 1 • X k l s (i.e; s is the enciphering secret key). Hence, we consider a modified game, defined in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], in which Ck l is either ê2 (h, h) α l •s or ê2 (h, h) θ , where θ is selected uniformly at random. A has to guess which is the case. The adversary's advantage is obviously equal to ε in the original security game.

In fact, no efficient adversary A can output b = b, in the security experiment Exp A (1 κ ), better than a random guess. Recall that a random guess b by A is equal to b, with a probability 1/2. Thus, we call ε the advantage of A if b = b with the probability 1/2 ± ε.

As such, in the modified game, the adversary advantage is at least ε/2, while considering two equivalent sub-cases: when A has to distinguish between M 0 • X k l s and ê2 (h, h) θ and when A has to distinguish between M 1 • X k l s and ê2 (h, h) θ . Hereafter, we consider A's advantage in the modified game.

G S-CCA (1 κ ) Game Analysis -As introduced in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] [START_REF] Boneh | Hierarchical Identity Based Encryption with Constant Size Ciphertext[END_REF], each element of G 1 , G 2 and G 3 is encoded as a unique random. The encoding properties of elements in G i is presented by ξ 0,i : Z p → {0, 1} * that maps all a ∈ Z p to the representation ξ 0,i (a) of g a ∈ G i and ξ T,i : Z p → {0, 1} * that maps all a ∈ Z p to the representation ξ T,i, j (a) of ê j (g, g) a ∈ G i (i ∈ {1, 2, 3} and j ∈ {1, 2}). The adversary communicates with the oracles to perform actions in G 1 , G 2 , G 3 , ê1 and ê2 based on ξ 0,i and ξ T,i, j representations.

For Case 0, during the INIT phase, C sets n = 1, chooses α ∈ Z p and sends the public parameters ξ 0,1 (1) = g, ξ 0,2 (1) = h and ξ T,3,2 (α) to the adversary. Subsequently, B initializes an empty table T . Then, during QUERIES, A queries several times obtain and cordec algorithms. For each obtain query, C simulates the H oracle function for each string i ∈ S j , queried in session j. The H oracle outputs g t i for each different queried i. In the sequel, for a session j, obtain selects a random r ( j) , computes D k = h α/r ( j) .

Then, for each i ∈ S j , it provides D i = g r ( j) +t i r i ( j) and D i = g r i ( j) . Then, B sets these computed values as new entries in T , and sends them to A.

Then, for the cordec oracle, A submits (S j ,CT j )

and asks for the decryption of CT j , w.r.t. the predefined security level k l * . Hence, B performs the decryption of CT ( j) for each session j and provides a message M j or an error message if the set of attributes does not satisfy the access policy w.r.t. the pre-defined security level. Clearly, the SABE construction is close to the CP-ABE construction proposed by [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF].

The main difference consists in the derivation of the embedded shared secret, obfuscated in the exponent of the related pairing function. Indeed, in addition to Lagrange interpolation proposed by the [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] scheme, in our proposal, the processing of Level 1 of an access structure Γ, with respect to k l * requires pointing out the correct public element

X k l * = Ê2 (h, h) α k , which is different for each level.
As such, to prove that Case 0 is close to the [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] construction, we consider an absurdum reasoning, where A can win Exp A with non-negligible probability. To do so, we consider that the root polynomial in Exp B is equal to q r,Exp B (x) = ∑ p i=0 a i x i , where a 0 = s. In the sequel, we easily verify that there exists one polynomial q r,Exp A , such that q r,Exp A = ∑ p i=0 a i x i and ∑ p j=1 ∑ p i=0 a i x j i = s.

To do, we consider p -1 random values a i , where i ∈ [1, p-1]. As such, we have the following equality:

p ∑ j=1 p ∑ i=0 a i x j i = s = p ∑ j=1 p-1 ∑ i=0 a i x j i + p ∑ j=1 a p x j p (6)
Following Equation 6, we notice that:

a p = s -∑ p j=1 ∑ p-1 i=0 a i x j i ∑ p j=1 a p x j p (7)
From Equation 6and Equation 7, it is worth noticing that the polynomial q r,Exp A exists. Consequently, A receives the challenge ciphertext CT b . If the adversary A can win the Exp A experiment with a nonnegligible probability, then A can guess b which is therefore sent to B. As such, B can win the security game Exp B , introduced in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] with a non-negligible probability. This contradicts our assumption that [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] is proved secure in GGM. Additionally, for Case 0 of G S-CCA (1 κ ), the INIT, QUERIES and CHALLENGE phases relies on one single security level, such that M b contains one single data block w.r.t. the k l security level, this first case follows the selective CCA-security of the Bethencourt et al.'s CP-ABE scheme [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. In the sequel, the advantage of A is at most equal to O( q 2 p ), where p is the order of an additive group F p and q is a bound on the total number of group elements received by any adversary A from its interaction with the G S-CCA (1 κ ) game.

For Case 1, during the INIT phase, C defines n and sends the public parameters ξ

0,1 (1) = g, ξ 0,2 (1) = h and ∀ j ∈ [1, n], ξ T,3,2 (α j ) to B. Let us notice that
Case 1 can be modeled in multi-user setting, such that there are multiple public keys and multiple challenge ciphertexts that can be dependent. In our case, the public keys correspond to the security levels' public parameters X k i and challenge ciphertexts consist of the different chuncks of the challenge message

M * = {m l * } l∈[1,c * ] .
Hence, Case 1 is a generalization of selective CCA security in the multi-user setting and the adversary A, having access to n different public keys, can perform multiple Left-or-Right queries. These challenge ciphertexts must be created with the same selector b; i.e; all ciphertexts are encryption of the left input, or all ciphertexts are encryption of the right input.

During the CHALLENGE phase, we distinguish

Case 1-a, where A sends two messages M 0 and M 1 , the access structure Γ * and a security level k l * ; and

Case 1-b where A sends two messages M 0 and M 1 and the access structure Γ * , which has to be encrypted with respect to a set of security levels {k l * }.

First, for Case 1-a, as the encryption is performed w.r.t. a single security level k l * , then the challenge message has to be composed of one single data block and the cardinal of the set of auxiliary constants is equal to 0 (i.e; |Σ k l | = 0 ). As the sequel, the progress of the CHALLENGE phase of Case 1-a is similar to Case 0, leading us to an adversary advantage equal at most to O( q 2 p ).

Second, for Case 1-b, when A asks for the encryption of the challenge message, C does the following. C first chooses a random s ∈ F p and uses the linear secret sharing scheme associated with the access structure Γ * to construct the shares σ k and λ i of s for all relevant sub-trees k and attributes i, respectively. As detailed in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], both λ i and σ k shares have to be chosen uniformly and independently at random values from F p . Subsequently, the simulation chooses µ randoms θ l ∈ F p , where l ∈ [1, µ] and µ is the cardinal of the set of security levels {k l * } l∈ [1,µ] . Finally, C outputs the encryption of the challenge message such that: for each security level k l , we have Ck l = ê2 (h, h) θ l and Σ k l = {ξ T,3,2 (α l ) -σ t }, where t ∈ [1,t r n l ] and l ∈ [1, µ] (cf; section 5.2). For each relevant attribute i, we have C i = g λ i and C i = g t i λ i . These values are then sent to the adversary. We state that if A asks for a decryption key for a set of attributes that satisfy Γ * w.r.t. any security level, then C does not issue the key. Similarly, if A asks for Γ * , w.r.t. any security level, such that one of the keys is already issued then the simulation aborts. In the sequel, the advantage of the adversary is at most equal to O(µ q 2 p ), due to the randomness of the choice of variable values in the simulation.

In fact, knowing that this randomization is required for generating the ciphertext, A is led to break the CDH assumption. The G S-CCA (1 κ ) security is then considered with respect to the CDH-assumption. Intuitively, here, B relies on the capabilities of A to forge a ciphertext C i obtained from interactions with C in Exp A . Since A and B algorithms are based on coin tosses, the first condition for B to succeed is that it does not abort the game before A. In [START_REF] Ahn | Computing on authenticated data[END_REF], this probability has been shown to be1 e if the probability for the coin flipping to be 0 is 1 ξ c +1 , where ξ c is the number of ciphertexts' queries. The other condition of the attacker is to be able to identify the value of λ i for each C i or to guess the value θ l related to a security level k l . After a time t , this probability is equal to 1 ξ c +1 . This shows that B can violate the CDH-assumption with a probability equal to ε e(ξ c +1) which conflicts the fact that G 1 is a (t, ε)-CDH group. Indeed, the adversary' view in this simulation is identically distributed for all security levels. In fact, despite the multi-user setting environment, the encryptions of data blocks of the challenge message M b are completely independent, thanks to the use of the encoding function ξ T,3,2 . As such, Case 1-b can be considered as µ random repetitions of Case 0 simulation, with respect to µ security levels.

As such, we prove that our SABE construction is secure against selective non-adaptive chosen ciphertexts attacks in the Generic Group Model (GGM), under the DLP and the CDH assumptions, with respect to Exp A (1 κ ) experiment.

SABE PERFORMANCES DISCUSSION

In this section, we discuss the functional properties as well as the processing, communication and storage cost of our SABE construction compared to the naive computing approach NC introduced in section 2.2 and two of the most closely related schemes (Kaaniche and Laurent, 2017a), [START_REF] Khan | Owner specified excessive access control for attribute based encryption[END_REF]. That is, we first present a theoretical performance analysis, based on mathematical operations' complexities, in subsection 7.1. Then, we discuss measurement results of different mathematical operations' computation and present an estimation of the different SABE algorithms calculation times, relying on the cpabe toolkit 1 . Finally, we discuss the support of the threshold feature when designing multi-level access control schemes in subsection 7.3.

Theoretical Performance Analysis

For our theoretical performance analysis, we assess the theoretical complexity where the encrypting entity has to create k different access control policies, associated to k different security levels, for the naive approach. To this purpose, we define, in Table 1 the following costs: Table 2 presents detailed computation, communication and storage overhead comparison, based on the processing cost of the encryption and decryption algorithms and the size of the ciphertext. Note that the It is worth noticing that the size of the master access tree, proposed in our SABE construction, is lower than the size of the set of access trees related to k access policies introduced by the naive approach NC. This is mainly due to the involved number of attributes (access tree leaves), that should be duplicated for different access trees in NC. Obviously, the number of leaves of the master tree Y MT is lower than the sum of leaves of access trees related to k access structures of NC, such that Y MT ≤ ∑ k Y AT k . As such, our SABE approach presents competitive communication and storage costs, compared to the NC approach. Notice that the ciphertext size of our SABE scheme is comparable to the [START_REF] Khan | Owner specified excessive access control for attribute based encryption[END_REF] proposal. Otherwise, our SABE construction presents larger ciphertext-sizes compared to (Kaaniche and Laurent, 2017a), due to additional auxiliary elements associated with security levels. Indeed, these group elements permit our SABE scheme to provide the threshold feature, which is not supported by either (Kaaniche and Laurent, 2017a) nor [START_REF] Khan | Owner specified excessive access control for attribute based encryption[END_REF] schemes.

In addition, based on the NC approach, the enciphering entity has to create an access tree AT to each different security level. Thus, he has to assign different polynomials to each node of each access tree, during the encryption phase. Consequently, the processing and communication costs introduced by the SABE approach are considerably optimized, where the number of polynomials, that have to be assigned to each node of an access tree, is reduced compared to NC, thanks to the use of an aggregate access structure. For the decrypt algorithm, SABE introduces merely the same computation cost generated by the decryption procedure of (Kaaniche and Laurent, 2017a) and [START_REF] Khan | Owner specified excessive access control for attribute based encryption[END_REF], except with only one extra multi-linear map calculation. This processing overhead remains interesting and attractive thanks to the support of threshold feature offering more flexibility for access policies' definition, as discussed in subsection 7.3.

Numerical Performance Analysis

Referring to the cpabe toolkit2 proposed in [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], the computation costs of the key generation, encryption and decryption algorithms are mainly depending on the number of attributes.

The cpabe toolkit provides a set of programs implementing CP-ABE schemes [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], using the PBC library3 for the algebraic operations. The code is split into two packages, libbswabe (i.e; a library implementing the core cryptographic operations) and cpabe (i.e; higher level functions and user interface), proving four main algorithms, namely cpabesetup, cpabekeygen, cpabeenc and cpabedec. To give some information on the performance achieved by our scheme, some experiments are conducted, for several mathematical operations (i.e; exponentiation, multiplication and pairing functions) on an Intel E5-1650-v3 6 cores, where each core relies on 1200 MHz. We set the security parameter to λ = 112, based on the super-singular curve y 2 = x 3 +x over a finite field and we run 1000 samples for getting an average duration.

Our measurements show that the computation of a symmetric pairing function requires approximately 6 ms, exponentiations and multiplications take about 1.2 ms and 0.5 ms, respectively. In addition, as stated above, based on the cpabe toolkit, the calculation of the cpabekeygen algorithm, similar to the keygen algorithm of our proposed algorithm, is perfectly linear to the number of attributes. It takes about 1 second for generating a private key containing around 30 attributes [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. Moreover, it is worth noticing that our encrypt algorithm follows the [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF] construction, except for the generation of auxiliary elements, depending on the execution of exponentiations and multiplications in a multiplicative group. In the sequel, the running time of the decrypt algorithm is also almost perfectly linear to the number of attributes involved in the access policy, where the execution time of cpabeenc algorithm takes 1.5 seconds for 60 gates (i.e; leaf nodes).

Threshold Support

Unlike (Kaaniche and Laurent, 2017a), [START_REF] Khan | Owner specified excessive access control for attribute based encryption[END_REF] schemes and the NC approach, our SABE construction provides the threshold feature, as shown in Table 2. This property aims at offering more flexibility while defining multiple access policies.

+ 2)γM + γε {k|AT |, 2k(1 +YAT )|E|} SABE kγM + 2[k(2 + η k ) +YMT ]γE (ηx MT +YAT )[2γε + γE + γM] + (zηx MT + 2)γM + γε {|MT |, [k(2 + η k ) + 2YMT ]|E|}
Nonetheless, our approach is not convenient when defining different independent access policies under the same master access tree (i.e; there is no duplicated attributes for each defined security level k). Hence, in such use-cases, the NC approach is much more appropriate in terms of processing (i.e; encryption process) and communication costs, mainly due to {η k } c , the set of auxiliary elements that has to be associated to each message m k enciphered with respect to a security level k, where k ∈

[1, c].
Furthermore, it is still inappropriate for hierarchical scenarios that require restrictive privileges, such as for military services. That is, these use cases often rely on encapsulated access structures, defined by hierarchical levels of security, such that each higher level of security k + 1 introduces additional attributes, compared to the security level k, that have to be satisfied with respect to the related access policy AT k+1 .

Finally, thanks to the use of a threshold approach for access policies' definition, SABE presents interesting computation, communication and storage overhead in collaborative use cases, where each security level requires the definition of several combinations of sub-access policies.

POSSIBLE APPLICATIONS

Our SABE scheme comes as an alternative that aims at providing sufficient security with an important gain in processing and communication overhead. In the following, we discuss a set of potential applications for selective attribute based encryption mechanisms, namely monitoring encrypted content, database search as well as mobile communications.

Monitoring Encrypted Contentthis case highlights situations when encrypted contents are usable for monitoring. For example, several applications such as military images, media audience or video surveillance where some faces have to be scrambled, require identifying partially encrypted data files with no need to decrypt the whole contents. Indeed, our SABE mechanism permits to decrypt parts of the enciphered contents with respect to assigned credentials under different security levels.

Database Searchnowadays, databases hold a critical concentration of sensitive information and their volume is increasing very quickly. In such cases, database outsourcing is becoming increasingly popular. Clients' databases are stored at an external service provider that should provide mechanisms for securing access to these contents, mainly by encrypting the outsourced data.

However, the problem consists in ensuring a selective retrieval over encrypted data. Several existing access control mechanisms, designed for distributed applications, operate on client-server architectures with respect to the basic assumption that the remote server is in charge of defining and enforcing access control policies. As such, our SABE scheme addresses the problem of enforcing access control by following up data encryption. The idea is concretely to use different encryption keys for different security levels as proposed, for example, for XML documents. To access such encrypted data, users have to decrypt them by using the appropriate deciphering key. If different users know different keys, with respect to their assigned credentials, they have different access rights.

Mobile Communicationmobile phones, PDAs and various mobile terminals are more and more often used for multimedia communication that require efficient access control mechanisms. Resource consumption is the main limiting factor for the development and deployment of such security mechanisms. This is mainly due to the nature of the smart things, which are resource-impoverished nodes where the implementation of heavy cryptographic primitives is unfeasible. The resource consumption in mobile communications is tied up to the amount of data being processed, stored, and transmitted. As such, reducing the amount of processed and transmitted data can effectively save energy. Our SABE mechanism can be considered as a promoting solution that permits to save computing and storage capabilities of mobile terminals by removing redundant processed information within the network flow. For example, our selective attribute based encryption technique should be a candidate for protecting content in a home multimedia network where some of the receiving devices are expected to be mobile (i.e., resource-constrained) or meant to be very inexpensive. So that, saving computational complexity is very important.

In this paper, we propose a novel cryptographic mechanism to ensure multi-level access control, based on the use of an attribute based encryption scheme. Our selective attribute based encryption mechanism SABE, enables the enciphering user to encrypt the same data content, based on an ABE aggregate access tree, and the deciphering entity to decrypt the subsets of data blocks with respect to a security level k l . Indeed, SABE supports a fine grained access control mechanism with low processing costs, which is directly inherited from the expressiveness of ciphertextpolicy attribute based encryption for defining access policies. Additionally, our proposal is proven secure against selective, non-adaptive chosen ciphertext attacks in the generic group model. Besides, a quantitative comparison of SABE with the naive computing approach shows the gain of our construction with respect to the processing and communication costs, especially due to the use of an aggregate access structure. Finally, we present the potential of SABE technique to support security and privacy in concrete networking and computing applications.

  where the secret sharing key s is embedded in the ciphertext. For this purpose, A has to retrieve the corresponding Ck l and the related private key element D k l from the user's private key.To prove that our scheme is secure against selective non-adaptive chosen ciphertext attacks, we first consider that A is running the G S-CCA experiment with an entity B. This latter is running the Exp B Bethencourt et al. security game[START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF], with C . The objective of this proof is to show that the advantage of A to win the G S-CCA (1 κ ) security game is equivalent to the advantage of B to win the Bethencourt et al. security game[START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. Hereafter, A and B proceed as follows:INIT -C executes setup, gives pp to B and keeps secret mk. Consequently, B sends pp to A. cordec : A sends (CT j , S j ) and queries for the decryption result of the ciphertext CT j , w.r.t. S j . Indeed, B checks if an entry sk j for S j does exist in T w.r.t. {Γ * , k l, j } and retrieves sk j . Then, B deciphers CT j and sends the result to A.CHALLENGE -A submits two equal length messages M 0 and M 1 and gives the access policy Γ * and the set of security levels {k l } * , such that none of the previous sets{S j } j∈[1,t] satisfies Γ * w.r.t. {k l } * .Consequently, B selects Γ B such that Γ B ⊆ Γ * . We have to emphasize that all pre-identified subtrees ST i required to satisfy the security level {k l } * have to be included in the selected access structure Γ B .Afterwards, B sends the access structure Γ B and the two equal length messages M 0 and M 1 , defined by A. C flips a coin b, encrypts M b under Γ B and sends the resulting ciphertext {CT b } * to A.

QUERIES -B sets an empty table T and repeatedly make the following queries, such that for each session j:

• obtain : A queries {sk j } j∈[1,t] w.r.t. a set of attribute {S j } j∈[1,t] associated to {k l, j } security levels. That is, B uses C to derive and send the queried secret keys to A. The private keys {sk j , S j } j∈

[1,t]

are returned to B. Subsequently, B sets a new entry with the pair {sk j , S j } j∈[1,t] and returns {sk j,GID } j∈N to A.

•

Table 1 :

 1 Notations.

	Notations	Description
	γM	cost of two group elements' multiplication in a multiplicative group
	γE	cost of an exponentiation in a multiplicative group
	γε	cost of a symmetric pairing function computation
	γε	cost of a leveled multi-linear map computation
	|MT |	size of an aggregate access tree, referred to as master tree
	|AT |	size of an access tree for an access policy k
	ηk	number of auxiliary elements associated to a security level k
	YMT	number of leaves of the master access tree
	ηx MT	number of interior nodes of the master access tree
	YAT	number of leaves of an access tree, with respect to an access policy k
	ηx AT	number of interior nodes of an access policy associated to a security level k
	|E|	size of a multiplicative group element
	communication and storage overhead are both refer-
	ring to the size of the ciphertext.

Table 2 :

 2 Theoretical Performance Comparisons. +YMT )γE (ηx MT +YAT )[2γε + γE + γM] + (zηx MT + 2)γM + γε {|MT |, 2(k +YMT )|E|} (Khan et al., 2016) 2(k + 1)γM + 2(k + 1)(1 +YMT )γE (ηx MT +YAT )[2γε + γE + γM] + (zηx MT + 2)γM + γε {|MT |, 2(k + 1)|E| + 2YMT |E|} NC kγM + 2k(1 +YAT )γE (ηx AT +YAT )[2γε + γE + γM] + (zηx AT

	Scheme	Processing cost	Ciphertext size	Threshold
		encrypt	decrypt	support
	(Kaaniche and Laurent, 2017a)	kγM + 2k(1

http://acsc.cs.utexas.edu/cpabe/index.html

http://acsc.cs.utexas.edu/cpabe/index.html

https://crypto.stanford.edu/pbc/