Farzaneh Karegar

Christoph Striecks

Stephan Krenn

Felix Hörandner
email: felix.hoerandner@iaik.tugraz.at

Thomas Lorünser

Simone Fischer-Hübner

Opportunities and Challenges of CREDENTIAL

Keywords:

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

With increasing mobility and Internet use, the demand for digital services has increased and already reached critical and high assurance domains like eGovernment, eHealth, and eBusiness. Those domains have particularly high security and privacy requirements, and services are harnessed with various novel mechanisms for securing access. Handling all the different authentication and authorization mechanisms requires user friendly support, which can efficiently be provided by digital identity management (IdM). Due to business mergers and acquisitions as well as the increasing number of cloud applications, IdM is currently experiencing a paradigm shift, moving away from company-internal custom-tailored IdM system towards non-standard fragmented authentication situations. However, under the given change, many current solutions fall short with respect to security, privacy, or usability. Therefore there exists a strong demand to delegate the management of multiple credentials, as well as traditional corporate identity and access management (IAM) functions, like single sign-on (SSO), to a cloud-based service.

The transformation in the IdM world goes hand in hand with the tremendous shift to cloud computing that has shaped the information and communications technology (ICT) world during the last years. IdM has not remained unaffected in this respect. By now, numerous IdM systems and solutions are available as cloud services, providing identity services to applications operated both in closed domains and in the public cloud. This service model is referred to as Identity (and Access) Management as a Service (IDMaaS). Popular examples for cloud IDMaaS providers are big companies from the sectors of social networks, search engines, business solutions, or online retailers. They offer their user identity base for authentication and identification at various services. However, for increased usability, identity services should cover more than login and authentication. For instance, they could also serve as online password vaults, replacing local password managers for providing better portability and anytime-anywhere access to protected resources. Finally, more general online vaults retaining entire identity documents or personal files and records (e.g., OneDrive, Dropbox, tresorit) can also be considered as identity services. However, currently no satisfactory approaches allowing for the privacy-preserving storage and advanced sharing of identity data by cloud service providers exist.

The vision of credential is to fill this gap, and to develop a privacypreserving solution for data sharing and identity provisioning. Users will be able to store identity data and other sensitive data such as health records in a cloudbased credential wallet such that confidentiality and privacy are upheld. In particular, the wallet provider will not be able to access the users' personal data, and can build its business strategy around this advantageous security property. If a user wants to share specific data with other users, or share identity information with a service provider in order to log on to a system, she will be guaranteed that after transmission the intended receiver of the data will be the only party capable of accessing the data items in plain text.

At the IFIP Summer School 2016 in Karlstad, Sweden, the credential project organized a workshop to present the project, raise awareness of the existing technologies and solutions, and to receive feedback and input from experts from different domains. To do so, the project's ambition, the used core technologies, and a representative use case from the eHealth pilot were presented to the audience. This was then followed by three focus groups to discuss different aspects and challenges of the credential approach. This paper summarizes the content and results of this workshop as well as subsequent findings that were inspired by those discussions.

Outline

This document is structured as follows. In Section 2 we give a short overview of the credential project and introduce the pilots and underlying core technologies. Section 3 then describes the challenges discussed during the workshop, as well as the inputs and recommendations received from the participants. In Section 4, a special focus is put on privacy-related challenges introduced by a central identity wallet. We recap existing countermeasures to those issues in Section 5 and explain their shortcomings, before we describe a potential high-level architecture solving those problems in Section 6. Finally, we briefly conclude in Section 7.

The CREDENTIAL Project

The overall vision of credential is to develop a user-centric cloud-based data storage and sharing platform, which enhances the user's privacy compared to current approaches and keeps the user in control, while retaining the benefits of cloud-based solutions. In order to achieve this, credential will employ advanced cryptographic mechanisms, such as proxy re-encryption [START_REF] Blaze | Divertible Protocols and Atomic Proxy Cryptography[END_REF] and redactable signatures [START_REF] Johnson | Homomorphic Signature Schemes[END_REF]. The developed solution will follow state-of-the-art security and privacy by design principles. By using and extending well-established standards and protocols, we aim to not only apply the credential approach to a comprehensive cloud system but to also facilitate integration into existing solutions. In the following, we will first explain credential's basic technologies and architecture, and then highlight its application to three different domains, namely eGovernment, eHealth, and eBusiness.

Basic Technologies

credential uses the following two cryptographic mechanisms as a foundation to enable confidentiality, integrity, and authenticity from end-to-end during the sharing process of whole messages or subsets.

Proxy re-encryption, introduced by Blaze et al. [START_REF] Blaze | Divertible Protocols and Atomic Proxy Cryptography[END_REF], extends asymmetric encryption with the ability to transform a ciphertext c A encrypted for party A into another ciphertext c B of party B without revealing the underlying plaintext in an intermediate step. To enable this transformation, party A generates a reencryption key rk A→B from her private key sk A and the public key pk B of party B. As neither plain text nor decryption keys are exposed during re-encryption, this operation can be outsourced to a semi-trusted proxy. The technology is therefore well suited for end-to-end encrypted data sharing.

Redactable signatures, introduced by Johnson et al. [START_REF] Johnson | Homomorphic Signature Schemes[END_REF], make it possible to black-out parts of a signed message and still verify the signature on the remaining parts; this is in contrast to plain digital signatures, where every bit flip in the message invalidates the signature. This redaction can be performed without access to the signer's private key. The technology is therefore well suited for realizing selective disclosure. After outlining these actors, their interactions are described.

The user owns data that should be securely stored or shared with other participants. A client application is deployed in the user's domain to handle operations involving user's private key material, such as signing or generating a re-encryption key. This application should not be accessible or online when the intended receiver wants to access the data.

The wallet represents the central component of credential. This wallet is a data storage and sharing service deployed in the cloud yielding among others benefits such as constant availability, scalability, and cost effectiveness. A powerful identity and access management system performs multi-factor authentication and authorizes access to the stored data. With proxy re-encryption, the confidentiality of the stored and shared data is ensured even when deploying the wallet at an honest-but-curious cloud provider, as no plain data is exposed. Furthermore, once a re-encryption key is provided, the data can be shared with other participants even when the user or her client application are not available.

The data receiver might be a service provider or another credential user. It relies on data stored in or authentication assertions issued by the wallet. With this information, the data receiver reaches authorization decisions and performs arbitrary data processing.

A simple data sharing process highlighting the interaction among the individual components is shown in Figure 1. First, the user authenticates to the wallet to get permission to upload signed and encrypted data c U . This data c U is encrypted for the user herself to retain maximum control. To share encrypted data, the user generates a re-encryption key rk U →DR towards a selected data receiver DR. This generation operation has to be performed in the user's domain, as the user's private key is involved. Along with this re-encryption key, a policy defining which data may be disclosed is transmitted to the wallet. Upon request of a data receiver, not-required data is redacted based on the policy. Then, using the re-encryption key rk U →DR , the user's redacted ciphertext c U is transformed into data encrypted for the data receiver c DR . Finally, the data receiver is able to decrypt the data c DR and verify the signature on the disclosed parts.

Pilot Scenarios

The credential technologies and architecture are showcased by pilot scenarios from three different domains. A more detailed description of the scenarios can be found in Hörandner et al. [START_REF] Hörandner | CRE-DENTIAL: A Framework for Privacy-Preserving Cloud-Based Data Sharing[END_REF].

eGovernment. In the eGovernment pilot, the focus lies on identity management to authenticate citizens and assess their eligibility for a service, based onoften sensitive -identity attributes. This identity management is considered an instance of credential's data sharing process via standardized identity protocols such as SAML [START_REF] Cantor | Assertions and Protocols for the OASIS Security Assertion Markup Language (SAML) V2 .0 -Errata Composite[END_REF] or OpenID Connect [START_REF] Sakimura | OpenID Connect Core 1.0[END_REF]. In such a protocol, the service provider (i.e., the data receiver) triggers the process by requesting user authentication and identity attributes from the identity provider (i.e., the credential wallet). Concerning authentication, we will not only integrate national eID solutions, but also look at a broader context and enable cross-border authentication according to the eIDAS regulation [START_REF]Regulation (EU) No 910/2014 of the European Parliament and the Council of 23 July 2014 on electronic identification and trust services for[END_REF]. The wallet prompts the user for consent as well as a re-encryption key, and then selectively discloses re-encrypted attributes to the service provider.

eHealth. The eHealth pilot is concerned with a data sharing between patients, doctors, and further parties, in particular in the context of Type 2 Diabetes. Namely, the developed components will allow patients to record their health data (blood sugar level, weight, blood pressure, etc.) using external mobile devices. The data measured on these devices will be collected by a credential eHealth mobile app, which remotely stores this data in the credential wallet. The user can then define who is allowed to access which parts of this medical data, to share specific parts of the measurements, e.g., with the family doctor, diabetologist, nutritionist, or personal trainer. Based on the data they see, they can then provide recommendations back to the patient. This remote data sharing functionality between patients and doctors is of key importance also in other telemedicine applications, as the patients' privacy is respected while the doctor still obtains high authenticity guarantees for the received data.

eBusiness. The eBusiness pilot showcases how easy the privacy offered by existing solutions can be enhanced through the integration of modular libraries implementing credential's technologies. Encrypted mails are a requirement for many companies to protect their data and inventions, but they also represent a significant challenge when employees are temporary unavailable, e.g., because of vacation. Currently, employees have to expose their private key material so that a substitute member of staff can still read and answer incoming mail. In contrast, with proxy re-encryption, an employee generates a re-encryption key for his or her deputy before leaving, with which the mail server is able to translate incoming mail during the absence. Advanced re-encryption schemes even allow one to program expiration dates into the re-encryption keys, thereby further reducing the required trust assumptions.

In this section, we summarize the outcome of three parallel focus groups that were held at the end of our workshop with credential project members and participants of the IFIP Summer School. In these groups, we discussed open research challenges in regard to the tradeoff between privacy, efficiency, and usability, end user trust, and adoption factors that we identified for the credential project. Possible approaches and solutions in regard to how these challenges could be addressed were discussed.

Focus Group 1: Privacy Challenges in CREDENTIAL

In the first focus group, we discussed privacy issues and the technologies to solve them, as well as the effects they may have on usability and efficiency. In particular the discussion was about the need of metadata privacy, i.e., whether information like access patterns, file sizes, or access rights need to be considered as sensitive or not. The following lines summarize the questions and discussions:

Which metadata needs to be protected, which may be leaked? It was discussed that it is not possible to generally say what kind of metadata is sensitive because it depends on the use cases, to what extent we want to trust the central identity wallet, and possible leakages from other sources the wallet might be able to access. If your file includes health data and the wallet already knows it, the frequency of accessing the file may divulge the severity of your disease. Knowing about the access rights of the files also reveals a lot about the type of the document. It was also suggested that we shall apply anonymization techniques on the receiver side and we should review the regulations related to the health domain to ascertain what kind of metadata is sensitive due to regulations. Furthermore, we should define some performance and privacy goals to see the added-value that we may gain by utilization of cryptographic techniques to hide the metadata.

May the wallet be allowed to see access patterns? In general, participants discussed that we should define objective decision criteria to decide on the assumptions we want to or we can make. Those criteria should not only be security-related, but also cover acceptable running times on well-defined devices or required costs to realize the solution. This is because exerting enhanced cryptographic tools like oblivious transfer (OT) or private information retrieval (PIR) would massively increase the requirements on the computational capabilities of the server. Depending on the available resources, this might render the entire system impracticable or too expensive.

How could access and behavior patterns be hidden from the wallet? Specifically, this question aimed at receiving feedback on whether splitting the identity providers into two components and making a non-collusion assumption would be a viable alternative to cryptographic "sledgehammers" like PIR. Alternatively, one could think about routing all data through the user's device so as not to enable the identity provider (IdP) learn which service provider is currently contacted.

It was discussed that the information about access patterns are definitely sensitive and should be hidden from the IdP or disguised. It is therefore valuable for users' privacy to avoid the IdP from learning access patterns in a usable way. The participants discussed that-depending on the concrete context-they tend to prefer to trust their own mobile phones rather than identity providers, meaning that information should be routed through the user's device. However, this approach would typically require key management and/or heavy computations on the user's side, which not always be possible. Furthermore, this approach would contradict the idea of a fully cloudified solution, and therefore might work for identity provisioning but not for data sharing in general, as the data owner might not be online when the receiver wants to access the data.

Focus Group 2: Establishing Trust in CREDENTIAL

In the second focus group, we discussed how to build the user's trust into the solution developed within credential, as this represents a key factor for adoption. The following lines summarize the questions and discussions:

Which aspects could be used to build trust? It was suggested that both the ability as well as motivation of the entity deploying and maintaining the credential solution has to be clearly stated. The competence assessment can be delegated to another trusted party, for example a consumer agency, which issues certificates or simplified results as icons. Also, the motivation of the deploying party is an important factor, which is influenced by this party's business plan but also legal consequences of not complying, for example, to the General Data Protection Regulation (GDPR) [START_REF][END_REF]. Furthermore, a gradual approach of first experiencing the system with non-sensitive data and later expanding to further use cases might help users to gain familiarity and overcome trust obstacles.

How should users be informed about potential risks, which still remain even after applying the credential approach? It was discussed that potential risks should be explained honestly and concisely, as users are then able to make informed decisions and are more willing to accept consequences if they occur. This information could be provided in a layered approach, where non-technical scenarios are first presented, for example as cartoons, but further details are also available. However, a balance has to be found where users are sufficiently informed but are not scared away so that they use less secure alternatives which do not explain their potential weaknesses with the same level of detail.

Should users be offered detailed access records for their data? Providing access logs to users would be very beneficial, as these records can not only be used to detect abuse, but they also inform the user about progress and involved people, for example when sharing data for a hospital visit. Having a detailed log might also be helpful in law suits or for quality assurance reasons.

Focus Group 3: Technology Adoption and Applications

The third focus group discussed challenges and strategies for promoting the adoption of credential technology by individuals and organizations and formulated hypotheses for questions which the project could investigate in its future research on adoption factors:

How can users be convinced to change to credential technology? It was suggested that adoption of a credential application could be promoted by framing and marketing it as a "Secure App", similarly to the Swedish BankID solution [START_REF] Bankid | Swedish BankID[END_REF] that is basically perceived as a secure and trustworthy authentication solution by Swedish citizens. Moreover, additional functionalities should be provided and marketed, which credential could in contrast with other solution providers offer in a secure and privacy-friendly way. For instance, additional data sharing applications could be offered enforcing data minimization, e.g., for social sharing of pictures and posts, or sharing of confidential documents by companies. If credential can promise compliance with the GDPR for its applications, this can be another important adoption factor for industry and government.

Who should pay for the adoption of credential technology? The reason for this question was that protecting the privacy of end-users might harm the business model of currently free data sharing or identity provisioning services, as other sources of income (e.g., personalized advertisements) would not be possible any more. It was discussed that in Sweden and other countries, there are efforts spent by the government to offer patients more treatments at home and to keep them away from hospitals as long as possible, as this has been proven to be also a more cost-efficient solution. The credential eHealth solution should therefore not only provide benefits for the patients, but should also enable cost savings for Health insurances and the public Health Care system, which should therefore also have incentives to pay for it. Other options could be non-monetary payment solutions such as novel "tagging-based payment systems", where users could use the service basically for free, in return for getting every X minutes a picture in which they should tag people or objects.

Why Metadata-Privacy Matters

As already briefly discussed in Section 3.1, hiding metadata is an essential requirement for a privacy-preserving identity provisioning and data sharing platform. This section is dedicated to defining metadata in more detail and to explaining some of the potential privacy risks related to metadata.

Metadata defines and describes the data and is often referred to as "data about data". It is the information about a particular data set which may describe how, when, and by whom it was received, created, accessed, and/or modified and how it is formatted. Metadata is not limited to the files. It also encompasses the records of interactions (e.g., a history of login times) or simple facts about individuals (e.g, an account number or mailing address) [START_REF] Breen | Nothing to hide: Why metadata should be presumed relevant[END_REF]. Metadata comes from a variety of sources; it can be created automatically by a computer, supplied by a user, or inferred through a relationship with another document to serve various purposes and functions, including enhancing the editing, viewing, filing, and retrieval of documents [START_REF] Breen | Nothing to hide: Why metadata should be presumed relevant[END_REF]. It opens the possibility for search engines to index the information. It promotes clearer understanding, better data management, and efficient use and reuse of information.

However, despite the benefits of collecting and analyzing metadata, all too often metadata lacks the privacy protections afforded to the content [START_REF] Conley | Metadata: Piecing together a privacy solution[END_REF] and limited privacy protection may expose sensitive information to the wrong people and present significant risks. Possible inferences from metadata can invade a user's privacy in the same way as sensitive personal information obtained from the content [START_REF] Greschbach | The Devil is in the Metadata -New Privacy Challenges in Decentralised Online Social Networks[END_REF]. Literally, the emergence of new technologies manifests how sensitive metadata can be: how friend lists can reveal a person's sexual orientation or political views, purchase histories can identify a pregnancy before any visible signs appear, and location information can expose individuals to harassment for unpopular political views, theft, or even physical harm [START_REF] Conley | Metadata: Piecing together a privacy solution[END_REF]. Thus to protect the privacy of personal data we should consider the necessity of minimizing the amount of accessible metadata.

As mentioned previously, all the contents stored in the credential wallet are encrypted and the wallet does not have access to the plain-text. Ostensibly, the idea of the encrypted content implies the elimination of privacy issues. Nonetheless, metadata of encrypted content can still leak lots of personal and sensitive information not originating from the content itself but from its properties or generated information during content management to the credential wallet. Ergo, we want to illustrate which threats to the users' privacy still remain when metadata is available in plain-text. We only consider a simple design of the cloud-based IDMaaS system in order to give a comprehensive overview of the possible problems with honest-but-curious adversary model for the credential wallet.

In the following sections, we analyze the consequences of metadata privacy leakage and access to metadata by the wallet as an IdP and file hosting service.

Metadata for Identity Providers

When users select credential to be authenticated for different services, credential wallet as an identity provider can infer lots of information from the communication flow as explained in the following.

Behavioral pattern. Albeit by design the wallet cannot see the plain attributes which service providers request to authenticate the users, it is aware of when, from where, and how frequent the users connect to service providers and what kind of attributes are required. As an IdP, credential can glean the information about the IP address and the devices from which users connect to different services and it can guess the location. Knowing the IP address, the wallet could further infer general usage patterns, such as the user's online times or working habits (when the user connects from which device). Furthermore, even in the case that the IP address is disguised (e.g., using Tor) the accessed services might reveal some information about the user's physical location, as one often uses regional or at least national services, e.g., for online banking or governmental tasks.

Moreover, the type of the service provider could leak information about the user's gender (some services are mainly used by a specific sex) or income situation (prices of services). Based on the attributes they require to authenticate users (e.g., if the user is over 18), credential can learn about the user's age range withal. The user's age range can also be derived from kind of service providers they use (e.g., pension-related services). The broader the range of authentication and usage of service providers, the more credential can learn about the users' attitudes and personal lives (e.g., websites related to special political parties or communities in society). Also very sensitive information might be leaked through access frequencies (e.g., addictions).

Behavioral pattern combined with background information. While credential can learn a lot directly from analyzing when, from where, how frequently and to whom the users communicate, it can also combine this kind of information with some background information it has extracted about the user and learn more. For example, if the wallet already knows that a user shares health data frequently with another user (probably a doctor), a request from an online pharmacy website to authenticate the user, reveals that the illness is in a new stage or user's health has not improved because the patient has to buy new medicine or repeat the previous ones.

Metadata for Data-Sharing

Similarly to the case of identity provisioning the credential wallet infers lots of information about stored content when acting as a file hosting service. The size, structure, modification time and access rights of a file may reveal information that the user originally intended to hide. In the following we give examples for each of these properties.

Size, name and type. Even if the type of an object was not known to the wallet, the size of the cipher-text would act as an indicator of the content type of the stored object (e.g., text, image, and video). Type or size of an object when combined with the object's name (especially if it is assigned by the users and not the system) divulge more information about the content. Additionally, consider a scenario in which some users (patients) should upload and share their blood pressure collected over three months with another user (doctor). Users benefit from the same kind of health devices (sphygmomanometers introduced by doctors using credential) and health applications (applications for health devices) to collect the necessary information and send it to the wallet. Blood pressure is collected over a specific period so the number of records in each file is probably the same and due to the fact that they are collected from the same kind of health devices and apps, they have some common metadata like size, type and access rights defined by the data owner. Correspondingly, the wallet can guess that the users have the same disease and the type of illness may also be derived from the identity of the one with whom the files are shared. Doctor's identity or field of expertise might be revealed previously from some background data.

Access rights and patterns. Metadata describing access rights granted to different objects reveals not only some extra information to the wallet but also some information to the people who have been granted access to a same file. For example, all users who have the read access to a file can see between whom the file is shared which may not be desirable for the owner. In addition, being aware of the fact that some users have shared medical or identity documents with the same user or the request to access some files initiated by a specific user is always accepted helps credential to infer the identity or occupation of the user with whom the files have been shared. Because that user seems to be trusted by the others and the characteristics of the files shared with her support the inferences that she may be a doctor or from government sector. Gradually learning about users' occupations, the fact that a file is shared between different people can reveal lots of sensitive information. A high amount of medical documents related to a user indicates frequent consultations of medical practitioners. A document shared among several medical practitioners may indicate an uncommon disease. On the other hand, certain access patterns by a gynecologist may leak more positive news than regular accesses by an oncologist.

More interestingly, the user's behaviors not only progressively contribute to the information credential collects in the user's profile but also add to what credential knows about the people who have some common characteristics with the user (e.g., they all share some documents with a doctor). As a consequence, requesting to authenticate to a service provider like a psychiatric hospital by one of the users can reveal the type of common disease they share together.

Date of modification.

Monitoring the cipher-text for changes reveals possibly sensitive information considering the fact that type and location are also among visible metadata. The modification history can for example tell something about the frequency of a user's illness updates, the intensity of her illness or monitoring her illness activity, or other general usage patterns.

Structure. The structure of an encrypted object may be needed to selectively download or insert some parts to an object or to enable redacting some parts. But it can also result in leaking extra information. For example, a folder is shared between different users but not all of them have the same access rights for all objects in the folder. Inferring from the data structure that there are more objects in the folder than what a user has access to, the user learns the exact numbers of objects that the owner of the folder has made hidden for her.

Hiding Metadata

In this section, we briefly recap some important solutions from the cryptographic literature that address the metadata problem and offer partial solutions by hiding certain types of metadata. Unfortunately, for many of the proposed solu-tions, only inefficient instantiations are known and therefore the given techniques are not entirely suitable for real-world usage. Nevertheless, solving the hidingmetadata problem with efficient instantiations is an active and vibrant area of research.

Private information retrieval. In a private information retrieval (PIR) protocol, a user is able to query database records such that the database server is unable to tell which of the records the user accessed during that query and which not. The cryptogaphic literature offers a variety of proposed instantiations which can be categorized at least in single-server and multi-server variants in the information-theoretic or computational setting with different communication and computation complexity overhead, see, e.g., [START_REF] Chor | Private information retrieval[END_REF][START_REF] Kushilevitz | Replication is NOT Needed: SINGLE Database, Computationally-Private Information Retrieval[END_REF]. Unfortunately, in such systems, each database record has to be accessed by the database server for each user query, since otherwise the server would trivially gain at least some information about the query which renders the schemes inherently inefficient (if the server does not need to touch a record, it can not have been queried by the user). Additionally, within the PIR setting, a user might be able to obtain any record of the user's choice; hence, the PIR paradigm lacks some hidden access control mechanisms which, however, can be overcome with the following Hidden Access Control Policies (HACOT) technique.

Oblivious transfer with hidden access control policies. In the work of Camenisch et al. [START_REF] Camenisch | Oblivious Transfer with Hidden Access Control Policies[END_REF], the term Oblivious Transfer with HACOT was coined and the most efficient instantiation by now (and also a real-world implementation thereof) was given by Camenisch et al. [START_REF] Camenisch | Oblivious Transfer with Hidden Access Control from Attribute-Based Encryption[END_REF]. Within their setting, each database record is associated with some hidden access control policy while any user is able to query the database in an anonymous fashion. The proposed solution uses attribute-based encryption and the user can obtain a database record if and only if the attribute(s) associated with the user's secret key matches the policy of the database record. In particular, the HACOT technique does not reveal to the database provider what database record was being accessed, what the policy of that record is, who accessed the record, and whether the access was denied or granted. (This holds even in a strong adversarial model, where a malicious database server is allowed to collude with the key issuer.) Nevertheless, the database server can monitor the amount of total accesses. Unfortunately, the given HACOT real-world implementation from [START_REF] Camenisch | Oblivious Transfer with Hidden Access Control from Attribute-Based Encryption[END_REF] is quite inefficient in a largescale setting.

Oblivious random-access memory. All described techniques above only consider reading of database records. If however one wants to deal with oblivious write operations, one has to consider oblivious random-access memory (ORAM). The technique and a scheme was proposed by Goldreich and Ostrovsky [START_REF] Goldreich | Software Protection and Simulation on Oblivious RAMs[END_REF]. A more efficient ORAM instantiation (based on the Goldreich-Ostrovsky system) was given by Pinkas and Reinman [START_REF] Pinkas | Oblivious ram revisited[END_REF]. Unfortunately, as with the other described techniques above, ORAM is still considered to be quite impractical for real-world large-scale usage.

Anonymous credentials. Specifically in the case of identity provisioning, anonymous credentials can be used to authenticate a user while only revealing the absolutely minimum necessary information. Such schemes have been envisioned by Chaum [START_REF] Chaum | Untraceable Electronic Mail, Return Addresses, and Digital Pseudonyms[END_REF][START_REF] Chaum | Security Without Identification: Transaction Systems to Make Big Brother Obsolete[END_REF], and several practically efficient instantiations exist, with the most prominent ones being IBM's identity mixer [START_REF] Camenisch | Design and Implementation of the idemix Anonymous Credential System[END_REF][START_REF] Camenisch | An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation[END_REF] and Microsoft's UProve [START_REF] Paquin | U-prove Cryptographic Specification v1.1[END_REF]. In such a system, the user receives a credential on its attributes, and can dynamically choose which attributes to reveal to a service provider, while not leaking any information about undisclosed attributes. In those schemes, the authentication process is done fully locally, and thus there is no need for a central IdP and also the related metadata-privacy problems disappear. However, these constructions are inherently non-cloudified, as the attributes are required in the plain for performing authentication, contradicting the ambition of a solution not requiring any key material, dedicated software, or heavy computations on the user's side, cf. Section 3.1.

Recently, Krenn et al. [START_REF] Krenn | Attribute-based credentials on encrypted attributes[END_REF] suggested the first anonymous credential system based on proxy re-encryption, where the authentication can be outsourced to a semi-trusted IdP, having the advantage that neither specific software nor heavy computations are required on the users' side. However, re-inventing the central IdP also re-introduces all the metadata problems, which are not further addressed in their work.

Metadata-Hiding Identity Provisioning

As discussed in the previous section, existing cryptographic mechanisms are either not suited or too inefficient for usage in a large-scale central identity provider. In the following we will therefore present a potential high-level architecture of a metadata-privacy respecting IdP. The main idea is to split the identity provider into two components. A first component communicates with the user, whereas a second component communicates with the service providers. Assuming that those two entities do not collaborate, we can circumvent many of the discussed metadata problems while not negatively impacting the usability of the overall system.

In the following we assume that a user U received an authentication credential in form of a signature on encrypted attributes from an issuer, and stored it to the first part of the identity provider, i.e., IdP 1 , together with a re-encryption key from its personal public key to the public key of the second part of the identity provider, i.e., IdP 2 (note here that this computation requires access to the user's secret key). The used encryption scheme needs to support at least two subsequent proxy re-encryption operations. Furthermore, we assume that the user wants to log in to a service provider SP, which has already been accessed by some user previously. If this was not the case, the SP and the two identity providers jointly perform in a multi-party computation protocol, at the end of which IdP 2 learns the required re-encryption key from its own public key to that of SP. This protocol is necessary because for obvious reasons neither IdP 1 nor IdP 2 must learn the secret key corresponding to IdP 2 's public key, but rather the key needs to be appropriately shared between them.

The following protocol shows the message flow for a login process, assuming that every sent message is supplemented by a zero-knowledge proof of knowledge showing the correctness of the performed computations [START_REF] Bellare | On defining proofs of knowledge[END_REF].

-In a first step, U contacts SP (via some anonymized network layer, e.g., using

Tor as an anonymization service). The two parties agree on a random session identifier sid and the set of attributes to be disclosed. -If the received sid's are equal, IdP 2 forwards the presentation token to SP, which grants the user access in case that the presentation token is valid.

The above approach requires that the two parts of the identity provider do not collude. In this case, the following privacy requirements can be given. On the one hand, IdP 1 only learns that U is authenticating to some service provider, but it neither learns which attributes will be disclosed nor the identity of the service provider. Therefore, no sensitive information is leaked to IdP 1 . On the other hand, IdP 2 only learns that some user is authenticating itself towards a specific service provider, but it neither learns the user nor the plain values of the revealed attributes. Again, IdP 2 therefore does not learn critical information about a specific user if the number of users is sufficiently large.

From a computational point of view, the costs of our conceptual architecture should be comparable to previous single IdP solutions such as, e.g., Krenn et al. [START_REF] Krenn | Attribute-based credentials on encrypted attributes[END_REF], while giving far higher privacy guarantees. Security-wise the above protocol achieves similar guarantees as [START_REF] Krenn | Attribute-based credentials on encrypted attributes[END_REF] by assuming essentially passive adversaries in the sense that the identity providers try to learn as much information about the user, but do not actively behave maliciously.

Conclusion

The workshop took advantage of the different expertise present in the focus groups. Experts from different domains discussed the opportunities and challenges of the credential approach towards a privacy-preserving IDMaaS and data sharing solution. The discussions covered various aspects such as challenges related to user trust, or potential business models and applications of the resulting systems. Special attention was paid to the necessity of metadata-privacy and the related technical obstacles. This report summarizes the results of the focus groups. Furthermore, it presents a potential high-level architecture of a metadata-privacy respecting identity provider which arose based on the inputs from the focus groups.

A first step for future work will include the formal modeling, specification, and security and privacy analysis of this proposed concept architecture.

Fig. 1 .

 1 Fig. 1. credential's Basic Architecture

-

  Next, the user encrypts the indices of the required attributes, sid, and the identity of SP under the public key of the second part of the identity provider, IdP 2 , yielding a ciphertext c. -The user then contacts (and potentially authenticates itself towards) the first part of the identity provider, IdP 1 . It hands c to IdP 1 . -In a fourth step, IdP 1 re-encrypts a re-randomized version of U's encrypted credential to the public key of IdP 2 , and forwards the result together with c to IdP 2 . -Next, IdP 2 decrypts c and computes a presentation token for SP. It therefore re-encrypts the requested attributes for SP, thereby redacting the remaining attributes in order to show the validity of the underlying credential. This can, e.g., be done similar to Krenn et al. [23]. -The service provider contacts IdP 2 and hands over sid.

Acknowledgement. The authors would like to thank the workshop participants for their valuable comments and inputs during the focus groups. In particular, we want to thank Anna Klughammar for her introductory presentation on the eHealth pilot, Charlotte Bäccman and John Sören Pettersson for moderating the second focus group, and Karl Koch for providing us with his extra notes for the third focus group.

determined using a fair dice.


Daria V Berdnikova

Thomas Paululat

Gediminas Jonusauskas

Svetlana M Peregudova

Olga A Fedorova

Protonation-Gated Dual Photochromism of a Chromene-Styryl Dye Hybrid

A novel hybrid bisphotochromic system involving a chromene residue and a styryl dye fragment is described. Initially, the compound shows almost no photochromism due to intramolecular energy and electron transfer between the chromophores. Protonation of the hybrid system blocks the transfer processes and unlocks a dual photochromic activity that includes ring opening of the chromene fragment and E Z isomerization of the styryl dye residue. Deprotonation of any photoinduced form resets the system to the initial photoinactive form.

Multiphotochromic systems represent an emerging field of photoactive compounds possessing high practical or creation of miniature molecular devices, logic gates, and high-density optical memory. 1 The range of homodimeric and homomultimeric photochromes constructed of equal units is rather extensive, 1 while examples of hybrid molecules comprising photochromic fragments of a different nature are still relatively limited because of increased complex-ity of their behavior. [2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19] At the same time, hybrid photo-chromes are especially useful as a platform for new smart materials and surfaces due to the possibility of orthogonal activation of photochromic entities and a greater number of available states. The majority of the reported hybrid photo-chromes is based on a dithienylethene moiety, and therefore, further development of these perspective compounds requires the use of other classes of photochromes.

In this work, we have designed and investigated novel hybrid bisphotochromic system 3 consisting of a chromene unit tethered to a styryl(pyridinium) dye fragment by a methylene linker (Scheme 1). Target compound 3 was obtained in 54% yield by interaction of bromoderivative 4 20 with p picoline followed by the Knoevenagel condensation of methylpyridi nium derivatized chromene 5 with N,N dimethylamino benzaldehyde under alkaline conditions. New compounds 3 and 5 were fully characterized. In the free state, compound 3 showed almost no photochromism, whereas upon protonation of the dimethylamino group both chromophores in 3 H + became photoactive, thus demonstrating protonation gated dual photochromism.

It is known that styryl(pyridinium) dye 1, which is the first building unit of hybrid 3, is photochemically inert in polar Scheme 1. Synthesis of Hybrid System 3 and Structures of Its Building Blocks 1 and 2 solvents due to fast nonradiative relaxation through formation of TICT states (Twisted Intramolecular Charge Transfer). 21,22 The second building unit is chromene 2 that upon UV irradiation undergoes electrocyclic C-O bond cleavage followed by isomerization of the double bonds yielding two isomeric open forms TC (s trans-cis) and TT (s trans-trans). [START_REF] Hepworth | Photochromic Naphthopyrans[END_REF] The closed form (CF) of 2 absorbs light in the UV (λ max = 315, 350 nm), whereas absorption of the open forms (OF) is significantly shifted to the visible region (λ max = 430-460 nm), leading to formation of two spectroscopically clearly distinguishable states. The absorption spectrum of hybrid system 3 represents a superposition of its building block absorption with a moderate red shift of the styryl fragment absorption (λ max = 483 nm) in comparison to parent compound 1 (λ max = 471 nm)(Figure 1A). Notably, the absorption of the styryl dye residue at 350 nm is close to zero whereas the chromene absorption has a maximum at this wavelength providing a possibility of orthogonal excitation of the chromophores in 3.

Based on the photophysical properties of parent compounds 1 and 2, we expected that photoexcitation of hybrid system 3 in polar acetonitrile into the chromene absorption band would lead to the ring opening reaction of the chromene residue whereas the structure of the styryl fragment would remain unchanged. However, regardless of the excitation wavelength, compound 3 appeared to be almost photochemically inert and only showed very weak reversible changes of the absorption upon continuous irradiation. To clarify the reason for this behavior the steady state fluorescence of 3 was checked upon selective excitation of each chromophore. It was found that irrespective of the excitation wavelength, hybrid molecule 3 demonstrates the only fluorescence band centered at 630 nm that belongs to the styryl dye fragment. Additionally, the fluorescence excitation spectrum of 3 detected at the styryl residue emission maximum (630 nm) shows good coincidence with the absorption spectrum of hybrid system 3. Based on these data and considering good spectral overlap between fluorescence of 2 24 and absorption of 1 (Figure 1A), we proposed the occurrence of the intramolecular energy transfer (ET) from the excited chromene unit to the styryl dye residue in 3. [START_REF] Valeur | Molecular Fluorescence Principles and Application[END_REF] The possibility of ET has also been supported by the relative positioning of the LUMO levels of each chromophore determined by cyclic voltammetry.

Thus, the energy difference between the LUMO of 2 (energy donor) and 1 (energy acceptor) is ΔE = -0.36 V, which confirms thermodynamic feasibility of the energy transfer process in 3. [START_REF] Mandal | [END_REF] Additionally, the positions of the energy levels of 2 and 1 indicate the possibility of photoinduced electron transfer (PET) from the HOMO of the styryl chromophore to the HOMO of the chromene fragment upon excitation of the latter (ΔE = -0.48 V).

A complete characterization of the energy and electron transfer processes in hybrid system 3 was obtained by transient absorption spectroscopy (TRABS). First, we performed a reference experiment, in which the styryl dye residue of 3 was directly excited into its absorption maximum at 490 nm. The excitation kinetics of the styryl chromophore was not delayed and followed the temporal profile of the excitation pulse. Then we selectively excited the chromene moiety of 3 at 350 nm. The styryl dye fragment does not absorb at 350 nm and, therefore, remained nonexcited. After the laser pulse, the excited state of chromene rapidly relaxed. In parallel, the initially nonexcited styryl dye fragment became excited indicating the transfer of the excitation from the chromene residue. The excitation kinetics of the styryl fragment was delayed in comparison with the reference experiment and occurred with the time constant of τ tr = 0.12 ps that characterizes the overall time frame of energy and electron transfer.

Treatment of the obtained data yielded the overall rate constant of the transfer processes k tr = 8.3 × 10 12 s -1 . Assuming that the singlet excited state lifetime of CF of chromene 2 in acetonitrile is τ 0 = 0.45 ps, 27 we estimated the ring opening rate constant to be k ro = 2.2 × 10 12 s -1 . This means that the ET+PET processes in 3 occur about four times faster than the ring opening. Taking into account obtained rate constant values, we calculated the efficiency of the chromene ring opening in 3 as Φ ro = 21%. Detailed analysis of the excited state decay kinetics of the styryl chromophore in 3 yielded efficiencies of the energy transfer Φ ET = 63% and electron transfer Φ PET = 16%. This means that, upon selective photoexcitation of the chromene unit in 3, the excitation energy is mainly forwarded to the styryl dye fragment through the ET channel that, together with the parallel PET process, significantly reduces the photochromic performance of the chromene residue. Notably, both Forster and Dexter mechanisms [START_REF] Valeur | Molecular Fluorescence Principles and Application[END_REF] are involved in the energy transfer in 3.

Protonation of the dimethyamino group of hybrid 3 causes a pronounced blue shift of the styryl fragment absorption (Δλ = -148 nm) resulting in complete overlap of the absorption of both chromophores (Figure 1B). Such spectral changes indicate that the energy transfer in 3 H + is not favored anymore. Complementary cyclic voltammetry studies showed that the energy gap between HOMO and LUMO in 1 H + (E 0-0 = 3.44 eV) exceeds that in 2 (E 0-0 = 3.11 eV), thus confirming that ET in 3 H + is disabled. Since protonation of 3 blocks the lone electron pair on the dimethylamino nitrogen, the PET process from the protonated styryl fragment to chromene residue is also stopped. The drastic decrease in efficiency of the transfer processes unlocks the photochromic performance of 3 H + . Thus, irradiation of 3 H + results in the appearance of the characteristic absorption of the chromene open forms in the visible region at 400-550 nm (Figure 1B). Additionally, absorption of 3 H + at 335 nm demonstrates a noticeable decrease that cannot be assigned with the chromene opening reaction. To explain this, we proposed the occurrence of the second photochemical transformation in protonated hybrid 3 H + . As it was mentioned above, parent dimethylamino styryl(pyridinium) dye 1 is photochemically inactive in polar solvents. However, proto nation of the dimethylamino group in 1 H + results in considerable loss of polarity of the molecule that favors photoinduced E Z isomerization 28 instead of the thermal relaxation through the TICT states. Changes in the spectral region of 300-350 nm observed during the photolysis of the protonated hybrid 3 H + strongly resemble the behavior of the protonated parent compound 1 H + in the course of E Z photoisomerization. 28 Therefore, there are two parallel photo chromic processes taking place in the protonated hybrid molecule 3 H + , namely (i) chromene ring opening and (ii) E Z isomerization of the styryl double bond. Both photochromic reactions are protonation gated and can be induced by light of the same wavelength.

To obtain a more detailed structural picture of the photochemical transformations, we performed NMR inves tigations upon continuous irradiation of the sample inside the NMR spectrometer. The E Z isomerization of the protonated styryl fragment in 3 H + can be clearly seen by the appearance of two doublets with the coupling constant of J = 12.4 Hz corresponding to the Z conformation of the CC double bond. Unfortunately, due to the fast back reaction (see below), we were not able to detect the open form of chromene in this experiment even when lowering the temperature to -40 °C.

A principal scheme of the photochromic transformations of hybrid system 3 is depicted on Scheme 2. Protonation of the initial low active form 3 unlocks its photochemical activity. Thus, absorption of the first photon by the CF E form of 3 H + transfers the molecule into TC E or CF Z forms. Based on the absorption fraction of each photochromic unit of 3 H + at 365 nm and the quantum yields of the corresponding photo reactions in MeCN (the ring opening of chromene 2: φ ro = 0.7 -0.9; 29 the E Z isomerization of protonated styryl dye 1 H + : φ E-Z = 0.6, we estimated that formation of the CF Z state occurs twice more efficiently compared to TC E. Further absorption of a photon by photoinduced TC E yields either TC Z or TT E species, whereas CF Z can transform only into TC Z. Finally, irradiation of TT E and TC Z results in the TT Z state. The back reactions of all photoinduced species occur thermally. The rate constant value for the reverse Z E isomerization of the styryl residue in 3 H + is k Z-E = 0.5 × 10 -4 s -1 . Considering the common thermal relaxation path for chromenes (TT → TC → CF), [START_REF] Hepworth | Photochromic Naphthopyrans[END_REF] biexponential ring closure (bleaching) kinetics for the chromene unit in 3 H + was expected. Nevertheless, the bleaching kinetics for 3 H + were fitted to a monoexponential dependence with rate constant of k rc = 0.34 s -1 . We explain this by a slow TC → TT reaction, when the observed kinetics virtually corresponds to the TC → CF transition. However, the TT form of the chromene residue of 3 H + can be accumulated upon prolonged irradiation, which results in the residual coloration of the solution [START_REF] Hepworth | Photochromic Naphthopyrans[END_REF] that persists for several days. Based on the above discussion, we conclude that formation of the TC Z species mainly takes place from the CF Z form as the latter decays much slower than TC E. To check the photochemical stability of the chromene residue in 3 H + ,we recorded coloration -bleaching cycles that showed highly reproducible absorption intensity upon coloration and good thermal reversibility. Interestingly, the chromene ring closure in protonated hybrid 3 H + occurs faster than in parent chromene 2 (cf. for 2 k rc = 0.25 s -1 ). At the same time, the reverse Z E isomerization in 3 H + is slower than in parent dye 1 H + (cf. for 1 H + k Z-E = 1.2 × 10 -4 s -1 ). Nevertheless, close rate constant values for the corresponding photoprocesses in bischromophoric mole cule 3 H + and its monochromophoric analogues 2 and 1 H + indicate that the chromophores in protonated 3 H + behave almost independently, whereas in free 3 the chromophores represent an integral system due to the tight interaction within the ET and PET processes. Importantly, deprotonation of any photoinduced form of 3 H + by addition of the base NEt 4 OH immediately switches the molecule back to the initial low active species 3 possessing the chromene residue in the closed form and the styryl double bond in the E conformation. In summary, we have developed novel chromene-styryl dye hybrid 3 existing in two different modes. In the free state, the molecule undergoes efficient photoinduced energy and electron transfer between chromophores and, for this reason, exhibits virtually no photochromism (the "transfer" mode). Protonation switches the hybrid to the dual photochromic mode, in which both units demonstrate characteristic photochemical trans formations, i.e. ring opening/closure reaction of the chromene residue and reversible E Z isomerization of the styryl dye fragment. Deprotonation of any photoinduced form of 3 H + provides a complete reset of the system to the initial weakly photochromic species 3. Obtained results outline an interesting approach toward creation of systems that can be easily switched between the photoinactive and dual photochromic state "on demand".

Figure 1 .

 1 Figure 1. (A) Absorption spectra of hybrid system 3 (red) and parent compounds 1 (black) and 2 (blue) in MeCN; in all cases c = 25 μM, 20 °C. (B) Absorption spectra of the protonated hybrid system 3 H + (blue) and spectral changes upon irradiation of 3 H + (red) in MeCN, c = 21 μM, 20 °C. The arrows indicate increasing absorption of the OF of the chromene fragment and decreasing absorption of the Z isomer of the styryl dye residue upon irradiation.

Scheme 2 .

 2 Scheme 2. Overview of the Photochemical Transformations of Free Hybrid System 3 and Its Protonated Form 3 H +

ACKNOWLEDGMENTS

The publication was financially supported by the Ministry of Education and Science of the Russian Federation (Agreement No. 02.a03.0008) and RFBR 15 03 04705. We thank Markus Rabe and Dr. Rainer Bornemann (Universitaẗ Siegen, Germany) for help to setup the "irradiation inside NMR". D.B. thanks Dr. Sergey Paramonov (INEOS RAS, Russia) for his friendly help and discussions on the chemistry of chromenes.

AUTHOR INFORMATION

Corresponding Author *E mail: daria@ineos.ac.ru. ORCID Daria V. Berdnikova: 0000 0002 0787 5753 Gediminas Jonusauskas: 0000 0002 2647 1439 Olga A. Fedorova: 0000 0001 7843 4157

Notes

The authors declare no competing financial interest.


Erik Vanhoutte

Franck Ruffier

Julien Serres

A Quasi-panoramic Bio-inspired Eye for Flying Parallel to Walls

In this study, a quasi-panoramic bio-inspired eye dedicated to optic flow measurement on board micro flying robots is presented. It will allow future micro flying robots to mimic honeybees' navigational tasks which work without any metric sensors. An innovative optic flow-based algorithm was tested in the horizontal plane to measure the robot's incidence angle when travelling along a wall. Experimental results achieved while using a moving texture showed that our algorithm is able to measure the local visual heading with respect to a tapered wall with an error of 3 • and an accuracy of 3 • on average. Our bio-inspired eye will be implemented in the near future on board a micro quadrotor to "sense and avoid" obstacles in a GPS-denied environment.

I. INTRODUCTION

Detailed study of flying insects has led to the discovery of smart solutions in biologically inspired robotics [START_REF] Srinivasan | Honeybees as a model for the study of visually guided flight, navigation, and biologically inspired robotics[END_REF]. One of the most impressive flying insects is the honeybee because it is able to navigate up to a few kilometers from its hive to forage without access to GPS (GPS stands for Global Positioning System) while avoiding obstacles mainly through the use of optic flow (OF) sensing [START_REF] Srinivasan | Honeybees as a model for the study of visually guided flight, navigation, and biologically inspired robotics[END_REF]. Since, different mobile robots ( [START_REF] Franceschini | From insect vision to robot vision [and discussion[END_REF], [START_REF] Davis | A bio-inspired apposition compound eye machine vision sensor system[END_REF], [START_REF] Srinivasan | Honeybees as a model for the study of visually guided flight, navigation, and biologically inspired robotics[END_REF]) or micro flying robots ( [START_REF]Autonomous Vision-Based Navigation of a Quadrotor in Corridor-Like Environments[END_REF], [START_REF] Moore | Autonomous mav guidance with a lightweight omnidirectional vision sensor[END_REF], [START_REF] Expert | Flying over uneven moving terrain based on optic-flow cues without any need for reference frames or accelerometers[END_REF], [START_REF] Briod | A method for egomotion estimation in micro-hovering platforms flying in very cluttered environments[END_REF]), fitted with a bio-inspired custom-made compound eyes to measure OF, have been built for indoor navigation in obstacle-rich corridors or forests.

OF-based control methods have been developed on board simulated ( [START_REF] Humbert | A control-oriented analysis of bio-inspired visuomotor convergence[END_REF], [START_REF] Humbert | Extracting behaviorally relevant retinal image motion cues via wide-field integration[END_REF], [START_REF] Portelli | Modelling honeybee visual guidance in a 3-D environment[END_REF]) or physical micro flying robots ( [START_REF]Autonomous Vision-Based Navigation of a Quadrotor in Corridor-Like Environments[END_REF], [START_REF] Moore | Autonomous mav guidance with a lightweight omnidirectional vision sensor[END_REF]) in order to follow flat surfaces (ground or walls). However, OF-based strategy has been also demonstrated to improve the crossing capabilities in case of a tapered wall encountered in bent corridors [START_REF] Serres | Biomimetic Autopilot Based on Minimalistic Motion Vision for Navigating along Corridors Comprising Ushaped and S-shaped Turns[END_REF]. In [START_REF] De Croon | Optic-flow based slope estimation for autonomous landing[END_REF], the slope of the ground has been assessed on board a quadrotor. In [START_REF] Expert | Flying over uneven moving terrain based on optic-flow cues without any need for reference frames or accelerometers[END_REF], 10 local OF measurements coupled to a least mean squares method was used to keep constantly level a minimalistic quasi-panoramic compound eye of the Beerotor robot with respect to the local downward slope, thus allowing the robot to avoid very steep relief.

In the present paper, a quasi-panoramic bio-inspired eye built with 8 custom-made OF sensors (based on M 2 APix sensor [START_REF] Mafrica | A bio-inspired analog silicon retina with Michaelis-Menten auto-adaptive pixels sensitive to small and large changes in light[END_REF], [START_REF] Vanhoutte | Timeof-Travel Methods for Measuring Optical Flow on Board a Micro Flying Robot[END_REF]) is presented for local visual heading measurement purposes : it should allow a future micro flying robot devoid of a magnetic compass to stabilize its heading in an unpredictable indoor environment while visually following local flat surfaces. In section II, the eye design will be *This work was supported by the French Direction Générale de l'Armement (DGA), CNRS, Aix-Marseille Université, the Provence-Alpes-Côte d'Azur region and the French National Research Agency for Research (ANR) with the Equipex/Robotex project.

1 Correspondance: julien.serres@univ-amu.fr; Tel.: +33(0)4 91 26 62 38 Aix Marseille Univ, CNRS, ISM, Marseille, France described. In section III, both the visual signals processing and the local visual heading computation on OF sensing will be presented. In section IV, the embedded electronics for computational purposes will be described in detail, and in section V, experimental results obtained while using a test bench based on a moving texture will be presented to test our visual heading estimation algorithm. In section VI, it will be concluded that our quasi-panoramic bio-inspired eye is able to estimate the local visual heading profile with respect to a tapered wall set in motion.

II. QUASI-PANORAMIC BIO-INSPIRED EYE

A custom-made 3D print gimbal case was designed to be used on board our micro flying robot to support our bioinspired eye (Fig. 1). Two 10-gram servo motors mounted in serial stabilize the 8 OF sensors (based on M 2 APix sensor [START_REF] Mafrica | A bio-inspired analog silicon retina with Michaelis-Menten auto-adaptive pixels sensitive to small and large changes in light[END_REF], [START_REF] Vanhoutte | Timeof-Travel Methods for Measuring Optical Flow on Board a Micro Flying Robot[END_REF]) in pitch and roll (Fig. 1) to avoid any perturbation coming from attitude disturbances. A first group of 3 OF sensors are oriented toward the left-hand side, a second group of 3 sensors is oriented toward the right-hand side. Each group of sensors placed in the horizontal plane has a field of view of 92.8 • in the horizontal plane and 13.4 • in the vertical plane. A third group of 2 sensors is oriented downwards to measure the ventral OF with a field of view of 62.8 • in the forward axis and 13.4 • in the orthogonal axis. This quasi-panoramic bio-inspired eye was designed to provide navigational capabilities to a micro flying robot (see [START_REF] Vanhoutte | Timeof-Travel Methods for Measuring Optical Flow on Board a Micro Flying Robot[END_REF]) in order to adopt wall-following behaviour in indoor environments while following the ground by regulating the OF. Moreover, 10-local OF measurements is obtained by each M 2 APix sensor, and each of these pixels is based on a Michaelis-Menten Auto-adaptive Pixel analog silicon retina that can auto-adapt in a 7-decade lighting range and responds appropriately to step changes up to ± 3 decades [9]. Consequently, a M 2 APix sensor can work in any lighting conditions [START_REF] Vanhoutte | Timeof-Travel Methods for Measuring Optical Flow on Board a Micro Flying Robot[END_REF].

III. VISUAL HEADING COMPUTED WITH OPTIC FLOW

In our experiment the bio-inspired eye, called OctoM 2 APix (Fig. 1), is placed in front of a moving pattern to perceive an OF with its 3 left-hand M 2 APix sensors (same experimental set-up as Fig. 4 in [START_REF] Vanhoutte | Timeof-Travel Methods for Measuring Optical Flow on Board a Micro Flying Robot[END_REF]). Different possibilities are available to compute the local visual heading α from a tilted surface (here, a wall), but one of the lightest solution in terms of CPU load is to consider a median filter from the 10 local OF measurements coming from each M 2 APix sensor. Hence, the local visual heading α can be computed with only 2 local OF measurements (ω B and ω D ) and their respective azimuthal angle (ϕ B and ϕ D in Fig. 2). The computed angle α will be independent from the robot's forward speed V (Eq. ( 1)). However, the bio-inspired eye will be immobile in space while seeing a moving texture at a speed V p , thus requiring a correction Eq. (1) by mean of Eq. ( 2). With a speed condition V p = 0 and V = 0 (real flight), the local visual heading α is computed with Eq. ( 1), where c is cos, s is sin, and t is tan function. However, with a speed condition V p = 0 and V = 0, the local visual heading α is computed with Eq. ( 2).

ωB = V OB • s(ϕB) ωD = V OD • s(ϕD) t(α) = OD • s(ϕD) -OB • s(ϕB) OB • c(ϕD) -OD • c(ϕB) t(α) = ωB • s(ϕD) 2 -ωD • s(ϕB) 2 ωD • s(ϕB) • c(ϕB) -ωB • s(ϕD) • c(ϕD) (1)
t(α) = ωB • s(ϕD + α) • s(ϕD) -ωD • s(ϕB + α) • s(ϕB) ωD • s(ϕB + α) • c(ϕB) -ωB • s(ϕD + α) • c(ϕD) (2)
Our algorithm uses a pair of local OF measurements (Eq. ( 2)) among 3 M 2 APix sensors, 3 local visual heading α can be therefore computed and compared.

IV. EMBEDDED ELECTRONICS

A custom-made PCB was designed to connect, as presented in the Fig. 3a, the following components: a Teensy 3.2 featuring a 72 MHz Cortex-M4 (PJRC), an 8-bit SPI GPIO EXPANDER called XRA1404 (Exar c ), an Inertial Measurement Unit (IMU) MPU6050, and connections to plug 8 M 2 APix sensors and 2 servo motors of the gimbal system which aims to stabilize the bio-inspired eye in pitch and roll.

A M 2 APix sensor works with a SPI bus running at maximum 1 MHz to transmit a data frame of 256 bits. The maximum theoretical frame rate is at 3906 Hz. SPI devices communicate in full duplex mode using a masterslave architecture with a single master. By and large, only one SPI bus is available on dedicated electronic board. So, the maximum frame rate to get data from 8 slave M 2 APix sensors is less than 488 Hz, and data will not process synchronously but sequentially (Fig. 3b). To get a higher frame rate from 8 M 2 APix sensors, and to be synchronous, a XRA1404 GPIO EXPANDER was used. The XRA1404 can read the logic state on 8 digital ports and send this data as a byte to a SPI bus working at 26 MHz (Fig. 3b). Each of these 8 digital ports is used to read the bit to bit data frame of each M 2 APix sensor (step 1 in the Fig. 3b). As a result, the first bit of each M 2 APix data frame is grouped in one byte that is sent on the SPI bus. Each bit of each M 2 APix sensor is processed in this way.

The Teensy electronic board reads the SPI bus at 26 MHz from the XRA1404 and puts each data frame of each M 2 APix sensor back in order (step 2 in Fig. 3b). The M 2 APix sensor sends a mean value of light and 12 pixel values, each one coded on 10-bit values. Then, the algorithm selects only the pixel data. It remains 12x10 bits per M 2 APix sensor . Finally, the Teensy removes the offset of the used range and deletes the last bit equivalent to the amplitude of the noise to get data in the 8-bit format. Then, the 12 pixels coded with the 8-bit value of the 8 M 2 APix sensors are sent to the serial bus at 3 Mbps to a computational unit to compute OF (step 3 in Fig. 3b).

V. RESULTS WITH A MOVING TEXTURE AND

CONCLUSION

Results of the local visual heading α computed with Eq. ( 2) with the 3 pairs of left-hand M 2 APix sensors in four α angle cases are presented in Fig. 4. The eye heading is manually rotated along the yaw axis with an accuracy of ±3 • , and it is represented by 4 purple steps in Fig. 4. Using Eq. ( 1) assumes the hypothesis of a flying robot at a speed V (Fig. 2), but in this experiment, the wall was moving at a speed V p (Fig. 2), which is not collinear with V , so a correction has been made offline to compute the correct visual heading α with Eq. ( 2).

These results show that such a group of OF sensors (here 20 local OF measurements) can be used on board a flying robot to implement a yaw control feedback loop based on a local visual heading estimation (error less than 3 • in Fig. 4). Such bio-inspired eyes will be used in the future when exploring a building by keeping a visual contact with the wall while keeping the quadrotor heading parallel to the same wall [START_REF] Vanhoutte | A honeybee's navigational toolkit on board a bio-inspired micro flying robot[END_REF]. Moreover, the computation of OF and local visual heading appears to be light enough in terms of computational resources to be embedded on board a micro flying robot fitted with an Overo AirSTORM Computer-On-Module (COM) (Gumstix) including a 1-GHz CPU DM3703 processor.

Fig. 1 :

 1 Fig. 1: The 50-gram bio-inspired eye called OctoM 2 APix.

Fig. 2 :

 2 Fig. 2: Geometry of the OctoM 2 APix eye (centering in O) in the horizontal plane and a tapered wall on its left-hand side. Each green rectangle represents one M 2 APix sensor.

Fig. 3 :

 3 Fig. 3: a) Electronic diagram. b) Data diagram of how visual signals coming from the OctoM 2 APix eye are processed.

Fig. 4 :

 4 Fig. 4: Incidence angle assessment with respect to a textured wall set in motion using the OctoM 2 APix eyes. Results are shown for 4 different incidence angles α : 20 deg, -25 deg and -45 deg. The incidence angle estimation was compared in the case of three different combinations of M 2 APix sensors: numbered from 1 to 3. Precision and accuracy are in general the lowest while using the pair of sensors 1 and 3, the most widely separated ones.

  n ... a 1 h n ... h 1 g n ... g 1 b n ... b 1 ...

				UART @3 Mbps
	M²APix a 12 pixels M²APix b 12 pixels M²APix c 12 pixels Servo motor roll MKS 480	M²APix d 12 pixels PWM IMU SPI UART @3 Mbps MPU 6050 @1 Mbps XRA1404 M²APix e 12 pixels PWM Teensy SPI @26 Mbps I2C	M²APix f 12 pixels M²APix g 12 pixels M²APix h 12 pixels	M²APix a M²APix g M²APix e M²APix c Teensy a 1 SPI @1 Mbps c n ... c 2 c 1 e n ... e 2 e 1 g n ... g 2 g 1 a n ... a 2 a 1 SPI @26 Mbps b 1 c 1 d 1 e 1 f 1 g 1 h 1 ... b i a i c i d i e i f i g i h i h n g n f n e n d n c n b n a n	b 1 d 1 f 1 h 1	b 2 d 2 f 2 h 2	... ... ... ...	b n d n f n h n	M²APix h M²APix f M²APix d M²APix b Computational Unit
				XRA 1404

a