Lars Grüne

Athena Picarelli

Zubov's method for controlled diffusions with state constraints

Keywords: Mathematics Subject Classification (2010). Primary 93B05; Secondary 93E20, 49L25 Controllability for diffusion systems, Hamilton-Jacobi-Bellman equations, viscosity solutions, stochastic optimal control

We consider a controlled stochastic system in presence of state-constraints. Under the assumption of exponential stabilizability of the system near a target set, we aim to characterize the set of points which can be asymptotically driven by an admissible control to the target with positive probability. We show that this set can be characterized as a level set of the optimal value function of a suitable unconstrained optimal control problem which in turn is the unique viscosity solution of a second order PDE which can thus be interpreted as a generalized Zubov equation.

Introduction

In this paper we aim to study the asymptotic controllability property of controlled stochastic systems in presence of state constraints.

The basic problem in this context is the existence of a control strategy that asymptotically steers the system to a certain target set with positive probability. In the uncontrolled framework, the idea, due to Lyapunov, of linking the stability properties of a system with the existence of a continuous function (in the nowadays literature called a "Lyapunov function") that decreases along the trajectories of the system, represents a fundamental tool for the study of this kind of problems. In his seminal thesis [START_REF] Lyapunov | The General Problem of the Stability of Motion[END_REF], Lyapunov proved that the existence of such a function is a sufficient condition for the asymptotic stability around a point of equilibrium of a dynamical system ẋ = b(x),

x(t) ∈ R d , t ≥ 0.

(1.1)

This theory was further developed in later years, see [START_REF] Hahn | Stability of motion[END_REF][START_REF] Massera | On Lyapunov's condition of stability[END_REF][START_REF] Kurzweil | On the inversion of the second theorem of Lyapunov on stability of motion[END_REF], and also the converse property was established. Since the 60s, Lyapunov's method was extended to stochastic diffusion processes. The main contributions in this framework come from [START_REF] Hasminskii | Stochastic stability of differential equations[END_REF][START_REF] Kushner | Stochastic stability and control[END_REF][START_REF] Kushner | Converse theorems for stochastic Lyapunov functions[END_REF][START_REF] Kushner | Stochastic stability. In "Stability of stochastic dynamical systems[END_REF], where the concepts of stability and asymptotic stability in probability, as well as the stronger concept of almost sure stability, are introduced. An important domain of research concerns the developments of constructive procedure for the definition of Lyapunov functions. In the deterministic case an important result was obtained by Zubov in [START_REF] Zubov | Methods of A.M. Lyapunov and their Application[END_REF]. In this work the domain attraction of an equilibrium point x E ∈ R d for the system (1.1), i.e. the set of initial points that are asymptotically attracted by x E , is characterized by using the solution ϑ of the following first order equation

Dϑ(x)b(x) = -f (x)(1 -ϑ(x)) 1 + b(x) 2 x ∈ R d \ {x E } ϑ(x E ) = 0, (1.2)
for a suitable choice of a scalar function f (see [START_REF] Zubov | Methods of A.M. Lyapunov and their Application[END_REF] and [START_REF] Hahn | Stability of motion[END_REF]). Equation (1.2) is referred to in the literature as Zubov equation. In particular, what is proved in [START_REF] Zubov | Methods of A.M. Lyapunov and their Application[END_REF] is that the domain of attraction coincides with the set of points x ∈ R d such that ϑ(x) < 1. Further developments and applications of this method can be found in [START_REF] Aulbach | Asymptotic stability regions via extensions of Zubov's method. I and II. Nonlinear Anal[END_REF][START_REF] Hahn | Stability of motion[END_REF][START_REF] Hassan | Numerical determination of domains of attraction for electrical power systems using the method of Zubov[END_REF][START_REF] Genesio | On the estimation of asymptotic stability regions: State of the art and new proposals[END_REF][START_REF] Kirin | Construction of the attraction region by Zubov's method[END_REF][START_REF] Camilli | A generalization of the Zubov's equation to perturbed systems[END_REF]. More recently, this kind of approach has been applied to more general systems, included control systems, thanks also to the advances of the viscosity solution theory that allows to consider merely continuous solutions of fully nonlinear PDE's. While for systems of ordinary differential equations the property of interest is stability, for systems that involve controls, the interest lies on "controllability", i.e. on the existence of a control such that the associated trajectory asymptotically reaches the target represented by the equilibrium point (see [START_REF] Artstein | Stabilization with relaxed controls[END_REF][START_REF] Sontag | A Lyapunov-like characterization of asymptotic controllability[END_REF]). The case of deterministic control systems was considered in [START_REF] Camilli | Control Lyapunov Functions and Zubov's Method[END_REF]. Here, through the formulation of a suitable optimal control problem, it is proved that the domain of attraction can be characterized by the solution of a nonlinear PDE (that we can consider as a generalized Zubov equation) which turns out to be a particular kind of Hamilton-Jacobi-Bellman (HJB) equation.

In this case the existence of smooth solutions is not guaranteed and therefore the equation is considered in the viscosity sense. The state constrained case, where we aim to steer the system to the target satisfying at the same time some constraints on the state, has been treated in [START_REF] Grüne | Zubov's equation for state-constrained perturbed nonlinear systems[END_REF].

The Zubov method has been extended to the stochastic setting in [START_REF] Camilli | A characterization of the domain of attraction for a locally exponentially stable stochastic system[END_REF] and [START_REF] Camilli | Characterizing attraction probabilities via the stochastic zubov method[END_REF] taking into account diffusion processes. The controlled case was later considered in [START_REF] Camilli | Characterizing controllability probabilities of stochastic control systems via Zubov's method[END_REF] and [START_REF] Camilli | Stabilization of controlled diffusions via Zubov's method[END_REF]. In this last paper, under some property of local exponential stabilizability in probability of the target set (that weakens the "almost sure" stabilizability assumption made in [START_REF] Camilli | Characterizing controllability probabilities of stochastic control systems via Zubov's method[END_REF] and [START_REF] Camilli | A characterization of the domain of attraction for a locally exponentially stable stochastic system[END_REF]), the set of points x ∈ R d that can be asymptotically steered with positive probability towards the target, is characterized by means of the unique viscosity solution with value zero on the target of the following equation

sup u∈U -f (x, u)(1 -ϑ(x)) -Dϑ(x)b(x, u) - 1 2
T r[σσ T (x, u)D 2 ϑ(x)] = 0.

In this paper we aim to add state-constraints in this framework, trying to exploit the ideas proposed in [START_REF] Grüne | Zubov's equation for state-constrained perturbed nonlinear systems[END_REF]. By the way the results in terms of PDE characterization of the domain of attraction will be very different. In [START_REF] Grüne | Zubov's equation for state-constrained perturbed nonlinear systems[END_REF] the state constrained controllability is characterized by the solution of an obstacle problem, whereas in our case we will deal with a mixed Dirichlet-Neumann boundary problem in an augmented state space (see Section 5). As in [START_REF] Grüne | Zubov's equation for state-constrained perturbed nonlinear systems[END_REF], for satisfying the state constrained requirement at any time t ≥ 0 we use a cost in a maximum form. In the stochastic case this requires the introduction of an additional state variable (that we will denote by y), leading to a generalized Zubov equation which involves oblique derivative boundary conditions. Because of the particular feature of Zubov-type problems comparison results cannot be proved by standard techniques (this is mainly due to the degeneracy of the function f ) and the comparison principle stated by Theorem 6.4 is proved providing sub-and super-optimality principles for PDEs of the following form:

   H(x, y, ϑ, D x ϑ, ∂ y ϑ, D 2 x ϑ) = 0 in O ϑ = 1 on ∂ 1 O -∂ y ϑ = 0 on ∂ 2 O.
It should be mentioned that -similar to [START_REF] Camilli | A characterization of the domain of attraction for a locally exponentially stable stochastic system[END_REF] -in this paper we characterize the domain of controllability with arbitrary positive probability without specifying the exact probability of controllability. We conjecture that it will be possible to extend the approach introduced in this paper to obtain such a specific characterization, similar to how [START_REF] Camilli | Characterizing attraction probabilities via the stochastic zubov method[END_REF] extends [START_REF] Camilli | A characterization of the domain of attraction for a locally exponentially stable stochastic system[END_REF]. However, due to the fact that the treatment of the Zubov problem with mixed boundary conditions covered in this paper already requires a very involved analysis, we decided to postpone this extension to a later publication, see also Remark 2.2.

The paper is organized as follows: in Section 2 we introduce the setting and the main assumptions. Section 3 is devoted to the study of some properties of the domain of attraction. In Section 4 is defined our level set function v as the value function associated with an optimal control problem with a maximum cost and the domain of attraction is characterized as a sub-level set of v. In Section 5 the domain of attraction is characterized by the viscosity solution of second order nonlinear PDE with mixed Dirichlet-Neumann boundary conditions. A comparison principle for bounded viscosity sub-and super-solution of this problem is provided in Section 6.

Setting

Let (Ω, F, F, P) be a probability space supporting a p-dimensional Brownian motion W (•), where F = {F t , t ≥ 0} denotes the P-augmentation of filtration generated by W .

We consider the following system of stochastic differential equations

(SDE's) in R d (d ≥ 1) dX(t) = b(X(t), u(t))dt + σ(X(t), u(t))dW (t) t > 0, x ∈ R d , X(0) = x (2.1)
where u ∈ U, and U denotes the set of F-progressively measurable processes taking values in a compact set U ⊂ R m . The following classical assumption will be considered for the coefficients b and σ.

(H1) b : R d × U → R d and σ : R d × U → R d×p are bounded and Lipschitz continuous in their first arguments in the following sense: there exist L ≥ 0 such that for every x, y ∈ R d and u ∈ U

|b(x, u) -b(y, u)| + |σ(x, u) -σ(y, u)| ≤ L|x -y|.
It is well-known (see for instance [START_REF] Touzi | Optimal Stochastic Control, Stochastic Target Problems, and Backward SDE[END_REF]Theorem 3.1]) that, under these assumptions, for any choice of the control u ∈ U and any initial position x ∈ R d there exists a unique strong solution of equation (2.1). We will denote this solution by X u x (•). By T ⊂ R d we denote a target set for the system, i.e., a nonempty and compact set towards which we want to asymptotically drive the trajectories. The open set C ⊆ R d represents the state constraints for system (2.1), i.e., the set where we want to maintain the state X x (t) with a positive probability for all t ≥ 0, cf. the definition of the set D T ,C below. For simplicity we assume that T ⊂ C. Note that this implies that for r small enough one has T r := {x ∈ R d : d(x, T ) ≤ r} ⊂ C, where d(•, T ) denotes the positive Euclidean distance to T . We impose the following assumptions on the target.

(H2) (i) T is viable for (2.1): for any x ∈ T there exists u ∈ U such that

X u x (t) ∈ T ∀t ≥ 0 a.s.;
(ii) T is locally exponentially stabilizable in probability for (2.1): there exist positive constants r, λ such that for every ε > 0, there exists a C ε > 0 such that for every x ∈ T r there us a control u ∈ U for which one has

P sup t≥0 d(X u x (t), T )e λt ≤ C ε d(x, T ) , X u x (t) ∈ C ∀t ≥ 0 ≥ 1 -ε. (2.2)
Remark 2.1. We point out that assumption (H2) implies that for any x ∈ T r

sup u∈U P lim t→+∞ d(X u x (t), T ) = 0 , X u x (t) ∈ C ∀t ≥ 0 = 1.
Indeed, for any ε > 0 and for suitable positive constants λ and C ε , the local exponentially stabilizability implies the existence of a control u ∈ U such that

(1 -ε) ≤ P sup t≥0 d(X u x (t), T )e λt ≤ C ε d(x, T ) , X u x (t) ∈ C ∀t ≥ 0 ≤ P lim t→+∞ d(X u x (t), T ) = 0 , X u x (t) ∈ C ∀t ≥ 0 ,
and the result follows by the arbitrariness of ε. We also note that without loss of generality we may assume that r > 0 in (H2)-(ii) is so small that T r ⊂ C.

Aim of this work is to characterize the set D T ,C of initial states x ∈ R d which can be driven by an admissible control to the target T with positive probability:

D T ,C := x ∈ R d : ∃u ∈ U s.t. P lim t→+∞ d(X u x (t), T ) = 0 , X u x (t) ∈ C ∀t ≥ 0 > 0 = x ∈ R d : sup u∈U P lim t→+∞ d(X u x (t), T ) = 0 , X u x (t) ∈ C ∀t ≥ 0 > 0 .
The set D T ,C is called the domain of asymptotic controllability (with positive probability) of T .

Remark 2.2. We conjecture that the approach in this paper can be extended to a characterization of the sets

x ∈ R d : sup u∈U P lim t→+∞ d(X u x (t), T ) = 0 , X u x (t) ∈ C ∀t ≥ 0 = p
for given probabilities p ∈ [0, 1], similar to how [START_REF] Camilli | Characterizing attraction probabilities via the stochastic zubov method[END_REF] extends [START_REF] Camilli | A characterization of the domain of attraction for a locally exponentially stable stochastic system[END_REF]. However, in order no to overload this paper we decided to postpone this extension to a future paper.

Some results on the set D T ,C

For any x ∈ R d and u ∈ U we introduce the random hitting time τ (x, u) as the first time instant when the trajectory starting at point x and driven by the control u hits the set T r , that is for any

ω ∈ Ω τ (x, u)(ω) := inf t ≥ 0 : X u x (t)(ω) ∈ T r . (3.1)
Remark 3.1. We remark that under our assumptions on the set of control processes U, the property of stability under bifurcation is satisfied, that is for any u 1 , u 2 ∈ U and any stopping time τ ≥ 0 one has

u 1 1 [0,τ ] + (u 1 1 A + u 2 1 A C )1 (τ,+∞) ∈ U.
In [START_REF] Bouchard | Weak dynamic programming principle for viscosity solutions[END_REF] it is shown how this property automatically follows from stability under concatenation and that stability under bifurcation is important in order to rigorously establish a Dynamic Programming Principle (DPP). In our context, this property also plays another important role in ensuring the controllability of the system. Indeed, for every y ∈ T r the exponential stabilizability property guarantees the existence of a control u y ∈ U such that (2.2) holds.

Intuitively, this means that once a controlled path hits the boundary of T r , we can control it to T by switching to the process u X u x (τ (x,u)) . However, this is only possible if the process

ū(t) = u1 {t≤τ (x,u)} + u1 {τ (x,u)=+∞} + u X u x (τ (x,u)) 1 {τ (x,u)<∞} 1 {t>τ (x,u)}
belongs to U and this is exactly what the stability under bifurcation property guarantees.

Our goal is now to establish a relation between the set D T ,C and the hitting time τ (x, u). To this end, we start with the following preliminary result. Therein and in the rest of the paper we use the notation X u τ := X u

x (τ (x, u)). Lemma 3.2. Let assumptions (H1)-(H2) be satisfied. Then for the hitting time τ (x, u) from (3.1) there exist positive constants λ, C such that

sup u∈U P τ (x, u) < +∞ , X u x (t) ∈ C ∀t ∈ [0, τ (x, u)] > 0 ⇒ sup u∈U P τ (x, u) < +∞ , X u x (t) ∈ C ∀t ≥ 0 , sup t≥0 d(X u(τ (x,u)+•) X u τ (t), T )e λt ≤ C > 0.
Proof. The statement is proved using the exponential stabilizability assumption. By assumption there exists ν ∈ U such that P[τ (x, ν) < +∞ and X ν x (t) ∈ C, ∀t ∈ [0, τ (x, ν)]] > 0. Moreover, thanks to assumption (H2)-(ii), constants λ, C > 0 can be found such that for any y ∈ T r , there is u y ∈ U with

P sup t≥0 d(X uy y (t), T )e λt ≤ C , X uy y (t) ∈ C ∀t ≥ 0 ≥ 1 2 .
Therefore, defining the control

ν(t) := ν1 {t≤τ (x,ν)} + ν1 {τ (x,ν)=+∞} + u X ν τ 1 {τ (x,ν)<∞} 1 {t>τ (x,ν)} ,
see Remark 3.1, and abbreviating τ = τ (x, ν) = τ (x, ν) one obtains

P τ (x, ν) < +∞ , X ν x (t) ∈ C ∀t ≥ 0 , sup t≥0 d(X ν(τ +•) X ν τ (t), T )e λt ≤ C = P τ (x, ν) < +∞ , X ν x (t) ∈ C ∀t ∈ [0, τ (x, ν)] , X ν(τ +•) X ν τ (t) ∈ C ∀t ≥ 0 , sup t≥0 d(X ν(τ +•) X ν τ (t), T )e λt ≤ C = +∞ 0 d(y,T )=r P X ν τ = y , τ (x, ν) = s , X ν x (t) ∈ C ∀t ∈ [0, τ (x, ν)] • P X uy y (t) ∈ C ∀t ≥ 0 , sup t≥0 d(X uy y (t), T )e λt ≤ C X ν s = y dyds ≥ 1 2 +∞ 0 d(y,T )=r P X ν τ = y , τ (x, ν) = s , X ν x (t) ∈ C ∀t ∈ [0, τ (x, ν)] dyds = 1 2 P τ (x, ν) < +∞ , X ν x (t) ∈ C ∀t ∈ [0, τ (x, ν)] > 0.
Thanks to the previous result, the following alternative characterization of D T ,C is obtained. Proposition 3.3. Let assumptions (H1)-(H2) be satisfied. Then

D T ,C = x ∈ R d : sup u∈U P τ (x, u) < +∞ , X u x (t) ∈ C ∀t ∈ [0, τ (x, u)] > 0 .
Proof. The "⊆" inclusion is immediate since for every u ∈ U one has

ω ∈ Ω : lim t→+∞ d(X u x (t), T ) = 0 , X u x (t) ∈ C ∀t ≥ 0 ⊆ ω ∈ Ω : τ (x, u) < +∞ , X u x (t) ∈ C ∀t ∈ [0, τ (x, u)] .
For the converse inclusion, consider x ∈ R d with

sup u∈U P τ (x, u) < +∞ , X u x (t) ∈ C ∀t ∈ [0, τ (x, u)] > 0.
Then, Lemma 3.2 yields Proof. Let us start observing that for any x ∈ D T ,C , there is a time T > 0 and a control ν ∈ U such that

sup u∈U P τ (x, u) < +∞ , sup t≥0 d(X u(τ (x,u)+•) X u τ (t), T )e λt ≤ C , X u x (t) ∈ C ∀t ≥ 0 > 0 which immediately implies sup u∈U P X u x (t) ∈ C ∀t ≥ 0 , lim t→∞ d(X u(τ (x,u)+•) X u τ (t), T ) = 0 >
P d(X ν x (T ), T ) ≤ r 2 , X ν x (t) ∈ C ∀t ≥ 0 =: η > 0.
Thanks to assumptions (H1), one has that for any ε > 0

lim |x-y|→0 P sup s∈[0,T ] X ν x (t) -X ν y (t) > ε = 0,
therefore we can find δ η > 0 such that for any x, y such that |x -y| ≤ δ η

P sup s∈[0,T ] X ν x (t) -X ν y (t) > ε ≤ η 2 .
It follows that for any fixed ε > 0 if y ∈ B(x, δ η ), the set Ω 1 ⊂ F defined by

Ω 1 := ω ∈ Ω : d(X ν x (T )(ω), T ) ≤ r 2 , X ν x (t)(ω) ∈ C ∀t ≥ 0 , sup s∈[0,T ] X ν x (t) -X ν y (t) (ω) ≤ ε satisfies P[Ω 1 ] = P d(X ū x (T ), T ) ≤ r 2 , X ū x (t) ∈ C ∀t ≥ 0 , sup s∈[0,T ] X ū x (t) -X ū y (t) ≤ ε = 1 -P d(X ν x (T ), T ) ≤ r 2 , X ν x (t) ∈ C ∀t ≥ 0 C ∪ sup s∈[0,T ] X ν x (t) -X ν y (t) > ε ≥ 1 -P d(X ν x (T ), T ) ≤ r 2 , X ν x (t) ∈ C ∀t ≥ 0 C -P sup s∈[0,T ] X ν x (t) -X ν y (t) > ε ≥ 1 -1 + η - η 2 = η 2 > 0. For any ω ∈ Ω 1 , since X ν x (t) ∈ C, ∀t ≥ 0 and C is an open set one has δ(x, ν)(ω) := inf t∈[0,T ] d(X ν x (t), C C )(ω) > 0. and sup t∈[0,T ] |X ν x (t) -X ν y (t)|(ω) < δ(x, ν)(ω) ⇒ X ν y (t)(ω) ∈ C, ∀t ∈ [0, T ].
Furthermore it is also possible to prove that there exist M > 0 and Ω1 ⊆ Ω

1 with P[ Ω1 ] > 0 such that ∀ω ∈ Ω1 δ(x, ν)(ω) > M. (3.2)
Indeed defined

B n := ω ∈ Ω 1 : δ(x, ν)(ω) ∈ [ 1 n + 1 , 1 n ) one has 0 < P[Ω 1 ] = P[ n≥0 B n ] = n≥0 P[B n ].
It means that there exists n ∈ N such that P[B n] > 0 and defined

Ω1 := ω ∈ Ω 1 : δ(x, ν)(ω) ≥ 1 n + 1 we have P[ Ω1 ] ≥ P[B n] > 0.
We have now all the elements necessary for concluding the proof. Taking ε ≤ min{M/2, r/2} we have that for any ω ∈ Ω1

X ν y (t)(ω) ∈ C, ∀t ∈ [0, T ] and d(X ν y (T ), T )(ω) ≤ d(X ν x (T ), T )(ω) + |X ν x (T ) -X ν y (T )|(ω) ≤ r 2 + ε ≤ r that is τ (y, ν)(ω) ≤ T .
In conclusion we have proved that there exists a control ν ∈ U such that for any y ∈ B(x, δ η )

P τ (y, ν) < +∞ , X ν y (t) ∈ C ∀t ∈ [0, τ (y, ν)] > 0, that means y ∈ D T ,C .

The "level set" function v

We are now going to define a function v that we will use in order to characterize the domain D T ,C as a sub-level set. Let us start introducing two functions g : R d × U → R and h : R d → [0, +∞] such that (H3) there exist constants L g , M g and g 0 > 0 such that for any x, x ∈ R d , u ∈ U and T , T r from (H2)

|g(x, u) -g(x , u)| ≤ L g |x -x |; g(x, u) ≤ M g ; g ≥ 0 and g(x, u) = 0 ⇔ x ∈ T ; and inf u∈U g(x, u) ≥ g 0 > 0, ∀x ∈ R d \ T r ; (4.1) (H4) h is a locally Lipschitz continuous function in C such that (i) h(x) = +∞ ⇔ x / ∈ C; h(x n ) → +∞, ∀x n → x / ∈ C; h(x) = 0, ∀x ∈ T ; (ii) there exists a constant L h ≥ 0 such that e -h(x) -e -h(x ) ≤ L h |x -x | (4.2) for any x, x ∈ R d .
Let the function v : R d → [0, 1] be defined by:

v(x) := inf u∈U 1 + E sup t≥0 -e -t 0 g(X u x (s),u(s))ds-h(X u x (t)) . (4.3)
We will now show that the function v can be used in order to characterize the domain of controllability D T ,C . In particular, we are going to prove that D T ,C consists of the set of points x where v is strictly lower than one.

Theorem 4.1. Let assumptions (H1)-(H4) be satisfied, then

x ∈ D T ,C ⇔ v(x) < 1. Proof. "⇐" We show v(x) = 1 for every x / ∈ D T ,C . If x / ∈ D T ,C then Propo- sition 3.3 implies sup u∈U P τ (x, u) < +∞ , X u x (t) ∈ C ∀t ∈ [0, τ (x, u)] = 0.
This means that for any control u ∈ U and almost every realization

ω ∈ Ω τ (x, u)(ω) = +∞ or ∃ t ∈ [0, τ (x, u)(ω)] : X u x ( t)(ω) / ∈ C. On the one hand, if τ (x, u)(ω) = +∞, ∃t such that X u x (t)(ω) ∈ T r . By assumption (H3) it follows that g(X u x (t), u(t))(ω) > g 0 , ∀t ≥ 0 with g 0 > 0, that is e -t 0 g(X u x (s),u(s))ds-h(X u x (t)) (ω) ≤ e -g0t-h(X u x (t)) (ω) ∀t ≥ 0.
On the other hand, if X u x ( t)(ω) / ∈ C for a certain t ∈ [0, τ (x, u)(ω)], one has h(X u x ( t))(ω) = +∞. In both cases, for every u ∈ U the argument of the expectation in (4.3) almost surely has the value 0, implying

1 + E sup t≥0 -e -t 0 g(X u x (s),u(s))ds-h(X u x (t)) = 1
for every u ∈ U from which v(x) = 1 follows by the definition of v. "⇒" We will prove that sup u∈U E[inf t≥0 e -t 0 g(X u x (s),u(s))ds-h(X u x (t)) ] > 0 for every x ∈ D T ,C . Let us start observing that, since there exists a control ν ∈ U such that

P τ (x, ν) < +∞ , X ν x (t) ∈ C ∀t ∈ [0, τ (x, ν)] > 0,
then there exist T, M > 0 large enough such that for

Ω u 1 := ω ∈ Ω : τ (x, u) < T , max t∈[0,τ (x,u)] h(X u x (t)) ≤ M one has δ := sup u∈U P[Ω u 1 ] > 0. Indeed, defining Ω ∞ := ω ∈ Ω : τ (x, ν) < +∞ , X ν x (t) ∈ C ∀t ∈ [0, τ (x, ν)] = ω ∈ Ω : τ (x, ν) < +∞ , h(X u x (t)) < ∞ ∀t ∈ [0, τ (x, ν)]
and

Ω n := ω ∈ Ω : τ (x, u) < n , max t∈[0,τ (x,u)] h(X u x (t)) ≤ n one has 0 < P[Ω ∞ ] = P[ n≥0 Ω n ] ≤ n≥0 P[Ω n ].
Hence, there exists n ∈ N such that P[Ω n] > 0 and thus sup u∈U P[Ω u 1 ] > 0 for T = M = n. Moreover, thanks to the assumption of local exponential stabilizability in probability, there exist constants λ, C > 0 such that for any y ∈ T r

sup u∈U P[A u y ] ≥ 1 - δ 2 for A u y := ω ∈ Ω : sup t≥0 d(X u y (t), T )e λt ≤ C , X u y (t) ∈ C ∀t ≥ 0 .
In what follows we will denote by τ = τ (x, u) the hitting time (3.1) if no ambiguity arises. For any u ∈ U one has (recall that g ≥ 0):

E inf t≥0 exp - t 0 g(X u x (ξ), u(ξ))dξ -h(X u x (t)) ≥ E exp - +∞ 0 g(X u x (ξ), u(ξ))dξ -max ξ∈[0,+∞) h(X u x (ξ)) ≥ Ω u 1 exp - +∞ 0 g(X u x (ξ), u(ξ))dξ -max ξ∈[0,+∞) h(X u x (ξ)) dP ≥ Ω u 1 exp - τ 0 g(X u x (ξ), u(ξ))dξ - +∞ τ g(X u x (ξ), u(ξ))dξ -max ξ∈[0,τ ] h(X u x (ξ)) ∨ max ξ∈[τ,+∞) h(X u x (ξ)) dP ≥ T 0 d(y,T )=r P X u τ = y , τ = s , τ < T , max ξ∈[0,τ ] h(X u x (ξ)) ≤ M e -g0T -M • E exp - +∞ τ g(X u x (ξ), u(ξ))dξ -max ξ∈[τ,+∞) h(X u x (ξ)) X u τ =y, τ =s, ω∈Ω u 1 dyds ≥ e -g0T -M T 0 d(y,T )=r P X u τ = y, τ = s, τ < T, max ξ∈[0,τ ] h(X u x (ξ)) ≤ M • E e -+∞ 0 g(X u(s+•) y (ξ),u(s+ξ))dξ-max ξ∈[0,+∞) h(X u(s+•) y (ξ))
X u s = y dyds.

Here we are using the notation a ∨ b := max(a, b). Therefore, applying the Lipschitz continuity of g and h, one has

e -g0T -M sup u∈U T 0 d(y,T )=r P X u τ = y, τ = s, τ < T, max ξ∈[0,τ ] h(X u x (ξ)) ≤ M • E e -+∞ 0 g(X u(s+•) y (ξ),u(s+ξ))dξ-max ξ∈[0,+∞) h(X u(s+•) y (ξ)) X u s = y dyds ≥ e -g0T -M sup u∈U T 0 d(y,T )=r P X u τ = y, τ = s, τ < T, max ξ∈[0,τ ] h(X u x (ξ)) ≤ M • E χ A u y e -+∞ 0 g(X u(s+•) y (ξ),u(s+ξ))dξ-max ξ∈[0,+∞) h(X u(s+•) y (ξ)) X u s = y dyds ≥ e -g0T -M sup u∈U T 0 d(y,T )=r P X u τ = y, τ = s, τ < T, max ξ∈[0,τ ] h(X u x (ξ)) ≤ M • E χ A u y e -Lg +∞ 0 d(X u(s+•) y (ξ),T )dξ-max ξ∈[0,+∞) Ld(X u(s+•) y (ξ),T ) X u s = y dyds ≥ e -g0T -M sup u∈U T 0 d(y,T )=r P X u τ = y, τ = s, τ < T, max ξ∈[0,τ ] h(X u x (ξ)) ≤ M • E χ A u y e -Lg +∞ 0 Ce -λξ dξ-max ξ∈[0,+∞) LCe -λξ X u s = y dyds ≥ e -g0T e -M e -CLg λ e -LC sup u∈U T 0 y∈Tr E χ A u y X u s = y • P X u τ = y, τ = s, τ (x, u) < T, max ξ∈[0,τ ] h(X u x (ξ)) ≤ M dyds = e -g0T e -M e -CLg λ e -LC sup u∈U P Ω u 1 ∩ A u X u τ > 0
where for the last inequality we used the fact that (thanks again to the arguments in Remark 3.1) one has

sup u∈U P[Ω u 1 ∩ A u X u τ ] > 0.
Remark 4.2. The definition of the function v is based on a similar construction used in [START_REF] Grüne | Zubov's equation for state-constrained perturbed nonlinear systems[END_REF] for a deterministic controlled setting. That paper shows that in the deterministic setting the domain of controllability can alternatively be characterized by a second function, whose definition, translated to the stochastic framework, would be

V (x) = inf u∈U E sup t≥0 t 0 g(X u x (s), u(s))ds + h(X u x (t)) . (4.4)
A little computation using Jensen's inequality shows the relation

x ∈ R d : V (x) < +∞ ⊆ x ∈ R d : v(x) < 1 .
Since, however, it is not clear whether the opposite inclusion holds in the stochastic setting, we will exclusively work with v in the remainder of this paper.

The PDE characterization of D T ,C

After having shown that D T ,C can be expressed as a sub-level set of v, we now proceed to the second main result of this paper, the PDE characterization of v and thus of D T ,C . In order to derive the PDE which is solves by v, we need to establish a dynamic programming principle (DPP) for v. Unfortunately, however, the presence of the supremum inside the expectation in the definition of v prohibits the direct use of the standard dynamic programming techniques. In particular, it is possible to verify that v does not satisfy a fundamental concatenation property that is usually the main tool necessary for the derivation of the associated partial differential equation. To avoid this difficulty, we follow the classical approach to reformulate the problem by adding a new variable y ∈ R that, roughly speaking, keeps track of the running maximum (we refer to [START_REF] Barles | Optimal control on the l ∞ norm of a diffusion process[END_REF], [START_REF] Bokanowski | Dynamic Programming and Error Estimates for Stochastic Control Problems with Maximum Cost[END_REF] for general results regarding this kind of problems). For this reason we introduce the function ϑ :

R d × [-1, 0] → [0, 1]
defined as follows:

ϑ(x, y) := inf u∈U 1 + E sup t≥0 -e -t 0 g(X u x (s),u(s))ds-h(X u x (t)) ∨ y . (5.1)
We point out that ϑ(x, -1)

= v(x) ∀x ∈ R d ,
therefore ϑ can still be used for characterizing the set D T ,C and one has

D T ,C = x ∈ R d : ϑ(x, -1) < 1 . (5.2)
Furthermore, it follows from Theorem 4.1 that

ϑ(x, y) = 1 + y on T × [-1, 0] 1 on (D T ,C ) C × [-1, 0]. (5.3)
In what follows we will also denote

G(t, x, u) := t 0 g(X u
x (s), u(s))ds, so that using this notation the function ϑ reads

ϑ(x, y) = inf u∈U 1 + E sup t≥0 -e -G(t,x,u)-h(X u x (t)) ∨ y .
For the new state variable y we can define the following "maximum dynamics":

Y u x,y (•) := e G(•,x,u) y ∨ sup t∈[0,• ]
(-e -G(t,x,u)-h(X u x (t)) ) (5.4) We remark that Y u x,y (t) ∈ [-1, 0] for any u ∈ U, t ≥ 0 and (x,

y) ∈ R d ×[-1, 0].
We are now able to prove a DPP for the function ϑ. Since no information is available at the moment on the regularity of ϑ, we state the weak version of the DPP presented in [START_REF] Bouchard | Weak dynamic programming principle for viscosity solutions[END_REF] involving the semi-continuous envelopes of ϑ. Let us denote by ϑ * and ϑ * respectively the upper and lower semi-continuous envelope of ϑ. One has: Lemma 5.1. Let assumptions (H1),(H3) and (H4) be satisfied. Then for any finite stopping time θ ≥ 0 measurable with respect to the filtration, one has the dynamic programming principle (DPP)

inf u∈U E e -G(θ,x,u) ϑ * (X u x (θ), Y u x,y (θ))) + θ 0 g(X u x (s), u(s))e -G(s,x,u) ds ≤ ϑ(x, y) ≤ inf u∈U E e -G(θ,x,u) ϑ * (X u x (θ), Y u x,y (θ))) + θ 0 g(X u x (s), u(s))e -G(s,x,u) ds .
For a rigorous proof of this result we refer to [START_REF] Bouchard | Weak dynamic programming principle for viscosity solutions[END_REF]. Here, we only show the main steps that lead to our formulation of the DPP in the non-controlled and continuous case.

Sketch of the proof of Lemma 5.1. For any finite stopping time θ ≥ 0 one has

ϑ(x, y) -1 = E sup t≥0 -e -G(t,x)-h(Xx(t)) ∨ y = E sup t≥θ -e -G(t,x)-h(Xx(t)) ∨ sup t∈[0,θ] -e -G(t,x)-h(Xx(t)) ∨ y = E e -G(θ,x) sup t≥θ -e -t θ g(Xx(s))ds-h(Xx(t)) ∨ sup t∈[0,θ]
-e -G(t,x)-h(Xx(t)) ∨ y

= E e -G(θ,x) sup t≥θ -e -t θ g(Xx(s))ds-h(Xx(t)) ∨ Y x,y (θ)
where the property of the maximum (a

• b) ∨ c = a • (b ∨ c a )
, ∀a, b, c ∈ R, a > 0, is used. Applying now the tower property of the expectation one obtains ϑ(x, y)

= 1 + E E e -G(θ,x) sup t≥0 -e -G(t,Xx(θ))-h(X Xx (θ) (t)) ∨ Y x,y (θ) F θ = 1 + E e -G(θ,x) E sup t≥0 -e -G(t,Xx(θ))-h(X Xx (θ) (t)) ∨ Y x,y (θ) F θ = 1 + E e -G(θ,x) ϑ(X x (θ), Y x,y (θ)) -1
and the result just follows observing that 1-e -G(θ,x) = θ 0 g(X x (s))e -G(s,x) ds.

Using the DPP from Lemma 5.1, we can now show that ϑ is actually continuous. For what concerns the continuity with respect to x, in (D T ,C ) C and T there is nothing to prove thanks to (5.3). We start by proving the continuity at the boundary of T . Let x 0 ∈ ∂T . We aim to prove that for any ε there exists δ > 0 such that for x ∈ B(x 0 , δ) one has ϑ(x, y) -ϑ(x 0 , y) = ϑ(x, y) -(1 + y) ≤ ε.

(5.5)

For δ > 0 small enough we can assume that B(x 0 , δ) ⊂ T r . Hence, for this choice of δ there exists λ > 0 such that for any ε > 0 there exists a constant C ε and a control ν such that one has

P[A C x ] ≤ ε 2 for A x := ω ∈ Ω : sup t≥0 d(X ν x (t), T )e λt ≤ C ε d(x, T ) and X ν x (t) ∈ C, ∀t ≥ 0 .
From the definition of ϑ and the monotonicity of the exponential one has

ϑ(x, y) -(1 + y) = ϑ(x, y) -1 + (-1) ∨ y ≤ E sup t≥0 (-e -G(t,x,ν)-h(X ν x (t)) ) ∨ y -(-1) ∨ y ≤ E 1 + sup t≥0 (-e -G(t,x,ν)-h(X ν x (t)) ) = E 1 -e -sup t≥0 (G(t,x,ν)+h(X ν x (t))) = Ax 1 -e -sup t≥0 (G(t,x,ν)+h(X ν x (t))) dP + A C x 1 -e -sup t≥0 (G(t,x,ν)+h(X ν x (t))) dP ≤ Ax 1 -e -sup t≥0 (G(t,x,ν)+h(X ν x (t))) dP + ε 2
for every T > 0. Therefore in order to conclude (5.5) it will be sufficient to estimate the integral taking into account the events in A x .

For sufficiently small δ > 0 we obtain C ε d(x, T ) < r and thus X ν x (t, ω) ∈ T r for all ω ∈ A x , all t ≥ 0 and all x ∈ B(x 0 , δ). Thus, since T r is a compact subset of C, the function h is Lipschitz with constant L along all these trajectories. Since g is Lipschitz, too, and since g(ξ, u) = h(ξ) = 0 ∀ξ ∈ T , u ∈ U , for any t ≥ 0 one has

g(X ν x (t), ν(t)) ≤ L g d(X ν x (t), T ) and h(X ν x (t)) ≤ Ld(X ν x (t), T ).
Using these inequalities and the definition of A x , we obtain Ax 1 -e -sup t≥0 (G(t,x,ν)+h(X ν x (t))) dP

≤ Ax 1 -e -+∞ 0 g(X ν x (t),ν(t))dt-sup t≥0 h(X ν x (t))) dP ≤ Ax 1 -e -+∞ 0 Lgd(X ν x (t),T )dt-sup t≥0 Ld(X ν x (t),T ) dP ≤ Ax 1 -e -+∞ 0 LgCεd(x,T )e -λt dt-sup t≥0 LCεd(x,T )e -λt dP ≤ Ax 1 -e -(Lg/λ+L)Cεδ dP ≤ 1 -e -(Lg/λ+L)Cεδ .
Now, choosing δ > 0 such that

L g λ + L C ε δ ≤ -ln(1 -ε/2)
we have 1 -e -(Lg/λ+L)Cεδ ≤ ε/2 and thus

ϑ(x, y) -(1 + y) ≤ Ax 1 -e -sup t≥0 (G(t,x,ν)+h(X ν x (t))) dP + ε 2 ≤ ε,
for any x with d(x, T ) < δ, which proves (5.5) and thus continuity at ∂T . The proof of the theorem is concluded proving the continuity in R d \ T . We point out that we already know that ϑ(x, y) = 1 + y in (D T ,C ) C , however the proof that follows is independent of whether x ∈ D T ,C or not. Let x ∈ D T ,C \T and ξ ∈ B(x, δ). From the DPP (Lemma 5.1), for any y ∈ [-1, 0] and any finite stopping time θ, there exists a control ν = ν ε ∈ U such that

ϑ(ξ, y) -ϑ(x, y) ≤E e -G(θ,ξ,ν) ϑ * (X ν ξ (θ), Y ν ξ,y (θ)) -e -G(θ,ξ,ν) -e -G(θ,x,ν) ϑ * (X ν x (θ), Y ν x,y (θ)) + e -G(θ,x,ν) + ε 4 .
In order to prove the result we will use the continuity at T we proved above. We can in fact state that for any ε > 0 there exists η ε > 0 such that

ϑ * (z, y) ≤ 1 + y + ε 4 if d(z, T ) ≤ η ε .
Let T ≥ -ln(ε/4) g * and 0 < R ≤ ε/4 L h +LgT where g * := inf {x:d(x,T )≥ηε/2} g(x, ν) > 0 and L h , L g are, respectively, the Lipschitz constant of e -h(x) and g. Denoting

E := ω ∈ Ω : sup t∈[0,T ] |X ν x (t) -X ν ξ (t)| ≥ R ,
under assumption (H1) we can choose δ sufficiently small such that P

[E] ≤ ε 4 . Then (recalling that ϑ * , ϑ * ∈ [0, 1]), we have E e -G(θ,ξ,ν) ϑ * (X ν ξ (θ), Y ν ξ,y (θ)) -e -G(θ,ξ,ν) -e -G(θ,x,ν) ϑ * (X ν x (θ), Y ν x,y (θ)) + e -G(θ,x,ν) dP ≤ E e -G(θ,x,ν) dP ≤ P[E] ≤ ε 4 .
(5.6)

Let us now define the stopping time

τ := inf t ≥ 0 : d(X ν x (t), T ) ≤ η ε with the convention that τ (ω) = T if d(X ν x (t)(ω), T ) > η ε , ∀t ∈ [0,
T ] (this ensures the finiteness of the stopping time needed for the DPP). Thanks to (5.6) (which holds for an arbitrary stopping time), we can write

E e -G(τ,ξ,ν) ϑ * (X ν ξ (τ ), Y ν ξ,y (τ )) -e -G(τ,ξ,ν) -e -G(τ,x,ν) ϑ * (X ν x (τ ), Y ν x,y (τ )) + e -G(τ,x,ν) ≤ ε 4 + E C . . . = ε 4 + E C ∩{τ <T } . . . + E C ∩{τ =T }
. . . and we will provide estimates separately for the last two integrals.

In E C ∩ {τ = T }, using again ϑ * , ϑ * ∈ [0, 1], we get

E C ∩{τ =T } e -G(T,ξ,ν) ϑ * (X ν ξ (T ), Y ν ξ,y (T )) -e -G(T,ξ,ν) -e -G(T,x,ν) ϑ * (X ν x (T ), Y ν x,y (T )) + e -G(T,x,ν) dP ≤ E C ∩{τ =T } e -G(T,x,ν) dP ≤ e -g * T ≤ ε 4
thanks to the choice of T . In E C ∩ {τ < T } we have

E C ∩{τ <T } e -G(τ,ξ,ν) ϑ * (X ν ξ (τ ), Y ν ξ,y (τ )) -e -G(τ,ξ,ν) -e -G(τ,x,ν) ϑ * (X ν x (τ ), Y ν x,y (τ )) + e -G(τ,x,ν) dP ≤ E C ∩{τ <T } e -G(τ,ξ,ν) 1 + Y ν ξ,y (τ ) + ε 4 -e -G(τ,ξ,ν) -e -G(τ,x,ν) 1 + Y ν x,y (τ ) + e -G(τ,x,ν) dP = E C ∩{τ <T } e -G(τ,ξ,ν) Y ν ξ,y (τ ) -e -G(τ,x,ν) Y ν x,y (τ ) dP + ε 4
where we used the fact that ϑ * (x, y) ≥ 1 + y. Recalling the definition of the variable Y (•) given by (5.4) and because of assumptions (H3)-(H4) we have

E C ∩{τ <T } e -G(τ,ξ,ν) Y ν ξ,y (τ ) -e -G(τ,x,ν) Y ν x,y (τ ) dP = E C ∩{τ <T } sup t∈[0,τ ] (-e -G(t,ξ,ν)-h(X ν ξ (t)) ) ∨ y -sup t∈[0,τ ]
(-e -G(t,x,ν)-h(X ν x (t)) ) ∨ y dP

≤ E C ∩{τ <T } sup t∈[0,τ ] e -G(t,ξ,ν)-h(X ν ξ (t)) -e -G(t,x,ν)-h(X ν x (t)) dP ≤ E C ∩{τ <T } sup t∈[0,τ ] e -G(t,ξ,ν) e -h(X ν ξ (t)) -e -h(X ν x (t)) + sup t∈[0,τ ] e -h(X ν ξ (t)) e -G(t,ξ,ν) -e -G(t,x,ν) dP ≤ E C ∩{τ <T } (L h + L g T ) sup t∈[0,T ] |X ν ξ (t) -X ν x (t)|dP ≤ ε 4
thanks to the choice of R. T r[σσ T (x, u)Q] -q g(x, u)y .

(5.7)

The following theorem holds.

Theorem 5.4. Let assumptions (H1)-(H4) be satisfied. Then ϑ is a continuous viscosity solution of

   H(x, y, ϑ, D x ϑ, ∂ y ϑ, D 2 x ϑ) = 0 in O ϑ = 1 on ∂ 1 O -∂ y ϑ = 0 on ∂ 2 O.
(5.8)

We refer to [START_REF] Crandall | User's guide to viscosity solutions of second order partial differential equations[END_REF]Definition 7.4] for the definition of viscosity solution for equation (5.8). It is in fact well-known that boundary conditions may have to be considered in a weak sense in order to obtain existence of a solution. It means that for the viscosity sub-solution (resp. super-solution) of equation ( 5 Without loss of generality we can always assume that (x, ȳ) is a strict local maximum point (let us say in a ball of radius r) and that ϑ(x, ȳ) = ϕ(x, ȳ). Using continuity arguments, for any u ∈ U and for almost every ω ∈ Ω we can find θ := θ u small enough such that

(X u x (θ) , Y u x,ȳ (θ))(ω) ∈ B((x, ȳ), r). Let us in particular consider a constant control u(t) ≡ u ∈ U . Thanks to Lemma 5.1 one has ϕ(x, ȳ) ≤ E e -G(θ,x,u) ϕ(X u x (θ), Y u x,ȳ (θ)) + θ 0 g(X u
x (s), u)e -G(s,x,u) ds . (5.11) We now take into account two different cases, depending on whether or not we are in x) . In this case (since we are inside O) for almost every ω ∈ Ω, taking the stopping time θ(ω) small enough, we can say

∂ 2 O. Case 1: ȳ > -e -h(
e G(θ,x,u) (ȳ ∨ sup t∈[0,θ]
(-e -G(t,x,u)-h(X u x (t)) ))(ω) = (e G(θ,x,u) ȳ)(ω).

Therefore from (5.11), for this choice of the stopping time θ, for any u ∈ U we obtain

E ϕ(x, ȳ) -e -G(θ,x,u) ϕ(X u x (θ), e G(θ,x,u) ȳ) + θ 0 g(X u
x (s), u)e -G(s,x,u) ds ≤ 0 (5.12)

which yields

E θ 0
-d e -G(s,x,u) ϕ(X u x (s), e G(s,x,u) ȳ) + g(X u x (s), u)e -G(s,x,u) ds ≤ 0.

Applying the Ito's formula we have

d e -G(s,x,u) ϕ(X u x (s), e G(s,x,u) ȳ) = e -G(s,x,u) -g(X u x (s), u)ϕ(X u x (s), e G(s,x,u) ȳ) + D x ϕ(X u x (s), e G(s,x,u) ȳ) • dX u x (s) + ∂ y ϕ(X u x (s), e G(s,x,u) ȳ) g(X u x (s), u)ȳ + 1 2 T r[σσ T (X u x (s), u)D 2 x ϕ(X u x (s), e G(s,x,u) ȳ)] .
Then, replacing the stopping time θ by θ h := θ ∧ h we get

E 1 h θ h 0 e -G(s,x,u) -g(X u x (s), u)ϕ(X u x (s), e G(s,x,u) ȳ) + D x ϕ(X u x (s), e G(s,x,u) ȳ) • b(X u x (s), u) + ∂ y ϕ(X u x (s), e G(s,x,u) ȳ) g(X u x (s), u)ȳ + 1 2 T r[σσ T (X u x (s), u)D 2
x ϕ(X u x (s), e G(s,x,u) ȳ)] ds ≤ 0.

Letting h → 0 and observing that for ω fixed θ h =h holds for h > 0 sufficiently small, we can apply the mean value theorem inside the integral for any fixed ω. In this way, applying also the dominated convergence theorem, we finally obtain at (x, ȳ)

g(x, u)(ϕ-1)-D x ϕ•b(x, u)- 1 2 T r[σσ T (x, u)D 2
x ϕ]-∂ y ϕg(x, u)ȳ ≤ 0 ∀u ∈ U and then thanks to the arbitrariness of u

H(x, ȳ, ϕ(x, ȳ), D x ϕ(x, ȳ), ∂ y ϕ(x, ȳ), D 2
x ϕ(x, ȳ)) ≤ 0, i.e., (5.9).

Case 2: ȳ = -e -h(x) . If -∂ y ϕ(x, ȳ) ≤ 0, then (5.10) holds. Hence, let us assume that -∂ y ϕ(x, ȳ) > 0. This means that in a neighborhood of (x, ȳ)

ϕ(x, y 1 ) ≥ ϕ(x, y 2 ) if y 1 ≤ y 2 .
For almost every ω ∈ Ω and for θ(ω) small enough, the point

X u x (θ) , e G(θ,x,u) (ȳ ∨ sup t∈[0,θ] (-e -G(t,x,u)-h(X u x (t)) ))
is in this neighborhood. Because of

Y u x,ȳ (θ) = e G(θ,x,u) ȳ ∨ sup t∈[0,θ]
(-e -G(t,x,u)-h(X u x (t)) ) ≥ e G(θ,x,u) ȳ we obtain for any u ∈ U ϕ(x, ȳ)

≤ E e -G(θ,x,u) ϕ(X u x (θ), Y u x,ȳ (θ)) + θ 0 g(X u x (s), u)e -G(s,x,u) ds ≤ E e -G(θ,x,u) ϕ(X u x (θ), e G(θ,x,u) ȳ) + θ 0 g(X u
x (s), u)e -G(s,x,u) ds from which we have again (5.12) and thus

H(x, ȳ, ϕ(x, ȳ), D x ϕ(x, ȳ), ∂ y ϕ(x, ȳ), D 2
x ϕ(x, ȳ)) ≤ 0, implying (5.10).

For proving the super-solution property let us assume that ϑ -ϕ attains a strict maximum in (x, ȳ). Starting again from the DPP and taking the stopping time θ small enough one has

ϕ(x, ȳ) ≥ sup u∈U E e -G(θ,x,u) ϕ(X u x (θ), Y u x,ȳ (θ)) + θ 0 g(X u x (s), u)e -G(s,x,u) ds .
If either ȳ > -e -h(x) or ȳ = -e -h(x) and -∂ y ϕ(x, ȳ) < 0 we get, for θ small enough ϕ(x, ȳ) ≥ sup u∈U E e -G(θ,x,u) ϕ(X u x (θ), e G(θ,x,u) ȳ) + θ 0 g(X u x (s), u)e -G(s,x,u) ds and the desired property can be obtained by standard passages, with the usual modifications required for proving the super-solution inequality.

Comparison principle

After having shown that ϑ solves equation (5.8), we now consider the uniqueness question. As usual in viscosity solution theory, we establish uniqueness in form of a comparison principle between USC sub-solutions and LSC supersolutions. In proving such a comparison principle, some additional difficulties arise because of the degeneracy of g in T . In order to overcome this difficulty we will show that for any super-solution (resp. sub-solution) a superoptimality (resp. sub-optimality) principle holds and then we will use this result for proving the comparison principle by a direct calculation. The proof of the optimality principles given here adapts the techniques in presented in [START_REF] Bardi | Optimal Control and Viscosity Solutions of Hamilton-Jacobi-Bellman equations[END_REF]Theorem 2.32] to the particular case of the second order boundary value problem (5.8).

Let us start with a preliminary result. We can in fact prove that, thanks to assumption (H4)-(ii), together with (H1) and (H3), for any control u ∈ U and T ≥ 0, aside from the standard estimation for the process X u x (•)

E sup t∈[0,T ] X u x (t) -x 2 ≤ C T (1 + |x| 2 )T (6.1)
the following inequality also holds for Y x,y (•):

If (x, y) ∈ O, then E sup t∈[0,T ] Y u x,y (t) -y 2 ≤ C T |1 -e MgT | 2 + e 2MgT (1 + |x| 2 )T (6.2)
where C T = Ce CT and C is a constant depending only on the Lipschitz constants of b and σ, and M g denotes the bound of the function g. We prove the following result for a later use.

Lemma 6.1. For any ε > 0, T ≥ 0 and (x, y) ∈ O one has

sup u∈U P sup t∈[0,T ] |(X u x (t), Y u x,y (t)) -(x, y)| > ε ≤ C T,x ε 2 T + |1 -e MgT | 2 for C T,x := C T (1 + e 2MgT )(1 + |x| 2 ).
Proof. The result is a consequence of Doob's inequality applied to the submartingale M t := sup s∈[0,t] (|X(s) -x| + |Y (s) -y|) and of inequalities (6.1) and (6.2). Indeed for any u ∈ U one has:

P sup t∈[0,T ] |(X u x (t), Y u x,y (t)) -(x, y)| > ε ≤ P sup t∈[0,T ] (|X u x (t) -x| + |Y u x,y (t) -y|) > ε ≤ 1 ε 2 E sup t∈[0,T ] |X u x (t) -x| + |Y u x,y (t)) -y| 2 ≤ 2 ε 2 E sup t∈[0,T ] |X u x (t) -x| 2 + sup t∈[0,T ] |Y u x,y (t)) -y| 2 ≤ C T ε 2 (1 + e 2MgT )T (1 + |x| 2 ) + |1 -e MgT | 2
where C T is the constant appearing in (6.1) and (6.2). This shows the claim.

Let us define the domain

O δ := (x, y) ∈ O : d(x, T ) > δ, y < -δ
and the associated exit time for the process (X u x (t), Y u x,y (t))

τ u δ := inf t ≥ 0 : (X u x (t), Y u x,y (t)) / ∈ O δ .
Theorem 6.2. Let V ∈ U SC(O) be a bounded viscosity sub-solution to equation (5.8) such that

V (x, y) = 1 on ∂ 1 O. Then V satisfies V (x, y) ≤ inf u∈U E e -G(τ u δ (t),x,u) V (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) (6.3)
+ τ u δ (t) 0 g(X u
x (s), u(s))e -G(s,x,u) ds for any (x, y) ∈ O δ , t ≥ 0, where τ u δ (t) := min(t, τ u δ ) and τ u δ denotes the exit time of the process

(X u x (•), Y u x,y (•)) from the domain O δ .
Proof. This proof is based on an adaptation of classical arguments (see Theorem 2.32 in [START_REF] Bardi | Optimal Control and Viscosity Solutions of Hamilton-Jacobi-Bellman equations[END_REF] for instance) to our context. Let us start observing that since V is upper semi-continuous we can write for any (x, y) ∈ O

V (x, y) = inf k≥0 V k (x, y) (6.4)
where {V k } k≥0 is a decreasing sequence of bounded continuous functions. Let us consider for k ≥ 0 the following evolutionary obstacle problem

           max ∂ t V + H(x, y, V, D x V, ∂ y V, D 2 x V ) , V -V k = 0 (0, t] × O V (t, x, y) = 1 (0, t] × ∂ 1 O -∂ y V (t, x, y) = 0 (0, t] × ∂ 2 O V (0, x, y) = V k (x, y)
O. (6.5) It is immediate to verify that V is a bounded viscosity sub-solution of this problem for any k ≥ 0 and t ≥ 0. For t ≥ 0, we now define the following function

L k (t, x, y) :=            inf u∈U E e -G(τ u δ (t),x,u) V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) O δ + τ u δ (t) 0 g(X u x (s), u(s))e -G(s,x,u) ds V k (x, y) O \ O δ .
Let us start proving that L k is continuous in t = 0. Of course, we only need to prove the result in O δ . Noting that L k (0, x, y) = V k (x, y), for any u ∈ U,

(x, y) ∈ O δ one has E e -G(τ u δ (t),x,u) V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) + τ u δ (t) 0 g(X u x (s), u(s))e -G(s,x,u) ds -L k (0, x, y) ≤ E |e -G(τ u δ (t),x,u) V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) -V k (x, y)| + M g t ≤ E e -G(τ u δ (t),x,u) |V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) -V k (x, y)| + E + |V k (x, y)| 1 -e -G(τ u δ (t),x,u) + M g t ≤ E e -G(τ u δ (t),x,u) |V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) -V k (x, y)| + C -Ce -Mgt + M g t.
Thanks to the continuity of V k , there exists δ ε such that

|V k (x, y) -V k (ξ, η)| ≤ ε 2
for any (ξ, η) ∈ B((x, y), δ ε ). Therefore if we define the set

E := ω ∈ Ω : | X u x (τ u δ (t)), Y u x,y (τ u δ (t)) -(x, y)| > δ ε
we obtain

E C e -G(τ u δ (t),x,u) |V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) -V k (x, y)|dP ≤ ε 2 .
Moreover, thanks to the boundedness of

V k we get E e -G(τ u δ (t),x,u) |V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) -V k (x, y)|dP ≤ 2M P[E].
Using the result in Lemma 6.1 we can state that there exists a constant C = C x such that

P[E] ≤ Ce Ct δ 2 ε t + (1 -e Mgt ) 2 .
Therefore, there exists t ε > 0 such that for t < t ε

P[E] ≤ ε 2 .
In conclusion we have proved that for any ε > 0, if t is small enough

|L k (t, x, y) -L k (0, x, y)| ≤ ε which proves continuity of L k in t = 0.
Denoting by L k * the lower semi-continuous envelope of L k , it is possible to prove that the following DPP holds (see [START_REF] Barles | The Dirichlet problem for semilinear second-order degenerate elliptic equations and applications to stochastic exit time control problems[END_REF]Theorem 4.3]):

inf u∈U E τ u δ (θ) 0 g(X u x (s), u(s))e -G(s,x,u) ds + 1 {θ≥τ u δ } V k (X u x (τ u δ ), Y u x,y (τ u δ ))e G(τ u δ ,x,u) + 1 {θ<τ u δ } L k * (t -θ, X u x (θ), Y u x,y (θ))e G(θ,x,u) ≤ L k (t, x, y).
for any stopping time 0 ≤ θ ≤ t.

Thanks to this result, applying the standard dynamic programming arguments, it is possible to prove (see the proof given in [START_REF] Barles | The Dirichlet problem for semilinear second-order degenerate elliptic equations and applications to stochastic exit time control problems[END_REF]) that L k * is a viscosity super-solution of (6.5). We point out that the necessity of the obstacle term V -V k is a consequence of the possible discontinuity of L k * on the boundary of O δ . The initial condition and the boundary condition on ∂ 1 O are on the contrary satisfied in the strong sense because of the continuity of L k * in t = 0 and y = 0. For equation (6.5) a comparison principle for semi-continuous viscosity sub-and super-solution holds, see Theorem A.1 in the appendix. It can be obtained by the arguments in [START_REF] Dupuis | On oblique derivative problems for fully nonlinear second-order elliptic partial differential equations on nonsmooth domains[END_REF] adapted to the parabolic case. The necessity of using such a result instead of a more classical comparison principle for fully nonlinear second order elliptic equations with oblique derivative boundary conditions, as that one presented for instance in [START_REF] Crandall | User's guide to viscosity solutions of second order partial differential equations[END_REF] (see also the references therein), comes from the lack of regularity of the domain O. Since the key arguments of the proof in [START_REF] Dupuis | On oblique derivative problems for fully nonlinear second-order elliptic partial differential equations on nonsmooth domains[END_REF] easily extend to our context, we only give a sketch of the proof in the appendix.

Applying Theorem A.1, we obtain for any (t, x, y)

∈ [0, +∞) × O δ V (x, y) ≤ L k * (t, x, y),
which leads to

V (x, y) ≤ E e -G(τ u δ (t),x,u) V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) + τ u δ (t) 0 g(X u
x (s), u(s))e -G(s,x,u) ds ∀u ∈ U.

It remains to pass to the limit for k → +∞. Recalling expression (6.4) for V we have

V (x, y) = lim sup k→+∞ V k (x, y)
and then for any u ∈ U V (x, y)

≤ lim sup k→+∞ E e -G(τ u δ (t),x,u) V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) + τ u δ (t) 0 g(X u x (s), u(s))e -G(s,x,u) ds ≤ E lim sup k→+∞ e -G(τ u δ (t),x,u) V k (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) + τ u δ (t) 0 g(X u x (s), u(s))e -G(s,x,u) ds = E e -G(τ u δ (t),x,u) V (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) + τ u δ (t) 0 g(X u x (s), u(s))e -G(s,x,u) ds
where for the second inequality we used Fatou's lemma, thanks to the boundedness of the functions V k . Hence, the desired result is obtained thanks to the arbitrariness of u ∈ U.

The same techniques can be applied in order to prove the super-optimality principle for LSC super-solutions. In this case, however, compactness assumption on the dynamics (considering weak solutions of the SDE) are necessary in order to guarantee the last passage to the limit (see [START_REF] Cesaroni | Lyapunov stabilizability of controlled diffusions via a superoptimality principle for viscosity solutions[END_REF]). The version of the super-optimality principle we state below avoids this kind of assumption by taking into account only continuous super-solutions. Theorem 6.3. Let V ∈ C(O) be a bounded viscosity super-solution to equation (5.8). Then for any (x, y) ∈ O δ and t ≥ 0

V (x, y) ≥ inf u∈U E e -G(τ u δ (t),x,u) V (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) (6.6) + τ u δ (t) 0 g(X u
x (s), u(s))e -G(s,x,u) ds .

Proof. Let us consider the following evolutionary obstacle problem:

           min ∂ t V + H(x, y, V, D x V, ∂ y V, D 2 x V ) , V -V = 0 (0, t] × O V (t, x, y) = 1 (0, t] × ∂ 1 O -∂ y V (t, x, y) = 0 (0, t] × ∂ 2 O V (0, x, y) = V (x, y) O. (6.7)
We can easily observe that V is a viscosity super-solution to (6.7). In what follows, we build a viscosity sub-solution for problem (6.7). Let W : O → R be defined by

W (t, x, y) :=            inf u∈U E e -G(τ u δ (t),x,u) V (X x (τ δ (t)), Y x,y (τ δ (t))) in O δ + τ u δ (t) 0 g(X u x (s), u(s))e -G(s,x,u) ds V (x, y) in O \ O δ
Let us consider its upper semi-continuous envelope W * . By similar arguments as in Theorem 6.2 we can prove that W * is a viscosity sub-solution to (6.7). Indeed, the continuity with respect to time in t = 0 can be prove as in Theorem 6.2. Moreover, the boundary condition on ∂ 1 O is satisfied in the strong sense thanks to the continuity of V . Therefore, applying the comparison principle Theorem A.1 between sub and super solutions to (6.7) we get

V (x, y) ≥ W * (t, x, y).
This yields

V (x, y) ≥ inf u∈U E e -G(τ u δ (t),x,u) V (X u x (τ u δ (t)), Y u x,y (τ u δ (t))) + τ u δ (t) 0 g(X u
x (s))e -G(s,x,u) ds for any t ≥ 0, (x, y) ∈ O δ .

The super-optimality principle from Theorem 6.3 and the sub-optimality principle from Theorem 6.2 are finally used in the next theorem in order to establish the desired comparison result. Theorem 6.4. Let V ∈ U SC(O) and V ∈ C(O) be a bounded viscosity suband super-solution to equation (5.8), respectively. Let us also assume that

V (x, y) ≤ 1 + y ≤ V (x, y) on {(x, y) ∈ O : x ∈ T } (6.8) and V (x, 0) = V (x, 0) = 1 ∀x ∈ O. (6.9)
Then V (x, y) ≤ V (x, y) for any (x, y) ∈ O.

Proof. Clearly, if x ∈ T there is nothing to prove. Thanks to inequalities (6.6) and (6.3), for any (x, y) ∈ O δ and T ≥ 0 we have

V (x, y) -V (x, y) ≤ sup u∈U E e -G(τ u δ (T ),x,u) V (X u x (τ u δ (T )), Y u x,y (τ u δ (T ))) -V (X u x (τ u δ (T )), Y u x,y (τ u δ (T ))) = sup u∈U τ u δ ≤T e -G(τ u δ ,x,u) V (X u x (τ u δ ), Y u x,y (τ u δ )) -V (X u x (τ u δ ), Y u x,y (τ u δ )) dP + τ u δ >T e -G(T,x,u) V (X u x (T ), Y u x,y (T )) -V (X u x (T ), Y u x,y (T )) dP
We will study these two integrals separately. Thanks to the (semi-)continuity of V and V and conditions (6.8) and (6.9), for any ε > 0 it is possible to find δ ε small enough such that

V (x, y) ≤ 1 + y + ε 2 , V (x, y) ≥ 1 + y - ε 2 if d(x, T ) ≤ δ and V (x, y) ≤ 1 + ε 2 , V (x, y) ≥ 1 - ε 2 if y ≥ -δ.
Recalling that τ u δ is the exit time from the domain O δ , we have that for any

u ∈ U either Y u x,y (τ u δ ) = -δ or d(X u x (τ u δ ), T ) = δ.
For both these cases, choosing δ small enough, for the first integral we find

τ u δ ≤T e -G(τ u δ ,x,u) V (X u x (τ u δ ), Y u x,y (τ u δ )) -V (X u x (τ u δ ), Y u x,y (τ u δ )) dP ≤ ε P[τ u δ ≤ T ] ≤ ε.
For the second integral we can use the boundedness of V and V . Denoting by M a bound for these functions, we obtain for any u ∈ U

τ u δ >T e -G(T,x,u) V (X u x (T ), Y u x,y (T )) -V (X u x (T ), Y u x,y (T )) dP ≤ 2M τ u δ >T
e -G(T,x,u) dP.

If we define

g * := inf {g(x, u) | x ∈ R : d(x, T ) > δ, u ∈ U } > 0
we finally obtain for T large enough

V (x, y) -V (x, y) ≤ ε + e -g * T = 2ε
for any (x, y) ∈ O δ and the result is obtained thanks to the arbitrariness of ε.

Finally. we obtain the desired comparison principle in the whole domain O by sending δ → 0, thanks to the upper semi-continuity of the function V -V . are considered, in the viscosity sense, respectively for sub-and super-solutions. In the sequel we will denote by | • | M -1 the norm restricted to the first M -1 components of the vector, that is:

|x| M -1 := |(x 1 , . . . , x M -1 )|, ∀x ∈ R M .
∈ [0, T ) v(t, x) ≤ v(t, x).
Since the main arguments of the proof can be found in [START_REF] Dupuis | On oblique derivative problems for fully nonlinear second-order elliptic partial differential equations on nonsmooth domains[END_REF] we only report below the main lines and the modification necessary for dealing with the possible unboundedness of the domain.

Sketch of the proof. Recalling that the boundary ∂ 2 O is defined by the function -e -h(x1,...,x M -1 ) , thanks to the Lipschitz assumption (H4)-(ii), we can easily observe that just taking µ :=

1 √ 1+L 2 h , where L h is the Lipschitz con- stant appearing in (H4)-(ii), for any z ∈ ∂ 2 O one has 0≤ξ≤µ B(z -ξ, ξµ) ⊂ O C . (A.2)
This corresponds to condition (2.9) in [START_REF] Dupuis | On oblique derivative problems for fully nonlinear second-order elliptic partial differential equations on nonsmooth domains[END_REF] and by the same arguments as in

v δ,ρ,β (t, x) := v(t, x) -δe -ρT ζ(x) - β T -t and v δ,ρ,β (t, x) := v(t, x) + δe -ρT ζ(x) + β T -t . One has v δ,ρ,β t→T -→ -∞ and v δ,ρ,β t→T -→ +∞.
It is possible to verify that v δ,ρ,β (resp. v δ,ρ,β ) is a sub-solution (resp. supersolution) of an obstacle problem with the following modified boundary condition on ∂ 2 O:

-∂ x M v + δe -ρT ≤ 0 resp. -∂ x M v -δe -ρT ≥ 0 . (A.3)
Moreover, thanks to the positivity of ζ, one has v δ,ρ,β ≤ v and v δ,ρ,β ≥ v, so the boundary conditions for t = 0 and y = 0 in (6.7) are trivially satisfied. By using the non negativity of g and the linear growth of b and σ, in O one has

H(x, v δ,ρ,β , Dv δ,ρ,β , D 2 v δ,ρ,β ) -H(x, v, Dv, D 2 v) ≤ H(x, v, Dv δ,ρ,β , D 2 v δ,ρ,β ) -H(x, v, Dv, D 2 v) ≤ sup u∈U b(x, u) • δe -ρT Dζ + 1 2 T r[σσ T (x, u)(δe -ρT D 2 ζ)] ≤ C 1 δe -ρT (1 + |x| 2 M -1 )
, where C 1 only depends on K ζ and the Lipschitz constants of b and σ. Then if

min ∂ t v + H(x, v, Dv, D 2 v) , v -ψ(x) ≤ 0 for some x ∈ O ∪ ∂ 2 O one obtains min ∂ t v δ,ρ,β + H(x, v δ,ρ,β , Dv δ,ρ,β , D 2 v δ,ρ,β ) + β T 2 -C 1 δe -ρT (1 + |x| 2 M -1 ) , v δ,ρ,β + β T -ψ(x) ≤ min ∂ t v + H(x, v, Dv, D 2 v) , v -ψ(x) ≤ 0.
The analogous result can be proved for the super-solution v δ,ρ,β . Our goal is now to prove the inequality v δ,ρ,β (t, x) ≤ v δ,ρ,β (t, x) + 2C 1 δe -ρ(T -t) (1 + |x| 2 M -1 ) (A.4) for all δ, ρ, β > 0. By virtue of the definition of v δ,ρ,β and v δ,ρ,β , this implies the claim of the theorem by letting δ, β → 0. In order to prove (A.4), we consider the modified obstacle problems given by

                   min ∂ t v + H(x, v, Dv, D 2 v) + β T 2 -C 1 δe -ρT (1 + |x| 2 M -1 ) , v + β T -ψ ≤ 0 (0, T ) × O v(t, x) ≤ 1 (0, T ) × ∂ 1 O -∂ x M v(t, x) + δe -ρT ≤ 0 (0, T ) × ∂ 2 O v(0, x) ≤ ψ(x) O and                    min ∂ t v + H(x, v, Dv, D 2 v) -β T 2 + C 1 δe -ρT (1 + |x| 2 M -1 ) , v -β T -ψ ≥ 0 (0, T ) × O v(t, x) ≥ 1 (0, T ) × ∂ 1 O -∂ x M v(t, x) -δe -ρT ≥ 0 (0, T ) × ∂ 2 O v(0, x) ≥ ψ(x) O
and consider the function Φ(t, x) := v δ,ρ,β (t, x) -v δ,ρ,β (t, x)-2C 1 δe -ρ(T -t) (1 + |x| 2 M -1 ). Thanks to the boundedness and the semi-continuity of v δ,ρ,β and v δ,ρ,β , Φ admits a maximum point ( tδ,ρ,β , xδ,ρ,β ) = ( t, x). If either t = 0 or x ∈ ∂ 1 O, then (A.4) follows from the boundary conditions. Similarly, (A.4) follows immediately in case Φ( t, x) ≤ 0. If x ∈ O, inequality (A.4) can be proved using classical comparison results for obstacle problems, see [START_REF] Touzi | Optimal Stochastic Control, Stochastic Target Problems, and Backward SDE[END_REF]Theorem 7.8] (see also the discussion of Case 1 and 2 below). It remains to consider the case x ∈ ∂ 2 O, for which we will show that it cannot occur if t > 0, x ∈ ∂ 1 O and Φ( t, x) > 0 and if ρ > 0 is sufficiently large (observe that it is enough to establish (A.4) for all sufficiently large ρ because this will imply (A.4) for all ρ > 0). Thanks to the property (A.2) of our domain, the existence of a family of C 2 test functions {w ε } ε>0 as in [START_REF] Dupuis | On oblique derivative problems for fully nonlinear second-order elliptic partial differential equations on nonsmooth domains[END_REF]Theorem 4.1] can be proved. Among the other properties, {w ε } ε>0 satisfies: and we denote by (t ε , x ε , y ε ) its maximum point. By the usual techniques, thanks to the properties (A.5) and (A.6), it is possible to prove that for ε going to 0

w ε (x, x) ≤ ε (A.5) w ε (x, y) ≥ C |x -y| 2 ε (A.6) -∂ x M w ε (x, y) ≥ -C |x -y| 2 ε if x ∈ ∂ 2 O ∩ B(x,
x ε , y ε → x, t ε → t and |x ε -y ε | 2 ε → 0.
It follows that for ε small enough we can assume that x ε , y ε / ∈ ∂ 1 O and t ε > 0. Taking ε small enough we can also say that x ε , y ε ∈ B(x, η) and then we can make use of properties (A.7) and (A.8). In particular if x ε ∈ ∂ 2 O, taking ε small enough, we have

-∂ x M w ε (x ε , y ε ) + δe -ρ(T -tε) (1 + |x ε | 2 M -1 ) + |x ε -x| 4 ≥ -C |x ε -y ε | 2 ε -4|x ε -x| 2 |x ε M -xM | > -δe -ρT .
On the other hand if In this case we would get (since v δ,ρ,β (t ε , y ε ) -β T -ψ(y ε ) ≥ 0 always holds)

y ε ∈ ∂ 2 O -∂ y M -w ε (x ε , y ε ) -C 1 δe -ρ(
v δ,ρ,β (t ε , x ε ) -v δ,ρ,β (t ε , y ε ) + 2β T + ψ(y ε ) -ψ(x ε ) ≤ 0.
For sufficiently small ε > 0, from Φ( t, x) > 0 we know that Φ ε (t ε , x ε , y ε ) > 0 and this implies v δ,ρ,β (t ε , x ε ) -v δ,ρ,β (t ε , y ε ) > 0, leading to a contradiction for ε going to 0.

Case . Using the properties of the Hamiltonian H and of the test function w ε , we can find a constant C 2 such that at the limit for ε → 0 one has

δe -ρ(T -t) (1 + |x| 2 M -1 )(ρ -C 2 -C 1 ) ≤ 2ρδe -ρ(T -t) (1 + |x| 2 M -1 ) -C 2 δe -ρ(T -t) (1 + 2|x| 2 M -1 ) -C 1 δe -ρT (1 + 2|x| 2 M -1 )
≤ -2β T 2 and a contradiction is obtained as soon as ρ ≥ (C 1 + C 2 + 1).

Proposition 3 . 4 .

 34 0 and thus x ∈ D T ,C . Assume assumptions (H1)-(H2) be satisfied. Then D T ,C is an open set.

Proposition 5 . 2 .

 52 Let assumptions (H1)-(H4) be satisfied. Then the function ϑ from (5.1) is continuous in R d+1 . Proof. The continuity with respect to y is trivial and one has |ϑ(x, y) -ϑ(x, y )| ≤ |y -y |.

Thanks to Lemma 5 . 1

 51 and the continuity of ϑ, we can finally characterize ϑ as a solution, in the viscosity sense, of a second order Hamilton-Jacobi-Bellman equation. To this end, we define the open domain O ⊂ R d × [-1, 0] by O = (x, y) ∈ R d+1 : -e -h(x) < y < 0 and the following two components of its boundary ∂ 1 O := (x, y) ∈ O : y = 0 ∂ 2 O := (x, y) ∈ O : y = -e -h(x) , y < 0 . Remark 5.3. We point out that thanks to the relation ϑ(x, y) = ϑ(x, -e -h(x) ) ∀y ≤ -e -h(x) it is sufficient to determine the values of ϑ in O in order to characterize ϑ in the whole domain of definition R d × [-1, 0]. We also remark that ϑ(x, 0) = 1 for any x ∈ R d . Let us consider the following Hamiltonian H : R d ×R×R×R d ×R×S d → R, with S d denoting the space of d × d symmetric matrices H(x, y, r, p, q, Q) := sup u∈U g(x, u)(r -1) -p•b(x, u) -1 2

  .8), we will ask that on the boundary ∂ 2 O the inequality min H(x, y, ϑ, D x ϑ, ∂ y ϑ, D 2 x ϑ), -∂ y ϑ ≤ 0 resp. max H(x, y, ϑ, D x ϑ, ∂ y ϑ, D 2 x ϑ), -∂ y ϑ ≥ 0 holds in the viscosity sense. In contrast, the condition on ∂ 1 O is assumed in the strong sense. Proof of Theorem 5.4. The boundary condition on ∂ 1 O follows directly by the definition of ϑ. Let us start proving the sub-solution property. Let be ϕ ∈ C 2,1 (O) such that ϑ-ϕ attains a maximum at point (x, ȳ) ∈ O and let us assume ȳ < 0. We need to show H(x, ȳ, ϑ(x, ȳ), D x ϕ(x, ȳ), ∂ y ϕ(x, ȳ), D 2 x ϕ(x, ȳ)) ≤ 0 (5.9) if (x, ȳ) / ∈ ∂ 2 O and min H(x, ȳ, ϑ(x, ȳ), D x ϕ(x, ȳ), ∂ y ϕ(x, ȳ), D 2 x ϕ(x, ȳ)), -∂ y ϕ(x, ȳ) ≤ 0 (5.10) if (x, ȳ) ∈ ∂ 2 O.

Theorem A. 1 .

 1 Let assumptions (H1),(H3) and (H4) be satisfied and ψ ∈ C(O). Let v ∈ U SC([0, T ] × O) and v ∈ LSC([0, T ] × O) be respectively a bounded viscosity sub-and super-solution of (A.1). Then for any x ∈ O and t

[ 17 ,

 17 Corollary 2.3] the existence of a functionζ ∈ C 2 (O) follows such that ζ ≥ 0 on O, -∂ x M ζ ≥ 1 on ∂ 2 O and |Dζ|, D 2 ζ ≤ K ζ for some constant K ζ ≥ 0.We point out that the in our case the proof of Corollary 2.3 can be strongly simplified because of the constancy of the derivative direction. In particular the local construction presented in[START_REF] Dupuis | On oblique derivative problems for fully nonlinear second-order elliptic partial differential equations on nonsmooth domains[END_REF] will be independent of the choice of the the boundary point allowing us to obtain a uniform bound on |Dζ| and D 2 ζ on the whole domain. Let us define for δ, ρ, β > 0

  η), y ∈ B(x, η) (A.7) -∂ y M w ε (x, y) ≥ 0 if y ∈ ∂ 2 O ∩ B(x, η), x ∈ B(x, η) (A.8)for ε > 0 and some η > 0 small enough. Applying the doubling variables procedure we defineΦ ε (t, x, y) := v δ,ρ,β (t, x) -v δ,ρ,β (t, y) -C 1 δe -ρ(T -t) (1 + |x| 2 M -1 ) -C 1 δe -ρ(T -t) (1 + |y| 2 M -1 ) -w ε (x, y) -|x -x| 4 -|t -t| 2

  This means that for sufficiently small values of ε, we can neglect the derivative boundary conditions in x ε , y ε and only considermin ∂ t v δ,ρ,β + H(x ε , v δ,ρ,β , Dv δ,ρ,β , D 2 v δ,ρ,β ) + β T 2 -C 1 δe -ρT (1 + |x ε | 2 M -1 ) , min ∂ t v δ,ρ,β + H(y ε , v δ,ρ,β , Dv δ,ρ,β , D 2 v δ,ρ,β ) -β T 2 + C 1 δe -ρT (1 + |y ε | 2

	v	δ,ρ,β +	β T	-ψ ≤ 0
					M -1 ) ,
	v δ,ρ,β -	β T	-ψ ≥ 0
	in the viscosity sense.
		Case 1: let us assume that
					v	δ,ρ,β (t ε , x ε ) +	β T	-ψ(x

T -tε)

(1 + |y ε | 2 M -1 ) ≤ 0 < δe -ρT . ε ) ≤ 0.

  2: let us assume that -C 1 δe -ρT (1 + |x ε | 2 M -1 ) ≤ 0. It follows that ∂ t v δ,ρ,β (t ε , x ε ) -∂ t v δ,ρ,β (t ε , y ε ) -C 1 δe -ρT (1 + |x ε | 2 M -1 + |y ε | 2

	∂ t v	δ,ρ,β + H(x, v	δ,ρ,β , Dv	δ,ρ,β , D 2 v	δ,ρ,β ) +	β T 2

M -1 ) + H(x ε , v δ,ρ,β , Dv δ,ρ,β , D 2 v δ,ρ,β ) -H(y ε , v δ,ρ,β , Dv δ,ρ,β , D 2 v δ,ρ,β ) ≤ -2β T 2

Acknowledgment

We would like to thank Annalisa Cesaroni for the interesting discussions on optimality principles on occasion of the SADCO NetCo conference (Tours 2014).

This work was partially supported by the EU under the 7th Framework Programme Marie Curie Initial Training Network "FP7-PEOPLE-2010-ITN", SADCO project, GA number 264735-SADCO. Parts of the research for this paper were carried out while the second author was visiting the University of Bayreuth as part of her SADCO secondment.

An immediate consequence of this theorem and Theorem 5.4 is the following existence and uniqueness result. Corollary 6.5. Let assumptions (H1)-(H4) be satisfied. Then ϑ from (5.1) is the unique bounded and continuous viscosity solution to equation (5.8) such that ϑ(x, y) = 1 + y if x ∈ T and ϑ(x, 0) = 1 for any x ∈ R d .

Appendix A. Comparison principle for obstacle problems with Dirichlet-Neumann boundary conditions

In this section we will give a proof of a comparison principle for the obstacle problem (6.7). The result and its proof modify the arguments in [17, Theorem 2.1] in order to take into account the unbounded domain of (6.7). Of course, the same arguments apply to (6.5).

Before starting the proof of the result, we introduce a more compact notation. Let us start defining b(x, y, u)

In what follow we will directly denote with x the variable in the augmented state space R M for M := d + 1, that is x ≡ (x, y) ∈ R M . Using this notation we can write the Hamiltonian H in (5.7) in the following compact form

The boundary value problem we deal with is the following

(where ∂ x M denotes the partial derivative with respect to the M -th space variable and ψ(x) = 1 on ∂ 1 O). We recall that the boundary conditions in t = 0 and ∂ 1 O are considered in the strong sense, that is for any viscosity sub-solution v (resp. super-solution v) one has

We also recall that on the boundary ∂ 2 O the following weak conditions


Amina Ahmed Nacer
email: amina.ahmed-nacer@loria.fr

Claude Godart
email: claude.godart@loria.fr

Samir Youcef
email: samir.youcef@loria.fr

Abdelkamel Tari
email: abdelkamel.tari@univ-bejaia.dz

A Metric for Evaluating the Privacy Level of a Business Process Logic in a Multi-Cloud Deployment

Some companies are willing to execute their business processes (BP) in the cloud for enjoying its benefits. However, they are also reluctant because of the new security risks that using cloud resources introduces. Security risk includes many dimensions, but this work focus on preserving the privacy of the logic of a BP deployed in a multi-cloud context by preventing a coalition of malicious clouds to re-construct important information from this logic. More precisely, the paper presents a BP logic privacy metric directly supporting the evaluation of the risk a company has its logic hacked in a particular multi-cloud configuration Index terms-BP modelling, BP deployment in the cloud, Security risk, BP logic privacy

I. INTRODUCTION

Cloud computing has emerged as a dominant technology because it avoids upfront infrastructure costs and helps organizations to focus on their core business activities, instead of their system infrastructure.

In this context, some companies are willing to execute, in the same way as other software, their business processes (BP) in the cloud for enjoying its benefits. However, they are also reluctant for their more valuable software because of the new security risks the cloud introduces. Security risk can include many dimensions (privacy, integrity, availability . . . ). In this work, we focus on a particular aspect of security which is the privacy of a BP logic deployed on a multi-cloud for preventing a coalition of malicious clouds to re-construct important information by combining their BP logic knowledge.

More precisely the paper presents a BP logic privacy metric to evaluate the risk a company has its BP logic hacked in a particular multi-cloud configuration. The global idea is that, on the one hand the more sensitive information is contained in some more sensitive BP fragments, and on the other hand, more these fragments are distant in a cloud configuration, more the configuration is resistant to privacy leaks. The distance between fragments is measured based on the number of clouds on the paths between sensitive fragments weighted with the reputation of these clouds. The metric considers not only attacks from one malicious cloud provider, but from a coalition of cloud providers.

The rest of the paper is organized as follows. The next section explains the basics on which our metric is designed. Section III describes our risk computing metric. Section IV makes an evaluation of the proposed approach and discusses the obtained results. Section V discusses the state of the art and finally section VI concludes and introduces some future work.

II. MOTIVATION, CONTEXT AND APPROACH

A. Motivating example

Figure 1 depicts1 a selection process of residents for a hospital. The objective of this process is to accept or reject a candidacy. Depending on the resident's record (medical school performed, scores, internships . . . ) the candidacy can be accepted, refused or, in case of neutral decision, reevaluated. The final decision is taken on the basis of the decision notification combined with aptitude test results.

The hospital is ready to externalize its business process execution to the cloud, however it wants to preserve its strategy for selecting or rejecting a candidacy. In this objective, the company managing the IT services of the hospital decides to obfuscate the BP model by splitting its logic in a collaborations of BP fragments to be assigned to different cloud.

B. BP obfuscation by splitting its logic

Splitting a BP model in a BP fragments collaboration, each BP fragment being assigned to a different cloud , is a basic idea of BP obfuscation [START_REF] Jensen | Security prospects through cloud computing by adopting multiple clouds[END_REF] as, in consequence, each cloud provider has only a partial view of the BP model.

To support this process, several works [8][5][1] use separation constraints (separate(t i , t j )) for requiring a sensitive task t i and its complementing sensitive task t j to be assigned to different clouds. [START_REF] Goettelmann | Paving the way towards semi-automatic design-time business process model obfuscation[END_REF] proposes an algorithm for automating the generation of separation constraints which, if applied to our motivating example returns the following separation constraints In addition and for increasing the complexity of a BP fragments collaboration, some works [START_REF] Ahmed Nacer | Obfuscating a business process by splitting its logic with fake fragments for securing a multi-coud deployment[END_REF] add separation constraints with fake fragments. Figure 3 describes another collaboration of the same process while using this principle.

As the BP fragments of the process are assigned to clouds for execution, different assignments leading to different cloud configurations are possible. Therefore, there is a need for comparing these configurations. This is the objective of the metric developed in this paper

C. BP logic privacy violation risk assessment approach

While the splitting of a BP process in BP fragments and other security artifacts (for example fake fragments) provide active support against malicious clouds attacks, they cannot completely ensure the protection of the BP logic and a risk persists. Thus an important issue is to be able to measure this risk. This is the objective of the metric developed in this paper.

Moreover this risk evaluation metric developed is directly related to our BP obfuscation method, and thus enlightens sensitive tasks as first class elements to be preserved from attacks.

Its principle is that for discovering a sensitive information, an attacker has:

• to possess both a sensitive task and the corresponding complementing one (in other terms, to possess the tasks t i and t j of a separation constraint separate(t i , t j )): in the context of a BP fragments collaboration, we formalize this risk as the ability for a cloud executing a sensitive task to discover a path between such a sensitive task and its complementing one, following forward the send operation(s) of its fragment (the BP fragment it executes), and/or backward the receive operation(s) of this fragment.

• to collude with clouds on the paths between sensitive complementing tasks More precisely, the metric used for measuring logic privacy is related to number of clouds on the paths between complementing sensitive tasks weighted with the reputation level of these clouds.

III. METRIC FOR BP LOGIC PRIVACY VIOLATION RISK

In this section we explain how we compute a risk value for a whole collaboration of BP fragments as the sum of the risk for all sensitive tasks to be protected. The risk value for each sensitive task is computed as the sum of the risk for all paths between this task and its complementing one. Such a risk is computed using the general risk formula [START_REF] Australia | Handbook: Risk management guidelines, companion to as/nzs 4360: 2004[END_REF] introduced just below.

A. General definition of a risk

In general, a risk is defined by the likelihood of an incident scenario mapped onto estimated negative impacts.

In the IT context, [START_REF] Australia | Handbook: Risk management guidelines, companion to as/nzs 4360: 2004[END_REF] refine this definition as the likelihood a threat, accidentally or intentionally, exploits one or more vulnerabilities (flaws or weaknesses in system security procedures, in design, implementation, or internal controls) of the IT environment with a negative impact (destruction, alteration, theft, etc.).

Thus the security risk assessment on an artifact a consists usually in evaluating the following formula:

Risk(a) = V (a) × T (a) × I(a) (1)

B. Risk level of a collaboration

The risk level to which is exposed the whole process (the collaboration of its process fragments) represents the sum of the risks to which are exposed all the sensitive tasks it includes, and is computed as follows

Risk(collaboration) = nb i=1 Risk(t i ) (2)
where

• nb: the number of sensitive tasks • Risk(t i ): the risk level of the sensitive task t i

C. Global risk level of a sensitive task (considering all paths)

The risk of a task t i is defined as the sum of the risks following all paths to its complementing task t i .

A path p j (t i ) between a sensitive task t i and its complementing sensitive task t i , noted p j (t i ) is the set of clouds executing the tasks in the j th logical path between t i and t i in the BP logic.

Risk(t i ) = p j=1 Risk j (t i ) (3)
where

• p: the number of paths from t i to its complementing task t i • Risk j (t i ): risk for the task t i when selecting the path p j (t i ) D. Risk for a sensitive task on a particular path p j Accordingly to definition 1, the risk for a task t i on path p j (t i ) is defined as:

Risk j (t i ) = V ulnerability(t i ) × T hreat j (t i ) × Impact j (t i ) (4) where :
• V ulnerability(t i ) : the vulnerability of t i depends on the cloud executing the task, or how it is ready to collude with other clouds. This value is common to all paths. • T hreat j (t i ) : the threat on a task t i or how the clouds on the path p j (t i ) are ready to collude • Impact j (t i ): the impact of a collusion of the clouds on the path p j (t i ) 1) Vulnerability of a task: As introduced above, the vulnerability of a BP fragment comes from the cloud executing it, or how it is ready to collude with other clouds. In practice, we directly relate the vulnerability of a task to the level of reputation of the cloud deploying it, or the more a cloud has a good reputation, the less the task will be exposed to threats. Formally, the vulnerability of a task t i is a normalized value belonging to the interval [0; 1] defined as follows:

V ulnerability(t i ) = 1 -rep(c) (5)
where: 1) t i : the considered sensitive task 2) c: the cloud deploying (t i ) 3) rep(c) : the reputation of the cloud which execute (t i ) Measuring the reputation of a cloud is out of the scope of this paper. Many approaches has been proposed for dynamically measuring such a reputation [START_REF] Jøsang | A survey of trust and reputation systems for online service provision[END_REF]. Our only hypothesis is that reputation can be normalized in [0,1], 0 the less reputed, 1 the best.

2) Threat of a task t i relatively to path p j (t i ): We consider that the threat on a sensitive task relatively to a path is related to:

• the sensitivity 2 : the more a task is sensitive, and the more malicious clouds will be motivated to attack it, • the reputation of clouds: the better reputation a cloud has, and the less it is ready to collude, • the number of clouds: the more clouds in the path and the more difficult it is for them to collude; we consider that this difficulty evolve exponentially.

2 the notion of sensitivity of a task is introduced in [START_REF] Nacer | Business process design by reusing business process fragments from the cloud[END_REF]: it is a designer defined value assigned to a task taken in [0, 1] : 0 for the less sensitive, 1 fore the more sensitive T hreat j (t i ) =

s t * ( 1 e card(pj (ti)) card(p j (t i )) j=1 rep(Cj ) ) (6)
where • s t : the sensitivity of the task t (∈ [0, 1])

• card(p j (t i )) : the number of clouds in p j (t i )

• rep(c j ): the reputation of cloud j 3) Impact of a threat on a task: As previously suggested, the impact of threats can be opportunely correlated to the number of clouds implied in an attack, i.e. the more clouds in the coalition, the more important is the impact as each cloud belonging to the malicious coalition can take advantage of the flaw. Thus, we choose to measure the impact of a threat as the rate (percentage) of clouds implied in the attack. Equation 7gives the impact of a threat for a task t i relatively to a path p j .

Impact j (t i ) = card(p j (t i )) cardSys (7)
where 1) card(p j (t i )) : the number of clouds in p j (t i ) 2) cardSys : the cardinality of the system, i.e. the number of clouds involved in the BP collaboration.

IV. APPLICATION AND EXPERIMENTATIONS

To illustrate the utility and the applicability of our metric, we apply it in a first time to our motivating example (section IV-A) to compute the different risk levels to which is exposed a sensitive task on different paths. In a second time, we simulate its behavior in different execution settings (section IV-B). To illustrate the risk model developed above, we come back to our motivating example and we focus on the risk that malicious clouds can link the sensitive task CAR to its complementing one DN.

Figure 4 depicts all existing paths linking the tasks CAR and DN. The top part of the figure depicts the paths which can be discovered using the receive operation and the bottom part the ones which can be discovered using the send operation.To each path is associated its length i.e. the number of clouds it includes. It must be noted that the task CAR is deployed on subprocess 1 (SP 1) while DN is deployed on subprocess 14 (SP 14). a)

Step one: In the first step, we determine the different paths linking tasks CAR and DN. For example, starting from SP 1 and following the send 2 87 operation, we find the path of length 4 composed of subprocesses (SP 1 -SP 5 -SP 10 -SP 14) (highlighted in bold in figure 3 and shown in figure 4, bottom part) leading from CAR to DN.

b)

Step two: After selecting the set of paths, we calculate the risk to which is exposed the task CAR on each path by computing the vulnerability, the threat and the impact.

For example, applying our equations 5, 6 and 7 to the path (SP 1 -SP 5 -SP 10 -SP 14) returns respectively the following results for CAR about its vulnerability, its threat and their impact, while using the clouds' reputation depicted on table I :

V ulnerability(CAR) = (1 -0, 5) = 0, 5 T hreat(CAR) = 0.7 × ( 1 e 4 4 j=1
Rep(C j ) ) Where C = {SP 1 -SP 5 -SP 10 -SP 14}. We obtain then T hreat(CAR) = 0, 7 × ( 1 e 4×1,8 ) = 0.00052 The impact of CAR is computed as impact(CAR) = ( 418 ) = 0, 22 Then, we compute the risk to which is exposed the task using equation 1. The risk of CAR on path SP 1 -SP 5 -SP 10 -SP 14 is computed as Risk(CAR) = 0, 5 × 0.00052 × 0, 22 = 57.10 -6.

We compute the risk to which is exposed CAR on each path of figure 4 using the same method.

After computing the risk to which is exposed CAR on each path, we compute the global risk to which it is exposed using equation 3.

c) Third step: After applying the same method as applied to the task CAR for each sensitive task of the process for global risk computation, we compute the risk of the whole collaboration using equation 2.

Risk(Collaboration)

= n i=1 Risk(t i ), n ∈ SetOf SensitiveT asks

B. Experimentation

To observe the behavior of our risk metric, we have evaluated the risk of deploying a BP in the cloud with regards to three deployment approaches:

1) an aleatory distribution of tasks, 2) a distribution respecting the principle of assigning complementing sensitive tasks in different clouds (as introduced in [START_REF] Goettelmann | Paving the way towards semi-automatic design-time business process model obfuscation[END_REF] and summarized in section II-B, 3) a distribution as the previous one but extended with fake fragments as introduced in [START_REF] Ahmed Nacer | Obfuscating a business process by splitting its logic with fake fragments for securing a multi-coud deployment[END_REF].

1) Experimental settings: All algorithms were coded in java language. All experiments were performed on an intel (R) Core(TM) i3-2310M 2.10 GHz running Windows Seven.

We used different BP with a variable number of tasks. We generate until 1000 instances of collaborations for each of these BP and for each of the three ways of distribution.

As we were not able to find real data information (providers do not reveal the level of reputation of their cloud servers), we generate randomly a set of cloud reputations (table I is an example).

2) Experimental Results: Figures 5 depicts our experimental results in terms of risk level3 (figure a) and number of clouds (figure b), depending on the number of tasks in processes. As intended, they confirm:

• that configurations separating complementing sensitive fragments are less risky that aleatory defined configurations, • the fake mechanism coupled to the previous algorithm minimizes even more the risk until obtaining very small values, • the number of clouds is not correlated to the number of activities, but to the number of sensitive tasks (this explain why the process with 10 activities in figure 5-b needs more clouds than the process with 14 activities.

These results confirm our assumptions i.e. separating sensitive complementing fragments on different clouds minimizes the likelihood and the risk of a coalition. Moreover, the mechanism of fake fragments increases the length and the number of paths separating sensitive fragments, making longer an eventual collusion and therefore less probable.

V. STATE OF THE ART

The work described in this paper is related to Business Process Outsourcing (BPO) in a multi-cloud environment. Even if many researches have already be done in the context of BPO [START_REF] Yang | Developing a decision model for business process outsourcing[END_REF][2], only few of them are concerned by the cloud computing context.

Directly related to our field, Rekik and al. [START_REF] Rekik | A comprehensive framework for business process outsourcing to the cloud[END_REF] proposed a framework named Business Process Outsourcing (BPO2C) covering the outsourcing process life-cycle to identify the implied business process in the outsourcing decision. However, this work did not consider the risk of know-how disclosure by neither a single cloud provider nor a collusion of several clouds.

The proposed approach of this paper comes in the continuation of our previous works. In [START_REF] Goettelmann | A security risk assessment model for business process deployment in the cloud[END_REF] we yet defined a security risk metric but based on data given by cloud providers, while in this current work the risk value is based on our proper obfuscation model i.e. in other words based on data from the cloud client himself.

Several other researches are directly concerned with the security risk of a BP but in traditional information systems settings [14] [7][11][4] and as such do not consider the deployment of a BP in a multi-cloud context, and less the conspiracy of resource providers.

VI. CONCLUSION AND FUTURE WORK

This paper has introduced a metric for risk evaluation during a BP deployment in a multi-cloud context. Its originality is to be based on client-side data and not data given by cloud providers, what is a better guarantee for BP owners.

Such a metric is important for cloud clients who need to compare different deployment solutions, as at the one hand security cannot be completely ensured, and on the other hand the security is a parameter to balance with other quality of services (QoS) parameters.

Our future work concerns the development of a larger security risk metric based on our previous work in [START_REF] Goettelmann | A security risk assessment model for business process deployment in the cloud[END_REF] and this current work, while confronting the security dimension to other QoS parameters.

Fig. 1 :Fig. 2 :

 12 Fig. 1: The resident selection Process (orchestration)

Fig. 4 :

 4 Fig. 4: Possible paths between CAR and DN

Fig. 5 :

 5 Fig. 5: Risk level evolution with regards to deployment strategies.

SubProcess 15 SubProcess 14 SubProcess 8 SubProcess 7 SubProcess 6 SubProcess 4 SubProcess 5 SubProcess 10 SubProcess 9 SubProcess 11 SubProcess 12 SubProcess 13 SubProcess 16 SubProcess 17 Start Send287 End And g2 And g1 Receive127 Send178 F2 Fict63 And g1 Fict62 And g2 End Legend : -F i : the i th fake fragment -Send k and Receive k' : synchronization

		Start SubProcess 1		SubProcess 0			SubProcess 2	SubProcess 3
				Start
				ASP
	Receive 187
	CAR			Send287
	Send 287		End
	Xor
	g1
	Fict12	Fict19 Fict01
	Xor
	g2
		End			Start
					Receive66
			Start
	Start			Xor
			Receive12	g1
	Receive187
	g1 Xor		g1 Xor	Fict22	F10
	Fict70	F6		F7	Send105
		Send17		Send200	Xor g2
	g2 Xor		g2 Xor	End
			End
					Start		Start
	Start		Start	Receive489		Receive1989
	Receive189	Receive17		Xor		Xor g1
					g1
	Xor g1		Xor g1	Fict50	AA	Fict80
	Fict50	F8	Fict20	F3	Send337	RR
	Send237
			Send205	Xor
					g2
	Xor g2		Xor g2		End		Xor g2
	End		End				End

messages with labels k and k' -Fict i : the i th fictive activity t : t is a sensitive task

CAR

The set of paths linking the sensitive tasks

CAR and DN Fict92 Start Send287 End And g2 And g1 Receive227 Send78 Send27 F11 F1 Start Send287 End And g2 And g1 Receive22 Receive88 Send928 Send002 F12 AT Fict27 Start Receive13 Send27 End Xor g1 Xor g2 AR Fict32 Start Receive157 Send967 End Xor g1 Xor g2 F9 Receive170 Send237 NA F4 Fict55 Start Receive689 Send2337 End Xor g1 Xor g2 Fict52 Start Receive787 Send999 End Xor g1 Xor g2 F5 Start End Xor g2 Xor g1 Receive2287 Receive290 Receive255 Receive2287 Receive123 Receive2287 Receive119 DN Send8877 ᄇ Start FD Receive77 End

Fig. 3: The BP collaboration corresponding to The Resident Selection process with fake fragment deployment Where • V: the vulnerability of artifact a • T: the threat on a • I: the impact on a

TABLE I

 I

	: Cloud's reputation
	A. Example: the case of the sensitive task CAR and its
	complementing one DN

We use the BPMN (Business Process Modeling Notation (http://www.bpmn.org)) for modeling our BP models. In addition these process models are supposed to be well structured[START_REF] Polyvyanyy | Structuring acyclic process models[END_REF]

The risk level is normalized to scale the range in [0, 1] using the following widespread formula x = x-min max-min (x'and x are respectively the normalized and original values while min and max are respectively the minimum and the maximum risk values computed)