Subhadeep Sarkar
email: subhadeep.sarkar@inria.fr

Jean-Pierre Banatre
email: jean-pierre.banatre@inria.fr

Christine Morin
email: ‡christine.morin@inria.fr

Towards Enforcement of the EU GDPR: Enabling Data Erasure

Keywords: Personal data privacy, EU GDPR, Internet of Things (IoT), Data erasure

With the emergence of the Internet of Things (IoT), an increasing need for preserving the privacy of personal data has been realized. In this context, the EU has recently published the general data protection regulation (GDPR), which ensures strengthening of the privacy rights of the data subjects concerning their personal data. In this paper, we present the importance of having a holistic solution aimed towards the enforcement of the GDPR. As a first step towards the enforcement of the GDPR, we present the research challenges in facilitating the erasure of data as per the right to erasure. We also propose the envisaged technical solutions to work through the challenges.

Introduction

Over the past four months Alice has developed this habit of weighing herself every morning using the smart connected-scale she bought. Since last month, Alice has gained some weight and this morning while browsing through the Internet, she has seen a number of advertisements on 'weight losing products' and 'weight losing diets'. Given that Alice is always aware of her personal data privacy, specially those concerning sensitive personal information, this incident is recorded as a breach of privacy. Clearly, Alice's weight records have fallen in the hands of some third party organizations either through active data sharing or by undesired data leakage or security breaches.

In today's smart world, many individuals like Alice, own their personal set of Internet-connected devices, comprising of smartphones, tablets, wearables for well-being and ubiquitous health monitoring, and other connected objects. These devices often collect the individual's private information and personal data for the sake of service provisioning. Aggregation, analysis, and storage of these data are governed by service providers, beyond the visible range of the data subjects. The term data subject corresponds to the natural person, who is the subject of personal data (in oue example, Alice) [START_REF]679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and[END_REF]. Selling and buying of personal data without due . This work was done while Jean-Pierre Banatre was Professor Emeritus at Univ Rennes, Inria, CNRS, IRISA. consent of the concerned data subjects is now more of a trend than an exception [START_REF] Acquisti | What Is Privacy Worth?[END_REF], [START_REF] Boutin | The Secretive World of Selling Data About You[END_REF]. Also, the end users often end up allowing the service providers to use their personal data for business purposes when they agree to the terms and conditions put forward by the providers, in most cases, without reading them [START_REF] Brewster | Facebook, Google and personal data: What's your worth? BBC[END_REF], [START_REF] Morris | Why big companies buy, sell your data? CNN[END_REF]. It is often the case that these service providers use these data for organizational profit (for example, directly selling an individual's data to another party in exchange of money [START_REF] Mirani | The nine companies that know more about you than Google or Facebook[END_REF], [START_REF] Sadowski | Companies are making money from our personal data but at what cost? The Guardian[END_REF]) and also for manipulation of the concerned individuals (like for advertisement purposes [START_REF] Gross | Facebook to show you ads based on your Web browsing[END_REF], [START_REF] Felix | This Is How Facebook Is Tracking Your Internet Activity[END_REF]). Moreover, with the 'capture data at the source' policy, service providers cut the rights and privileges of the data subject on their own data at the very root.

With the advancement in embedded technology and communication systems, we stand today at the brink of a new era of ubiquitous computing, where data stand to be the new currency [START_REF] Eggers | Data as the new currency: Governments role in facilitating the exchange[END_REF], [START_REF] Schmarzo | Data is a New Currency[END_REF]. The Internet-of-things (IoT) is not a technology of the future anymore; rather a reality which awaits the correct season to bloom. A report published by Gartner, Inc. states that an estimated 20.4 billion devices will be connected to the Internet, constituting the IoT ecosystem in 2020 [START_REF]Gartner Says 8.4 Billion Connected "Things" Will Be in Use in 2017, Up 31 Percent From 2016[END_REF]. The unprecedented amount of data generated every day by billions of smart things, form the backbone of a massive data-driven business model. In this context, data privacy and data security [START_REF] Ziegeldorf | Privacy in the Internet of Things: Threats and Challenges[END_REF]- [START_REF] Hwang | IoT Security & Privacy: Threats and Challenges[END_REF] are the key terms which demands to be revisited.

Motivation

Today's standard service model is typically dictated by the service provider with little or no room of customization. The end-users may not express their preferences over the data collection mechanisms and service specifications. The major limitations of the existing service model below are as follows.

(i) Data subjects have no control over their personal data: In the current service model the business agreements are designed solely by the authorities of the service providers. The service policies and contracts are usually compiled and put forward by the service provider, to which the clients of this service, i.e., the data subjecs must agree in order to be able to obtain the service. The users do not have means to express their preferences over the purpose of use, location of processing, sharing policy, or retention policy concerning their personal data. Disagreeing to the terms essentially implies opting out from the service. Hence, more often than not, individuals do not read the terms and conditions of these online contracts [START_REF] Berreby | Click to agree with what? No one reads terms of service[END_REF] and agree to receive the service. (ii) Lack of appropriate data privacy protection measures for IoT: Although there have been disconnected work done on various aspects, such as data confidentiality, access control, and accountability, a holistic solution dedicated to provided end-to-end protection for data privacy is long overdue. Also, the aspect of 'control over data' has always been overlooked and data subjects today have no control over their personal data once the data leaves their personal space. Especially, in the context of the IoT, where data streams generated by the IoT devices flow across the domains of multiple stakeholders (such as the fog and cloud service providers), introduction of a cross-domain and coherent solution for privacy protection is important.

Herein comes the importance of the two primary objectives of our research endeavor: (a) giving back the end-users the control over their personal data and (b) implementing the privacy solutions by the principle of design. Although there have been plenty of discussions on issues such as 'privacy by design' [START_REF]Privacy by Design. Information & Privacy Commissioner of Ontario[END_REF] and 'privacy as operating system service' [START_REF] Ioannidis | Privacy As an Operating System Service[END_REF], implementation of privacy preserving measures at the system level is long overdue.

The Legal Front: The EU GDPR

Cyber-security and data protection measures have failed to evolve apace with the technological shift and evolution of the data-centric business models. However, in recent years, one of the much discussed issues in the cyber-security community has been protection of personal data privacy and rights of citizens over their personal data. As far as Europe is concerned, in 2012, the European Union (EU) drafted a new set of regulation aimed towards protection of data. The General Data Protection Regulation (GDPR) was finally accepted in April 2016 [START_REF]679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and[END_REF], and comes as a replacement the old Data Protection Directive (95/46/EC). The goal of this new regulation is designed to harmonize data privacy laws across Europe with a vision to protect personal data, empower all EU citizens with data privacy and protection rights, and to reshape the way organizations approach data privacy [START_REF]679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and[END_REF], [START_REF]The Guide to Data Protection[END_REF]. Enforced on May 25, 2018, the key changes introduced through the GDPR are as follows.

• Rights of the data subject: One of the main changes proposed in the GDPR is empowerment of the data subjects.

-Right to be forgotten: One of the fundamental changes introduced through the GDPR is the data subject's right to be forgotten, also known as the right to erasure. This specifically concerns the retention period of the personal data collected and on-demand erasure of all records of the information. The service provider must comply with such erasure requests unless it has compelling reasons for acting otherwise (as listed in Art. 17 [START_REF] Boutin | The Secretive World of Selling Data About You[END_REF]). -Right to access: This grants the data subjects to right to obtain information from the service providers concerning the purpose and location of the processing of the personal data obtained from them. The service provider is also responsible to provide the data subject with an electronic copy of all her personal data in its possession, if demanded.

• Consent of the data subject: The GDPR also specifies that instead of long and hard-to-understand terms and conditions, service providers must provide precise and intelligible terms and conditions to the data subjects. Revocation of consent also should not be unnecessarily complicated.

Apart from these, the GDPR also regulates the issues of data portability (from one service provider to another), breach notification, legal assistance through the data protection officers, and penalty for service providers for breach of contract. Thus, the GDPR strengthens the legal front of data privacy protection. This work focuses particularly on empowering the data subjects by allowing them to express their preferences over the usage of their personal data and towards enforcement of the right to erasure. In our example, this will, allow Alice to dictate the purpose of use, the location of the processing, the retention period, and sharing policies concerning her personal data. Alice may also for erasure of all records of her. On the legal side, Alice can lodge a complain or issue an inquiry after she suspects a breach in contract.

Contributions

In the context of the IoT, where billions of Internetconnected devices continuously transmit heterogeneous data streams at a high velocity demanding for real-time services, existing solutions fail to provide a holistic solution for preserving data privacy. The main contribution of this work this to identify the research challenges in providing an end-toend solution for data privacy protect in a multi-stakeholder, distributed service architecture, and present the envisaged potential solutions to those challenges.

We present the fundamental research challenges with respect to implementation of data erasure as per the data subjects' preferences, in this work. At first, we discuss the significance of having a policy language which is customizable by the data subjects based on their preferences, and also highlight the importance and the challenges associated with policy enforcement in a multi-stakeholder service architecture. We also propose the principal mechanisms and design The EU GDPR is the one of the primary catalysts behind our research endeavor. The broader objective of this endeavor is to analyze the technical challenges envisioned in course of enforcement of the GDPR and to propose a set of solutions for protecting data privacy by design.

Paper organization

The rest of the manuscript of is organized as follows.

In Section 2, we present the technical challenges associated with this research undertaking. In Section 3, we present the solutions envisaged to facilitate policy customization and efficient policy management, while the potential solutions towards enabling data erasure are presented in Section 4. Finally, the manuscript is concluded in Section 5.

Technical Challenges

Before we discuss the technical challenges concerning our research endeavor, we present the reference service model. As shown in Figure 1, the service model has three primary categories of stakeholders, i.e., data subject, data controller, and data processor. As per the GDPR, data controller refers to the stakeholder, which dictates the purpose and means of processing of the personal data, and data processor corresponds to the stakeholder which processes the data on behalf of the data controller [START_REF]679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and[END_REF]. In the model, at one end are the data subjects, who own a set of wearable and non-wearable smart devices. Each such device, provides a set of services to the data subject. The data controller is responsible for provisioning of the services concerned. The data subject and the data controller must be bound by a set of business agreements for the service model to be valid. The data controller's ability to obtain the data produced by the IoT devices is based on these business agreements.

Note that, any data produced by the device, in this case, will be considered as personal to the data subject. The data controller may outsource processing of the acquired data to one or more data processors, who are responsible for processing the data on its behalf and sending back the results. These data processors can be referenced as typical fog or cloud service providers.

Next we illustrate, with examples, the challenges in implementing our solution. The right to erasure concerns the data subjects right to ask the data controller to erase all her personal information after a pre-agreed retention period or on-demand. Considering the in an IoT environment, data are transmitted in form of a stream, a data segment is defined as a finite set of data tuples, which arrive successively in a data stream, and data tuple refers to the smallest data unit transmitted by a data producing unit. Data erasure, in this context, is defined as follows.

Definition 1. Data erasure is defined as the process invocation of which, either by the data subject or as per the agreement between the data subject and the data controller, ensures that (i) replication and dissemination of the data segment requested to be erased, must be stopped, (ii) all replicas of the data segment, which are in possession of the data controller and the data processors, must be erased, without undue delay, unless there is a compelling reason as per Art. 17(3) of the EU GDPR for not doing so.

We now present the fundamental research challenges concerning implementation of the right to erasure.

Challenges in Policy Design

First we present the challenges identified in design and management of the privacy policies, in the context of enabling data erasure.

Determining the granularity of erasure: Our first goal is to allow the data subjects to express their preferences over the retention period of their personal data during the contract negotiation phase. The challenge, here therefore, is to optimally choose the granularity of the erasure operation. Now to erase the data, we rely on the cryptographic erasure techniques [START_REF] Gutmann | Secure Deletion of Data from Magnetic and Solidstate Memory[END_REF], [START_REF] Regenscheid | NIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization[END_REF], as they provide the most secured yet fast mode of data erasure and also preserves the integrity of the devices. Erasing data using the cryptographic means essentially corresponds to secured deletion of the encryption keys corresponding to the data. Therefore, smaller erasure granularity (such as hourly or daily) will correspond to managing a higher number of encryption keys (also higher cost). Therefore, based on the sampling rate of the data, the data controller must optimize and ascertain the minimum allowable size of a data segment for the erasure operation, and accordingly construct the erasure-related policies. Considering the heterogeneity of the data and the varied data-rates of different IoT devices (e.g., a wearable ECG sensor transmits a data frame every 0.2 seconds, whereas a smart scale reports only when someone stands on it, i.e., typically 1-5 times in a day), it is a challenge to determine the erasure granularity for different data streams.

Policy management: The business policies, which serve the same purpose are usually compiled together to constitute a business agreement. Management of these business agreements, however, is no less important than design and formalization of the customizable policies. Ensuring the coherence and consistency of the business agreements between the different parties is highly challenging, particularly in a multi-stakeholder and distributed service architecture.

Legal aspects of the policies designed: While our goal is to give back the data subjects the right over their personal data by facilitating policy customization, conformation with the legal regulations is advocated. Also, after the policy negotiation phase is over, and both the stakeholders come to an agreement, it is important to have a verification mechanism that neither party tamper with the policies agreed, and any dispute must be settled through by invoking the mechanism. Design of such mechanism involves challenges both in the technological and legal fronts.

Challenges in Enabling Data Erasure

In order to enforce the right to erasure, invocation of the erasure operation must ensure that the replicas of a given data segment are erased (or will eventually be erased). This includes all replicas of the data located within any of the storage units of the multi-domain, distributed framework. Below, we present the fundamental technical challenges associated with enforcement of the data erasure facility.

Identification of data replication: Given that the EU GDPR is applicable to not only the original data, but also any replicas of the same, it is important for us to identify all replicas of a given data segment. The next research challenge, therefore, is to detect efficiently the process of data replication within a machine. Data, in an IoT ecosystem, are generated and transmitted in the form of streams, and are considered to be stored segment-wise in some persistent storage unit (such as files and databases). Considering that a process either replicates an entire storage unit, or simply a subset of it, identification of the replication operation is a highly challenging task.

Designing the distributed data erasure algorithms: Design and implementation of the data erasure algorithms for a distributed, multi-domain service model is also not straightforward as it involves a number of technical challenges. We present the three main challenges involved with the process of data erasure below.

•

Concerning the erasure technique of data, the question of 'how sensitive personal data can be erased efficiently and securely' itself looms as the biggest research challenge. While cryptographic erasure of data is considered to be fast and secured [START_REF] Gutmann | Secure Deletion of Data from Magnetic and Solidstate Memory[END_REF], [START_REF] Regenscheid | NIST Special Publication 800-88, Revision 1: Guidelines for Media Sanitization[END_REF], 'losing' the key is never simple, as digitally erased data can be retrieved through manipulation of the physical storage disk. Secure management of the keys is also an open research issue.

• Enforcement of the right to erasure fundamentally implies design and implementation of (a) an algorithm that would facilitate automatic erasure of a data segment after expiration of its retention period and (b) another algorithm that would facilitate erasure of data segments on demand of the corresponding data subjects. Now, considering that these algorithms are executed on a distributed, multi-domain service architecture guaranteeing atomicity, mutual exclusion, and consensus is crucial and challenging.

• By definition, data erasure corresponds to erasure of all replicas of a given data segment. However, some data storage sites may be offline or inaccessible when the erasure operation is invoked. Therefore, our final challenge is to ensure 'eventual' erasure of all replicas of the data.

Enabling Policy Customization

While there are multiple languages specifically designed for expression of privacy policies, such as APPEL [START_REF] Cranor | A P3P Preference Exchange Language 1.0 (APPEL1.0)[END_REF], EPAL [START_REF] Anderson | A Comparison of Two Privacy Policy Languages: EPAL and XACML[END_REF], XPref [START_REF] Agrawal | XPref: a preference language for P3P[END_REF], and XACML [START_REF] Anderson | A Comparison of Two Privacy Policy Languages: EPAL and XACML[END_REF], none of the existing languages support customization of the policies based on the data subjects' preferences. To enable customization of the personal data privacy policy as per the preferences of the data subject, it is important to identify the different types of business agreements between the different stakeholders. It is also crucial to provide system solutions to ensure the consistency of the different stakeholders in terms of the version of the contract they agreed to, in order to facilitate policy enforcement.

Business Agreements

First, we define and illustrate the different types of business agreement which may be in place between different pairs of stakeholders.

Definition 2. Service level agreement (SLA) is a formal contract between a service provider and its customer, which details about the nature, quality, scope, span, and responsibilities regarding the service to be provided.

An SLA, in general, includes details of the type of services to be provided, the reliability, responsiveness, expected performance of the services, fallibility and means of recovery, penalty for breach of the agreement, and other constraints. As shown in Figure 2, for the SLA between the data subject and the data controller, the data controller is the service provider offering its services against the data obtained from the data producing unit owned by the subject. For the SLAs between the data controller and the data processors, however, the data controller acts as the client and the data processors provide the services after processing the data obtained from the data controller. A DUA is an agreement between the data subject and the data controller. It includes the privacy rights associated with the data, data confidentiality details, access control, and accountability concerning the violation of the agreement. Definition 4. Data protection agreement (DPA) is a legal contract which describes the obligations to safeguard the data, details about the security measures adopted to protect the data from from both physical harm and cyber-attacks, and about the accountability and compensation in case of a breach, and is offered by an entity (as an individual or an organization) to another from which it acquires the data.

A DPA, therefore, may be in place either between the data subject and the data controller or between the data controller and the data processor, with the latter entity acquiring the data from the former, in both cases. Definition 5. Non-disclosure agreement (NDA) is a legal contract between two or more organizations who agree not to disclose confidential information which is shared among them for certain purposes, but wish to restrict from generalized use.

As shown in Figure 2, there exists an NDA between data processor 1 and data processor 2, i.e., the organizations who exchange data or information in between them for business purposes. Note that, there may be NDAs between the different data processors which are connected in terms of data exchange, as well.

Policy Management

In a multi-stakeholder service model, where different domains are owned and managed by different stakeholders, attaining coherence is challenging. Our objective, thus, is to ensure by design, that all the stakeholders concerning a business agreement are consistent and coherent in terms of the version of the agreement agreed upon, at any point of time. This prevents tampering of the business agreement either by a stakeholder or by an unauthorized third party. The fact that any modification of a local copy of an agreement, in possession of a particular stakeholder, must be approved by every other stakeholder concerned before it is committed, essentially disregards any unapproved modification to an agreement. This, therefore, prevents any of the stakeholders from modifying their local copy of the agreement for their business benefits. Also, cases in which the security of a particular stakeholder is compromised and certain business agreements are maliciously tampered, the principle of unanimous consensus before commit, localizes the breach and helps in recovery. To put it into perspective, in our example with Alice, after successful negotiation of the business contracts between Alice and her service provider, it is important to ensure that both parties have with them the exact same version of the contracts. Therefore, when Alice speculates that her personal data may have been misused and initiates an investigation against the same, she is at least certain of the fact the service provider and she have the same version of the business agreements. In other words, in case of a possible breach in a contract, the service can not come up with a modified (tampered) version of the contract so as to negate the breach. Architecturally, there are two possible ways of solving this issue, which we discuss on below.

Centralized approach: The centralized approach involves a central trusted verification authority (TVA), which acts as the management authority for the business contracts between different groups of stakeholders. The TVA can either operate at a global scale or in a region-specific manner, based on the location of the stakeholders. The operating principle is based on simple timestamp-based verification. After successful negotiation of contracts between a group of stakeholders, each stakeholder independently sends a digitally signed copy of the contract (the one, which is at their possession) to the TVA. After receiving the duly signed copies from all the stakeholders concerning the agreement, the TVA performs a coherence check on the coherence of the agreement timestamp (i.e., the time when the negotiation was successful), followed by a consistency check on the different copies of the agreements. One verified to be coherent and consistent, the TVA retains a copy of the signed contracts and sends a message bearing a unique validation reference to the corresponding stakeholders. Otherwise, it simply sends to all the stakeholders, informing about the disparities observed. In cases of modification of an existing contract, the same process is followed and a modification is only considered to be in place, only after the validation reference is issued by the TVA against the modified version of the contract. However, there are a couple of disadvantages of this centralized approach.

• Trust issues: A major point of concern for this approach is the trustworthiness of the centralized authority, and therefore, its composition. The most plausible solution to this, would be to entrust the cyber-police to take up this role. However, as it stands, this needs more careful investigation before we entrust someone with the responsibility.

• Single point of failure: Like most centralized solutions, this approach also suffers from single point of failure, i.e., in this case, if the TVA crashes or is compromised, all records are lost. One potential solution to this issue is to add redundancy to it.

The other way of managing the business contracts is a distributed one with no central authority involved.

Distributed approach: The distributed policy management approach basically thrives on the principle of distributed ledger technology (DLT) [START_REF] Evans-Greenwood | Distributed Ledgers & Linked Data[END_REF], [START_REF] Khan | A Distributed-Ledger Consortium Model for Collaborative Innovation[END_REF]. The idea is that once agreed upon, each stakeholder stores the contract as a part of a continuous ledger stored at their end. Any modification of this ledger may take place only after a consensus is reached among all stakeholders of the agreement, and in form of appending to the list. A distributed ledger is essentially a database which is managed and updated independently by each participant node of the network. Every node processes every transactions taking place within the network independently and derives its own conclusions. A node then casts its vote against its derived conclusions. Once a consensus is reached, all nodes update their own version of the ledger, and thus, a single identical copy of the ledger is maintained throughout the network. Every entry in the ledger has a timestamp associated with it and bears a unique cryptographic signature, which ensures the integrity and consistency of the ledger.

One possible implementation of this DLT is blockchains [START_REF] Christidis | Blockchains and Smart Contracts for the Internet of Things[END_REF], [START_REF] Luu | Making Smart Contracts Smarter[END_REF]. DLT offers multiple advantages over the centralized approach. First of all, dis-intermediation by a centralized authority makes the process of validation simpler and issue of single point of failure is resolved. Moreover, DLT does not require trust to be placed on any authority and can operate in a ecosystem comprising of untrusted parties as well. It also offers transparency among all stakeholders of the system and guarantees timely validation of the requests. However, it may require additional redundant computations to be performed, which may lead to higher energy consumption and computational cost.

Given the multi-fold advantages of the distributed approach over its centralized counterpart, we are inclined towards adopting it for the sake of efficient and secured policy management. Also, each agreement must have an exclusive reference, known as the unique agreement identifier (UAI), through which any agreement can be uniquely identified. We will have to design a means to uniquely identify the business agreements, as it will be used as a reference to identify the contracts associated with a data stream.

Implementation of Data Erasure

Towards enabling data erasure in a multi-stakeholder, distributed service model, we present the primary objectives.

A. Tracking all replicas of data: Tracking all replicas of the data segments in a multi-domain architecture by correctly identifying the data storage location. B. Enabling data erasure: Design of a set of distributed services, which will ensure 'eventual' erasure of all replicas of the data segment.

Tracking of Data

In order to facilitate erasure of all replicas a given data segment, the first milestone is to identify the (persistent) storage location of the data segments. Considering the multidomain service model, as described in Figure 1, the flow of data spans multiple processing devices located at different domains. In each of these devices the data may be replicated multiple times during the course of its processing. We, therefore, have two primary challenges associated with data tracking are as follows.

(i) Identifying the event of data replication (ii) Locating the storage location of all replicas of the data segment

We present the solutions envisaged to address each of these challenges below.

Identification of the event of data replication

We investigate into how to track all replicas of a given data segment, and for this we first need to distinctively identify the system processes, which are responsible for replication of data. Note that, by replication, here we specifically refer to duplication of data segments where for the original and replica data segments reside in the same computing device. Any cross-device duplication of data are categorized under data flow management.

To efficiently detect the process of data replication we envision to exploit the operating system capabilities. By restricting the purpose (read or write) for which a process may access a persistent memory location, we first of all regulate the privilege under which the data may be accessed. The next phase is to detect whether or not a process with sue access privilege is making a replica of the data. Considering that a process either replicates an entire storage unit, or simply a subset of it, identification of the replication operation is a highly challenging task. Herbster et al. [START_REF] Herbster | Privacy Capsules: Preventing Information Leaks by Mobile Apps[END_REF] proposed the concept of privacy capsules (PCs), which is an Android platform execution model for mobile applications that prevents unauthorized flow of information. Although, the scope of the work is restricted to monitoring data flow within a single device, the principles of PCs can be useful for process monitoring, in our context. We will develop a novel mechanism by linking the principles of PC with the operating system capabilities, to put restrictions on processes to access certain memory addresses containing the sensitive personal data.

Locating all data replicas

In order to locate the location of the data replicas, we first need to track the flow of the data. Data slow may be broadly categorized into two types -(a) flow of data from one device to another within the same domain, and (b) flow of data from one device to another, where the devices are located in different domains. For this, we propose a novel tainting method which will help in uniquely tainting [START_REF] Enck | TaintDroid: An Information-flow Tracking System for Realtime Privacy Monitoring on Smartphones[END_REF] the data stream generated by each data producing unit. Every data stream is tainted at the source and the same taint is carried forward even when the data transits across domains. The taint contains, as a part of it, the relating UAI, which assists in quick referencing to the business agreements. The taint-tables store the necessary information about which tainted data-stream has been re-directed to which physical machine. The taint-tables can only be accessed or modified by processes (or threads) with due capabilities, i.e., appropriate access rights. Another challenge, in this regard, which will be interesting to examine, is ensuring cross-domain integrity of the information on data flow and storage.

It is, therefore, evident that operating system capabilities are to play an important part in design of our proposed solution. For this, the services provided by the operating system, and thus, the choice of operating system would be crucial.

Enabling Data Erasure

The final piece of the puzzle is to design a distributed mechanism to facilitate the erasure of data. Given that we now have the required information about the storage location of all replicas of the data segment to be erased, we have to design data erasure mechanism. Towards this, we have identified the following challenges.

(i) Design of a secure data erasure technique (ii) Design of the data erasure algorithms (iii) Enabling eventual erasure of inaccessible data We discuss about each of the challenges separately below.

Designing the data erasure technique

Considering the fact that the work deals with erasure of personal and sensitive personal data, it is important to wisely choose an erasure mechanism, which would securely erase the data, leaving behind minimum contingent of retrieval of the erased data. For this, we rely on encryptionbased erasure techniques, where instead of erasing the data segments in question, we 'lose' the encryption (or decryption) key corresponding to the segments. However, 'losing' the key is never very straightforward, as retrieval of the key, through any possible means, indicates access to all the erased data. For this, we will investigate secure key storage techniques, such as secure element (SE) [START_REF] Urien | Towards secure elements for the Internet of Things: The eLock use case[END_REF] and hardware security module (HSM) [START_REF] Koppel | Analysis of a hardware security module's high-availability setting[END_REF], which offer hardware-based solutions for secure key storage and application execution. However, these solutions suffer from the problem of single-point of failure, i.e., if the device stops operating or the authentication unit within the device does not function properly, all data associated with the keys, which are stored inside the device, effectively becomes 'lost'. Also, hardware-based solutions are often costly and may induce performance overhead. Our research, therefore, aims towards designing of an erasure technique, which is secured, cost-effective, and resistant to failures.

Design of the data erasure algorithms

In this work, we focus on erasure of data driven by two factors -(a) erasure of data after the expiration of its retention period and (b) erasure of data on the demand of the data subject. We plan to design two separate algorithms for each type of erasure. Erasure of data after expiration of its retention period is directly associated with the contract associated with the data segment in question, and the erasure algorithm will be automatically invoked in due course of time. On the other hand, the erasure algorithm for on-demand erasure of data has to be manually invoked by the administrator for it to take effect. The main challenge in designing these algorithms is to ensure that integrity of the storage policy is preserved following the erasure mechanism. Considering that information derived from the raw data may also be categorized as personal data, lossless and integrity-preserving erasure of data in a multi-domain service model is a challenge. Note that, the erasure operation is invoked only if the erasure policy or erasure request complies with Art. 17(3) of the GDPR. Otherwise, for data which may be retained by the data controller for research purposes and in public interest, the data segments in question undergo the process of pseudonymization. Pseudonymization of data, however, is beyond the scope of this work, and is a part of our future work.

Enabling eventual erasure of data

The erasure algorithms, discussed till now, are designed to erase all accessible replicas of the data segment to be erased. However, some data storage sites may be offline or inaccessible when the erasure operation is invoked. Our goal, therefore, is to ensure eventual erasure of all replicas of the data. For this, we will design a persistent erasure technique, that holds the last state of the uncommitted or partially committed erasure requests, and effects opportunistic erasure of the same. This will guarantee that data will never be used anymore once an erasure request is issued.

Conclusion

This work is poised as a position paper aiming for the enforcement of the EU GDPR focusing on the right to erasure. We identified the research challenges in enforcement of the right to erasure -one of the crucial changes introduced through the GDPR. We also presented some technical solutions envisaged to overcome the challenges and facilitate erasure of data as per the GDPR norms. Our next objective is to implement the proposed solutions and validate their correctness. We also plan to extend this work by investigating on how to provide support at system level for the other regulations of the GDPR.

Figure 1 :

 1 Figure 1: Service model highlighting the domains of the different stakeholders

Figure 2 :

 2 Figure 2: Data flow outline


Andrea Gilberto Filippini
email: andrea-gilberto.filippini@u-bordeaux.fr

Sébastien De Brye
email: sebastien.de-brye@u-bordeaux.fr

Vincent Perrier
email: vincent.perrier@inria.fr

Fabien Marche
email: fabien.marche@umontpellier.fr

Mario Ricchiuto
email: mario.ricchiuto@inria.fr

David Lannes
email: david.lannes@math.u-bordeaux.fr

Philippe Bonneton
email: philippe.bonneton@u-bordeaux.fr

Sébastien

UHAINA : A parallel high performance unstructured near-shore wave model

Keywords: Green Naghdi equations, Phase-resolving wave model, Wave breaking, Discontinuous Finite Element, Unstructured meshes

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Thème 1 -Hydrodynamique côtière 1. Introduction For several decades the population density in coastal areas has significantly increased. This trend is expected to continue in the next decades. Consequently, extreme ocean events, such as tsunamis or storm waves, have increasing damaging consequences. This makes risk assessment a crucial element for the safe development of these communities. In this context, it is essential to dispose of robust and yet efficient models for predicting extreme events involving the propagation of waves in the near shore, and their impact on the coast. Over the past years, strong efforts have been made by the French laboratories and research centers EPOC, IMAG, IMB, and INRIA BSO to advance the state of wave modelling and flooding simulations for coastal engineering applications. These efforts have recently focused on developing and validating the newly developed non-hydrostatic wave-flow model UHAINA. This model will integrate the collective know how on non-linear wave modelling, high order numerical discretizations, and high performance object oriented implementation developed in the last decade. Typical applications of UHAINA will be the study of the propagation and transformation of waves in the surf and swash zones, such as wave shoaling, dispersion and breaking together with coastal flooding and structure overtopping. In recent years, Boussinesq wave models have become a useful tool for modeling surface wave transformation from deep water to the swash zone. Great improvements have been obtained in the derivation and mathematical understanding of particular asymptotic models able to describe the behaviour of the solution in some physical specific regimes; a recent review on different existing models is given in [START_REF] Lannes | Derivation of asymptotic two-dimensional timedependent equations for surface water wave propagation[END_REF]. In particular, great efforts have been focused on improving the range of model applicability with respect to classical restrictions to both weak dispersion and weak nonlinearity. The use of the so-called fully-nonlinear formulation of [START_REF] Green | A derivation of equations for wave propagation in water of variable depth[END_REF] eliminates the restriction to weak nonlinearity, enhancing the models capabilities in the surf and swash zones, where the wave breaking point is attended in conditions of increased nonlinearity. For these reasons, the Green-Naghdi equations have gained a lot of attention in the recent past. UHAINA uses a nonclassical variant of this model with improved linear dispersion properties and which allows a faster solution procedure [START_REF] Lannes | A new class of fully nonlinear and weakly dispersive Green-Naghdi models for efficient 2D simulations[END_REF]. Phase-resolved modelling, based on Boussinesq-type equations and in conjunction with suitable numerical techniques, has emerged as a mature discipline and generated the most widely employed predictive tools in coastal engineering and in morphodynamics, as e.g. FUNWAVE (KIRBY et al., 1998) or COULWAVE [START_REF] Liu | Modeling wave generation, evolution, and interaction with depth-integrated, dispersive wave equations[END_REF]. UHAINA fits into this category of models, embedding the most recent research progresses in coastal wave modelling, making them accessible to anyone. To do so, the platform relies on libraries developed at Inria, such as the AeroSol finite element library (for its hydrodynamic core), and the libraries PaMPA and SCOTCH to handle transparently for the model developer data management in distributed memory parallel XV èmes Journées Nationales Génie Côtier -Génie Civil La Rochelle, 29 au 31 mai 2018 computations. The use of these libraries, and in particular AeroSol, offers a wide range of possibilities including both continuous and discontinuous High-Order finite element discretizations, hybrid meshes (structured and unstructured), as well as a code design driven by performance purposes (HPC) using advanced C++ programming techniques.

In what follows, Section 2 summarises the essential model, as well as numerical and computational aspects featuring in UHAINA. In Section 3, a few application examples are then presented, reflecting both capabilities and performances. Finally, Section 4 concludes the paper with some closing remarks.

Modelling framework

2.1 Physical model Modeling nonlinear coastal wave processes, such as inundation, wave runup, bore propagation, tsunami propagation, and infragravity waves, requires efficient and accurate computing of the evolution of highly nonlinear and dispersive surface wave fields in complex coastal environments. UHAINA relies on a phase-resolving approach, based on the fully-nonlinear and weakly-dispersive Boussinesq wave model of [START_REF] Green | A derivation of equations for wave propagation in water of variable depth[END_REF]. This system of equations shares the same linear dispersion properties of the original Boussinesq model of PEREGRINE (1967), however an equivalent model with improved dispersion properties has been proposed in [START_REF] Chazel | Numerical simulation of strongly nonlinear and dispersive waves using a Green-Naghdi model[END_REF], by the introduction of a tuning parameter α multiplying some dispersive terms. The new formulation of the governing equations, proposed by [START_REF] Bonneton | A splitting approach for the fully nonlinear and weakly dispersive Green-Naghdi model[END_REF], allows the system of governing equations to be rewritten as follows:

∂t ζ+ • (hu) = 0 (1) ∂t (hu) + • (hu ⨂ u) + gh ζ = ϕ (2) (I + αT)(ϕ) -T(gh ζ) + hQ(u) = 0
(3) having used ζ to indicate the free surface elevation, h for the total water depth, u for the velocity vector, and where ϕ accounts for the non-hydrostatic effects, I is the identity matrix, while T and Q are operators containing high-order derivatives in space (for more details on their definitions please refer to the cited works). A two steps solution procedure is applied to the system (1)-(3), as described in [START_REF] Filippini | A flexible genuinely nonlinear approach for nonlinear wave propagation, breaking and run-up[END_REF]. It consists in: an elliptic phase (3) in which the source term ϕ is computed by inverting the coercive operator associated to the dispersive effects; an hyperbolic phase in which the flow variables are evolved by solving the Shallow Water equations (1)-( 2), with all nonhydrostatic effects accounted for by the source ϕ computed in the elliptic phase. The main advantage of this formulation is the presence of the operator (I+αT), which makes the model robust with respect to high frequency perturbations, an interesting property for numerical computations. However, the inversion of the (I+αT) matrix, for the solution of the elliptic phase, is the most computationally demanding part of the whole solution process. This is due to the fact that, firstly, (I+αT) is a matricial second order Thème 1 -Hydrodynamique côtière differential operator acting on two-dimensional vectors and this structure entails a coupling of the time evolutions of the two components of hu through (2). Secondly, T(h(x,t)) is a time-dependent operator, through the dependence on h: the corresponding matrices have, thus, to be assembled at each time step or sub-steps. In order to overcome these drawbacks without loosing the benefits of the formulation (1)-( 3), UHAINA exploits new very promising non-classical models derived by [START_REF] Lannes | A new class of fully nonlinear and weakly dispersive Green-Naghdi models for efficient 2D simulations[END_REF]. While keeping the same asymptotic O(μ 2 ) order (being μ = (h 0 / λ) 2 the dispersion parameter, with h 0 the reference water depth and λ the typical wave length), and linear properties of the original model, LANNES & MARCHE ( 2015) have shown that it is possible to rewrite the elliptic equation (3) in a way such that the new operator to invert to be either block diagonal or block diagonal and time-independent, leading to considerable improvement in terms of computational time, since it allows to perform the corresponding matrix assembling and factorization in a pre-processing step. For the representations of dissipative wave-breaking events, UHAINA exploits the hybrid strategy of TISSIER et al. (2012[START_REF] Kazolea | Numerical treatment of wave breaking on unstructured finite volume approximations for extended Boussinesq type equations[END_REF] and DURAN & MARCHE (2017), by locally reverting to the Shallow Water equations to model energy dissipation in breaking regions.

Numerical discretization

From the numerical point of view the Green-Naghdi equations have been discretized using different numerical techniques including Finite Differences (FD), Finite Elements (FE) and Finite Volumes (FV) approaches. The major challenges that need to be dealt with are the approximation of the complex higher order derivative terms, in respect of the accuracy requirements on the schemes in terms of low dispersion errors. Fully unstructured solvers, allowing for adaptive mesh refinement, have been proposed based either on a hybrid FV/FE approach [START_REF] Filippini | A flexible genuinely nonlinear approach for nonlinear wave propagation, breaking and run-up[END_REF] or on a discontinuous FE approach (DURAN & MARCHE, 2017). Inspired by these works, UHAINA is focused on the application of a FE discretization of the governing equations. This gives a framework to naturally introduce higher order polynomial representation of the unknowns and of their derivatives. UHAINA adopts an arbitrary high-order discontinuous FE discretization of the hyperbolic phase, exploiting the robustness and shock capturing capabilities of this approach in wave breaking regions, where the Shallow Water equations are solved, due to the hybrid breaking model used. The use of a nodal approach together with the prebalanced formulation of the hyperbolic part of the model allows to combine two important properties (DURAN & MARCHE, 2017): firstly, an efficient quadrature free treatment for the integrals which are not involved into the equilibrium state preservation; secondly, a quadrature-based treatment with a lower computational cost, needed to exactly compute the surface and face integrals involved in the preservation of the steady states at rest. Moreover discontinuous FE approach has a compact stencil; a XV èmes Journées Nationales Génie Côtier -Génie Civil La Rochelle, 29 au 31 mai 2018 property which makes it well-suited for parallel computing. Concerning the discretization of the elliptic phase, a second order FE approach is here used, leading for the fully coupled scheme to a phase accuracy very close to that of a fourth order FD method, as stated in the works of [START_REF] Filippini | A flexible genuinely nonlinear approach for nonlinear wave propagation, breaking and run-up[END_REF] and DURAN & MARCHE (2017).

HPC Implementation

High-order accuracy, computational efficiency and parallelism are among the main targets of the UHAINA platform. In order to achieve these objectives UHAINA relies on the Aerosol library, developed at the INRIA SO institute. Aerosol is a C++ library, devoted to the solution of complex CFD problems and recently adapted to deal also with hydrodynamic applications. It is a high order finite element library based on both continuous and discontinuous elements on hybrid meshes, involving triangles and quadrangles in two dimensions. More precisely, it enables the generation of finite element classes up to the fourth order polynomial approximation. The code design is driven by the purpose of performance using advance C++ programming techniques and employs an efficient parallel implementation, which allows high performance computing on massively parallel architectures. Aerosol depends on the PaMPA library for memory handling, for mesh partitioning, and for abstracting the MPI layer, and it is also linked with external linear solvers (e.g. BLAS, PETSc 4 and MUMPS 5 ). At present, only the hyperbolic part of the model is operational, while the development of the non-hydrostatic part of the model is currently underway.

Preliminary results

Convergence test

Firstly, we report a convergence study performed on an academic test, which allows us to asses the theoretical order of accuracy of the implemented scheme.

The test proposed consists in propagating a subcritical flow over a submerged bump described by the function 0.5 2 / exp 0.5 10 . The free surface elevation is initially set as constant at η = 2 [m] and a constant discharge of q = 4. 42 [m 2 /s] is injected from the left boundary of the domain, while an open boundary is simulated on the right. The result of the simulation is shown in Figure 1 (left). The test is performed using the nonlinear shallow water model, for which an analytical solution to this problem exists [START_REF] Goutal | A discontinuous Galerkin method for a new class of Green-Naghdi equations on simplicial unstructured meshes[END_REF]. This allows us to perform a grid convergence of the error using different order of polynomial approximation in our numerical scheme. The test case is performed on a set of four meshes successively dividing the space step by two up to dx = 0.125 [m], while keeping the time step small enough to ensure that the leading error order is provided by the spatial discretization.

The slopes obtained from the errors, in Figure 1 (right), reveal that the convergence rates of the scheme match the theoretical values for all the combinations. Figure 1. Left: Steady subcritical flow over a bump; illustration of the profile of water surface and bottom. Right : convergence of the L 2 norm of the error with respect to the inverse of the number of degrees of freedom, when polynomial approximations of order P 0 , P 1 , P 2 and P 3 are used in the scheme.

Real case application

Hereafter, UHAINA is applied to numerically reproduce the laboratory experiment of PARK et al. (2013). This is a very recent benchmark test for tsunami inundation of an urban waterfront. A 1:50 scale idealization of the town Seaside, Oregon was designed to observe the impact of a tsunami wave and measure the water flows which are produced around the city buildings. The scale model was installed in a rectangular basin with a wavemaker on the offshore boundary. Free surface elevation and velocity time series were measured and analyzed at 31 points along 4 transects (please refer to the cited work for the precise setup of the experiment and gauges positions).

The numerical simulation has been performed using the shallow water model. Figure 2 shows two different views of the computational domain during the simulation, one before (left) and the other just after (right) the tsunami impacting the town. The computed free surface time series at some significant gauges (Figure 2, left), located along the central street of the city, are illustrated in Figure 3 and compared with respect to the experimental ones. The comparisons show a good agreement between the numerical and the physical model in the most of the locations inspected. However, as known, the shallow water equations, applied for the numerical simulation, underestimate the shoaling of the tsunami wave over the sloping beach. This cause the computed peak of the first incoming wave to be smaller than the experimental one, an effect which is visible in the signal registered at gauge B1 (the one situated close to the seaside). La Rochelle, 29 au 31 mai 2018

Conclusions and perspectives

A new non-hydrostatic wave-flow modelling platform named UHAINA is presented in this work. It is devoted to the prediction of surface waves transformation processes in coastal waters, gathering the following numerical properties: it provides arbitrarily highorder discretization of a new non-classical formulation of the Green-Naghdi equations; it works on unstructured meshes; it exploits an efficient parallel implementation, allowing HPC, through the use of the Aerosol library and its dependencies.

To validate the currently operational part of the code and to demonstrate its potential, two test cases have been presented for demonstration and validation purposes, showing that an arbitrary order of accuracy of the numerical scheme is correctly obtained and that the scheme is able to correctly reproduce a realistic case of study in a complex flooding scenario.

Figure 2 .

 2 Figure 2. Three dimensional views of the Seaside numerical simulation, at two different instant of the computation: before (left) and just after (right) the tsunami arrival. Red bullets correspond to some gauges positions.

Figure 3 .

 3 Figure 3. Time series of the free surface elevation at some gauges positions along the main street of the city, perpendicular to the sea line: blue lines indicate the results of the simulation, while red lines stay for the experimental ones.

Thème 1 -Hydrodynamique côtière Further developments will lead in the coming years to a favorable environment for a large community of users to perform real-time large simulations with pre-and postprocessing of the data, and will make UHAINA a new generation robust and computationally efficient phase-resolving numerical wave model very suitable for practical application studies. PARK H., COX D.T., LYNETT P.J., WIEBE D.M., SHIN S. ( 2013