J Bourgalais

Michael Spencer

David L Osborn

F Goulay

S D Le Picard

Reactions of Atomic Carbon with Butene Isomers: Implications for Molecular Growth in Carbon-Rich Environments

Product detection studies of C( 3 P) atom reactions with butene (C4H8) isomers (but-1-ene, cisbut-2-ene, trans-but-2-ene) are carried out in a flow tube reactor at 353 K and 4 Torr under multiple collision conditions. Ground state carbon atoms are generated by 248 nm laser photolysis of tetrabromomethane, CBr4, in a buffer of helium. Thermalized reaction products are detected using synchrotron tunable VUV photoionization and time of flight mass spectrometry. The temporal profiles of the detected ions are used to discriminate products from side or secondary reactions. For the C( 3 P) + trans-but-2-ene and C( 3 P) + cis-but-2-ene reactions, various isomers of C4H5 and C5H7 are identified as reaction products formed via CH3-and H-elimination. Assuming equal ionization cross sections for all C4H5 and C5H7 isomers, C4H5:C5H7 branching ratios of 0.63:1 and 0.60:1 are derived for the C( 3 P) + transbut-2-ene and the C( 3 P) + cis-but-2-ene reactions, respectively. For the C( 3 P) + but-1-ene reaction, two reaction channels are observed: the H-elimination channel, leading to the formation of the ethylpropargyl isomer, and the C3H3 + C2H5 channel. Assuming equal ionization cross sections for ethylpropargyl and C3H3 radicals, a branching ratio of 1:0.95 for the C3H3 + C2H5 and H + ethylpropargyl channels is derived. The experimental results are compared to previous H-atom branching ratios and used to propose the most likely

2 4 8
mechanisms for the reaction of ground state carbon atoms with butene isomers.

I. INTRODUCTION

Carbon is the fourth most abundant element in the universe and unbounded carbon atoms have been detected in a wide range of environments, from interstellar media (dense and diffuse clouds, protoplanetary nebulae, circumstellar envelopes…) [START_REF] Ingalls | Atomic carbon in the high-latitude molecular cloud MBM-12[END_REF][START_REF] Ingalls | Atomic carbon in southern hemisphere high-latitude clouds[END_REF][START_REF] Van Der Veen | Atomic carbon in the circumstellar envelopes of evolved stars[END_REF][START_REF] Sofia | Carbon in the diffuse interstellar medium[END_REF][START_REF] Wilson | Atomic carbon emission from individual molecular clouds in M33[END_REF] to planetary atmospheres (e.g. Mars, Venus, Titan), [START_REF] Zhang | Atomic carbon in the upper atmosphere of Titan[END_REF][START_REF] Mcelroy | Atomic carbon in atmospheres of Mars and Venus[END_REF][START_REF] Ajello | Titan airglow spectra from the Cassini Ultraviolet Imaging Spectrograph: FUV disk analysis[END_REF] and plasmas. [START_REF] Belikov | Mass spectrometry of molecules and radicals in glow discharge plasma[END_REF][START_REF] Benedikt | Role of carbon atoms in the remote plasma deposition of hydrogenated amorphous carbon[END_REF][11] In these environments, their barrierless reactions with abundant saturated and unsaturated hydrocarbons, nitrogen bearing molecules, and small free radicals are expected to initiate the growth of complex molecules [START_REF] Belikov | Mass spectrometry of molecules and radicals in glow discharge plasma[END_REF][START_REF] Malik | Study of the production of hydrogen and light hydrocarbons by spark discharges in diesel, kerosene, gasoline, and methane[END_REF][START_REF] Pascoli | Condensation and growth of hydrogenated carbon clusters in carbon-rich stars[END_REF] even at very low temperatures. [12][13][14][START_REF] Haider | Kinetic investigation of the reactions of ground-state atomic carbon, C(2p 2 ( 3 PJ)), with acetylenes by time-resolved atomic resonance -absorptionspectroscopy in the vacuum ultra-violet Ber[END_REF][START_REF] Husain | Collisional removal of atomic carbon, C 2p 2 ( 3 PJ) , by aldehydes and ketones, investigated by time-resolved atomic resonance absorption spectroscopy in the vacuum ultra-violet[END_REF] Consequently, carbon atom reactions are expected to play a role in the formation of polycyclic aromatic hydrocarbons (PAHs), aerosols, and soot. [START_REF] Belikov | Mass spectrometry of molecules and radicals in glow discharge plasma[END_REF][START_REF] Malik | Study of the production of hydrogen and light hydrocarbons by spark discharges in diesel, kerosene, gasoline, and methane[END_REF][START_REF] Pascoli | Condensation and growth of hydrogenated carbon clusters in carbon-rich stars[END_REF] Improving the accuracy of models trying to reproduce the chemistry of such environments requires a better understanding of the mechanisms of elementary reactions between carbon atoms and abundant hydrocarbons. This goal can be achieved by probing the products of these reactions experimentally and theoretically over a wide range of physical conditions.

Most of the previous research on C( 3 P) reactivity focused on reactions with hydrocarbons containing fewer than 4 carbon atoms, investigated using various experimental techniques such as crossed molecular beams, 16,[19][START_REF] Leonori | Unraveling the dynamics of the C( 3 P, 1 D)+C2H2 reactions by the crossed molecular beam scattering technique[END_REF][START_REF] Kaiser | Crossed-beam reaction of carbon atoms with hydrocarbon molecules. V. Chemical dynamics of n-C4H3 formation from reaction of C( 3 PJ) with allene, H2CCCH2(X 1 A1)[END_REF][START_REF] Kaiser | Crossed-beam reaction of carbon atoms with hydrocarbon molecules .4. Chemical dynamics of A c c e p t e d m a n u s c r i p t g methylpropargyl radical formation, C4H5, from reaction of C( 3 PJ) with propylene, C3H6 (X 1 A')[END_REF][START_REF] Geppert | Combined crossed-beam studies of C( 3 PJ)+C2H4 -> C3H3+H reaction dynamics between 0.49 and 30.8 kJ mol -1[END_REF][START_REF] Lee | Molecular-beam studies of elementary chemical processes[END_REF][START_REF] Chin | Exploring the dynamics of reaction C( 3 P)+C2H4 with crossed beam/photoionization experiments and quantum chemical calculations[END_REF] flow tubes, [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF][START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF][START_REF] Bourgalais | The C( 3 P) + NH3 reaction in interstellar chemistry. I. Investigation of the product formation channels[END_REF][START_REF] Bergeat | Reaction of carbon atoms, C (2p 2 , 3 P) with C2H2, C2H4 and C6H6: Overall rate constant and relative atomic hydrogen production[END_REF] or CRESU experiments, 13,14,41 often coupled with ab initio calculations. 18,[START_REF] Mebel | Ab initio MO study of the global potential energy surface of C4H4 in triplet electronic state and the reactions of C( 3 PJ) with C3H4 (allene and propyne) and C2(A 3 u) with C2H4(X 1 A + )[END_REF]25 The accepted dominant reaction mechanism derived from these experiments is addition of the C( 3 P) to the hydrocarbon followed by the loss of a hydrogen atom or methyl group to form an open-shell molecule. [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF][START_REF] Bergeat | Reaction of carbon atoms, C (2p 2 , 3 P) with C2H2, C2H4 and C6H6: Overall rate constant and relative atomic hydrogen production[END_REF] For large unsaturated hydrocarbons such as butene isomers (C H ), exit channels other than H-atom or CH3 loss may become accessible. [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] Butene is one of the smallest hydrocarbons with structural isomers and is a good archetype molecule for the study of gaseous fuel reactivity. It is a negligible component in A c c e p t e d m a n u s c r i p t 2 gasoline but is produced during the combustion of larger hydrocarbons. [42][43][44] The high temperature (>1200 K) pyrolysis of butene isomers leads to the formation of reactive free radicals such as methyl (CH3), propargyl (C3H3) and allyl (C3H5) and ultimately to the formation of larger molecules such as benzene and C5H6 isomers. 45 Under plasma conditions, butene is known to decompose easily into CHx and C2Hx (x=1,2,3) species and is used as a source of carbon atoms. 46 Butene isomers are also believed to play a role in the photochemistry of organic molecules in planetary atmospheres (e.g. Titan). 47,48 They are expected to react rapidly with atoms such as C, O, or N and with small hydrocarbons radicals such as CH or C2H. Although rate constants and product distributions of butene reactions have been shown to depend on the specific butene isomer, 49 computational model of these environments do not consider isomeric C4H8 structures, likely leading to uncertainties in the derived abundances of large species. Atkinson & Aschmann 49 determined rate constants for the reactions of OH radical with but-1-ene, cis-but-2-ene, trans-but-2-ene and isobutene at 295±1 K to be (3.13±0.16)×10 -10 cm 3 molecules -1 s -1 , (5.60±0.13) ×10 -10 cm 3 molecules -1 s -1 , (6.39±0.13 ) × 10 -10 cm 3 molecules -1 s -1 and (5.13±0.24 ) × 10 -10 cm 3 molecules -1 s -1 , respectively. Loison et al. 50 investigated the lighter products formed by the reaction of OH radicals with trans-but-2-ene, and but-1-ene in a fast flow reactor at room temperature. The branching fractions for the H-atom abstraction channel were measured to be 8±3% for OH + but-1-ene, and 3±1% for OH + trans-but-2-ene. More recently Bouwman et al. 51 investigated C H radical reactions with butene isomers (but-1-ene, cis-but-2-ene, trans-but-2-ene and isobutene) in a Laval expansion at 79 K. They found similar rate constants for all reactions (ca. 2 × 10 -10 cm 3 molecules -1 s -1 ) in agreement with previous measurements performed at room temperature, 52,53 but observed an isomer dependence of the reaction products. It is worth noting that this work also showed that the C2H + C4H8 reactions contribute to molecular weight growth with formation of larger species (4-penten-1-yne, 3-penten-1-yne, A c c e p t e d m a n u s c r i p t 4 2-methyl-1-buten-3-yne, 4-methyl-3-penten-1-yne) through methyl radical elimination in addition to H-atom elimination.

The reaction kinetics of C( 3 P) + butene isomers was first studied by Haider & Husain 12 at room temperature in a slow flow reactor. They measured overall rate constants for reactions with but-1-ene, cis-but-2-ene and trans-but-2-ene of (4.3±0.2)×10 -10 cm 3 molecule -1 s -1 , (3.2±0.2)×10 -10 cm 3 molecule -1 s -1 and (2.9±0.2)×10 -10 cm 3 molecule -1 s -1 , respectively. More recently, Loison & Bergeat [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] measured an overall rate coefficient for the the C( 3 P) + trans-but-2-ene reaction of (1.9±0.6)×10 -10 cm 3 molecule -1 s -1 , which is a factor propene reaction products. [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF]57 The reaction of acetylene (C2H2) with the i-C4H5 isomer is suggested as a possible route to benzene (c-C6H6) formation under certain flame conditions. 58 The reaction would initially form fulvene (c-C5H4=CH2) which could then convert to benzene by H-atom-assisted isomerization. 59 The role of the methylpropargyl isomers (CH3CHCCH and CH3CCCH2) in ring formation processes is still unknown and requires further investigation. For instance, CH3CHCCH, is completely absent from flame models whereas CH3CCCH2 is suggested to form toluene C7H8 (C6H5-CH3) or benzyl radical C7H7 (C6H5-CH2) by reaction with the propargyl radical (CH3CCH2). 60 In this work we present an investigation of the products formed by reactions of triplet ground state carbon atoms C( 3 P) with three butene isomers : but-1-ene, cis-but-2-ene and trans-but-2-ene. In order to probe the reaction products, experiments are performed in a flow tube reactor under multiple collision conditions [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF]

II. EXPERIMETAL PROCEDURE

A description of the apparatus has been given elsewhere 61,62 and only a brief overview is presented here. Reactions are performed in a quartz flow tube with a length of 62 cm and Carbon atoms were generated by 248 nm photolysis of CBr4, using a pulsed excimer (KrF) laser operating at 10 Hz. The laser power output is typically 266 mJ per pulse (20 ns), with a fluence inside the reaction flow tube of ~20-50 mJ cm -2 . The multiphoton photodissociation of CBr4 at 248 nm eliminates multiple halogen atoms, leading to the formation of carbon atoms 62 and CBr radicals. rate coefficient of k = 5.3x10 -12 cm 3 molecules -1 s -1 . 65 In order to avoid potential chemical interferences from the reaction between C( 1 D) and butene, the present experiments were performed using a large excess of N2 (1.8x10 16 cm -3 ). In the present experimental conditions (353 K & 4 Torr), for known densities of reactant (C4H8 ~ 10 14 cm -3 ) and considering a C( 3 P)

+ C H reaction rate constant of k = 1.9 x 10 -10 cm 3 molecules -1 s -1 , [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] the characteristic decay times are calculated to be five times shorter for C( 1 D) reaction with molecular nitrogen than for the C( 3 P) reaction with butene isomers. Consequently, in the following sections the influence of C( 1 D) atoms reactions with butene isomers is neglected. In addition, due to the high efficiency of C( 3 P) fine structure relaxation by collision with He, the spin-orbit level population distribution of ground state carbon atoms, C( P0,1,2) in the flow tube are expected to be thermalized. 13,66 The impact of CBr reactions with butene on product identification is discussed in the Results section. Finally, it is worth noting that the absorption cross-section of 1-butene was measured to be 6.810 -21 cm 2 at 220 nm, [START_REF] Es-Sebbar | Temperature-dependent absorption crosssection measurements of 1-butene (1-C4H8) in VUV and IR[END_REF] likely leading to negligible dissociation of the butene isomers at the longer wavelength used here.

III. COMPUTATIONAL METHODS

Electronic structure calculations of the neutral C5H7 species and their cations are carried out using the Gaussian09 package employing the B3LYP/CBSB7 method to obtain optimized geometries. Theoretical calculations with the same methods were applied for C4H5 isomers in a previous study. [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] Heats of reaction and adiabatic and vertical ionization energies are obtained using the CBS-QB3 composite method. All the vibrational frequencies are real, indicating that the optimized geometries represent minima on the potential energy surface.

Photoionization spectra of C5H7 isomers are calculated at 298 K using the G09 package within the Franck-Condon approximation. [START_REF] Barone | Fully integrated approach to compute vibrationally resolved optical spectra: From small molecules to macrosystems[END_REF] The simulated factors are convolved with a 40 meV (FWHM) Gaussian response function and integrated to simulate direct photoionization spectra.

IV. RESULTS

Table 1 reports the optimized structures for seven C5H7 isomers together with their computed ionization energies. Because the cationic form of the cyclic isomer cannot be optimized, the value reported is the vertical ionization energ. As mentioned above, C4H5 isomers have been investigated in a previous study. [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] Table 1 Optimized structures (B3LYP/CBSB7 method) and adiabatic ionization energies (CBS-QB3 method) (verticalfor thec-C5H7) of C5H7 isomers Table 2 presents computed enthalpies of reaction at 298 K for all the predicted reaction channels and investigated C4H8 isomers. All of the reaction channels are found to be exothermic. The difference between isomers is outside the error of the method which is ~5 kJ mol -1 on averaged prediction of ∆ fH°(298.15 K) for CBS-X methods. [START_REF] Simmie | Benchmarking compound methods (CBS-QB3, CBS-APNO, G3, G4, W1BD) against the active thermochemical tables: A litmus test for costeffective molecular formation enthalpies[END_REF] Within these uncertainties, the enthalpies of reaction displayed in Table 2 Photoion spectra were recorded with and without CBr4 and with or without the photolysis laser pulse. In the absence of butene in the reactor flow, no ion signals were detected at m/z 15, 53 and 67, corresponding to the expected C( 3 P) + butene product masses (CH3, C4H5 and C5H7). The reactivity of CBr radicals with butene isomers has to be considered to ensure that products formed at m/z 53 and 67 do not originate from reactions involving CBr. The rate coefficient of trans-C4H8 reaction with CBr has been determined by Ruzsicska et al. [START_REF] Ruzsicska | Chemistry of carbynes -Reaction of CF, CCl, and CBr with alkenes[END_REF] to be 1.2310 -11 cm 3 molecules -1 s -1 , which is fifteen times lower than that of the C( 3 P) reaction with butene. [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] Consequently, under the present experimental conditions, CBr + butene products are formed more slowly than the C( 3 P) + butene products. Previous slower secondary processes and side reactions with characteristic times of the order of few hundreds of microseconds can be discriminated against primary processes by inspecting the product time traces. [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] Furthermore, for all the results presented below, the contributions from slow reactions or subsequent reactions are minimized by integrating mass spectra only over the 0-1 ms time range.

In the sections below, we analyze mass spectra and photoionization spectra obtained upon irradiation of a mixture of CBr4 with three different butene isomers: but-1-ene, cis-but-2-ene, trans-but-2-ene. Photoionization spectra acquired at 4 and 8 Torr do not show significant differences. In the following section only spectra recorded at 4 Torr are presented.

Comparing photoionization spectra to previous results or to calculated photoionization spectra identifies the isomeric structure of the reaction products.

The time behavior of the non-normalized ion signal after the laser pulse is used to discriminate between C( 3 P) reaction products and products from side reactions as well as to infer product branching fractions. The signals Si for the main products are fitted using Eq. 1 corresponding to a pseudo-first order model of sequential reactions. 71

  S i k 1,i   k1,i t k2,i t   S i t     e e Eq.1  k 2,i k 1,i 
The coefficients k1,i and k2,i are the pseudo first order rate constants for the formation and loss of the product i. S i is proportional to the amount of reactants consumed to form product i.

'

Branching ratios are obtained from the ratio of the S i assuming equal ionization cross sections. The diffusion corrected [START_REF] Keyser | High-pressure flow kinetics. A study of the OH + HCl reaction from 2 to 100 torr[END_REF][START_REF] Bergeat | Fast-flow study of the CH plus CH reaction products[END_REF] pseudo first order rate (9,000 s -1 ) is still lower than the predicted one (19,000 s - From the above analysis, C5H7 and C4H5 isomers are likely to be the primary products Photoionization spectra were also recorded for secondary products, m/z 55 and 68

A. C( 3 P) + trans-but-2-ene values for two different channels

(not shown here). The presence of an ion onset at ca. 7.5 eV for m/z 55 suggests the contribution of one or two 1-methylallyl isomers (C4H7). 76 They are likely formed by abstraction of an H atom from butene by reactive species such as Br, CBr, or H. 76 The presence of an ion onset at 8.8 eV in the photoionization spectrum for m/z 68 suggests its identification as isoprene. 54

B. C( 3 P) + cis-but-2-ene

The mass spectrum registered (not shown here) following photolysis of a CBr4 and cis-but-2-

V. DISCUSSION

For the C( 3 P) reactions with the trans-and cis-but-2-ene isomers, assuming equal ionization cross sections for the C4H5 and C5H7 isomers, C4H5:C5H7 branching ratios are found to be 0.63:1 and 0.60:1 ratio, respectively. This suggests that the stereoisomery has no effect on the product ratios. The results for the trans-but-2-ene isomer differs from the 0.330. detection. [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] The discrepancy reported here could be due to the low signal in the present experiments for the C5H7 isomers combined with the assumed equivalence of the photoionization cross section of these isomers. For these reasons the values reported by

Loison and Bergeat [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] are likely to be more accurate. For the C( 3 P) reaction with but-1-ene, 9 suggests ethylpropargyl as the main product isomer.

FIG. 10 presents a proposed mechanism for the direct formation of the dimethylpropargyl and ethylpropargyl isomers from C( 3 P) reactions with the butene isomers.

As previously proposed [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] the carbon atom is likely to interact with the  -electron system of the unsaturated hydrocarbon to form a 3-carbon ring. In the case of but-2-ene, different stereoisomers of the cyclic intermediate will be formed by reaction with the cis-or trans-but-2-ene. The strained isomer is likely to have a very short life time (<1ps) as suggested by

Loison et al. [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] Interestingly, in the case of C( 3 P) + trans-and cis-but-2-ene reactions where C4H5 is formed, the photoinization spectra, displayed in FIG. 4 and6, differ significantly from those obtained for the C + C3H6 reactions by Capron et al. [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] or for fuel-rich flames experiments by

Hansen et al. 57 The main difference seems to be due to the absence of the i-C4H5 isomer (IE=7.55 eV). [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] This contrast can be explained by the different loss channels of the intermediates formed by ring opening of the adducts from the C + propene or C + butene reactions. FIG. 12 displays the adduct formed by reaction of carbon atoms with cis-but-2-ene (top) and propene (bottom). In the case of the reaction with propene, the i-C4H5 isomers are formed directly by elimination of an H-atom from the methyl group. [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] In the case of CH3 loss from the C5H8 intermediate, the isomer formed by the most direct pathway is the CH 3 CHCCH methylpropargyl isomer. Formation of the i-C4H5 isomer would require a hydrogen transfer from the methyl group to a carbon in position. Although within our experimental energy resolution it is not possible to distinguish between the two methylpropargyl isomers, the detection of one or both of the methylpropargyl isomers is Although carbon atoms may not be formed in standard flames and engines, they are known to be present in plasma and plasma-assisted environments. [START_REF] Belikov | Mass spectrometry of molecules and radicals in glow discharge plasma[END_REF][START_REF] Benedikt | Role of carbon atoms in the remote plasma deposition of hydrogenated amorphous carbon[END_REF][11] Similar to the CH radical, carbon atoms will react with the most abundant fuel molecules through addition/elimination pathways to form larger molecules. Such mechanisms still need to be validated, especially for large hydrocarbon molecules used as fuels. Coupling plasmas to combustion systems has the potential to greatly improve the combustion process through both an increase in combustion efficiency and a reduction in the emission of pollutants (e.g. NOx, CO2, soot). 78 Feedback control algorithms using emission concentration as error signals and applied plasma as control signals could allow the combustion device to run at its stability limit. The design of such plasma-assisted technologies requires a basic understanding of the Isomers of the C4H5 and C5H7 hydrocarbon radicals have been detected in standard combustion flames where they contribute to the formation of larger molecules, including aromatic hydrocarbons. 58,79 Their detection from the C( 3 P) + butene isomers reactions suggests that the formation of these radicals will be enhanced under plasma assisted combustion conditions potentially changing the molecular growth chemical scheme. The estimated branching ratios obtained in the present experiments are important data for the design of new combustion models under high-energy conditions such as those found in plasma. Ultimately these models will be used to tailor new combustion strategies with lower emission and higher efficiency.

Carbon-containing molecules can take various forms such as carbon chain molecules, polycyclic aromatic hydrocarbons (PAHs), carbon clusters and carbonaceous solids. 80 C( 3 P) atoms have been detected in dense interstellar clouds [81][82][83] where a large fraction of the observed interstellar molecules are formed. None of the C4H8 isomers however, have been observed so far, likely due to their low electric dipole moments ( 0,5 D). Their predicted abundances in astrochemical models, formed through C and C + reactions, seems to be sensitive to reactions involving atomic oxygen and nitrogen. 84 In methane rich atmospheres such as Titan's, hydrocarbon formation is initiated by the photochemistry of methane that produces more complex and less saturated hydrocarbons. 47,48,85-88 Although C4H8 has not been detected in Titan's atmosphere, 47 Lavvas and coworkers 48 for instance, included the reaction of carbon with 1-butene isomer in their photochemical model of Titan's atmosphere with no information on the products. Zhang et al. [START_REF] Zhang | Atomic carbon in the upper atmosphere of Titan[END_REF] showing that C4H8 (with no isomer distinction) is among the most abundant C4Hx species above 600 km. Such large hydrocarbons could also play a role in the formation of organic hazes observed in Titan's atmosphere. 89 The rate coefficient of the reaction C( 3 P) trans-but-2-ene was measured by Loison et al. at room temperature (k = 1.910 -10 cm 3 molecules -1 s -1 ) [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] and is likely to be of the same order of magnitude for cis-but-2-ene and but-1-ene. A large number of reactions between ground state carbon atoms and small saturated or unsaturated hydrocarbons have been shown

to be fast at room temperature 12,[START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF][START_REF] Haider | Kinetic investigation of the reactions of ground-state atomic carbon, C(2p 2 ( 3 PJ)), with acetylenes by time-resolved atomic resonance -absorptionspectroscopy in the vacuum ultra-violet Ber[END_REF][START_REF] Bergeat | Reaction of carbon atoms, C (2p 2 , 3 P) with C2H2, C2H4 and C6H6: Overall rate constant and relative atomic hydrogen production[END_REF]90 with rate coefficients increasing with decreasing temperature. 13,14,91 Similarly, it is expected that reactions of C( 3 P) with butene isomers remain fast down to very low temperatures. Furthermore, the present investigation shows that even for such a simple system, the title reaction can form quite a large number of hydrocarbon radicals such as C4H5 isomers (H2CCCCH3 and/or HCCCHCH3), propargyl (C3H3), dimethylpropargyl and ethylpropargyl. Although the methyl radical is not detected it is expected to be formed by reaction of carbon atoms with trans-and cis-butene. The nature and branching ratios of these radicals are found to depend on the C H isomers considered, and are consistent with simple addition/elimination schemes shown in Figs. 10 -12. All these radicals are susceptible to participate in the formation and destruction of other molecules present in these environments. This stresses the importance of including molecular isomer resolution for both reactants and products in interstellar astrochemical and atmospheric photochemical models in order to estimate their abundances as well as their potential importance in chemical schemes leading to the formation and destruction of complex molecules.

A c c e p t e d m a n u s c r i p t

VI. CONCLUSION

The ground state C( 3 P) reactions with butene isomers (but-1-ene, cis-but-2-ene, transbut-2-ene) were studied under multiple collision conditions [START_REF] Capron | Flow tube studies of the C( 3 P) reactions with ethylene and propylene[END_REF] at 353 K and 4 Torr using tunable photoionization coupled to time-of-flight mass spectrometry. Products from secondary or side reactions are distinguished from primary products using the temporal profile of the detected ions. The reactions are performed under multiple collision conditions from 4 to 8 Torr with no significant pressure dependence of the product distributions.

Although the initial energized adduct is expected to have a very short lifetime (<1ps), 16,[START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] statistical calculations have shown that some of its isomers may have longer lifetime, up to tens of nanoseconds for intermediates of the C( 3 P) + C H reaction for instance. 18 Experimental or theoretical studies over a wider range of pressure are required to fully investigate the effect of collisional quenching on the final product distribution and the role of intersystem crossing.

In the case of C( 3 P) + trans-but-2-ene and C( 3 P) + cis-but-2-ene reactions, the observed reaction exit channels are C4H5 + CH3 and C5H7 + H. Assuming similar ionization cross sections for the CH3-and H-coproducts, the C4H5:C5H7 branching ratios are 0.63:1 and 0.60:1 for reactions with trans-and cis-2-butene, respectively. These values differ from the 1:0.5 CH3:H-loss ratio measured in fast flow reactor [START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF] or the 1:1 ratio suggested by Li et al. 54 from the analysis of the C H potential energy surface. The difference between the experimental branching ratios is likely to be in part due to the absence of data on the photoionization cross sections for the C5H7 and C4H5 isomers. Further experimental or theoretical studies are required to obtain C4H5 and C5H7 photoionization cross-section and therefore more accurate branching ratios.

For the C( P) + but-1-ene reaction, the observed reaction channels are C3H3 + C2H5

and C5H7 + H. The measured C3H3:C5H7 signal ratio from the present flow data is found to Photoionization spectra at the mass of the C4H5 isomers for the trans and cis isomers show formation of one or both methylpropargyl isomers and negligible formation of i-C4H5.

Within the experimental energy resolution, it is not possible to distinguish between the two methylpropargyl isomers. Photoionization spectra at the mass of the C5H7 isomers display very low signal-to-noise ratio and do not allow the unequivocal identification of the formed isomers. The detection of signal below 7.8 eV is consistent with the formation of dimethylpropargyl for reaction with the trans and cis isomers. In the case of the reaction with but-1-ene, the photoionization spectrum is well reproduced by the simulated spectrum of only ethylpropargyl.

Overall, the isomer-resolved product detection for the C(

of 1 .

 1 scheme leading to the formation of aromatic rings. 55,56 C4H5-isomers (i-C4H5 and methylpropargyl isomers) have been observed both in fuel-rich flames 57 and as C( 3 P) +

  (353 K & 4 Torr) at the Advanced Light Source (ALS) synchrotron of Lawrence Berkeley National Laboratory. Detection of the products in the flow is carried out using tunable Vacuum Ultraviolet (VUV) photoionization and time of flight mass spectrometry. Kinetic traces and photoionization spectra supported by thermodynamic and Franck-Condon factor calculations of the C4H5 and C5H7 species have been used to infer the primary products of the reactions.

A c c e p t e d m a n u s c r i p t 6 1.

 6 photoionization spectra at a given m/z ratio are obtained by integrating the data set over the desired mass and time windows. The ionizing photon energy is scanned from 7.4 to 9.0 eV in

A c c e p t e d m a n u s c r i p t 4 8 3

 8 harmonics of the undulator energy. Up to three independent datasets are recorded for each reaction and averaged. The photon energy resolution is determined to be of the order of 40 meV by measuring an atomic resonance of Xe.

A c c e p t e d m a n u s c r i p t 8

 8

A c c e p t e d m a n u s c r i p t

A c c e p t e d m a n u s c r i p t 10 ''

 10 investigations on the C( 3 P) + ethylene and C( 3 P) + propylene reactions have shown that such

FIG. 1

 1 FIG.1displays the mass spectrum obtained following photolysis of a mixture of CBr4

  FIG. 2. Normalized averaged kinetic traces of m/z 146/148 (red circles) and m/z 147/149 (blue squares) obtained by photolysis of a CBr4 and trans-but-2-ene mixture in helium, at 9.0

  A c c e p t e d m a n u s c r i p t 13 350 µs time constant of the observed rise, corresponding to a large value of k1st (≥3 500 s -1 ).

  FIG. 3. Normalized kinetic traces obtained by photolysis of a CBr4 and trans-but-2-ene mixture in helium, at 9.0 eV photon energy of (a) m/z 53 (blue down triangles) & 67 (purple

FIG. 4 .

 4 FIG. 4 displays the m/z 53 photoionization spectrum obtained by irradiating the CBr4 and trans-but-2-ene mixture at 248 nm. The data are integrated over the 0-40 ms time range and displayed from 7.4 to 9.0 eV photon energy. Within the experimental uncertainty, the

A c c e p t e d m a n u s c r i p t In FIG. 3 ,

 3 the decay rate of the m/z 67 signal (428 s -1 ) is greater than that of the m/z 53 signal (42 s -1 ). From the product identification above, these signals are likely to be due to ionization of dimethylpropargyl and methylpropargyl. The presence of a methyl group on either terminal carbon of the propargyl radical may result in hyperconjugation[START_REF] Fleming | Frontier orbitals and organic chemical reactions[END_REF] between the partially filled p orbital and the  orbital from a C-H bond in beta position. Although hyperconjugation stabilizes the radical site, it weakens the methyl C-H bond, facilitating Habstraction by Br or H atoms. The large difference in decay rate between the two radicals could be due to the dependence of the hyperconjugation strength on the isomeric structure of the substituted propargyl radical and the number of methyl groups. Abstraction of a H-atom from dimethylpropargyl is consistent with the detection of a signal at m/z 66 with a slow formation rate (not shown). Within the experimental signal-to-noise, no signal is detected at m/z 52.

  ene mixture in helium and nitrogen leads to the observation of the same four major peaks m/z 53, 55, 67 & 68 as for trans-but-2-ene. FIG. 5 shows the normalized temporal traces of (a) m/z 53 (blue down triangles) and 67 (purple triangles) (b) m/z 55 (cyan diamonds) and 67 (purple triangles) and (c) m/z 68 (dark yellow left triangles) and 67 (purple triangles). Thick blue, cyan and purple lines are double exponential fits to m/z 53, 55 and 67 respectively. The

A c c e p t e d m a n u s c r i p t 18 thickA c c e p t e d m a n u s c r i p t 4 5 4 (

 184 FIG. 5. Normalized kinetic traces obtained by photolysis of a CBr4 and cis-but-2-ene mixture

A c c e p t e d m a n u s c r i p t 20 FranckFIG. 7 .FIG. 8

 2078 FIG. 7. Photoionization spectrum of m/z 67 obtained by photolysis of a CBr4 and cis-but-2-

A c c e p t e d m a n u s c r i p t A c c e p t e d m a n u s c r i p t 20 observedA c c e p t e d m a n u s c r i p t 21 at 9 .FIG. 9 .

 202199 FIG. 8. 3D mass spectrum obtained by photolysis of a CBr4 and but-1-ene mixture in helium

  06 absolute H-atom production branching fraction measured in fast flow reactor monitoring H-atom fluorescence by Loison and Bergeat 23 corresponding to a 1:0.5 C4H5:C5H7 branching ratio. Li et al. propose a possible 1:1 branching fraction based solely on the energetics of the products and transition states. 54 Previous work on branching fraction for the C( 3 P) + C3H6 reaction led to reasonable agreement between our results using tunable VUV photoionization with time of flight mass spectrometry and those obtained Loison and Bergeat using H atom fluorescence

the 1 :A c c e p t e d m a n u s c r i p t 3 3

 13 0.95 branching fraction for the C3H3:C5H7 isomers derived from our experiments suggests similar probability of losing a H or C2H5 group from the initial C5H8 reaction adduct. No experimental or theoretical values are available for comparison. C5H7 production, corresponding to the H elimination channel, is observed for all three C( 3 P) + butene isomer reactions. In the case of the C( 3 P) + trans-but-2-ene reaction, the theoretical investigation by Li et al. suggests that dimethylpropargyl (CH3CHCCCH3) is the most likely isomer produced. Although this cannot not be confirmed by the present study for the C( 3 P) + trans-but-2-ene reaction, the fit of the photoionization spectrum presented in FIG.7 is consistent with the formation of the dimethylpropargyl isomer by the C( 3 P) + cis-but-2-nene reaction. Regarding the C( 3 P) + but-1-ene reaction, the photoionization spectrum in FIG.

  FIG.10. Proposed mechanisms for the formation of C5H7 isomers from C( P) reactions with butene isomers.

A c c e p t e d m a n u s c r i p t 24 C4H5

 24 FIG. 11. Formation of propargyl radical from C2H5-loss from the C( 3 P) + but-1-ene reaction

A c c e p t e d m a n u s c r i p t consistent with mechanisms

  FIG.12. Formation of C4H5 isomer from CH3 or H-loss from the C( 3 P) + cis/trans-but-2-ene (top) and C + propene (bottom) reaction adducts.[START_REF] Hahndorf | A combined crossed-beam, ab initio, and Rice-Ramsperger-Kassel-Marcus investigation of the reaction of carbon atoms C( 3 PJ) with benzene, C6H6(X 1 A1g) and d(6)-benzene, C6D6(X 1 A1g)[END_REF]

A c c e p t e d m a n u s c r i p t ACS

 t Paragon Plus Environment combined combustion and plasma chemistry leading to increased heat release and decreased emissions.

A c c e p t e d m a n u s c r i p t 4 8 photochemical

 8 photochemical reactions involving chemical species containing at least three carbon atoms to describe carbon atom chemistry above 600 km. Recently, Dobrijevic and coworkers 88 derived abundance profiles from a 1D-photochemical model coupling neutral and ion chemistries,

28

 28

A c c e p t e d m a n u s c r i p t be 1 :

 1 0.95 assuming equal photoionization cross sections for the C3H3 and C5H7 radicals. No C4H5 formation is observed for this reaction. The non-detection of C4H5 for reaction with but-1-ene is consistent with direct addition of the carbon atom onto the carbon double bond followed by rapid ring opening to form a triplet allene-like structure. The most likely fate of the energized intermediate is a C-C bond breaking in  position from the carbene center. In the case of reaction with but-1-ene, this direct addition-elimination mechanism leads to the formation of the observed C2H5 and C3H3 radicals.

( 80 )

 80 Henning, T.; Salama, F. Carbon -Carbon in the universe. Science 1998, 282, 2204-2210. (81) Phillips, T. G.; Huggins, P. J. Abundance of atomic carbon (C) in dense interstellar clouds. Astrophys. J. 1981, 251, 533-540. (82) Schilke, P.; Benford, D. J.; Hunter, T. R.; Lis, D. C.; Phillips, T. G. A line survey of Orion-KL from 607 to 725 GHz. Astrophys. J. Supp. Series 2001, 132, 281-364. (83) Stark, R.; Wesselius, P. R.; vanDishoeck, E. F.; Laureijs, R. J. Neutral carbon in translucent regions of the dark cloud L 183. Astron. Astrophys. 1996, 311, 282-290. (84) Loison, J. C.; Wakelam, V.; Hickson, K. M.; Bergeat, A.; Mereau, R. The gas-phase chemistry of carbon chains in dark cloud chemical models. Mon. Not. R. Astron. Soc. 2014, 437, 930-945. (85) Vuitton, V.; Yelle, R. V.; Lavvas, P.; Klippenstein, S. J. Rapid association reactions at low pressure: impact on the formation of hydrocarbons in Titan. Astrophys. J. 2012, 744, 1-7. (86) Krasnopolsky, V. A. Chemical composition of Titan's atmosphere and ionosphere: Observations and the photochemical model. Icarus 2014, 236, 83-91.

A c c e p t e d m a n u s c r i p t 41 (

 41 87) Dobrijevic, M.; Hebrard, E.; Loison, J. C.; Hickson, K. M. Coupling of oxygen, nitrogen, and hydrocarbon species in the photochemistry of Titan's atmosphere. Icarus 2014, 228, 324-346. (88) Dobrijevic, M.; Loison, J. C.; Hickson, K. M.; Gronoff, G. 1D-coupled photochemical model of neutrals, cations and anions in the atmosphere of Titan. Icarus 2016, 268, 313-339. (89) Woon, D. E.; Park, J. Y. Modeling chemical growth processes in Titan's atmosphere 2. Theoretical study of reactions between C2H and ethene, propene, 1-butene, 2-butene, isobutene, trimethylethene, and tetramethylethene. Icarus 2009, 202, 642-655. (90) Haider, N.; Husain, D. The collisional behavior of ground-state atomic carbon, C(2p 2 ( 3 PJ)), with unsaturated cyclic-compounds studied by time-resolved atomic resonanceabsorption spectroscopy in the vacuum ultra-violet Ber. Bunsen-Ges. Phys. Chem. Chem. Phys. 1993, 97, 571-577. (91) Chastaing, D.; Le Picard, S. D.; Sims, I. R.; Smith, I. W. M. Rate coefficients for the reactions of C( 3 PJ) atoms with C2H2, C2H4, CH3C=CH and H2C=C=CH2 at temperatures down to 15 K. Astron. Astrophys. 2001, 365, 241-247.

A c c e p t e d m a n u s c r i p t

  for the C( 3 P) + trans-C4H8 reaction are similar to those calculated by Li et al. (G3B3//B3LYP/6-311G(d,p)).54 These values are all lower than the enthalpies calculated by Loison and Bergeat based on experimental enthalpies of formation.[START_REF] Loison | Reaction of carbon atoms, C (2p 2 , 3 P) with C3H4 (allene and methylacetylene), C3H6 (propylene) and C4H8 (trans-butene): Overall rate constants and atomic hydrogen branching ratios[END_REF]

Table 2

 2 Hr (298 K) a (kJ.mol -1 ) for possiblereaction channels of C( 3 P) + C4H8.

	Channels	Trans-C4H8 Cis-C4H8	1-C4H8
	Trans-C5H7 + H	-204.52	-209.75	-215.00
	Cis-C5H7 + H	-207.13	-212.37	-217.62
	Dimethylpropargyl + H	-209.75	-215.00	-220.24
	Ethylpropargyl + H b	-199.26	-204.51	-209.75
	3-C5H7 + H	-201.89	-207.13	-212.37
	c-C5H7 + H	-49.82	-55.06	-60.30
	i-C3H5 + CH3	-243.84	-249.08	-254.32
	CH3CHCCH + CH3	-238.59	-243.84	-249.08
	CH3CCCH2 + CH3	-249.08	-254.32	-259.57
	C3H3 + C3H5	-236.64	-247.66 -247.14
	a CBS-QB3

b Cis and Trans

  Hickson, K. M.; Loison, J. C.; Wakelam, V. Temperature dependent product yields for the spin forbidden singlet channel of the C( 3 P) + C6H2 reaction. Chem. Phys. Lett. 2016, 659, Atkinson, R.; Aschmann, S. M. Rate constants for the reaction of the OH radical with series of alkenes and dialkenes at 295 +/-1 K. Int. J. Chem. Kinet. 1984, 16, 1175-1186. (50) Loison, J.-C.; Daranlot, J.; Bergeat, A.; Caralp, F.; Mereau, R.; Hickson, K. M. Gasphase kinetics of hydroxyl radical reactions with C3H6 and C4H8: product branching ratios and OH addition site-specificity. J. Phys. Chem. A 2010, 114, 13326-13336. (51) Bouwman, J.; Fournier, M.; Sims, I. R.; Leone, S. R.; Wilson, K. R. Reaction rate and isomer-specific product branching ratios of C2H + C4H8: 1-butene, cis-2-butene, trans-2butene, and isobutene at 79 K. J. Phys. Chem. A 2013, 117, 5093-5105. (52) Nizamov, B.; Leone, S. R. Kinetics of C2H reactions with hydrocarbons and nitriles in the 104-296 K temperature range. J. Phys. Chem. A 2004, 108, 1746-1752. (53) Laufer, A. H.; Fahr, A. Reactions and kinetics of unsaturated C2 hydrocarbon radicals. Progress. Ener. Comb. Sci. 2006, 32, 247-294.(57) Hansen, N.; Klippenstein, S. J.; Taatjes, C. A.; Miller, J. A.; Wang, J.; Cool, T. A.; Yang, B.; Yang, R.; Wei, L. X.; Huang, C. Q. et al. Identification and chemistry of C H and C4H5 isomers in fuel-rich flames. J. Phys. Chem. A 2006, 110, 3670-3678. (58) Miller, J. A.; Melius, C. F. Kinetic and thermodynamic issues in the formation of aromatic-compounds in flames of aliphatic fuels. Combust. Flame 1992, 91, 21-39. Lang, M.; Holzmeier, F.; Hemberger, P.; Fischer, I. Threshold photoelectron spectra of combustion relevant C4H5 and C4H7 isomers. J. Phys. Chem. A 2015, 119, 3995-4000. (77) Savee, J. D.; Soorkia, S.; Welz, O.; Selby, T. M.; Taatjes, C. A.; Osborn, D. L. Absolute photoionization cross-section of the propargyl radical. J. Chem. Phys. 2012, 136, 134307 1-10. (78) Ju, Y. G.; Sun, W. T. Plasma assisted combustion: Dynamics and chemistry. Progress. Ener. Comb. Sci. 2015, 48, 21-83. (79) Yang, B.; Li, Y. Y.; Wei, L. X.; Huang, C. Q.; Wang, J.; Tian, Z. Y.; Yang, R.; Sheng, L. S.; Zhang, Y. W.; Qi, F. An experimental study of the premixed benzene/oxygen/argon flame with tunable synchrotron photoionization. Proc. Comb. Inst. 2007, 31, 555-563.

	3 P) + butene isomer reactions is consistent with the addition of the carbon atom to the double bond to form a cyclic intermediate. This intermediate is likely to have a very short lifetime and to isomerize through ring opening to a triplet allene-like intermediate. The experimental data can all be explained using direct H-, CH3-, or C2H5-elimination without further isomerization of the energized intermediates. Experimental and theoretical determinations of open-shell molecule photoionization cross-sections are required in order to improve the accuracy of branching A c c e p t e d m a n u s c r i p t assisted combustion is therefore likely to contribute to the formation of large carbon radicals and therefore to molecular growth chemical schemes. g 2 2 (11) Yu, B. W.; Girshick, S. L. Atomic carbom vapor as a diamond growth precursor in thermal plasmas. J. Appl. Phys. 1994, 75, 3914-3923. (12) Haider, N.; Husain, D. Absolute rate data for the reactions of ground-state atomic carbon, C 2p 2 ( 3 PJ), with alkenes investigated by time-resolved atomic resonance-absorption spectroscopy in the vacuum ultraviolet J. Chem. Soc., Faraday 1993, 89, 7-14. (13) Chastaing, D.; James, P. L.; Sims, I. R.; Smith, I. W. M. Neutral-neutral reactions at the temperatures of interstellar clouds: Rate coefficients for reactions of atomic carbon, C( 3 P), with O2, C2H2, C2H4 and C3H6 down to 15 K. Phys. Chem. Chem. Phys. 1999, 1, 2247-2256. (17) Takayanagi, T. Quantum dynamics study on the product branching for the C( 3 P)+C H reaction: cyclic-C3H versus linear-C3H. J. Phys. Chem. A 2006, 110, 361-366. (18) Mebel, A. M.; Kislov, V. V.; Hayashi, M. Prediction of product branching ratios in the C( 3 P)+C2H2 -> l-C3H+H/c-C3H+H/C3+H2 reaction using ab initio coupled clusters calculations extrapolated to the complete basis set combined with Rice-Ramsperger-Kassel-Marcus and radiationless transition theories. J. Chem. Phys. 2007, 126, 204310 1-11. (19) Kaiser, R. I.; Lee, Y. T.; Suits, A. G. Crossed-beam reaction of carbon atoms with hydrocarbon molecules .1. Chemical dynamics of the propargyl radical formation C3H3 A c c e p t e d m a n u s c r i p t (41) 70-75. (42) Bond, J. Q.; Alonso, D. M.; Wang, D.; West, R. M.; Dumesic, J. A. Integrated catalytic conversion of gamma-valerolactone to liquid alkenes for transportation fuels. Science 2010, 327, 1110-1114. (43) Mehl, M.; Pitz, W. J.; Westbrook, C. K.; Yasunaga, K.; Conroy, C.; Curran, H. J. Autoignition behavior of unsaturated hydrocarbons in the low and high temperature regions. Proc. Comb. Inst. 2011, 33, 201-208. Xie, E. Q. Structural and optical properties of Fe-doped hydrogenated amorphous carbon films prepared from trans-2-butene by plasma enhanced metal organic chemical vapor deposition. App. Phys. A 2010, 98, 895-900. (47) Lavvas, P. P.; Coustenis, A.; Vardavas, I. M. Coupling photochemistry with haze formation in Titan's atmosphere, part I: Model description. Planet. Space Sci. 2008, 56, 27-66. (48) Lavvas, P. P.; Coustenis, A.; Vardavas, I. M. Coupling photochemistry with haze A c c e p t e d m a n u s c r i p t 4 3 m a n u s c r i p t (49) A c c e p t e d (76)
	ratios inferred from photoionization mass spectrometry studies. The reaction of ground state carbon atoms with butene isomers in carbon rich environments such as the ISM or plasma (X 2 B2), from reaction of C( 8720.
	30 32 36 40

(14) Chastaing, D.; Le Picard, S. D.; Sims, I. R.; Smith, I. W. M.; Geppert, W. D.; Naulin, C.; Costes, M. Rate coefficients and cross-sections for the reactions of C( 3 PJ) atoms with methylacetylene and allene. Chem. Phys. Lett. 2000, 331, 170-176. (15) Clary, D. C.; Haider, N.; Husain, D.; Kabir, M. Interstellar carbon-chemistry -Reactionrates of neutral atomic carbon with organic-molecules Astrophys. J. 1994, 422, 416-422. (16) Kaiser, R. I.; Lee, Y. T.; Suits, A. G. Crossed-beam reaction of C( 3 PJ) with C2H2( 1  + ) -Observation of tricarbon-hydride C3H. J. Chem. Phys. 1995, 103, 10395-10398. 3 PJ) with ethylene, C2H4(X 1 Ag). J. Chem. Phys. 1996, 105, 8705-(44) Zhao, P.; Yuan, W. H.; Sun, H. Y.; Li, Y. Y.; Kelley, A. P.; Zheng, X. L.; Law, C. K. Laminar flame speeds, counterflow ignition, and kinetic modeling of the butene isomers. Proc. Comb. Inst. 2015, 35, 309-316. (45) Zhang, Y. J.; Cai, J. H.; Zhao, L.; Yang, J. Z.; Jin, H. F.; Cheng, Z. J.; Li, Y. Y.; Zhang, L. D.; Qi, F. An experimental and kinetic modeling study of three butene isomers pyrolysis at low pressure. Combust. Flame 2012, 159, 905-917. (46) Zhang, H. L.; Wu, W. D.; Gong, C. S.; Wang, W.; He, Z. B.; Li, J.; Ju, X.; Tang, Y. J.; formation in Titan's atmosphere, Part II: Results and validation with Cassini/Huygens data. Planet. Space Sci. 2008, 56, 67-99. Chem. Rev. 2004, 104, 2813-2832. (54) Li, Y.; Liu, H. L.; Huang, X. R.; Wang, D. Q.; Sun, C. C. Theoretical study of the C( 3 P) + trans-C4H8 reaction. J. Phys. Chem. A 2009, 113, 6800-6811. (55) Miller, J. A.; Pilling, M. J.; Troe, E. Unravelling combustion mechanisms through a quantitative understanding of elementary reactions. Proc. Comb. Inst. 2005, 30, 43-88. (56) McEnally, C. S.; Pfefferle, L. D.; Atakan, B.; Kohse-Hoeinghaus, K. Studies of aromatic hydrocarbon formation mechanisms in flames: Progress towards closing the fuel gap.

ACKNOWLEDGEMENTS

The Rennes team acknowledges support from the Agence Nationale de la Recherche, contract ANR-11-BS04-024-CRESUSOL-01, the French INSU/CNRS Program ''Physique et Chimie du Milieu Interstellaire'' (PCMI), the Institut National de Physique (INP CNRS), the Région Bretagne and the Université de Rennes 1. S.D.L.P. acknowledges financial support from the Institut Universitaire de France. Acknowledgement is made to the Donors of the American Chemical Society Petroleum Research Fund (PRF#53105-DN16) for partial support of this research (F.G. and M.S.). We thank Mr Howard Johnsen for technical support of this experiment. D.L.O. and the instrumentation for this work are supported by the Division of Chemical Sciences, Geosciences, and Biosciences, the Office of Basic Energy Sciences, the U.S. Department of Energy. Sandia is a multi-program laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the National Nuclear Security Administration under contract DE-AC04-94-AL85000. This research used resources of the Advanced Light Source, a DOE Office of Science User Facility, which is supported by the Direct, Office of Science, Office of Basic Energy Sciences, the U.S. Department of Energy under contract DE-AC02-05CH11231 at Lawrence Berkeley National Laboratory.

A c c e p t e d m a n u s c r i p t


Kaniz Fatema

David W Chadwick

Stijn Lievens
email: lievens@kent.ac.uk

W Chadwick

A Multi-Privacy Policy Enforcement System

Keywords: Privacy Policy, AIPEP, Master PDP, Conflict Resolution, Sticky Policy

 and it takes the research one step further.

Introduction

Many web sites today collect PII (Personal Identity Information) such as name and address from users through online registration, surveys, user profiles, and online order fulfilment processes etc. Also different personal data such as educational records, health data, credit card information and so on are collected by different organisations in order to provide consumers with services. An example of such a service is an online job agency where people post their CVs in order to hunt for jobs worldwide. Once released, users lose control of their personal data. But personal data like CVs which contain sensitive personal information may invite not only job offers but also identity theft. Losing PII has serious consequences ranging from significant financial loss to becoming a suspect in a crime which was committed with a stolen ID. Innocent people have been arrested due to a crime committed by an identity thief [2]. In the UK, the number of ID thefts is an alarming 19.86% higher in the first quarter of 2010 compared with the same period in 2009 [START_REF] Cifas | [END_REF]. About 27,000 victims were recorded by CIFAS members during the first 3 months of 2010 [START_REF] Cifas | [END_REF]. As a consequence concerns for the privacy of electronic private data are rising day by day [START_REF][END_REF]5]. Hence the necessity for more technical controls over personal data collected online in order for users to gain more confidence and trust about the use of their personal data. Technical controls will help to protect personal data from being misused as well as enforce privacy laws so that personal data loss from reputable organisations such as HSBC bank [6] or Zurich Insurance [7] may be avoided in future.

Policy based systems are now well established [START_REF] Zhu | A Policy System to Support Adaptability and Security on Body Sensors[END_REF][START_REF] Wu | Policy-based Access Control Framework for Grid Computing[END_REF]. They rely on an application independent policy decision point (PDP) to make authorization decisions, and an application dependent policy enforcement point (PEP) to enforce these decisions. The model assumes that all the policies are written in the same language and are evaluated by a single PDP. However in a federated identity management system we cannot assume that every service provider (SP) and identity provider (IdP) will use the same policy language for specifying their rules. This is because different policy languages support different rule sets and hence support different requirements. Today we have many examples of different policy languages e.g. XACMLv2 [START_REF]OASIS XACML 2.0. eXtensible Access Control Markup Language (XACML) Version 2.0[END_REF], XACMLv3 [START_REF]OASIS XACML 3.0. eXtensible Access Control Markup Language (XACML) Version 3[END_REF], PERMIS [START_REF] Chadwick | PERMIS: a modular authorization infrastructure[END_REF], P3P [START_REF]W3C: The Platform for Privacy Preferences 1[END_REF], Keynote [START_REF] Blaze | The KeyNote Trust-Management System Version 2[END_REF] etc. and even more PDP implementations. For example, P3P was designed specifically to express privacy policies, whereas the others were designed as access control or authorization policy languages. It is simply not possible to construct policies that satisfy every access control and privacy requirement using a single policy language or PDP. Therefore we need an infrastructure that can support multiple PDPs and multiple policy languages.

Private data should be protected by the policy of its owner. The sticky policy paradigm [START_REF] Chadwick | Enforcing "Sticky" Security Policies throughout a Distributed Application[END_REF] ensures that private data is stuck with its policy not only within the initial system but also when transferred between systems.

Obligations are actions that must be performed when a certain event occurs. When the event is reading PII, then an obligation may require the PII subject to be notified. Some obligations may need to be performed along with the enforcement of an authorization decision, others before or after the enforcement [START_REF] Chadwick | Coordinating Access Control in Grid Services[END_REF]. Privacy protecting systems thus need an obligations service, ideally with a standard interface so that it can be called from multiple places in an application.

In this paper we propose an advanced multi-policy authorization infrastructure that will provide privacy protection of personal data using multiple PDPs, sticky policies and obligations. The rest of the paper is structured as follows. Section 2 reviews related research. Section 3 discusses the architecture and components of the proposed system. Section 4 discusses the Sticky Policy implementation strategy whilst Section 5 describes the conflict resolution policy. Some use case scenarios are provided in Section 6. Details of our implementation are provided in Section 7. Section 8 concludes by discussing our future plans.

Related Research

IBM's security research group has performed research on privacy protection of customer's data collected by enterprises [START_REF] Karjoth | Privacy-enabled services for enterprises[END_REF][START_REF] Karjoth | Platform for Enterprise Privacy Practices: Privacy-enabled Management of Customer Data[END_REF][START_REF] Karjoth | A Privacy Policy Model for Enterprises[END_REF][START_REF] Nelson | Trust on Demand -Enabling Privacy, Security, Transparency, and Accountability in Distributed Systems[END_REF][START_REF] Schunter | Privacy Injector -Automated Privacy Enforcement through Aspects[END_REF]. They used the sticky policy paradigm where personal data is associated with its privacy policy and they are passed together when exchanging data among enterprises [START_REF] Karjoth | Privacy-enabled services for enterprises[END_REF][START_REF] Karjoth | Platform for Enterprise Privacy Practices: Privacy-enabled Management of Customer Data[END_REF][START_REF] Karjoth | A Privacy Policy Model for Enterprises[END_REF][START_REF] Schunter | Privacy Injector -Automated Privacy Enforcement through Aspects[END_REF]. But they did not provide a way to accommodate different policy languages. Also the obligations they are providing are just activity names such as 'log', 'notify', 'getConsent' etc. [START_REF] Karjoth | Platform for Enterprise Privacy Practices: Privacy-enabled Management of Customer Data[END_REF]. They also did not provide a way to actually enforce the obligations which our system does.

HP researchers [START_REF] Mont | Dealing with Privacy Obligations: Important Aspects and Technical Approaches[END_REF][START_REF] Mont | Towards Accountable Management of Identity and Privacy: Sticky Policy and Privacy[END_REF] have also been working on providing privacy to PII by enforcing obligations. They have provided a way of transmitting encrypted confidential data with obligations to other parties by obfuscation of the data [START_REF] Mont | Dealing with Privacy Obligations: Important Aspects and Technical Approaches[END_REF]. Nevertheless, the work only describes obligations related to privacy and does not provide a uniform solution to both access control and privacy. Their work does not consider policies from different authorities nor does it integrate multiple policy languages.

Qun Ni et al [START_REF] Ni | Privacy aware role based access control[END_REF][START_REF] Ni | An Obligation Model Bridging Access Control Policies and Privacy Policies[END_REF] have defined the privacy related access control model P-RBAC to support privacy related policies. This model theoretically associates data permissions with purposes, conditions and obligations. However, the model is too complex to be implemented practically.

It has been claimed [START_REF] Mont | Dealing with Privacy Obligations: Important Aspects and Technical Approaches[END_REF][START_REF] Mont | On Parametric Obligation Policies:Enabling Privacy-aware Information Lifecycle Management in Enterprises[END_REF] that the privacy policy defined by the owner of personal data should have the highest priority. But the fact is that the Law should have the highest priority. No one should be able to break the Law. No other previous work has focused on this issue. In our system we have implemented a Law PDP by converting the legal requirements into an XACML policy and this Law PDP is always given the highest priority. For example if there is a court order for seeing someone's personal data neither the person nor the data controller can deny access to the data. To the best of our knowledge, no previous work has been concerned with integrating the policies of the law, data subject and data controller together.

The Primelife Policy Language [START_REF] Ardagna | PrimeLife Policy Language, Project's position paper at W3C Workshop on Access Control Application Scenarios[END_REF], [START_REF] Trabelsi | PPL Engine: A Symmetric Architecture for Privacy Policy Handling[END_REF] is an extension of XACML v3 which offers access control and usage control under the same structure. PPL has a new obligation handling mechanism which integrates a set of acceptable values for each obligation parameter and thus it solves the problem of "overdoing" obligations [START_REF] Bussard | Data Handling: Dependencies between Authorizations and Obligations[END_REF]. Their work mainly considered two groups of authors of privacy policy, the Data controller and Data Subject [START_REF] Trabelsi | PPL Engine: A Symmetric Architecture for Privacy Policy Handling[END_REF] where we considered Law and Issuer as well. An automated matching is performed between the Data controller and Data subject's policy so that any mismatching elements do not appear in the final sticky policy [START_REF] Trabelsi | PPL Engine: A Symmetric Architecture for Privacy Policy Handling[END_REF]. In contrast, our system allows all the policies from all types of authors, and we have a sophisticated, automated, dynamic conflict resolution policy that resolves the conflicts of the decisions returned by the different policies. Moreover, we have considered that these policies can be written in different languages which lead to the need for multiple policy language support.

The Authorisation System

Suppose that a health service provider wants to protect the privacy of personal health data (i.e. the Dr's note, history of treatment of the patient, diagnostic test report and so on) through their authorisation system. To provide privacy the authorisation system will need to include privacy rules from different authors such as the law, issuer (i.e. Dr) and data subject (the person). Suppose the data subject wants to share a part of his personal data with a health insurance company to recover the cost of treatment. When the data is shared with the insurance company it is expected that the policies related to the data will also be passed with the data and the receiving system will be capable of handling policies from different health service providers, which may be written in different policy languages. Also it is expected that the authorisation system will be able to enforce obligations such as sending email or keeping a secure log of accesses. Consequently the authorisation system will need to provide the following features: a. Enforcing multiple policies from multiple authors b. Handling sticky policies c. Distributed policy enforcement d. Support for multiple policy languages e. Obligation enforcement. Our proposed system has the following capabilities.

a. Enforcing multiple policies from multiple authors: In a traditional access control system only the organisation's authority can set the access control policy which makes the system unsuitable for privacy protection. Our system will accept policies from different authorities and will resolve conflicts between decisions returned by different policies according to a sophisticated, automated, dynamic conflict resolution policy. b. Handling sticky policies: Our system will accept policies stuck to PII, will store the policies, enforce them every time the PII is accessed, and will return them when the PII is transferred to a remote site. c. Distributed policy enforcement: Our system ensures that sticky privacy policy are enforced within the current system and also in the receiving system, by a binding legal agreement between the two parties, such that if an organisation accepts data with a sticky policy, it confirms that its system will only store the data if it can satisfy the obligation to start one or more PDPs that support the received policies. d. Support for multiple policy languages: Our system supports an arbitrary number of PDPs that each utilise a different policy language. e. Obligation enforcement: Our system supports the enforcement of arbitrary obligations either before, after or whilst the access decision is enforced. The system is extensible and new obligations can easily be incorporated. In order to satisfy the various requirements presented above we introduce several new components into the privacy preserving advanced authorization infrastructure. These are explained more fully in [START_REF] Chadwick | An advanced policy based authorisation infrastructure[END_REF]. In this section a short description is given only.

Firstly we introduce an application independent policy enforcement point, the AIPEP. The AIPEP is so called because it enforces the application independent obligations and coordinates all the other components of the application independent authorization infrastructure. When the AIPEP receives an authorization decision query message (step 1 in figure 1), it first calls the CVS to validate any credentials that are contained in the message (step 2 in figure 1). If the message contains a sticky policy/ies then this/these will be stored in the policy store. The AIPEP retains a manifest which records which CVSs and PDPs are currently spawned and which policies each is configured with. The AIPEP tells the Master PDP which set of spawned PDPs to use for a particular authorization decision request.

The Credential Validation Service (CVS) is the component that validates users' credentials by checking that each credential issuer is mentioned in the credential validation policy directly, or that the credential issuer has been delegated a privilege by a trusted Attribute Authority (AA) either directly or indirectly (i.e. a chain of trusted issuers is dynamically established controlled by the Delegation Policies of the Source of Authority and the intermediate AAs in the chain). The Credential Validation Policy, written by the SOA, contains rules that govern which attributes different AAs are trusted to issue to which user groups, along with a Delegation Policy for each AA. We recognize that in distributed systems the same credential/attribute may be known by different names e.g. PhD, D Phil, Dr.-Ing etc. For this reason we introduce an Ontology Mapping Server (see below) which knows the semantic relationships between attribute names. If two names are semantically related then the CVS can determine if an unknown attribute is valid or not. Once the CVS has finished validating the subject's credentials, these are returned to the AIPEP as standard XACML formatted attributes (step 5), ready to be passed to the Master PDP. In order to evaluate multiple authorization policies in different languages we introduce a new conceptual component called the Master PDP. The Master PDP is responsible for calling multiple PDPs (step 7) as directed by the AIPEP, obtaining their authorization decisions (step 8), and then resolving any conflicts between these decisions, before returning the overall authorization decision and any resulting obligations to the AIPEP (in step 9). Each of the policy PDPs supports the same interface, which is the SAML profile of XACML [START_REF]SAML 2.0 profile of XACML, Version 2.0[END_REF]. This allows the Master PDP to call any number of subordinate PDPs, each configured with its own policy in its own language. This design isolates the used policy languages from the rest of the authorization infrastructure, and the Master PDP will not be affected by any changes to any policy language as it evolves or by the introduction of any new policy language. Of course, new policy languages will require new PDPs to be written to interpret them, and these new PDPs will require new code in the PDP/CVS factory object so that it knows how to spawn them on demand. But this is a one-off occurrence for each new policy language and PDP that needs to be supported by the infrastructure.

The policy store is the location where policies can be safely stored and retrieved. If the store is trusted then policies can be stored there in an unsecured manner. If the store is not trustworthy then policies will need to be protected e.g. digitally signed and/or encrypted, to ensure that they are not tampered with and/or remain confidential. When the AIPEP stores a policy in the policy store, it provides the store with the StickyPolicy element, and the globally unique Policy ID (PID). Each policy must have a globally unique id so that it can be uniquely referenced in the distributed system, primarily for performance reasons, so that when a sticky policy is moved from system to system, the receiver can determine if it needs to analyse the received policy or not. Already known PIDs don't need to be analysed, whereas unknown PIDs will need to be evaluated to ensure that they can be supported, otherwise the incoming data and sticky policy will need to be rejected. This design cleanly separates the implementation details of the policy store from the rest of the infrastructure, and allows different types of policy store to be constructed e.g. built on an LDAP directory or RDBMS.

The sticky store holds the mapping between sticky policies and the resources to which they are stuck. This is a many to many mapping so that one policy can apply to many resources and one resource can have many sticky policies applied to it. The design requires that each resource has a locally unique resource ID (RID) which is mapped to Policy IDs. The RID is locally unique and will vary from system to system, as resources are transferred. We do not have a requirement to pass the RID from system to system so each system can compute its own.

Obligations may need to be enforced before the user's action is performed, after the user's action has been performed, or simultaneously with the performance of the user's action [START_REF] Chadwick | Coordinating Access Control in Grid Services[END_REF]. We call this the temporal type of the obligation. Examples are as follows: before the user is given access get the consent of owner; after the user has been given access, email the data owner that his/her data is accessed; simultaneously with the user's access, write to the log the activities he/she is doing. According to the XACML model, each obligation has a unique ID (a URI). We follow this scheme in our infrastructure. Each obligations service is configured at construction time with the obligation IDs it can enforce and the obligation handling services that are responsible for enacting them. It is also configured with the temporal type(s) of the obligations it is to enforce. When passed a set of obligations by the AIPEP, the obligations service will walk through this set, ignore any obligations of the wrong temporal type or unknown ID, and call the appropriate obligation handling service for the others. If any single obligation handling service returns an error, then the obligations service stops further processing and returns an error to the AIPEP. If all obligations are processed successfully, a success result is returned. Each of the obligations enforced by the AIPEP must be of temporal type before.

The Ontology Mapping Server is a service which returns the semantic relationship between two different terms. Multiple terms can name the same concept. The ontology concepts are held as a lattice, and the server will say if one term (equivalent concept) dominates the other in the lattice or if there is no domination relationship between them. The CVS calls this service to determine the relationship between an attribute name in an SOA's policy and the attribute name in an issued credential. The Master PDP calls this server to determine the relationship between the different terms in the policy and the request context.

Sticky Policy Contents

A sticky policy comprises the following elements:

-The policy author i.e. the authority which wrote the policy.

-The globally unique policy ID -The time of creation of the policy and optional expiry time.

-The type(s) of resource(s) that are covered by this policy.

-The type of policy this is.

-The policy language.

-The policy itself, written in the specified policy language. Any number of sticky policies can be stuck to a data resource in either an application dependent manner e.g. as a <Condition> in a SAML attribute assertion, or by using the StickyPAD (sticky policy(ies) and data) XML structure that we have defined. The policies should be stuck to the data by using a digital signature. This could be by using the XML <ds:Signature> structure in the StickyPAD and SAML attribute assertion, or it could be externally provided e.g. by using SSL/TLS when transferring the data and policy across the Internet. It is the responsibility of the sending PEP to create the equivalent of our StickyPAD structure when sending data with a sticky policy attached, and the receiving PEP to validate its signature when it receives the message in step 0 of figure 1. The PEP should then parse and unpack the contents and pass the sticky policy to the AIPEP along with the authorization decision request (step 1 of figure 1).

Conflict Resolution Policy

Our system includes many different PDPs each with policies from different authorities and possibly written in different languages. As a consequence a mechanism is needed to combine the decisions returned by these PDPs and resolve any conflicts between them. We have introduced a Master PDP which is the component responsible for combining the decision results returned by the subordinate PDPs and resolving the conflicts among their decisions.

The Master PDP has a conflict resolution policy (CRP) consisting of multiple conflict resolution rules (CRRs). The default CRP is read in at program initialisation time and additional CRRs are dynamically obtained from the subjects' and issuers' sticky policies. Each conflict resolution rule (CRR) comprises: -a condition, which is tested against the request context by the Master PDP, to see if the attached decision combining rule should be used, -a decision combining rule (DCR), -optionally an ordering of policy authors (to be used by FirstApplicable DCR) -an author and -a time of creation.

A DCR can take one of five values: FirstApplicable, DenyOverrides, GrantOverrides, SpecificOverrides or MajorityWins which applies to the decisions returned by the subordinate PDPs. The DCRs will be discussed shortly.

The Master PDP is called by the AIPEP and is passed the list of PDPs to call and the request context. From the request context it will get the information such as requester, requested resource type, issuer and data subject of the requested resource. The Master PDP has all the CRRs defined by different authors as well as a default one. From the request context it knows the issuer and data subjects and so can determine the relevant CRRs. It will order the CRRs of law, issuer, data subject and holder sequentially. For the same author the CRRs will be ordered according to the time of creation so that the latest CRR always comes first in the ordered list.

All the conditions of a CRR need to match with the request context for it to be applicable. The CRR from the ordered CRR queue will be tested one by one against the request context. If the CRR conditions match the request context the CRR is chosen. If the CRR conditions do not match the request context the next CRR from the queue will be tested. The default CRR (which has DCR=DenyOverrides) will be placed at the end of CRR queue and it will only be reached when no other CRR conditions match the request context. The PDPs are called according to the DCR of the chosen CRR.

Each PDP can return 5 different results: Grant, Deny, BTG, NotApplicable and Indeterminate. NotApplicable means that the PDP has no policy covering the authorisation request. Indeterminate means that the request context is either malformed e.g. a String value is found in place of an Integer, or is missing some vital information so that the PDP does not currently know the answer.

BTG (Break the Glass) [START_REF] Ferreira | How to securely break into RBAC: the BTG-RBAC model[END_REF] means that the requestor is currently not allowed access but can break the glass to gain access to the resource if he so wishes. In this case his activity will be monitored and he will be made accountable for his actions. BTG provides a facility for emergency access or access over-ride and is particularly important in medical applications.

If DCR=FirstApplicable the CRR is accompanied by a precedence rule (OrderOfAuthors) which says the order in which to call the PDPs. For example, if the resourceType=PII and the requestor=data subject) then the DCR=FirstApplicable and the (OrderOfAuthor=law, dataSubject, holder). The Master PDP calls each subordinate PDP in order (according to the order of authors), and stops processing when the first Grant or Deny decision is obtained.

For SpecificOverrides the decision returned by the most specific policy will get preference. We define a policy to be the most specific if it is assigned to the most specific resource, as identified by its RID. We use the containment model in which the resource with the longest pathname is the most specific resource, for example C:/MyDocument/MyFile is more specific than C:/MyDocument. All the resources in the system have their RIDs formatted in the form of the URL hierarchy e.g. Kent.ac.uk/issrg2/C:/MyFiles. Each policy applicable to a resource is linked by its PID to that RID. In this containment model, polies applied to a less specific resource will also be applied to the resource contained in that; but policies applied to the more specific resource will not be applicable for the containing resource. For example, policies applied to the kent.ac.uk/issrg2/C: will be applied to kent.ac.uk/issrg2/C:/MyFiles but policies applicable to kent.ac.uk/issrg2/C:/MyFiles will not be applied to kent.ac.uk/issrg2/C:. If multiple most specific policies exist then all the most specific policies will be evaluated and the Deny result will get precedence; in other words DenyOverrides will be applied on the Most specific set of policies.

For DenyOverrides and GrantOverrides the Master PDP will call all the subordinate PDPs and will combine the decisions using the following semantics: -DenyOverrides -A Deny result overrides all other results. The precedence of results for deny override is Deny>Indeterminate>BTG>Grant>NotApplicable. -GrantOverrides -A Grant result overrides all other results. The precedence of results for grant override is Grant>BTG>Indeterminate>Deny>NotApplicable When a final result returned by the Master PDP is Grant (or Deny) the obligations of all the PDPs returning a Grant (or Deny) result are merged to form the final set of obligations.

For MajorityWins all the PDPs will be called and the final decision (Grant/Deny/BTG) will depend on the returned decision of the majority number of PDPs. If the same numbers of PDPs return Grant and Deny and there is at least one BTG, then BTG will be the final answer, otherwise Deny. If none of the PDPs return Grant, Deny or BTG then Indeterminate will override NotApplicable.

Initially the system will have the law and controller PDPs running as these two are common for all request contexts. Based on the request context the issuer and the data subject's PDP may be started.

Use Case Scenarios

Mr K wants to receive treatment from the X-Health Centre and for this he has to be registered. During the registration process he is presented with a consent form where he indicates with whom he is prepared to share his medical data. This form includes tick boxes such as:

1. Other Drs at this health centre, indicating that the patient will accept a one to many relationship with the health centre staff (as opposed to a one to one relationship with a specific Dr.). 2. Other registered Drs/Consultants of other Organisations and a place where the name of the doctor and organisation can be written. If this box is ticked and no Dr's name and organisation are specified then the consent will be for any Dr in general. 3. Health Insurance Companies (with a place for specifying the name(s) of the company(ies) or can say all) 4. Research organisation/ researcher. (A note will say that all medical data used for research purposes will be anonymised prior to release.) 5. Other organisations for promotional offers. These are for example organisations offering samples and promotions for newborn babies and their parents. In this case not all of the medical record will be available to the interested companies. What portion of medical data will be available is determined by the organisation's policy. 6. Other person (for specifying the name of someone such as next of kin.) Mr K has a policy with the Health Insurance Company HIC1 to cover his treatment costs. So he puts a tick in box 3 only and mentions HIC1 there and finishes his registration with X-Health Centre.

It is important to note that HIC1 will not have access to the complete medical records of Mr K. The policy of X-Health Centre determines what portion of the medical data can be made available to HIC1.

Mr K undergoes some treatment and HIC1 submits a request to X-Health Centre for (a portion of) the medical record of Mr K. The Master PDP of X-Health Centre's authorisation system consults the CRRs of Law, issuer, data subject and holder sequentially. The law CRRs say if resourceType=MedicalData and requestor=data subject and resourceClassification is different from Drs notes then DCR=GrantOverrides; anything else for resourceType=MedicalData leads to a DCR of DenyOverrides. Therefore in the case of medical data the CRRs of the other entities will never be consulted. Since the requestor is not the data subject the DCR is DenyOverrides. The PDPs give the following results:

x The law PDP returns NotApplicable because it only has rules pertaining to cases where the requestor is either the data subject or the creator of the data. x Depending on the actual medical data requested, the issuer (X-Health Centre) PDP returns either Grant or Deny. x The data subject PDP returns Grant because Mr K has allowed this on his registration with the health centre. The overall decision is therefore the same as that of the issuer's PDP. Assuming this is Grant, then the requested medical data is passed to HIC1 together with the sticky policies from the data subject, the law and the issuer. After receiving the medical data and sticky policies the receiving application will make a call to the authorisation system of HIC1 to see whether it is permitted to store the data. The authorisation system will reply Grant and will start two new PDPs with the received policies of the data subject (Mr K) and the issuer (X-Health Centre)assuming it can process them. If it cannot, it will return Deny. At HIC1's site a law PDP is already running containing the same legal policy as that sent and therefore it does not need to start a new law PDP. If HIC1 had been in a different jurisdiction to X-Health Centre, then it would have needed to run a new legal PDP for Mr. X's medical data. The policy to data mappings are duly recorded in the sticky store. HIC1's authorisation system subscribes for updates to these policies, so that if the patient or X-Health Centre should change their policies, the new ones will be notified to HIC1's authorisation system.. Mr K did not allow researchers to view his medical record. The researcher Mr R requests Mr K's medical record at HIC1's system and this request is denied for the following reasons: -as in the previous case the chosen DCR will be DenyOverrides chosen by the law CRR. -the law PDP will return NotApplicable (as before), -the issuer's PDP returns Grant with a "with" obligation for anonymisation (because it allows the data to be used for research), -the holder's (HIC1's) PDP returns NotApplicable because it allows data subjects to determine if researchers should have access to their data or not, -Mr K's PDP returns Deny which makes the overall result a Deny.. Mr K now changes his preferences at the X-Health Centre and allows his data to be accessed by researchers. The X-Health Centre publishes this update and both its and HIC1's authorisation systems update the subject's policy with the new rule, which contains a "with" obligation to anonymise the data prior to release. If a researcher now asks for access to Mr K's data at HIC1's site, the DCR will be DenyOverrides chosen by the law CRR, the law PDP will return NotApplicable (as before), both the issuer's and subject's PDPs return Grant with the same "with" obligation to anonymise the data, and the holder's (HIC1's) PDP returns NotApplicable. The overall result is therefore Grant with an obligation. The obligation is passed to the Obligations Service of the PEP for it to enact simultaneously with data release. If this obligation cannot be enforced by the PEP, then it must deny the researcher's request.

Implementation Details

Our advanced authorization infrastructure is implemented in Java, and is being used and developed as part of the EC TAS³ Integrated Project (www.tas3.eu). The first beta version is available for download from the PERMIS web site 1 . This contains the AIPEP, CVS, the Obligations Service, a Master PDP, a policy store and sticky store, and multiple PDPs of different types.

A number of different obligation handling services have been written that are called by the obligations service, and these can perform a variety of tasks such as write the authorization decision to a secure audit trail, send an email notification to a security officer, and update the internal state information (called retained ADI in ISO/IEC 10181-3 (1996)). We have implemented state based Break The Glass (BTG) policies [START_REF] Mont | On Parametric Obligation Policies:Enabling Privacy-aware Information Lifecycle Management in Enterprises[END_REF] using the AIPEP, the obligations service and a stateless PDP. A live demo of BTG is available at http://issrg-testbed-2.cs.kent.ac.uk/. The performance of the obligation state handling BTG wrapper adds only a small overhead in most cases (between 0.3% and 50%,depending on the size of the policy and the actual request) to the performance of a stateless PDP that does not support BTG. A paper presenting the complete results is currently under preparation.

We have constructed an ontology mapping server, which, when given two class names (such as Visa card and credit card) will return the relationship between them. The authorization infrastructure has been tested with three different PDPs: Sun's XACML PDP 2 , the PERMIS PDP 3 and a behavioral trust PDP from TU-Eindhoven 4 . Each of these PDPs uses a different policy language. Sun's PDP uses the XACML language, the PERMIS PDP uses its own XML based language whilst TU-Eindhoven's PDP uses SWI-Prolog. The next step is to integrate a secure publish/subscribe mechanism for policy updates and write a reasonably full set of validation tests and use cases along with example policies so that all the PDPs can be called together and their decisions resolved into one final decision using a conflict resolution policy that obeys the law and the wishes of all the various actors. This is a complex task since the number of permutations is infinite.

8 Discussion, Conclusions and Future Plans Our authorization infrastructure does not obviate the need for trust. Our infrastructure still requires trust between the various parties. It is not a digital rights management (DRM) system that assumes the receiving party is untrustworthy and wants to steal any received information from the sender. On the contrary, our infrastructure assumes that the various parties do trust each other to the extent that they want an automated infrastructure that can easily enforce each other's policies reliably and automatically, and if it cannot, will inform the other party of the fact. Consequently data subjects must trust the organizations that they submit their PII to, so that when an organization says it will enforce a subject's sticky policy, the subject can trust that it has every intention of doing so. Our system provides organizations with an application independent authorization infrastructure that makes it easy for them to enforce a subject's privacy policy without having to write a significant amount of new code themselves. Furthermore the user has the potential for more complete control over his/her privacy than now, in that the infrastructure allows the user to specify a complete privacy policy including a set of obligations which can notify the user when his/her data is accessed or transferred between organizations e.g. by using an after obligation when giving permission for the transfer of her PII to go ahead or a before obligation before giving permission for the PII to be read. However we expect the user interfaces for such full privacy policy creation to be too complex for most users to handle, and consequently organizations are more likely to provide their users with a policy template and a limited subset of options and boxes to tick, making the user's task much easier. This also reduces the burden on the organization, since it won't be sent user privacy policies that it cannot handle. The benefit of our infrastructure is that it does not constrain organizations in setting their privacy policy templates, as the infrastructure will enforce whatever combinations they choose.

Organizations must also trust each other to honor the sticky policies that are passed to them when they transfer data between themselves. An untrustworthy organization can always discard any sticky policies it receives and never need access the authorization infrastructure to ask for permission to receive the data, but we assume that legally binding contracts between the organizations will require them to support any sticky policies that are transferred between them. Our authorization infrastructure makes it much easier for them to do this.

Our final step is to perform user trials with two application demonstrators, one for the privacy protection and access to electronic medical records, the other for eportfolios. Both of these applications require access to distributed personal information that is stored in a variety of repositories at different locations, and so a distributed sticky policy enforcement infrastructure is needed.

Fig. 1 .

 1 Fig. 1. The privacy preserving advanced authorization system

Acknowledgements. The research leading to these results has received funding from the European Community's Seventh Framework Programme (FP7/2007-2013) under grant agreement n° 216287 (TAS³ -Trusted Architecture for Securely SharedServices).

.kent.ac.uk/permis 4 TU-Eindhovens PDP. Available from http://w3.tue