Patrice Camy
email: patrice.camy@ensicaen.fr

R Soulard
email: remi.soulard@oca.eu

P Loiko

L Guillemot
email: lauren.guillemot@ensicaen.fr

G Brasse

J.-L Doulan

A Braud

A Tyazhev
email: tyazheva@coria.fr

A Hideur
email: ammar.hideur@gmail.com

F Druon

> REPLACE THIS LINE WITH YOUR PAPER IDENTIFICATION NUMBER (DOUBLE-CLICK HERE TO EDIT) < 1

Keywords: Solid-state lasers, laser transitions, midinfrared, spectroscopy. I

The 3 H 4 → 3 H 5 transition of Thulium ions (Tm 3+ ), which features laser emission at ~2.3 µm is studied in details. We revise the conditions for efficient laser operation using a rateequation model accounting for the ground-state bleaching, crossrelaxation and energy-transfer upconversion (ETU). We show that ETU has a crucial role in reaching more than unity pump quantum efficiency (QY) for ~2.3 µm Tm lasers based on highlydoped crystals. A Ti:Sapphire pumped quasi-continuous-wave 3.5 at.% Tm:LiYF 4 laser generated 0.73 W at 2306 nm with a record-high slope efficiency of 47.3% (versus the absorbed pump power) featuring a QY of 1.27. Diode-pumping of this crystal yielded a peak output power of >2 W. The first 2.3 µm Tm waveguide laser is also reported based on Tm:LiYF 4 epitaxial layers with even higher doping of 6.2 at.% generating 0.23 W with a slope efficiency of 19.8%. The spectroscopic properties of Tm:LiYF 4 relevant for the ~2.3 µm laser operation are revised as well.

during the combustion experiments [START_REF] Webber | In situ combustion measurements of CO, CO2, H2O and temperature using diode laser absorption sensors[END_REF]. They are also relevant for non-invasive glucose measurements [START_REF] Fard | Optical absorption glucose measurements using 2.3 µm vertical-cavity semiconductor lasers[END_REF].

There exist several possibilities to achieve laser emission at ~2.3 µm. The first option is to use transition-metal-ion doped II-VI materials, i.e., Cr 2+ :ZnS or Cr 2+ :ZnSe [START_REF] Sorokina | Broadly tunable compact continuouswave Cr 2+ :ZnS laser[END_REF][START_REF] Wagner | Continuous-wave broadly tunable Cr 2+ :ZnSe laser[END_REF]. However, the synthesis of zinc chalcogenide crystals and ceramics with high optical quality is complicated and, moreover, these gain media cannot be directly pumped by laser diodes. The second option is the use of semiconductor materials (GaInAs on InP or GaInAsSb on GaSb) [START_REF] Cerutti | Vertical cavity surface emitting laser sources for gas detection[END_REF][START_REF] Geerlings | Widely tunable GaSb-based external cavity diode laser emitting around 2.3 µm[END_REF][START_REF] Wang | Heterogeneously integrated III-V-on-silicon 2.3µm distributed feedback lasers based on a type-II active region[END_REF][START_REF] Boehm | Comparison of InPand GaSb-based VCSELs emitting at 2.3 µm suitable for carbon monoxide detection[END_REF], in Vertical-Cavity Surface-Emitting Lasers (VCSELs) with a sophisticated design.

An easier way to generate the ~2.3 µm laser emission is to use optically-pumped dielectric materials (crystals or glasses) doped with trivalent Thulium ions (Tm 3+ ). Tm 3+ possesses an electronic configuration of [Xe]4f 12 and it is well-known for its near-infrared (NIR) laser emission at ~2 µm due to the 3 F 4 → 3 H 6 transition [START_REF] Stoneman | Efficient, broadly tunable, laserpumped Tm:YAG and Tm:YSGG cw lasers[END_REF], see Fig. 1(a). Tm 3+ -doped materials are typically pumped at ~0.8 µm (to the 3 H 4 level), e.g., using Ti:Sapphire lasers or high-power AlGaAs laser diodes. There exist a very efficient cross-relaxation (CR) process for adjacent Tm 3+ ions which promotes this pumping scheme, Tm 1 ( 3 H 4 ) + Tm 2 ( 3 H 6 ) → Tm 1 ( 3 F 4 ) + Tm 2 ( 3 F 4 ). Thus, the pump quantum efficiency may approach 2 leading to reduced heat loading and high laser slope efficiency well exceeding the Stokes limit [START_REF] Van Dalfsen | Thulium channel waveguide laser with 1.6 W of output power and ~80% slope efficiency[END_REF]. 3+ ions is according to [START_REF] Jenssen | Analysis of the optical spectrum of Tm 3+ in LiYF4[END_REF]. The ~2.3 µm MIR emission is related to less common Tm 3+ transition, 3 H 4 → 3 H 5 [START_REF] Caird | Characteristics of roomtemperature 2.3-µm laser emission from Tm 3+ in YAG and YAlO3[END_REF], Fig. 1(a). Due to the small energy gap of about 2000 cm -1 between the lower laser level ( 3 H 5 ) and Efficient Tm:LiYF 4 Lasers at ~2.3 µm: Effect of Energy-Transfer Upconversion Pavel Loiko, Rémi Soulard, Lauren Guillemot, Gurvan Brasse, Jean-Louis Doulan, Alain Braud, Aleksey Tyazhev, Ammar Hideur, Blandine Guichardaz, Frédéric Druon and Patrice Camy N the lower-lying excited-state ( 3 F 4 ), the former one is rapidly depopulated by the multi-phonon non-radiative (NR) relaxation, so that the ions are accumulated in the 3 F 4 metastable multiplet [START_REF] Pinto | Tm 3+ :YLF laser continuously tunable between 2.20 and 2.46 µm[END_REF]. Thus, the ~2.3 µm laser transition representing a quasi-four-level laser scheme is not selfterminating. A summary of bulk ~2.3 µm free-running and continuouswave (CW) Tm lasers reported to date is shown in Table I. In early papers [START_REF] Caird | Characteristics of roomtemperature 2.3-µm laser emission from Tm 3+ in YAG and YAlO3[END_REF][START_REF] Bar-Joseph | 2.32-micron flash-lamp-pumped high-repetition-rate laser operation in Tm:Cr:YAG[END_REF], pulsed laser operation has been achieved in Tm,Cr:Y 3 Al 5 O 12 and Tm,Cr:YAlO 3 oxide crystals (the Cr 3+ codoping enhanced the pump absorption efficiency) under flashlamp-pumping.

Further studies were performed with laser-pumping (using Alexandrite [START_REF] Sudesh | Spectroscopy, modeling, and laser operation of thulium-doped crystals at 2.3 µm[END_REF] and Ti:Sapphire [START_REF] Pinto | Tm 3+ :YLF laser continuously tunable between 2.20 and 2.46 µm[END_REF][START_REF] Canbaz | 2.3-µm Tm 3+ :YLF laser passively Q-switched with a Cr 2+ :ZnSe saturable absorber[END_REF] lasers) allowing for selective excitation to the 3 H 4 state. As gain materials, Tm 3+ doped fluoride LiYF 4 and oxide Y 3 Al 5 O 12 or Lu 3 Al 5 O 12 crystals were employed. A Ti:Sapphire pumped Tm:LiYF 4 laser generated 0.22 W at 2.30 µm with a slope efficiency of 15 % (versus the incident pump power, with 80% absorption) and a continuous tuning of the emission wavelength from 2.20 to 2.46 µm was also demonstrated [START_REF] Bar-Joseph | 2.32-micron flash-lamp-pumped high-repetition-rate laser operation in Tm:Cr:YAG[END_REF]. Slightly higher slope efficiency was reported [START_REF] Canbaz | 2.3-µm Tm 3+ :YLF laser passively Q-switched with a Cr 2+ :ZnSe saturable absorber[END_REF] (Table I) whilst still being lower than the Stokes efficiency for the 3 H 4 → 3 H 5 laser transition (~34%).

The suitability of Yb 3+ ,Tm 3+ -codoped fluoride crystals for laser emission at ~2.3 µm was analyzed theoretically in [START_REF] Braud | Energy-transfer processes in Yb:Tm-doped KY3F10, LiYF4, and BaY2F8 single crystals for laser operation at 1.5 and 2.3 µm[END_REF].

Regarding diode-pumping which may potentially allow for power scaling, the key results were achieved for Yb 3+ ,Tm 3+codoped LiYF 4 crystals [START_REF] Diening | Diode-pumped continuouswave, quasi-continuous-wave, and Q-switched laser operation of Yb 3+ , Tm 3+ :YLiF4 at 1.5 and 2.3 µm[END_REF][START_REF] De Matos | A high power 2.3 µm Yb:Tm:YLF laser diode-pumped simultaneously at 685 and 960 nm[END_REF][START_REF] Kintz | Cascade laser emission at 2.31 and 2.08 µm from laser diode pumped Tm,Ho:LiYF4 at room temperature[END_REF]. Here, the Yb 3+ ions were introduced to enhance the absorption efficiency when using InGaAs laser diodes emitting at ~0.98 µm. A diode-pumped Yb,Tm:LiYF 4 laser generated 0.45 W at 2.30-2.32 µm (broadband emission) with a slope efficiency of 18% (with 65% pump absorption) [START_REF] Diening | Diode-pumped continuouswave, quasi-continuous-wave, and Q-switched laser operation of Yb 3+ , Tm 3+ :YLiF4 at 1.5 and 2.3 µm[END_REF]. Pulsed laser operation in the passively Q-switched (PQS) [START_REF] Canbaz | 2.3-µm Tm 3+ :YLF laser passively Q-switched with a Cr 2+ :ZnSe saturable absorber[END_REF] and mode-locked (ML) [START_REF] Canbaz | Kerr-lens mode-locked 2.3-µm Tm 3+ :YLF laser as a source of femtosecond pulses in the midinfrared[END_REF][START_REF] Soulard | 2.3 µm Tm 3+ :YLF mode-locked laser[END_REF] regimes has been also achieved for ~2.3 µm bulk Tm lasers. The first ML ~2.3 µm bulk Tm laser using SEmiconductor Saturable Absorber Mirror (SESAM) generated 94 ps pulses at 2305.9 nm [START_REF] Soulard | 2.3 µm Tm 3+ :YLF mode-locked laser[END_REF]. Shorter ML pulses of 514 fs (emission bandwidth of >15 nm) were achieved based on Kerr-lens mode-locking [START_REF] Canbaz | Kerr-lens mode-locked 2.3-µm Tm 3+ :YLF laser as a source of femtosecond pulses in the midinfrared[END_REF].

There also exist reports about ~2.3 µm Tm fiber lasers [START_REF] Allen | CW diode pumped 2.3 µm fiber laser[END_REF][START_REF] Carter | Thuliumdoped fluorozirconate fiber lasers operating at around 0.8, 1.47, 1.9[END_REF][START_REF] El-Agmy | 2.31 µm laser under upconversion pumping at 1.064 µm in Tm 3+ : ZBLAN fibre lasers[END_REF][START_REF] Muravyev | Dual-band Tm 3+ -doped tellurite fiber amplifier and laser at 1.9 µm and 2.3 µm[END_REF][START_REF] Jia | Simultaneous Q-switching of a Tm 3+ :ZBLAN fiber laser at 1.9 µm and 2.3 µm using graphene[END_REF].

For the Tm 3+ ions, the lifetime of the 3 H 4 state (upper laser level for the ~2.3 µm transition) is subjected to quenching by different processes. Among them, multi-phonon NR relaxation which is strongly host-dependent, CR which raises fast with Tm 3+ doping and energy-migration (EM) which is relevant for certain materials and high Tm 3+ doping levels, Fig. 1(a). Thus, from the host-material-wise point of view, low-phonon hosts are preferred for ~2.3 µm lasers such as fluorides.

Among fluoride crystals, tetragonal lithium yttrium fluoride (LiYF 4 ) has been considered for ~2.3 µm lasers [START_REF] Pinto | Tm 3+ :YLF laser continuously tunable between 2.20 and 2.46 µm[END_REF][START_REF] Sudesh | Spectroscopy, modeling, and laser operation of thulium-doped crystals at 2.3 µm[END_REF][START_REF] Canbaz | 2.3-µm Tm 3+ :YLF laser passively Q-switched with a Cr 2+ :ZnSe saturable absorber[END_REF]. This crystal is well-known for Tm 3+ doping and it provides highly efficient laser operation at the 3 F 4 → 3 H 6 transition [START_REF] Schellhorn | High-power diode-pumped Tm:YLF laser[END_REF][START_REF] Loiko | Comparative spectroscopic and thermo-optic study of Tm:LiLnF4 (Ln = Y, Gd, and Lu) crystals for highly-efficient microchip lasers at ~2 µm[END_REF]. LiYF 4 features low maximum phonon energy, hν ph = 446 cm -1 [START_REF] Miller | Lattice vibrations of LiYF4[END_REF] diminishing the NR relaxation, good thermomechanical properties (the thermal conductivity is about 5-7 Wm -1 K -1 ) [START_REF] Aggarwal | Measurement of thermo-optic properties of Y3Al5O12, Lu3Al5O12, YAlO3, LiYF4, LiLuF4, BaY2F8, KGd(WO4)2, and KY(WO4)2[END_REF] opening the ways for power scaling, low refractive index, broad transparency range and large range of available Tm 3+ concentrations [START_REF] Loiko | Comparative spectroscopic and thermo-optic study of Tm:LiLnF4 (Ln = Y, Gd, and Lu) crystals for highly-efficient microchip lasers at ~2 µm[END_REF]. The growth of LiYF 4 crystals by Czochralski method is well-developed [START_REF] Cockayne | The Czochralski growth and laser characteristics of Li(Y,Er,Tm,Ho)F4 and Li(Lu,Er,Tm,Ho)F4 scheelite single crystals[END_REF]. When doped with Tm 3+ ions, the LiYF 4 crystals provide long (in the ms-range) lifetimes of the excited-states ( 3 H 4 and 3 F 4 ) and anisotropic emission properties [START_REF] Walsh | Branching ratios, cross sections, and radiative lifetimes of rare earth ions in solids: Application to Tm 3+ and Ho 3+ ions in LiYF4[END_REF] leading to polarized laser output.

Now, let us consider the effect Tm 3+ doping level on the ~2.3 µm laser performance. At a glance, it should be kept low so that the shortening of the upper laser level ( 3 H 4 ) lifetime by CR is weak. In the opposite case, the laser threshold will raise significantly. However, the doping cannot be too low to keep a reasonable pump absorption efficiency. As a result of such considerations, ~2.3 µm Tm:LiYF 4 lasers reported to date were based on crystals with low doping levels, about 1-2 at.% [START_REF] Pinto | Tm 3+ :YLF laser continuously tunable between 2.20 and 2.46 µm[END_REF][START_REF] Sudesh | Spectroscopy, modeling, and laser operation of thulium-doped crystals at 2.3 µm[END_REF][START_REF] Canbaz | 2.3-µm Tm 3+ :YLF laser passively Q-switched with a Cr 2+ :ZnSe saturable absorber[END_REF][START_REF] Yorulmaz | Low-threshold diode-pumped 2.3-µm Tm 3+ : YLF lasers[END_REF].

In the present paper, we aimed to investigate the effect of two relevant energy-transfer processes, namely, the CR and energy-transfer upconversion (ETU), Tm 1 ( 3 F 4 ) + Tm 2 ( 3 F 4 ) → Tm 1 ( 3 H 6 ) + Tm 2 ( 3 H 4 ) [START_REF] So | A power-scaling strategy for longitudinally diodepumped Tm:YLF lasers[END_REF], on the performance of ~2.3 µm Tm:LiYF 4 lasers. As a result, we prove that the ETU can play a positive role in highly Tm 3+ -doped crystals leading to the laser slope efficiencies exceeding the Stokes limit (or, in other words, to pump quantum efficiency of more than unity).

II. SPECTROSCOPY OF TM:LIYF 4

A. Crystal growth

Bulk Tm:LiYF 4 crystals used for spectroscopic studies were grown by the Czochralski (Cz) method using undoped [001]oriented LiYF 4 seeds. The growth temperature was ~780 °C. The Tm 3+ doping concentration was 0.5, 1, 3, 5 and 10 at.%. Tetragonal LiYF 4 crystal (space group C 6 4h -I4 1 a) is optically uniaxial (negative) and its optical axis is parallel to the crystallographic c-axis. The samples were thus oriented with respect to the a and c axes.

B. 3 H 4 → 3 H 5 Tm 3+ transition The stimulated-emission (SE) cross-sections, σ SE , for the 3 H 4 → 3 H 5 transition of Tm 3+ ions in LiYF 4 were calculated using the Füchtbauer-Ladenburg (F-L) formula [START_REF] Aull | Vibronic interactions in Nd:YAG resulting in nonreciprocity of absorption and stimulated emission cross sections[END_REF]:

. dλ ) λ ( ) ' ( ) λ ( 3 8 λ ) λ ( , , 3rad 2 5 SE ∑ ∫ = = α π σ λ β τ π σ j j j j i W JJ W c n (1)
Here, W(λ) is the measured luminescence spectrum, n is the refractive index (n o = 1.440 and n e = 1.462) [START_REF] Barnes | Temperature variation of the refractive indices of yttrium lithium fluoride[END_REF], c is the speed of light, τ 3rad is the radiative lifetime of the emitting state ( 3 H 4 ), β(JJ') is the luminescence branching ratio. The index j indicates the light polarization. The transition 3 H 4 → 3 H 5 is of both electric dipole (ED) and magnetic dipole (MD, ΔJ = 0, ±1) nature. Thus, for a uniaxial crystal, three principal light polarizations can be defined, i.e., σ [START_REF] Görller-Walrand | Spectral intensities of f-f transitions[END_REF]. Here, E and k are the light polarization and propagation direction, respectively. Note that for purely ED transitions, π ≡ α. This difference originates from the dependence of MD transition probability on the orientation of H vector. A 1 at.% Tm:LiYF 4 crystal was used to measure W(λ). The results on σ SE are shown in Fig. 2(a). The maximum σ SE = 0.57×10 -20 cm 2 at 2305 nm for πpolarization. The bandwidth (FWHM) for the corresponding emission peak is 25.8 nm. For the 3 H 4 → 3 H 5 transition, the upper laser level is 3 H 4 . The results on the 3 H 4 luminescence lifetimes τ 3lum obtained in the present work and in the previous papers [START_REF] Walsh | Branching ratios, cross sections, and radiative lifetimes of rare earth ions in solids: Application to Tm 3+ and Ho 3+ ions in LiYF4[END_REF][START_REF] Razumova | Spectralluminescent properties of Tm:YLF crystal[END_REF][START_REF] Armagan | Comparison of spectroscopic properties of Tm and Ho in YAG and YLF crystals[END_REF][START_REF] Tkachuk | Luminescence self-quenching in Tm 3+ :YLF crystals: II. The luminescence decay and macrorates of energy transfer[END_REF][START_REF] Braud | Caractéristiques spectroscopiques et émission laser de l'ion Tm 3+ à 1.5 µm dans les fluorures[END_REF] are summarized in Fig. 2(b). The τ 3lum decreases with the Tm 3+ doping due to the CR effect. For the limit of very small doping concentration and, consequently, zero CR, the so-called intrinsic lifetime τ 30 can be deduced, see Fig. 1(b) [START_REF] Razumova | Spectralluminescent properties of Tm:YLF crystal[END_REF]:

(E ⊥ c, k ⊥ c), π (E || c, k ⊥ c) and α (E ⊥ c, k || c)
. / 1 / 1 CR 30 3lum W + = τ τ (2)
Here, W CR is the CR rate (in s -1 ). In Eq. (2), we do not account for other mechanisms of quenching of the 3 H 4 lifetime such as EM which is relevant for very high Tm 3+ doping levels above 10 at.% [START_REF] Soulard | Laser operation of highly-doped Tm:LiYF4 epitaxies: Towards thin-disk lasers[END_REF]. One should distinguish τ 30 and the radiative lifetime τ 3rad . The latter is in general longer, τ 3rad ≥ τ 30 , because it is an inverse of the probability of solely spontaneous radiative transitions from the excited-state while τ 30 also includes the NR relaxation rate: 1/τ 30 = 1/τ 3rad + W NR . For LiYF 4 featuring a relatively low maximum phonon frequency hν ph , W NR is almost zero for the 3 H 4 state [START_REF] Walsh | Spectroscopy and modeling of solid state lanthanide lasers: Application to trivalent Tm 3+ and Ho 3+ in YLiF4 and LuLiF4[END_REF]. Thus, τ 30 ≈ τ 3rad . Note that this condition is typically not satisfied in oxide materials.

The CR rate is a function of Tm 3+ concentration [START_REF] Loiko | Stochastic model of energy-transfer processes among rare-earth ions. Example of Al2O3:Tm 3+[END_REF]:

, 2 Tm CR Tm CR CR N C N K W = = (3)
where, K CR and C CR are the CR macro-parameter and the CR concentration-independent micro-parameter, respectively. By using Eqs.

C. Cross-relaxation and quantum efficiency

CR is an important process defining populations of the Tm 3+ multiplets and, thus, the laser efficiency [START_REF] Van Dalfsen | Thulium channel waveguide laser with 1.6 W of output power and ~80% slope efficiency[END_REF]. The CR rate was determined using Eqs. ( 2)-( 3) based on the experimental luminescence lifetimes of the 3 H 4 state, Fig. 3(a). This figure is plotted in a double-log scale to illustrate the quadratic dependence of W CR on N Tm , Eq. ( 3). The best-fit C CR = 0.25±0.03×10 -37 s -1 cm 3 .

There exist another way to express the CR rate constant [START_REF] Honea | 115-W Tm:YAG diodepumped solid-state laser[END_REF]:

, 1 2 0 Tm 30 CR ⎟ ⎟ ⎠ ⎞ ⎜ ⎜ ⎝ ⎛ = C C W τ (4)
where, C Tm is the doping level (in at.%) and C 0 is the critical doping level which corresponds to a 2-fold decrease of the luminescence lifetime of the pump level ( 3 H 4 ). For Tm:LiYF 4 , we calculated C 0 as 0.96 at.% (as 1 at.% Tm corresponds to the ion density of 1.38×10 20 at/cm 3 , crystal density: ρ = 3.95 g/cm 3 ).

The pump quantum efficiency for the 3 F 4 state of Tm 3+doped materials, η q1 , can exceed unity and approach 2 due to the CR effect (pumping at the 3 H 6 → 3 H 4 transition) [START_REF] Van Dalfsen | Thulium channel waveguide laser with 1.6 W of output power and ~80% slope efficiency[END_REF][START_REF] Loiko | Stochastic model of energy-transfer processes among rare-earth ions. Example of Al2O3:Tm 3+[END_REF]. Assuming no ground-state bleaching and no other processes such as ETU and EM, Honea et al. determined η q1 (a ratio of ions excited to the 3 F 4 state to the number of absorbed pump photons) as [START_REF] Honea | 115-W Tm:YAG diodepumped solid-state laser[END_REF]:

. / 1 ) 1 )( / 1 ( 2 / 1 CR 30 32 3rad CR 30 q1 W W + - - + = τ β τ τ η (5)
Here, β 32 is the total luminescence branching ratio for the 3 H 4 → 3 F 4 + 3 H 5 transitions (due to the strong NR relaxation from the 3 H 5 state, both these transitions end up with the ions being at the 3 F 4 state). As explained above, for Tm:LiYF 4 , τ 30 ≈ τ 3rad . The results on η q1 are shown in Fig. 3(b). For very small Tm 3+ doping, η q1 is limited by the β 32 value. For more than 6 at.% Tm 3+ doping, the theoretical pump quantum efficiency exceeding 1.95 (strong CR) is expected. The calculated results agree well with the estimation of So et al. based on analysis of the laser performance [START_REF] So | A power-scaling strategy for longitudinally diodepumped Tm:YLF lasers[END_REF]. 3); pump quantum efficiency for the 3 F4 state ηq1: symbols -determined from the experimental WCR rates (this work) and from the laser performance [START_REF] So | A power-scaling strategy for longitudinally diodepumped Tm:YLF lasers[END_REF], curve -theoretical calculation using Eq. ( 5). All data are plotted vs. Tm 3+ doping concentration.

In Table II, we compared the parameters defining CR (τ 30 , C CR and C 0 ) for several widespread Tm 3+ -doped laser crystals [START_REF] Honea | 115-W Tm:YAG diodepumped solid-state laser[END_REF][START_REF] Loiko | Highly-efficient, compact Tm 3+ :RE2O3 (RE = Y, Lu, Sc) sesquioxide lasers based on thermal guiding[END_REF][START_REF] Mateos | Efficient micro-lasers based on highly-doped monoclinic double tungstates[END_REF]. Note that C CR for Tm:LiYF 4 is by order of magnitude smaller that in oxide crystals because of much longer intrinsic lifetime of the 3 H 4 state for this fluoride crystal.

D. Energy-transfer upconversion

Energy-transfer upconversion in Tm:LiYF 4 , 3 F 4 + 3 F 4 → 3 H 4 + 3 H 6 , is a phonon-assisted process which is detrimental for the ~1.9 µm laser transition [START_REF] So | A power-scaling strategy for longitudinally diodepumped Tm:YLF lasers[END_REF] but can be useful for the ~2.3 µm one.

To quantify ETU, we excited Tm:LiYF 4 crystals directly to the 3 F 4 state (at 1.68 µm) and monitored power dependence of luminescence from the 3 H 4 (at ~1.5 µm) and 3 F 4 (at ~1.9 µm) multiplets. The observation of the former emission is a direct evidence of ETU. From the ratio of integrated intensities of these emissions, we deduced the ratio of the populations N( 3 H 4 )/N( 3 F 4 ), see Fig. 4(a). This ratio was also calculated numerically using a rate-equation model accounting for the ground-state bleaching, CR, ETU and spatial distribution of the pump, as shown by the curves in Fig. 4(a). From such a modeling, we determined the ETU parameter K ETU which amounted to 3.5±1, 14.5±2 and 22±5×10 -20 cm 3 s -1 for 3, 4 and 5 at.% Tm-doping, respectively. As expected, K ETU increases with the Tm 3+ concentration.

A summary of K ETU values for Tm:LiYF 4 reported to date is presented in Fig. 4(b). In [START_REF] Walsh | Spectroscopy and modeling of solid state lanthanide lasers: Application to trivalent Tm 3+ and Ho 3+ in YLiF4 and LuLiF4[END_REF][START_REF] Falconieri | Fluorescence dynamics in Tm,Ho:YLF following 800 nm pulsed laser excitation[END_REF], K ETU was determined from luminescence-decay measurements. In [START_REF] Loiko | Watt-level Tm:LiYF4 channel waveguide laser produced by diamond saw dicing[END_REF], we determined it from the modeling of the laser performance and in [START_REF] Perlin | Cascade-avalanche up-conversion in Tm 3+ :YLF crystals[END_REF], it was calculated theoretically. For Tm 3+ doping below 6 at.% which is common for laser crystals, the results on K ETU are in relative agreement with each other while for higher doping, a strong discrepancy is observed.

The concentration dependence of K ETU has been previously expressed by a linear law using a concentration-independent micro-parameter C ETU [START_REF] Loiko | Stochastic model of energy-transfer processes among rare-earth ions. Example of Al2O3:Tm 3+[END_REF]:

. Tm ETU ETU N C K = (6)
In our case, C ETU = 3.9±1×10 -40 cm 6 s -1 and it is by two orders of magnitude smaller than C CR . However, the K ETU parameters of Tm:LiYF 4 are high enough to ensure efficient 2.3 µm laser operation of this crystal, as will be shown below. Note the concentration dependence of K ETU seems to be faster than linear and well fitted with a quadratic curve, Fig. 4(b).

III. BULK LASERS AT ~2.3 µM

A. Laser set-up

The laser experiments started using bulk Tm:LiYF 4 crystal. The laser crystal was an a-cut 3.5 at.% Tm:LiYF 4 having a cylindrical shape (diameter: 8.5 mm, length: 8.1 mm). The actual Tm 3+ ion density N Tm = 4.83×10 20 cm -3 . Both its faces were polished to laser quality and antireflection (AR) coated for ~1.9 µm. The crystal was mounted on a Cu-holder using a silver thermal paste and it was passively cooled.

The scheme of the laser set-up is shown in Fig. 5. A hemispherical laser cavity was formed by a flat pump mirror (PM) coated for high transmission (HT) at the pump wavelength (T = 81% at 0.79 µm) and at ~1.9 µm (the 3 F 4 → 3 H 6 Tm 3+ emission) and for high reflection (HR) at ~2.3 µm, and a set of concave output couplers (OCs) with the radius of curvature of 100 mm and a transmission T OC of 0.7%, 1.3% and 4.0% at 2.3 µm. Due to the R = 95% reflection from the OCs at the pump wavelength, the crystal was pumped in a double-pass. Moreover, to suppress further the ~1.9 µm emission, all the OCs provided HT (T > 90%) at this wavelength. The geometrical cavity length was about 100 mm.

As the first pump source, we used a CW Ti:Sapphire laser (model 3900S, Spectra Physics) delivering 3.2 W at 0.79 µm (M 2 ≈ 1). The pump power incident on the crystal was varied using a rotatory λ/2 plate and a Glan-Taylor polarizer. The pump polarization in the crystal corresponded to π. The pump beam was focused by a spherical lens (focal length: f = 150 mm) resulting in a spot radius w P of 61 µm and a confocal parameter 2z R of 4.2 cm. The pump beam was mechanically modulated using a chopper (duty cycle: 1:2, pulse duration: ~10 ms) leading to quasi-CW pumping. The second pump source was a fiber-coupled AlGaAs laser diode (DILAS, fiber core diameter: 105 µm, numerical aperture, N.A.: 0.22) emitting up to 28 W of unpolarized output at a wavelength of 793.2 nm (emission bandwidth: <4 nm, M 2 ≈ 46). The pump beam was collimated and focused by a pair of spherical lenses (f = 50 mm and 150 mm, respectively) resulting in w P of 150 µm and a Rayleigh length z R of 5.7 mm. The pump beam was electrically modulated (duty cycle: 1:20, pulse duration: ~10 ms). Due to the strong divergence of the pump, during the second pump pass (after the reflection from the OC), the diameter of the pump beam in the crystal was ~1.5 mm thus producing minor effect on inversion in the laser crystal. Consequently, the pumping was considered in single-pass.

The radius of the laser mode w L in the crystal was estimated within the ABCD formalism to be 70 µm (taking into account thermal lens in the crystal).

The laser emission spectra were measured using an optical spectrum analyzer (OSA, model AQ6375B, Yokogawa). The laser output was filtered from the residual pump using a cutoff filter (FEL 900, Thorlabs).

B. Results: Ti:Sapphire pumping

First, we describe the results achieved using the Ti:Sapphire pumping. For all studied OCs, the laser operated solely at the 3 H 4 → 3 H 5 transition with no emission at ~1.9 µm. The laser output was linearly polarized; the polarization was determined by the gain anisotropy (π), see Fig. 2(a). The maximum peak output power was achieved using 1.3% OC, namely 0.73 W at 2306 nm with a slope efficiency η of 34.6% (vs. the incident pump power P inc ). The input-output dependence was nonlinear close to the laser threshold (at P inc = 0.40 W). Because of this, the fit for the determination of η was performed for pump powers of about 3 times higher than the threshold value, Fig. 6(a). The maximum optical-to-optical efficiency η opt was 26.7%. For higher T OC = 4%, the laser operated with slightly higher slope efficiency (35.9%) whilst with lower peak output power of 0.55 W at 2305 nm and much higher laser threshold of 0.81 W. Further power scaling was limited by the available pump power. No thermal roll-over of the input-output dependences or crystal fracture were observed during the laser experiments.

The passive losses in the crystal were estimated to be 0.5% using the Findlay-Clay analysis [START_REF] Findlay | The measurement of internal losses in 4level lasers[END_REF].

The laser emission spectra for all OCs were similar, Fig. 6(b).

We have also studied true CW performance of this laser for the optimum 1.3% OC (i.e., when removing the chopper from the pump beam). The P inc value was limited to approximately half of the available power, ~1.5 W. The achieved CW output power was similar to the peak power achieved under quasi-CW regime. The maximum output power reached 0.24 W. The pump absorption under lasing conditions η abs,L was determined by measuring the residual pump power after the OC with a short-pass filter. The results are shown in Fig. 7. The saturation of absorption was observed. In particular for 1.3% OC, η abs,L decreased from 97.2% to 86.3% when the pump power increased from the laser threshold to its maximum value, i.e., from 0.40 to 2.74 W. For other OCs, a similar behavior was observed.

According to the measured pump absorption, the slope efficiency vs. the absorbed pump power P abs for the 1.3% and 4% OCs reached 47.3% and 51.7%, respectively. Here, the fit of the input-output dependence was performed starting from the pump power well above the laser threshold as explained above. Thus, this work represents the best results in terms of output power and slope efficiency for any laser-pumped 2.3 µm laser, cf. Table I.

C. Results: diode-pumping

The results for diode-pumping are shown in Fig. 8. For all OCs, the laser generated a linearly polarized emission (π) at ~2306 nm. The input-output dependences were linear. For 1.3% OC, the laser generated a maximum peak output power of 2.4 W (average power: 0.12 W) with η = 11.5%. The laser threshold was at P inc = 2.0 W and η opt amounted to 10.3%. For higher output coupling, the laser performance deteriorated. The input-output dependences were linear up to at least P inc = 23.2 W.

The pump absorption η abs,L was weakly dependent on the OC and the pump power and amounted to 60%. Thus, the maximum slope efficiency vs. the absorbed pump power was 19.2% (for T OC = 1.3%) which is much lower than in the case of Ti:Sapphire pumping.

D. Modeling of the laser performance

For modeling of the laser performance, we will consider the results achieved under Ti:Sapphire pumping. The model will account for ground-state bleaching, CR and ETU. The system of rate equations for Tm 3+ ions is as following:

, 2 2 3 L2 L2 SE 2 2 2 2 ETU 3 1 CR 2 N I N N K N N K dt dN σ τ + - - = (7a) , 3 L2 L2 SE 30 3 2 2 ETU 3 1 CR 1 P P abs 3 N I N N K N N K N I dt dN σ τ σ - - + - = (7b)
where, N i (i = 1, 2, 3) is the ion density for the i-th level, Fig. 1(b), N 1 + N 2 + N 3 = N Tm , t is time, K CR = W CR /N Tm is the CR macroscopic parameter expressed in cm 3 s -1 , τ 2 is the lifetime of the 2 nd level ( 3 F 4 ), τ 30 is the intrinsic (unquenched) lifetime of the 3 rd level ( 3 H 4 ), σ L2 SE is the SE cross-section at the laser frequency ν L2 ( 3 H 4 → 3 H 5 ) σ P abs is the absorption cross-section at the pump frequency ν P , I P and I L2 are the pump and laser intensities expressed in photons/(s•cm²). We will neglect the radiative decay in the 3 → 2 channel because the corresponding luminescence branching ratio β 32 is small [START_REF] Walsh | Branching ratios, cross sections, and radiative lifetimes of rare earth ions in solids: Application to Tm 3+ and Ho 3+ ions in LiYF4[END_REF]. In Eq. ( 7), we assume no lasing at the 3 F 4 → 3 H 6 transition with a frequency ν L1 (so that I L1 ≡ 0).

In the first approach, we will derive the pump quantum efficiency for the 3 H 4 → 3 H 5 transition η q2 from the measured output power of the laser P out . According to the definition of η q2 (the ratio of the number of emitted photons at ~2.3 µm to the number of absorbed pump photons), from the formalism of the rate equations, we have:

The population of the upper laser level N 3 can be estimated from the threshold condition (gain is equal to losses):

. 2

OC 3 L2 SE L T N + = ℓ σ (9)
Here, ℓ is the thickness of the crystal and L are the passive losses. In this equation, we neglect the axial dependence of the population N 3 . By deriving N 3 from Eq. ( 9) and substituting it into Eq. ( 8), we determined I L2 and, then, the output laser intensity I out = T OC •(I L2 /2). The output power P out is then given by: Here, w L is the radius of the laser mode in the crystal and we have also taken into account that the pump absorption η abs = σ P abs N 1 ℓ and the incident pump power P inc = hν P πw P 2 I P . The first term of Eq. (10b) represents an expression for the laser slope efficiency vs. the absorbed pump power P abs = η abs •P inc containing four factors: the Stokes efficiency η St = hν L2 /hν P , the mode overlap efficiency η mode = w L 2 /w P 2 (we assume η mode ≈ 1), the output-coupling efficiency η OC = T OC /(T OC +L) and the pump quantum efficiency η q2 . From Eq. (10b), the laser threshold is:

. 2 abs q2 30

L2 SE OC 2 P P th η η τ σ π ν L T w h P + = ( 11
)
Using Eq. (10b), we were able to determine η q2 for each point at the input-output laser dependence from Fig. 6(a). The calculated η q2 values are shown in Fig. 9. For all studied OCs, the quantum efficiency gradually increases with the incident pump power. The variation is from 0.14 to 1.27 for the optimum 1.3% OC. The values of η q2 exceeding unity represent a direct evidence of the effect of ETU on the laser performance. Indeed, ETU is responsible for re-feeding the upper laser level ( 3 H 4 ) at the expense of the 3 F 4 population. The fact that η q2 is well below unity close to the laser threshold clearly represents the effect of CR which is a detrimental process decreasing the upper laser level population. Fig. 9. Pump quantum efficiency for the 3 H4 → 3 H5 laser channel (pumping to the 3 H4 state) ηq2 calculated using Eq. (10b).

To reveal the effect of CR and ETU on the pump quantum efficiency, we have derived another expression for η q2 based on the populations of the Tm 3+ multiplets. In the steady-state conditions (dN i /dt = 0), by combining Eq. ( 8) and Eq. (7b), we obtained:

. 1

1 P P abs 2 2 ETU 1 P P abs 3 1 CR q2 N I N K N I N N K σ σ η + - = ( 12
)
This equation shows that that there exist two competitive energy-transfer processes which determine η q2 , namely CR and ETU. If both processes are negligible (an ideal case of almost zero doping concentration), η q2 ≡ 1 and the laser slope efficiency will be limited by the Stokes efficiency. If there is no ETU, the quantum efficiency will be less than unity due to CR. Finally, if there are two processes (CR and ETU), η q2 may exceed unity as observed in Fig. 9.

There exist upper limit for η q2 . By combining Eq. ( 12), the rate-equation, Eq. 7(a), at the steady-state (dN 2 /dt = 0), and the intuitive expression for η q2 , Eq. ( 8), we obtain: From this equation, η q2 ≤ 2. The upper limit can be reached for a material exhibiting strong ETU and long lifetimes of the 3 H 4 and 3 F 4 multiplets and pumped well above the laser threshold when the laser operates solely at the 3 H 4 → 3 H 5 transition, so that the 3 H 4 level is depopulated by ~2.3 µm laser emission and the 3 F 4 one is depopulated by ETU.

From these considerations, it is possible to explain the decrease of pump absorption η abs (bleaching) with the pump power, Fig. 7. This is because when there is no laser operation at the 3 F 4 → 3 H 6 transition, the population of the ground-state 3 H 6 is not clamped by the threshold condition. Thus, with an increased pump power, the ground-state is depopulated while the Tm 3+ ions are accumulated in the metastable intermediate 3 F 4 state. Note that when the laser operates at both the 3 H 4 → 3 H 5 and 3 F 4 → 3 H 6 transitions simultaneously, η abs is expected to be nearly constant with the pump power.

Within the second approach, we solved the system of rate equations, Eq. ( 7), numerically accounting for the spatial and axial distribution of the pump and laser fields in the crystal. Then, the laser output power at ~2.3 µm was determined from Eq. (10a) and η q2 was determined from Eq. [START_REF] Boehm | Comparison of InPand GaSb-based VCSELs emitting at 2.3 µm suitable for carbon monoxide detection[END_REF].

First, we performed the calculations assuming that the laser operates solely at the 3 H 4 → 3 H 5 transition (I L1 ≡ 0). Three different Tm 3+ doping levels of 1.5, 3.5 and 6.5 at.% were considered. The CR and ETU parameters were as following: K CR = 0.52, 1.21 and 2.24×10 -17 cm 3 s -1 and K ETU = 0.3, 1.4 and 4.5×10 -19 cm 3 s -1 , respectively. The calculations were done under two assumptions: (i) there exist both CR and ETU processes (K CR ≠ 0, K ETU ≠ 0); (ii) there exist only CR while ETU is absent (K CR ≠ 0, K ETU = 0). The spectroscopic parameters of Tm 3+ ions were as following: σ L2 SE = 0.57×10 -20 cm 2 , σ P abs = 0.63×10 -20 cm 2 at 791 nm (for π-polarization) [START_REF] Braud | Caractéristiques spectroscopiques et émission laser de l'ion Tm 3+ à 1.5 µm dans les fluorures[END_REF], τ 30 = 2.3 ms, τ 2 = 10 ms [START_REF] Braud | Caractéristiques spectroscopiques et émission laser de l'ion Tm 3+ à 1.5 µm dans les fluorures[END_REF]. The incident pump power was fixed (P inc = 3.0 W).

The results on the output power at ~2.3 µm are presented in Fig. 10(a). When there is no ETU in the system (K CR ≠ 0, K ETU = 0), for a fixed (small) radius of the laser mode (e.g., w L = 60 µm as in our case), the output power slightly increases with the Tm 3+ doping due to the increased pump absorption. When the ETU is present (K CR ≠ 0, K ETU ≠ 0), the output power is greatly increased and this effect becomes more evident for higher Tm 3+ doping levels because the action of ETU against CR is enhanced. Moreover, for each Tm 3+ concentration, there is an optimum radius of the laser mode maximizing the output power. With an increase of the Tm 3+ doping, the optimum w L value decreases. For 3.5 at.% Tm-doping, the laser geometry used in the present work, cf. Fig. 5, provided almost optimum w L value. Furthermore, we have analyzed the laser performance for operation at both the 3 H 4 → 3 H 5 and 3 F 4 → 3 H 6 transitions simultaneously. For this, the term -σ L1 SE I L1 N 2 representing stimulated-emission at ν L1 (at ~1.9 µm) was added to the rateequation, Eq. (7a). The results are shown in Fig. 10(b). In this case, the effect of ETU on the laser performance is minor because population of the 3 F 4 state is clamped by the threshold condition for the 3 F 4 → 3 H 6 laser. For a fixed (small) w L , the output power only slightly increases with Tm 3+ doping due to the increased pump absorption and finally saturates.

To conclude, the simultaneous operation of the Tm lasers at both the 3 H 4 → 3 H 5 and 3 F 4 → 3 H 6 transitions is mostly detrimental for their ~2.3 µm laser performance, especially at high doping levels. Moreover, in the case of single laser operation ( 3 H 4 → 3 H 5 ) the efficiency of the ~2.3 µm laser can be greatly enhanced by using highly Tm 3+ -doped crystals due to the ETU effect.

The existence of the optimum size of the laser mode for the ~2.3 µm Tm:LiYF 4 laser operating solely at the 3 H 4 → 3 H 5 transition is due to (i) strong dependence of pump absorption η abs or, equivalently, ground-state bleaching, on the pump spot radius w P (notice that in this modeling, we assumed w L ≈ w P ), see Fig. 11(a), and (ii) increase of the laser threshold with increasing pump spot size. Physically, the first effect is explained as following: if there is no laser operation at the 3 F 4 → 3 H 6 transition, the population of the ground-state ( 3 H 6 ) is not clamped by the threshold condition and thus it can be depopulated for high pump intensities (for small w P ). ETU increases the pump absorption because it brings excited Tm 3+ ions back to the ground-state. Thus, the optimum size of the laser mode decreases with Tm 3+ doping due to enhanced ETU.

When the laser operates at both the 3 H 4 → 3 H 5 and 3 F 4 → 3 H 6 transitions simultaneously, the size of the pump mode and ETU have minor action on the pump absorption, Fig. 11(b). In Fig. 12, the calculated pump quantum efficiency η q2 for the Tm:LiYF 4 laser is shown. When the laser operates solely at the 3 H 4 → 3 H 5 transition and there is no ETU in the system (K CR ≠ 0, K ETU = 0), the η q2 value has an upper limit of 1 and it has almost no dependence on the Tm 3+ doping level for small radii of the pump mode. If the ETU is present (K CR ≠ 0, K ETU ≠ 0), the pump quantum efficiency greatly increases with Tm 3+ doping approaching the upper limit of 2, Fig. 12(a). Note that for about 1-2 at.% Tm-doping which was typically used in the previous studies [START_REF] Pinto | Tm 3+ :YLF laser continuously tunable between 2.20 and 2.46 µm[END_REF][START_REF] Sudesh | Spectroscopy, modeling, and laser operation of thulium-doped crystals at 2.3 µm[END_REF][START_REF] Canbaz | 2.3-µm Tm 3+ :YLF laser passively Q-switched with a Cr 2+ :ZnSe saturable absorber[END_REF][START_REF] Yorulmaz | Low-threshold diode-pumped 2.3-µm Tm 3+ : YLF lasers[END_REF], η q2 is below 1 which agrees with the observed laser slope efficiencies. For 3.5 at.% Tmdoping, as in our case, η q2 > 1 can be observed, cf. Fig. 9. When the laser operates at both the 3 H 4 → 3 H 5 and 3 F 4 → 3 H 6 transitions simultaneously, η q2 cannot exceed unity even under the conditions of high Tm 3+ doping and, consequently, strong ETU, Fig. 12(b).

Using the above described second approach, we calculated the values of the maximum output power P out , threshold power P th , slope efficiency η (vs. the incident pump power) and the maximum pump quantum efficiency η q2(max) for the studied 3.5 at.% Tm:LiYF 4 laser, see Table III. The results of calculation are in reasonable agreement with the experimental data.

This confirms the first observation of more than unity pump quantum efficiency η q2 for the ~2.3 µm laser transition in bulk Tm:LiYF 4 .

IV. WAVEGUIDE LASERS AT ~2.3 µM

A. Fabrication of waveguides

Single-crystalline 6.2 at.% Tm, 3.5 at.% Gd:LiYF 4 thin film was grown on undoped (001)-oriented LiYF 4 substrate by the Liquid Phase Epitaxy (LPE) method [START_REF] Loiko | Watt-level Tm:LiYF4 channel waveguide laser produced by diamond saw dicing[END_REF]. The actual Tm 3+ ion density N Tm = 8.56×10 20 cm -3 . The optically passive Gd 3+ ions were added to enhance the refractive index contrast between the active layer and the substrate (Δn = 2.3±0.5×10 -3 ). The film thickness was 30 µm.

The films were further microstructured by diamond saw dicing resulting in surface channel (ridge) waveguides (WGs) oriented along the a-axis and having a square cross-section of 30×30 µm 2 . The length of the WGs was 8.0 mm. The WG propagation losses were 0.28±0.1 dB/cm at ~1.9 µm. More details can be found in [START_REF] Loiko | Watt-level Tm:LiYF4 channel waveguide laser produced by diamond saw dicing[END_REF].

B. Laser set-up

The scheme of the waveguide laser is shown in Fig. 11. The sample with the WG was mounted on a Cu-holder using a silver thermal paste. It was passively cooled. The laser cavity was composed of a flat PM coated for HR at 1.88-2.32 µm and HT at the pump wavelength (T = 69% at 0.79 µm), and a set of two flat OCs coated for HT at 1.83-1.88 µm (T = 90% / 97%) and having a transmission of 4% / 1.3% at 2.3 µm, respectively. Both PM and OC were placed as close as possible to the WG end-facets. No index-matching liquid was used to avoid damage of the optical elements.

As a pump source, we used the same Ti:Sapphire laser, see Section IIIA. The pump polarization corresponded to π in the WG. The pump beam was focused by an uncoated CaF 2 spherical lens (f = 40 mm, T = 93.8% at 0.79 µm) providing a pump spot diameter at the input face of the WG 2w P of ~30 µm. The pump coupling efficiency η coupl was determined from pump-transmission measurements at 0.84 µm (out of Tm 3+ absorption) to be 87±1%. The pump absorption at the laser threshold η abs(1-pass) was measured to be 71.0±0.5%. Both OCs provided partial reflection at the pump wavelength (R = 93% / 96%, respectively) and thus the WG was pumped in a doublepass. The calculated total pump absorption η abs(2-pass) amounted to 90.1%. The pump beam was mechanically modulated using a mechanical chopper (1:2 duty cycle, 10 ms pump pulses).

The WG laser operated at the fundamental transverse mode. The mode radius w L was 15 µm. The output laser beam was collimated using a spherical lens (f = 50 mm). The total output power was determined after filtering the residual pump using a cut-off filter (FEL 900, Thorlabs). The power at ~2.3 µm was separately determined using a bandpass filter (FB2250-500, Thorlabs).

C. Laser performance

The WG Tm:LiYF 4 laser operated at both ~1.9 µm and ~2.3 µm transitions for both OCs. The laser output was linearly polarized (π).

The best results were achieved using the output coupler having a transmission of 90% / 4% at ~1.9 µm / 2.3 µm. The maximum peak total output power reached 1.13 W with a total slope efficiency η Σ of 64.2% (vs. the coupled pump power). The laser threshold was at 0.10 W and the total optical-tooptical efficiency η Σ opt amounted to 59.4%. Near the threshold, the laser operated solely at the 3 F 4 → 3 H 6 transition. For the pump power exceeding 0.68 W, the emission due to the 3 H 4 → 3 H 5 transition appeared, as shown in Fig. 11(a). The corresponding peak output power reached 0.23 W with η = 17.8%. According to the pump absorption efficiency η abs(2-pass) , the slope efficiency vs. the absorbed pump power was 19.8% being smaller than in the bulk laser. For the second studied OC, the laser performance was inferior.

The typical spectra of the laser emission are shown in Fig. 11(b). The emission corresponding to the 3 F 4 → 3 H 6 transition occurred at 1877-1881 nm in agreement with the gain spectra for π-polarization. The 3 H 4 → 3 H 5 laser transition operated at 2304-2307 nm (both for T OC = 90% / 4%). The multi-peak spectral behavior for both transitions is due to the etalon effects at the WG / mirror interfaces.

The achieved results represent the first ~2.3 µm thulium waveguide laser.

D. Modeling of laser performance

The performance of the WG laser was modeled numerically using the second approach described above. The results of this modeling are summarized in Table IV. Here, P Σ out is the total output power (for both the 3 H 4 → 3 H 5 and 3 F 4 → 3 H 6 laser transitions), P Σ th is the corresponding laser threshold and η Σ is the corresponding slope efficiency (both vs. the coupled pump power). The values without the "Σ" superscript refer solely to the ~2.3 µm emission. For the WG laser, it was not possible to derive the η q2 value from the output power (using the first approach) because of simultaneous operation of the laser at ~1.9 µm and ~2.3 µm. 0.93 *Pout -output power, Pth -threshold incident power, η -slope efficiency vs. the incident pump power (the values with "Σ": emission at both the 3 H4 → 3 H5 and 3 F4 → 3 H6 transitions, without "Σ": emission at the 3 H4 → 3 H5 transition, ηq2(max) -pump quantum efficiency at the maximum pump power.

The model reasonably explains the observed output power at ~2.3 µm while it predicts lower values for the laser threshold. The maximum η q2 values are still below 1 in agreement with the prediction for simultaneous operation at

V. CONCLUSIONS

To conclude, the laser operation at the 3 H 4 → 3 H 5 Tm 3+ transition is a promising route towards efficient mid-IR bulk and waveguide oscillators operating around ~2.3 µm. Under the condition that the competitive 3 F 4 → 3 H 6 laser channel is suppressed, a pump quantum efficiency of more than unity (potentially, up to 2) can be achieved thus leading to a laser slope efficiency well exceeding the Stokes limit. This is due to the energy-transfer upconversion acting against crossrelaxation and populating the upper laser level. Strong ETU is linked to the use of moderate and high Tm 3+ doping levels that simultaneously bring high pump absorption efficiency and, in part, to the adjusted pump mode size.

Fluoride LiYF 4 crystals with moderate Tm 3+ doping levels of few at.% appear as excellent candidates for highly-efficient ~2.3 µm lasers because of a combination of easy Tm 3+ doping, low phonon energies and good thermo-mechanical properties of the host crystal and suitable spectroscopic behavior of the dopant Tm 3+ ions. In the present work, we report on a compact bulk 3.5 at.% Tm:LiYF 4 laser generating a maximum output power of 0.72 W (quasi-CW operation) at 2306 µm with a record-high slope efficiency of 47.3% versus the absorbed pump power (thus overcoming the Stokes efficiency, 34.4%). We show the first experimental evidence of more than unity pump quantum efficiency in this laser. By applying diode pumping, the power scaling strategy is demonstrated with a clear potential for improvement.

We also report on the first ~2.3 µm Tm waveguide laser based on epitaxially-grown 6.2 at.% Tm:LiYF 4 layers. Due to the simultaneous operation of the waveguide laser at both the 3 H 4 → 3 H 5 and 3 F 4 → 3 H 6 transitions, the pump quantum efficiency was upper-limited to be less than unity despite the high Tm 3+ doping level. The laser generated 0.23 W at 2304-2307 nm with a slope efficiency of 19.8% versus the absorbed pump power. Further efforts on ~2.3 µm Tm waveguide lasers should be focused on suppression of laser operation at the high-gain 3 F 4 → 3 H 6 transition, e.g., by dielectric coatings.

Our conclusions about the mechanism of ~2.3 µm laser operation are valid for other Tm 3+ -doped fluoride crystals, such as CaF 2 , LiLuF 4 , BaY 2 F 8 , or even other oxide hosts. A comparative study of CR and ETU parameters of these materials is required to select the best fluoride gain material for the laser operation at the 3 H 4 → 3 H 5 transition.

Fig. 1 .

 1 Fig. 1. (a) Simplified scheme of energy levels of Tm 3+ ions in LiYF4: blue and red arrows -pump and laser transitions, respectively, black arrowsradiative relaxation, green arrows -non-radiative relaxation (NR), crossrelaxation (CR), energy-transfer upconversion (ETU), energy migration (EM); (b) equivalent scheme of energy levels for construction of rate equations. The Stark splitting for Tm 3+ ions is according to [15].

Fig. 2 .

 2 Fig. 2. Spectroscopy of the 3 H4 → 3 H5 transition of Tm 3+ ions in LiYF4: (a) stimulated-emission (SE) cross-sections for the π, σ and α light polarizations; (b) luminescence lifetime of the 3 H4 state τ3lum vs. the Tm 3+ doping concentration: symbols -experimental data, curve -their fit with Eqs. (2)-(3), τ30 is the intrinsic lifetime. All results correspond to room temperature.

  (2)-(3), we fitted the experimental data on τ lum ( 3 H 4 ) yielding τ 30 = 2.3±0.1 ms, Fig. 2(b). A classical way to calculate τ 3rad (and, thus, τ 30 ) theoretically is to use the Judd-Ofelt (J-O) theory. From the standard J-O calculations, Walsh et al. determined τ 3rad ( 3 H 4 ) = 1.51 ms[START_REF] Walsh | Branching ratios, cross sections, and radiative lifetimes of rare earth ions in solids: Application to Tm 3+ and Ho 3+ ions in LiYF4[END_REF]. This value seems to be underestimated because longer luminescence lifetimes were measured for low doped Tm:LiYF 4 crystals[START_REF] Razumova | Spectralluminescent properties of Tm:YLF crystal[END_REF][START_REF] Armagan | Comparison of spectroscopic properties of Tm and Ho in YAG and YLF crystals[END_REF]. Indeed, a simultaneous use of the reciprocity method (RM) and the F-L formula for transitions from the 3 H 4 state yielded τ 3rad = 2.2 ms[START_REF] Braud | Caractéristiques spectroscopiques et émission laser de l'ion Tm 3+ à 1.5 µm dans les fluorures[END_REF]. This value is in agreement with Fig.2(b).

Fig. 3 .

 3 Fig. 3. Quantification of cross-relaxation in Tm:LiYF4: (a) cross-relaxation rate WCR: symbols -determined from the experimental data on τ3lum( 3 H4), line -theoretical calculation using Eq. (3); pump quantum efficiency for the 3 F4 state ηq1: symbols -determined from the experimental WCR rates (this work) and from the laser performance[START_REF] So | A power-scaling strategy for longitudinally diodepumped Tm:YLF lasers[END_REF], curve -theoretical calculation using Eq. (5). All data are plotted vs. Tm 3+ doping concentration.

Fig. 4 .

 4 Fig. 4. Quantification of energy-transfer upconverison, 3 F4 + 3 F4 → 3 H4 + 3 H6, in Tm:LiYF4: (a) ratios of the fractional populations of the 3 H4 and 3 F4 Tm 3+ multiplets for the 1.68 µm excitation (pump spot radius: wP = 120 µm) vs. the incident pump power for various Tm 3+ concentrations: symbols -experimental data, curves -their rate-equation modeling yielding KETU values; (b) summary of the ETU parameters reported to date, line and quadratic curve represent their possible concentration-dependences.

Fig. 5 .

 5 Fig. 5. Scheme of the ~2.3 µm Tm:LiYF4 bulk laser pumped by a Ti:Sapphire laser: λ/2 -rotatory half-wave plate, P -Glan-Taylor polarizer, L -lens, PM -pump mirror, OC -output coupler, F -cut-off filter.

Fig. 6 .

 6 Fig. 6. Ti:Sapphire pumped ~2.3 µm Tm:LiYF4 bulk laser: (a) input-output dependences, η -slope efficiency; (b) typical laser emission spectra. The laser polarization is π. The pumping is quasi-CW (duty cycle: 1:2).

Fig. 7 .

 7 Fig. 7. Pump absorption under lasing conditions ηabs,L for 3.5 at.% Tm:LiYF4 crystal (Ti:Sapphire pumping, wP = 61 µm).

Fig. 8 .

 8 Fig. 8. Input-output dependences of diode-pumped ~2.3 µm Tm:LiYF4 bulk laser, η -slope efficiency. The laser polarization is π. The pumping is quasi-CW (duty cycle: 1:20).

Fig. 10 .

 10 Fig. 10. Calculated output power at ~2.3 µm of a diode-pumped Tm:LiYF4 laser with different doping levels, solid curves -KCR ≠ 0, KETU ≠ 0, dashed ones -KCR ≠ 0, KETU = 0: (a) the laser operating at the 3 H4 → 3 H5 transition only; (b) the laser operating at both the 3 H4 → 3 H5 and 3 F4 → 3 H6 transitions simultaneously. The Tm 3+ doping is 1.5, 3.5 and 6.5 at.%, Pinc = 3.0 W, TOC = 2.0%, L = 0.2%, ℓ = 9.0 mm.

Fig. 11 .

 11 Fig. 11. Calculated pump absorption ηabs for a diode-pumped Tm:LiYF4 laser with different doping levels, solid curves -KCR ≠ 0, KETU ≠ 0, dashed ones -KCR ≠ 0, KETU = 0: (a) the laser operating at the 3 H4 → 3 H5 transition only; (b) the laser operating at both the 3 H4 → 3 H5 and 3 F4 → 3 H6 transitions simultaneously. The parameters used for modeling are listed in the text.

Fig. 12 .

 12 Fig. 12. Calculated pump quantum efficiency ηq2 for for a diode-pumped Tm:LiYF4 laser with different doping levels, solid curves -KCR ≠ 0, KETU ≠ 0, dashed ones -KCR ≠ 0, KETU = 0: (a) the laser operating at the 3 H4 → 3 H5 transition only; (b) the laser operating at both the 3 H4 → 3 H5 and 3 F4 → 3 H6 transitions simultaneously. The parameters used for modeling are listed in the text.

Fig. 13 .

 13 Fig. 13. Scheme of the ~2.3 µm Tm:LiYF4 channel WG laser: λ/2 -rotatory half-wave plate, P -Glan-Taylor polarizer, L -lens, PM -pump mirror, OCoutput coupler, F -cut-off / bandpass filter.

Fig. 14 .

 14 Fig. 14. Ti:Sapphire pumped ~1.9 µm & 2.3 µm Tm:LiYF4 waveguide laser: (a) input-output dependences, η -slope efficiency; (b) typical laser emission spectra. The laser polarization is π. The pumping is quasi-CW (duty cycle: 1:2).

the 3 H 4

 34 → 3 H 5 and 3 F 4 → 3 H 6 transitions, Fig. 12(b).

  Pout and Eout -output power and pulse energy, respectively, λL -laser wavelength, η -slope efficiency. **Pumping: FLflashlamp; AL -Alexandrite laser; TS -Ti:Sapphire laser, LD -laser diode. ***For both Tm 3+ and Ho 3+ emissions.

			TABLE I
	SUMMARY* OF ~2.3 µM LASERS REPORTED SO FAR
	Crystal	Pump** λP,	Pout,	Eout,	λL,	η,	Ref.
			µm	W	mJ	µm	%
	Tm,Cr:Y3Al5O12 FL	-	-	-	2.32	-	[16]
		FL	-	-	150 2.32	0.4 [18]
	Tm,Cr:YAlO3	FL	-	-	12	2.27, 2.35 -	[16]
	Tm:LiYF4	AL	0.79	-	1.1 2.29-2.31 18	[19]
		TS	0.78	0.22	-	2.30	15	[17]
		TS	0.78	0.15	-	2.31	19	[20]
	Tm:Y3Al5O12	AL	0.79	-	1.1 2.30-2.34 14	[19]
	Tm:Lu3Al5O12	AL	0.79		1.0 ~2.3	13	[19]
	Yb,Tm:LiYF4	LD	0.98	0.45	-	2.30-2.32 18	[22]
		LD	0.69+	0.62	-	~2.3	7.9 [23]
			0.96
	Tm,Ho:LiYF4	LD	0.79	0.002 -	2.08+2.31 42	[24]
							***
	Tm:LiYF4	LD	0.79	0.01	-	~2.3	10	[25]
	*λP -pump wavelength,

TABLE II PARAMETERS

 II

	Tm:LiYF4	~2.2 [46] 2.3	0.25	0.96	This work
	Tm:Lu2O3	0.69	0.35	1.25	0.53	[51]
	Tm:Y3Al5O12	1.44	0.54	3.95	0.50	[50]
	Tm:KLu(WO4)2 >>0.20	0.24	2.7	1.94	[52]

* OF CROSS-RELAXATION IN TM 3+ -DOPED CRYSTALS Crystal τ3rad( 3 F4), ms τ30( 3 F4), ms CCR, 10 -37 cm 6 /s C0, at.% Ref. *τ3rad and τ30 -radiative and intrinsic (unquenched) lifetimes of the 3 F4 Tm 3+ state, respectively; CCR -CR concentration-independent micro-parameter; C0 -critical Tm 3+ doping level.

  Pth -threshold incident power, η -slope efficiency vs. the incident pump power, ηq2(max) -pump quantum efficiency at the maximum pump power.

			TABLE III
		LASER PERFORMANCE* OF ~2.3 µM BULK TM:LIYF4 LASERS
	TOC	Data	Pout, W	Pth, W	η, %	ηq2(max)
	0.7%	Exp.	0.49	0.24	30.3	1.08
		Calc.	0.52	0.24	20.8	1.30
	1.3%	Exp.	0.73	0.40	34.6	1.27
		Calc.	0.65	0.36	27.2	1.23
	4%	Exp.	0.55	0.81	35.9	0.85
		Calc.	0.63	0.99	36.3	0.93
	*Pout -output power,

TABLE IV LASER

 IV PERFORMANCE* OF ~2.3 µM WAVEGUIDE TM:LIYF4 LASERS TOC Data P Σ

		out,	P Σ	th,	η Σ ,	Pout,	Pth,	η, %	ηq2(max)
		W	W		%	W	W
	90% / 4%	Exp. 1.13 0.10 64.2 0.23 0.68 17.8	-
		Calc. 0.99 <0.1 37.4 0.23 <0.2 12.0	0.91
	97% / 1.3% Exp. 0.71 0.11 40.9 0.09 0.64 6.8	-
		Calc. 0.84 <0.1 37.1 0.10 <0.2 5.1

Manuscript received February 1, 2019. This work was supported by French Agence Nationale de la Recherche (ANR) through the LabEx EMC3 project FAST-MIR; European Community funds FEDER and the Normandy region.


Z Fawaz

H Noura
email: hnnoura@gmail.com

A Mostefaoui
email: ahmed.mostefaoui@univ-fcomte.fr

Lightweight Format-Compliant Encryption Algorithm for JPEG 2000 Images

Keywords: JPEG 2000 compression standard, Format Compliant, selective encryption, substitution, diffusion, security analysis

The increasing usage of personal multimedia devices such as mobiles phones, smart glasses, etc. has pointed out the need for securing the captured/exchanged images content. Nevertheless, because of the limited resources of these novel platforms on one hand and the voluminous nature of multimedia content on the other hand, preserving multimedia content security remains a research challenge. In this paper, we tackle this issue by presenting a fast format-compliant selective encryption algorithm for JPEG 2000 images. It is based on selectively choosing data from the JPEG 2000 code-stream in a uniformly dynamic-key dependent manner to apply the proposed encryption algorithm. The encryption algorithm consists of two rounds of substitution-diffusion processes, based on a dynamic key, that is changed for every input image. Extensive security analysis has been conducted to evaluate the effectiveness of the proposed scheme. The obtained results have demonstrated the robustness of our algorithm against the most known types of attacks and have shown a significant improvement in term of execution time reduction compared to a similar existing JPEG 2000 images encryption scheme.

I. INTRODUCTION

Nowadays, the widespread usage of multimedia devices such as smart-phones, image sensors, smart glasses, etc. has contributed in the production of billions of images that are daily exchanged throughout social networks and/or dedicated networks (e.g., Instagram). Furthermore, a large part of this huge amount of images is stored for later use either locally (personal devices) or transferred to cloud based storage systems. The management of such a huge amount of data raises new interesting research issues as efficient processing and storing, fast and friendly access, securing and protecting their content, etc. Within this work, we are particularly focusing on the latter issue, namely securing the content of exchanged/stored images whilst taking into account the hard constraints of the underlying platforms. This issue has in fact been pointed out recently through realistic examples such as the one related to celebrity photo hacking scandal. Another example can be found in Wireless Multimedia Sensor Networks (WMSNs) when the monitored area is very sensitive. In this category of applications, all sent images to the base station must be secure. Many other real examples can be cited in several domains as elder persons monitoring, medical applications, military applications, etc.

The common feature between all these applications is the usage of tiny multimedia devices, characterized by limited resources (CPU, memory and energy). Hence, securing image content within these devices require researchers to take into account the following, sometimes orthogonal, constraints: (a) multimedia data is very voluminous by nature in comparison to scalar data. Consequently, managing raw data is either not possible due to hard constraints in resources (i.e., memory limitation) or will break down all the devices resources (i.e., energy). Compression techniques are used in order to reduce the data volume. Even though after compression, the data remains voluminous. (b) The inherent features of images such as high redundancy and high pixels correlation render the traditional cryptographic mechanisms (i.e., AES, DES) not effective [START_REF] Zhang | Image encryption using dna addition combining with chaotic maps[END_REF]. (c) Novel applications express the need of fast and lightweight cryptographic approaches that are able to provide sufficient security strength against most types of known attacks on one hand and that can be supported by these limited devices on the other hand. (d) For portability reasons between different platforms, the proposed approaches must be compression standard-Compliant (i.e., be able to be integrated into standard platforms without additional software installations).

In order to reduce the amount of transmitted data, especially in limited environments, many compression standards have been proposed [START_REF] Dufaux | The jpeg xr image coding standard[END_REF], among them we note the standard JPEG 2000 [START_REF] Christopoulos | The jpeg2000 still image coding system: an overview[END_REF] that provides better performance compared to other standards due to its main features such as: (a) low bit-rate performance, (b) lossless and lossy compression (c) random codestream access and processing which allow devices to support some in-network processing (i.e data aggregation in the codestream) and (d) robustness to bit-errors which guarantees a safe data transmission in wireless environments. These features motivate us to consider this compression standard within our work.

To secure compressed images, two main categories of approaches have been explored: (a) Selective Encryption approaches [START_REF] Cheng | Partial encryption of compressed images and videos[END_REF], where the encryption process is applied to a selective part of compressed data which is considered as important and (b) Joint Compression-Encryption approaches [START_REF] Grangetto | Multimedia selective encryption by means of randomized arithmetic coding[END_REF], [START_REF] Liu | Efficient selective encryption for jpeg 2000 images using private initial table[END_REF], where data encryption and compression are fulfilled into a single one step. Approaches in the first category must fulfill the standard format-compliant; i.e., the decoder is able to decode the encrypted data and to visualize the content. In other words, the decoder does not crash when decoding encrypted images. This important feature is fundamental to ensure the portability of the proposed encryption approaches. For this reason, we considered this feature as a requirement in our work.

In this paper, we propose a fast and format-compliant selective encryption algorithm for JPEG 2000 images. The proposed selective encryption scheme is applied to JPEG 2000 code-stream and requires two rounds of substitutiondiffusion processes. To enforce its robustness, the used key is dynamic and changes for every input image. In the substitution process, bytes positions are changed non-linearly in order to effectively crack the correlation between adjacent bytes of the encrypted code-stream. While, in the diffusion process, bytes are changed sequentially (i.e., linear transformation) such that a small change in one byte can affect almost all bytes of the code-stream. The proposed approach is based on selectively choosing an amount of only 4% of data from each JPEG 2000 packet to follow the encryption process.

The main contributions of our work can be summarized as follows:

• High level of security: The proposed cipher algorithm fulfills the main security requirements (key sensitivity, randomness and uniformity) with only two rounds of encryption, rather than using multi encryption rounds as in the case in other encryption algorithms [START_REF] Daemen | The design of Rijndael: AES-the advanced encryption standard[END_REF], [START_REF] Xiang | Joint spiht compression and selective encryption[END_REF]. • High data reduction: An amount of 4% of data is selected from each JPEG 2000 packet to contribute in the encryption process. This amount is sufficient to achieve a high security level compared to other approaches as [START_REF] Norcen | Selective encryption of the jpeg2000 bitstream[END_REF], where an amount of 20% of data is needed to attain the required security level. By that, the proposed algorithm preserves significantly the communication bandwidth. • Format-compliant property: Our proposed encryption scheme respects in its intrinsic construction the format compliant property. • Fast Encryption: The use of our proposed approach with only two rounds of substitution-diffusion processes allows to achieve a fast encryption speed compared to [START_REF] Massoudi | Secure and low cost selective encryption for jpeg2000[END_REF], where AES in counter mode (CTR) is used to achieve the encryption process. The rest of this paper is organized as follows. Section II provides the related work. Section III discusses the proposed encryption algorithm. Extensive security analysis is provided in Section IV. Additionally, compression analysis is investigated in Section V. The performance of the proposed algorithm is term of execution time is studied in Section VI. Finally, Section VII concludes the paper.

II. RELATED WORK

Several works have been proposed for JPEG 2000 encryption schemes. According to [START_REF] Xiang | Secure mq coder: An efficient way to protect jpeg 2000 images in wireless multimedia sensor networks[END_REF], the position where the encryption is introduced can be used as a primary parameter to classify the JPEG 2000 encryption approaches. This classification produces three main schemes: (1) transform-based schemes, (2) coding-based schemes and (3) package-based schemes. In transform-based schemes, the encryption is relied on the use of a secret wavelet transform to provide lightweight security as in [START_REF] Stütz | Efficient wavelet packet basis selection in jpeg2000[END_REF], [START_REF] Stütz | Best wavelet packet bases in a jpeg2000 rate-distortion sense: The impact of header data[END_REF]. Unfortunately, many of the transformbased schemes are found to be inefficient and insecure [START_REF] Engel | Assessing jpeg2000 encryption with key-dependent wavelet packets[END_REF]. In coding-based schemes, the encryption and the entropy coding are fulfilled by one step as in [START_REF] Yuen | A chaos-based joint image compression and encryption scheme using dct and sha-1[END_REF], [START_REF] Pande | Securing multimedia content using joint compression and encryption[END_REF]. Algorithms from this class necessitate a modification of both encoder and decoder which may require additional compression overhead.

In the package-based schemes, the encryption process is performed on the code-stream, which consists of multiple packets (i.e., each packets consists of one packet header and one packet body). Many approaches have been proposed under this class as in [START_REF] Brahimi | Selective encryption techniques of jpeg2000 codestream for medical images transmission[END_REF], [START_REF] Lian | On the design of partial encryption scheme for multimedia content[END_REF]. The main objective of these approaches is to achieve the encryption while respecting the format-compliant property. The mostly related work to this paper is Massoudi et al. approach [START_REF] Massoudi | Secure and low cost selective encryption for jpeg2000[END_REF], where a selective image encryption has been proposed based on selectively choosing an amount of 5.43% from each packet data. Then, bytes are encrypted using the standard AES-128 block cipher [START_REF] Daemen | The design of Rijndael: AES-the advanced encryption standard[END_REF] with a modified CTR mode of operation (using additional modular operation instead of XOR operation), in order to achieve the format-compliant property and ensure the full confidentiality.

Instead of using the AES block cipher with multi-rounds, our proposed encryption algorithm achieves in its intrinsic construction (substitution and diffusion processes) the formatcompliant criterion using only two rounds of encryption within a significantly shorter execution time and by selectively encrypting a small amount of data. Additionally, since the format-compliant property is ensured by the algorithm itself, then it can be used with any mode of operation without introducing any additional overhead.

III. THE PROPOSED ENCRYPTION SCHEME

In this section, we present the proposed cipher algorithm. First, we introduce the main elements of our algorithm. Then after, we discuss the encryption/decryption fundamentals processes. In order to achieve a sufficient level of security while preserving the format-compliant property, our proposed encryption scheme is realized, with two rounds of encryption. In each round, two main processes are applied: (1) the substitution process and (2) the diffusion process.

Moreover, the proposed cipher is applied in counter mode of operation (CTR). This is motivated by the fact that: (a) the encryption process in CTR mode is applied to each block independently from other blocks, which makes the algorithm fully parallelizable and fast in hardware implementation (b) it allows the random access of encryption/decryption process, (c) the algorithm is simple in software and hardware implementations, since the decryption process is achieved similarly to the encryption without the need to reconstruct the inverse counterparts (d) and most importantly, CTR mode assures the robustness against error propagation [START_REF] Burda | Error propagation in various cipher block modes[END_REF].

A. Preliminaries

The encryption/decryption process consists of two fundamental layers: substitution and diffusion layers. In this Section, we begin by explaining the generation of the dynamic key DK v . Then, we provide a discussion about the main elements that constitute the substitution and the diffusion layers (nonlinear S-box and the diffusion matrix G) which are derived from DK v .

1) Dynamic Key Generation: First, the generation of the dynamic key follows the shared key schemes, where the two intelligible parts of communication (transmitter and receiver) share a secret key called Master key (M K). This security mechanism exhibits low complexity compared to the public key schemes. Therefore, it can be well integrated when dealing with constrained devices.

The generation of one dynamic key DK v (v is a counter that is incremented for every new image) from the shared key M K is illustrated in Figure 1 and achieved following these steps:

• First, M K is XORed with an Initialization Vector IV (128 bits) to produce an output K. In order to ensure the unpredictability of IV , a pseudo-random generator proposed in [START_REF] Dworkin | Recommendation for block cipher modes of operation. methods and techniques[END_REF] is used to generate the IV sequence. • Then, K is concatenated with ID A (identity of the transmitter) and v. The concatenated form is hashed using SHA-512 hash function to produce the dynamic key DK v (64 bytes). • The dynamic key DK v (64 bytes) is reshaped into a matrix temp with size of 8 × 8 elements as follows:

temp =      DK 1 v DK 2 v • • • DK 8 v DK 9 v DK 10 v • • • DK 16 v . . . . . . . . . . . . DK 57 v DK 58 v • • • DK 64 v      (1)
This matrix contributes in the generation of the two main components: Substitution key (K s ) that is used later to construct the non-linear S-box of the substitution process and the diffusion matrix (G) for the diffusion process.

2) Substitution Box (S-box): First, K s is realized by Xoring the elements of each column of temp, to produce K s = {K s1 , K s2 , . . . , K s8 }. Then, two control parameters r and t are generated from K s . To assure the bijectivity property, r is chosen to be the even components of K s , while t corresponds to its odd components. After that, a nonlinear transformation f is iterated four times to produce the substitution S-box as follows:

L i = f (L i-1 ) = (L i-1 × (r i × L i-1 + t i )) mod 2 8 (2)
Where, the first input L 0 [k] = k, (k = 0, 1, . . . , 255). r i , t i are the corresponding control parameters for the i th value (i = 1, 2, 3, 4). Then, for each iteration, a bitwise right shift by 3 is applied on the result as expressed in this equation:

L i = RightShif t(L i , 3). (3)
S-box is equal to the output of Equation 3 after four iterations. In other words, S = L 4 . After that, values corresponding to 255 are eliminated from the lookup table of S-box. Therefore, the produced S-box does not contain any element whose value is equal to 0xFF. Let's note that the generation of the inverse S-box is not required here, since the encryption is realized in CTR mode.

3) Diffusion matrix G: The diffusion matrix G deals with integer numbers instead of floating ones to avoid the complex floating operations. G matrix of size 4×4 is constructed based on M that is derived from the dynamic key components as expressed in the following equations:

M = DK 1 v DK 2 v DK 9 v DK 10 v (4)
G = M M + I m M -I m M ( 5
)
I m is the identity matrix of size 2 × 2 and all elements in G matrix are belong to {0, 255}. I m is expressed as follows:

I m = 1 0 0 1 (6)

B. Encryption/Decryption Scheme

The cipher scheme deals with images after applying the JPEG 2000 compression. Hence, a packet is an elementary unit that constitutes the JPEG 2000 code-stream. It transports a compressed data format under certain resolution R, certain layer L, certain precinct P and certain component C. Indeed, the image can be viewed as a set of R × L × P × C packets, where the encryption process is applied to each packet P j contained in the code-stream P j ∈ {P 1 , P 2 , . . . , P t } (i.e., all packets do not necessary have the same number of bytes and t is the total number of packets contained in one code-stream).

Then, an amount of 4% of bytes is selected from each packet P j to follow the encryption process. Elements in the produced S-box (i.e., with size equal to 256) are used to specify the positions of bytes to be encrypted. The procedure of byte's selection is summarized in pseudo-code 1. Let's note that the percentage 4% is chosen in a way that a balance between the high visual degradation and the low computation complexity is fulfilled (see Section IV-E).

The selected data, corresponding to N j number of bytes is then represented as blocks, each of 16 bytes. If N j is not a multiple of 16, a padding with 0's is performed to complete the block elements. The number of blocks in one packet can be represented as {B 1 , B 2 , . . . , B m }, where m depends directly on N j (i.e., if the packet P 1 consists of 500 bytes, only N 1 = 20 bytes of P 1 are selected to follow the encryption process, which are stored in two blocks: the first block consists of 16 bytes, while the second block consists of the four remaining bytes and twelve bytes that are padded). Therefore, the encryption process is performed in block-byblock manner using the following steps:

• First, a pseudo-random generator PRGN is used to generate a pseudo-random, unpredictable and nonce sequence denoted by Count 1 . For each block encryption, this counter is incremented by one. Indeed, in order to encrypt the selected block B n , the counter Count n (i.e., which is equal to Count 1 + (n-1)) is XORed with the dynamic key DK v to produce the output X n . • Then, X n follows the encryption process, beginning by the first substitution process through the use of the non linear S-box as follows:

Y n = S(X n ) n ∈ {1, 2, . . . , m} (7)
• Then, the diffusion process is applied on each substituted block Y n by multiplying its components with the dynamic diffusion matrix G modulo 255, to prevent values of 0xFF to appear in the sequence. Thus, it produces an output denoted by Z n , as expressed in the following Equation:

     z n1,1 • • •z n1,4 z n2,1 • • •z n2,4 . . . . . . . . . z n4,1 • • •z n4,4      =      g 1,1 • • •g 1,4 g 2,1 • • •g 2,4 . . . . . . . . . g 4,1 • • •g 4,4      •      y n1,1 • • •y n1,4 y n2,1 • • •y n2,4 . . . . . . . . . y n4,1 • • •y n4,4     
mod 255

• After that, the output block Z n is used as an input to the second substitution process to produce a new block U n , as expressed in the following equation:

U n = S(Z n ) n ∈ {1, 2, . . . , m} (8)
• Then after, the second diffusion process is applied to the substituted block U n . In this step, elements of U n are multiplied by G ′ matrix (the transpose of G matrix), to produce the corresponding block V n as follows:

     v n1,1 • • •v n1,4 v n2,1 • • •v n2,4 . . . . . . . . . v n4,1 • • •v n4,4      =      g ′ 1,1 • • •g ′ 1,4 g ′ 2,1 • • •g ′ 2,4 . . . . . . . . . g ′ 4,1 • • •g ′ 4,4      •      u n1,1 • • •u n1,4 u n2,1 • • •u n2,4 . . . . . . . . . u n4,1 • • •u n4,4      mod 255
• As final step, the resultant output block V n is XORed (modulo 255) with their corresponding initial block B n to produce at the end the cipher block C n as follows:

C n = (V n + B n ) mod 255 n ∈ {1, 2, . . . , m} (9)
• Finally, after encrypting all corresponding blocks of one packet P j , only N j bytes are taken sequentially from the successive encrypted blocks and located back to their initial positions in P j . By these two rounds, the encryption scheme is completed and the code-stream becomes ready to be transmitted to the receiver. Let's note that, since we are dealing with CTR mode, the decryption process is realized similarly to the encryption one, using the same substitution S-box as well as the same diffusion G matrix. Also, due to the fact that the same S-box is produced, the receiver succeeds to retrieve the positions of the encrypted bytes from each packet of the code-stream to apply the decryption process. The only change is that in Equation 9, the addition operation is replaced by a subtraction operation as follows:

B n = (C n -V n ) mod 255 n ∈ {1, 2, . . . , m} (10)
IV. SECURITY ANALYSIS In this section, several security tests are conducted to evaluate the efficiency and the cryptographic performance of the proposed encryption algorithm. The three standards images: Lena, Pepper and Baboon, each of size 512 × 512 × 3 are taken as source images to perform our experiments. In some security tests, only results for Lena image are represented due to the space limitation. Additionally, security analysis are performed under the following software and hardware environments: GCC, micro-computer Intel Core i7, 5600U CPU at 2.6 GHz with 16 GB RAM Intel, Windows 7, MATLAB R2014a framework and OpenJPEG codec. The JPEG 2000 compression is performed using the standard lossy mode with rate 0.25, 4 tiles, 3 resolutions, one quality layer, one precinct and performed in LRCP progressive mode.

A. Key Sensitivity

Key sensitivity is of primary importance to resist to chosenplaintext and linear attacks. Thus, it means that the cipher is highly depends on the key. In other words, one bit change on the key must produce a totally different cipher-text. To test the sensitivity of the proposed encryption scheme, the following scenario is performed: First, a dynamic key DK 1 is used to perform the encryption algorithm on the compressed Lena image. The decryption process succeeds to recover the compressed image as illustrated in Figure 3-(c). On the other side, a modified dynamic key DK 2 with one bit difference from DK 1 is used to decrypt the same image. As shown in Figure 3-(d), with a little change on the dynamic key, the decryption process fails to reconstruct the original Lena image.

To further demonstrate the key sensitivity, the above scenario is repeated using 1000 randomly selected keys. First, the compressed Lena image followed the selective encryption process using the correct dynamic key DK v to produce the corresponding cipher code-stream C. The reconstruction of the original compressed Lena image L succeeds using DK v . On the other part, C is decrypted using 1000 different dynamic keys, that have only one-bit difference (Least Significant Bit LSB) to produce, at each iteration, a new image denoted by L ′ . After that, the hamming distance (i.e. the difference in bits) between L and L ′ is computed as expressed in Equation 11and illustrated in Figure 4,respectively.

KS = T k=1 L ⊕ L ′ T × 100% (11)
= T k=1 D DKv (C) ⊕ D DK ′ v (C) T × 100%
where T is the length in bits of the plain-text and cipher-text images.

Results show that the majority of values are close to the optimal value (50 %) [START_REF] Xiang | Joint spiht compression and selective encryption[END_REF], which indicates that the proposed selective encryption algorithm has a great sensitivity against any little change on the dynamic key.

B. Key Space analysis

Key space represents the total number of different keys that can be used in the encryption process. In order to ensure the robustness of the encryption algorithm against the bruteforce attacks, the size of key space must not be smaller than 2 128 [START_REF] Cho | Securing against brute-force attack: A hash-based rfid mutual authentication protocol using a secret value[END_REF]. For this reason, the initialization vector IV , the counter sequence as well as the dynamic key DK v used in the proposed approach, each consists of 128-bits. Indeed, the proposed encryption algorithm has 2 128 large key space. Thus, it makes the brute-force attacks unfeasible.

C. Histogram analysis

In statistical analysis, histogram is used to display the frequency of pixel values. If the frequency counts of the encrypted data behaves as a uniform distribution, then pixel values are effectively masked.

In Fig. 5, histograms of the original Lena, Peppers and Baboon images and their corresponding cipher ones are illustrated. Results show that the histograms of the JPEG-2000 encrypted data are uniformly distributed, which are very different compared to those of the original images. Hence, the proposed encryption algorithm significantly eliminates the statistical information of the original image and supports a high strength against statistical attacks.

D. Correlation between Original and Cipher images

Images are characterized by the high correlation between its adjacent pixels (close to 1). An encryption algorithm is said to be efficient, if it removes the spatial redundancy and hides all the attributes of the plain-image, to provide at the end a cipher image that does not support any information about the original image. Indeed after encryption, the correlation between the original and the encrypted images must be negligible (close to zero). To study the correlation effect of the proposed encryption algorithm, the correlation coefficient r between pixels of the original Lena image of size S = 512×512×3 and its corresponding JPEG-2000 encrypted image is measured after applying the proposed algorithm using 1000 different random keys. Results in Figure 6 show that pixels of the plain Lena image have negligible correlation with the pixels of the cipher image (mean equal to 0.0683). Thus, it demonstrates that the proposed encryption scheme succeeds to crack the correlation between pixels and have a high strength against statistical attacks.

E. Visual Degradation

This metric measures the degradation operated on the original image using the encryption algorithm in a way that its visual content, present in the cipher image, is no more comprehensible. In order to evaluate the visual degradation, an amount of 4% of bytes is chosen from each packet data of Lena code-stream to follow the encryption approach. This procedure is repeated using 1000 random keys to produce different cipher images. At each iteration, the Structural Similarity Index (SSIM ) [START_REF] Li | Content-partitioned structural similarity index for image quality assessment[END_REF] is used to measure the level of similarity between the original image and its corresponding JPEG-2000 encrypted image and results are illustrated in Figure 7. SSIM index ranges between 0 and 1. A value of 1 means that the two measured images are identical and a value close to 0 indicates that the two measured images are totally different. Results show that for all ciphered images, the SSIM index does not exceed the value of 0.17, which means that a hard and sufficient visual distortion is achieved using the proposed approach. Additionally, the amount of 4% that is selected from each packet data of the code-stream to follow the encryption process is sufficient to achieve a good balance between hard visual distortion and low computational complexity.

V. COMPRESSION ANALYSIS

Besides ensuring a high security level, the proposed selective encryption scheme must be compression friendly. For this reason, two main metrics related to the compression aspect are evaluated in this section, including (1) the Codestream Compliant analysis as well as (2) the Compression Friendliness evaluation.

A. Code-stream Compliant analysis

Ensuring the format-compliant property is of paramount importance, especially when dealing with selective JPEG 2000 encryption scheme. Since, compliance allows preserving the main characteristics of the original compression coding. Thus, it enables the decoder to decode the encrypted code-stream before decryption. In the proposed selective encryption scheme, both substitution and diffusion processes in their intrinsic structures are format-compliant. First, in the substitution process, any value that is corresponding to 0xFF is eliminated from the look-up table. Additionally, in the diffusion process, the matrix multiplication is provided with addition modulo 255. Indeed, preventing 0xFF marker to appear in the codestream, means that both code-words 0xFF90 and 0xFFFF will not appear in the packet body. Therefore, the encrypted codestream is compliant to the format of the original unencrypted code-stream and preserves all its characteristics.

B. Compression Friendliness

Most joint compression-encryption algorithms decrease the compression performance, since the encryption is performed before the quantization process or within the encoding process. However, using the code-stream-oriented encryption schemes, data modification is applied to the code-stream. Thus, it has no influence on the compression performance. Additionally, the proposed encryption method preserves the format-compliant property. By that, the encrypted image is compliant to the format structure of the unencrypted image. In order to fulfill the encryption algorithm, such operations are based on addition modulo, which neither add nor subtract a bit from the code-stream. Therefore, the proposed algorithm does not affect the compression performance and satisfies the compression friendliness property.

VI. PERFORMANCE EVALUATION

In order to study the performance of the proposed algorithm, the execution time is evaluated due to the fact that less computational time means low computation complexity, and consequently minimum resource requirements for the encryption/decryption processes. In this contexct, Colors Lena, Peppers and Baboon images, with three different sizes : 256 × 256 × 3, 512 × 512 × 3 and 1024 × 1024 × 3 are used to demonstrate the practical performance. First, the compression time for transforming each image into JPEG 2000 format is measured. Then, the encryption time for our proposed encryption scheme as well as for Massoudi et al. approach [START_REF] Massoudi | Secure and low cost selective encryption for jpeg2000[END_REF] are tested as shown in Table I. Results of the encryption time show that the proposed algorithm is faster than Massoudi et al. algorithm by approximately 8 times for small image sizes and by approximately 15.6354 times for large image sizes. Thus, it results to a highly increase in throughput.

VII. CONCLUSION

In this paper, we have proposed a secure format compliant lightweight cipher for protecting JPEG 2000 images. It is consisted of two rounds of: substitution and diffusion process. Format-compliant property is preserved intrinsically in the construction of both process, in order to preserve the characteristics of the original unencrypted code-stream.

Moreover, extensive experiments have been conducted to prove the high level of security and the robustness of the proposed algorithm against the most known types of attacks and its effectiveness in term of execution time compared to the approach proposed in [START_REF] Massoudi | Secure and low cost selective encryption for jpeg2000[END_REF]. Indeed, all these features consider our proposed JPEG 2000 images encryption scheme as a good candidate to deal efficiently with tiny constrained devices.

Fig. 1 :

 1 Fig. 1: The generation of the dynamic key DK v

Fig. 2 : 1 : 5 : 8 : 10 :for co ← 1 to nb do 17 : 18 :

 2158101718 Fig. 2: The proposed selective encryption scheme for JPEG 2000 images

Fig. 3 :Fig. 4 :

 34 Fig. 3: (a) Lena plain image, (b) Encrypted Lena image using DK 1 , (c),(d) Decrypted Lena image using DK 1 and DK 2 respectively (DK 2 differs from DK 1 with only one-bit).

Fig. 5 :Fig. 6 :

 56 Fig. 5: (a), (e), (i) Original Lena, Peppers and Baboon images. (b), (f), (j) Histogram of Lena, Pepper and Baboon images. (c), (g), (k) Cipher Lena, Pepper and Baboon images. (d), (h), (l) Histogram of cipher Lena, Pepper and Baboon images.

Fig. 7 :

 7 Fig. 7: SSIM index between original and JPEG-2000 encrypted Lena image for 1000 different random keys.

TABLE I :

 I Performance of the proposed Approach and Massoudi et al. Approach for the three standards images: Lena, Peppers and Baboon with different sizes.