Guji Tian
email: tianguji@wipm.ac.cn

Chao-Jiang Xu
email: chao-jiang.xu@univ-rouen.fr

EXISTENCE AND CONVEXITY OF LOCAL SOLUTIONS TO DEGENERATE HESSIAN EQUATIONS

Keywords: Mathematics Subject Classification. 35J60; 35J70 Degenerate Hessian equations, local solution, convex solution, Nash-Moser-Hörmander iteration

In this work, we prove the existence of local convex solution to the following k-Hessian equation

Introduction

In this work, we study the following k-Hessian equation :

(1.1) S k [u] = f (y, u, Du),
on the open domain Ω ⊂ R n with 2 ≤ k ≤ n, where f ≥ 0 is defined on Ω × R × R n with f (y 0 , u 0 , p 0 ) = 0. When u ∈ C 2 , the k-Hessian operator S k [u] is defined by

S k [u] = S k (D 2 u) = σ k [λ(D 2 u)] = 1≤i 1 <i 2 ...<i k ≤n λ i 1 λ i 2 . . . λ i k ,
where S k (D 2 u) is the sum of all k-order principal minors of the Hessian matrix (D 2 u), and λ(D 2 u) = (λ 1 (D 2 u), . . . , λ n (D 2 u)) are the eigenvalues of the matrix (D 2 u). One origin of k-Hessian operator is from Christoffel-Minkowski problem, see [START_REF] Guan | Convex hypersurfaces of prescribed curvatures[END_REF][START_REF] Guan | The Christoffel-Minkowski problem I: Convexity of solutions of a Hessian equation[END_REF][START_REF] Guan | The Christoffel-Minkowski problem II: Weingarten curvature equations[END_REF][START_REF] Guan | The Christoffel-Minkowski problem III: existence and convexity of admissible solutions[END_REF] and references therein, another one is from calibrated geometries in [START_REF] Harvey | Calibrated geometries[END_REF]. The background of k-Hessian operator in terms of differential geometry can also be found in Section 4, [START_REF] Ivochkina | The Gårding cones in the modern theory of fully nonlinear second order differential equations[END_REF]. When f > 0, the solutions u of (1.1) is considered with λ(D 2 u) in the so-called Gårding cone :

Γ k (n) = {λ = (λ 1 , λ 2 , . . . , λ n ) ∈ R n ; σ j (λ) > 0, 1 ≤ j ≤ k}.
If f ≥ 0, the equation (1.1) is called degenerate, in this case, we consider the solutions with λ(D 2 u) ∈ Γk (n) = {λ ∈ R n ; σ j (λ) ≥ 0, 1 ≤ j ≤ k}.

A function u ∈ C 2 is called to be k-convex, if λ(D 2 u) ∈ Γk (n). The n-convex function is simply called convex. The convexity of solutions of (1.1) is an important problem in the field of geometries analysis, including usual convexity, power convexity, log-convexity, or quasi-convexity.

For example, in the study of Christoffel-Minkowski problem (see [START_REF] Guan | Convex hypersurfaces of prescribed curvatures[END_REF][START_REF] Guan | The Christoffel-Minkowski problem I: Convexity of solutions of a Hessian equation[END_REF][START_REF] Guan | The Christoffel-Minkowski problem II: Weingarten curvature equations[END_REF][START_REF] Guan | The Christoffel-Minkowski problem III: existence and convexity of admissible solutions[END_REF]), an important subject is to prove the existence of a convex body with prescribed area measure of suitable order, this is equivalent to prove the microscopic convexity principle (constant rank theorem) for some k-Hessian type equation on the unit sphere S n . There is also a strong connection between convexity properties of solutions to elliptic and parabolic partial differential equations and Brunn-Minkowski type inequalities for associated variational functionals, see [START_REF] Liu | A Brunn-Minkowski inequality for the Hessian eigenvalue in threedimensional convex domain[END_REF][START_REF] Ma | The convexity of solution of a class Hessian equation in bounded convex domain in R 3[END_REF][START_REF] Paolo | Convexity of solutions and Brunn-Minkowski inequalities for Hessian equations in R 3[END_REF]. When Guan [START_REF] Guan | The Dirichlet problem for Hessian equations on Riemannian manifolds[END_REF] uses subsolution in place of all curvature restrictions on ∂Ω to construct local barriers for boundary estimates, it is an assumption that there exists a locally strictly convex function in C 2 (Ω), see Theorem 1.1 and 1.3, [START_REF] Guan | The Dirichlet problem for Hessian equations on Riemannian manifolds[END_REF].

The microscopic convexity principle, with applications in geometric equations on manifolds, has been established in [START_REF] Bian | A microscopic convexity principle for nonlinear partial differential equations[END_REF] for the very general fully nonlinear elliptic and parabolic operators of second order. Guan, Spruck and Xiao [START_REF] Guan | Interior curvature estimates and the asymptotic plateau problem in hyperbolic space[END_REF] point out that the asymptotic Plateau problem for finding a complete strictly locally convex hypersurface is reduced to the Dirichlet problem for a fully nonlinear equation, a special form of which is the k-Hessian equation, see Corollary 1.11, [START_REF] Guan | Interior curvature estimates and the asymptotic plateau problem in hyperbolic space[END_REF] and they have proved the existence of such hypersurface, it is especially interesting that they have proved that, if ∂Ω is strictly (Euclidean) star-shaped about the origin, so is the unique solution, see Theorem 1.5, [START_REF] Guan | Interior curvature estimates and the asymptotic plateau problem in hyperbolic space[END_REF]. For the k-Hessian equation with k = 2, n = 3, the power convexity for Dirichlet problem of equation (1.1) with f = 1, and log-convexity for the eigenvalue problem have been studied in [START_REF] Liu | A Brunn-Minkowski inequality for the Hessian eigenvalue in threedimensional convex domain[END_REF][START_REF] Ma | The convexity of solution of a class Hessian equation in bounded convex domain in R 3[END_REF], see also [START_REF] Paolo | Convexity of solutions and Brunn-Minkowski inequalities for Hessian equations in R 3[END_REF]. The above convexity results are established on two facts, one is that the equations are elliptic, another is that the existence of classical (at least C 2 ) solution has already known or can be proved. However, in many important geometric problem, the associated k-Hessian equation is degenerate (see [START_REF] Han | Isometric embeddings of Riemannian manifolds in Euclidean spaces[END_REF]), and for the degenerate elliptic k-Hessian equation, one can only prove the existence of C 1,1 solution for Dirichlet problem ( [START_REF] Ivochkina | The Dirichlet problem for degenerate Hessian equations[END_REF]).

In this paper, we study the convexity of solution with following definition: for a convex domain E, the function v ∈ C(E) is said to be strictly convex if v(ty + (1t)z) < t v(y) + (1t)v(z), 0 < t < 1, y, z ∈ E, y z.

Which, in case v ∈ C 2 (E), is equivalent to (1.2) n i, j=1
(y iz i )(y jz j ) 1 0 1 0 ∂ 2 v ∂x i ∂x j (x(s, µ)) dµ ds > 0 with x(s, µ) = (sµ + (1s)t)y + (s(1µ) + (1s)(1t))z, this shows that the positive definiteness of Hessian matrix (D 2 v) is a sufficient condition for the strict convexity, but not necessary. However if u ∈ C 2 is a k-convex solution of S k [u] = f (y) ≥ 0 with 2 ≤ k < n and f (y 0 ) = 0, then S k+1 [u](y 0 ) > 0 will never occur, so that there are two possibilities: 1) S k+1 [u](y 0 ) < 0, in this case, u is not (k + 1)-convex; 2) S k+1 [u](y 0 ) = 0, in this case, it is shown in Theorem 1.1 of [START_REF] Tian | Local solvability of the k-Hessian equations[END_REF] that, if S k [u](y 0 ) = S k+1 [u](y 0 ) = 0, then S l [u](y 0 ) = 0 for k ≤ l ≤ n. In particular, if f ≡ 0, since the case S k+1 [u] > 0 will never occur, then either S k+1 [u] < 0 in some open subset of Ω or S k+1 [u] ≡ 0 in Ω itself, in the former case u is not (k + 1)-convex and let alone strictly convex; in the latter case, S l [u] ≡ 0 for k ≤ l ≤ n, then the graph (y; u(y)) for k = 2 has the vanishing sectional curvature and must be a cylinder or a plane, see [START_REF] Shiohama | Cylinders in Euclidean space E 2+n[END_REF] and [START_REF] Ushakov | Developable surfaces in Euclidean space[END_REF], meanwhile the graph (y; u(y)) for k > 2, by Lemma 3.1 of [START_REF] Hartman | On isometric immersions in Euclidean space of manifolds with non-negative sectional curvatures[END_REF], is a surface of constant nullity (at least) nk + 1 and then is a (nk + 1)-ruled surface. Therefore if f ≡ 0, the solution u to (1.1) is not strictly convex (at least) along the rulings.

Motivated by above analysis, in this work, we study the local solutions for the following equation, 2 ≤ k ≤ n,

(1.3) S k [u] = K(y)g(y, u, Du) ,
with the following assumptions (H)

           K ∈ C ∞ is nonnegative in a neighbourhood of y 0 ∈ R n , K(y 0 ) = 0, Rank (D 2 K)(y 0 ) ≥ n -k + 1, g ∈ C ∞ near Z 0 = (y 0 , u 0 , p 0 ) and g(Z 0 ) > 0.
This assumption is independent of coordinates. Our main Theorem is :

Theorem 1.1. If K, g satisfy the assumption (H), then for any s ≥ 2[ n 2 ] + 5, the equation (1.3) admits a strictly convex H s -local solution in a neighbourhood of y 0 ∈ R n .

Remark that u = 1 2 n-1 i=1 y 2 i + 1 12 y 4
n is a strictly convex solution of the following Monge-Ampère equation : det D 2 u = y 2 n . But the Hessian matrix (D 2 u) is not positive definite at origin. This article is arranged as follow: In Section 2, we will introduce the idea of how to construct convex local solution in terms of K(y). In Section 3, we will construct the first order approximate solution ψ(y) which is strictly convex. The Section 4 will be devoted to proving the degenerate ellipticity of the linearized operator of S k [u] around ψ. In Section 5, we will use Lax-Milgram theorem to prove the existence of H 0 -weak solution and their a priori H s -estimates. In Section 6, we will prove the existence of k-convex solution by the Nash-Moser-Hörmander iteration procedure. In section 7, we will prove the strict convexity of the local solution obtained in Section 6. Section 8, as an appendix, is devoted to the estimates of eigenvalues and eigenvectors for a matrix after a small perturbation, the conclusion of which is a generalization of Lemma 1.1 of [START_REF] Hong | Exitence of C ∞ local solutions for the Monge-Ampére equation[END_REF].

Schema of construction of convex local solutions

The assumption (H) is independent of coordinates. Now we choose special coordinates under which the leader term of the solution can be explicitly expressed. Since the degeneracy is come from the term K, for the simplicity of notations and also computation, we suppose that (B)

g ≡ 1, Rank (D 2 K)(y 0 ) = n -k + 1.
By a translation y → y + y 0 and a change of unknown function u → uu(y 0 ) -Du(y 0 ) • y, we can assume Z 0 = (0, 0, 0). On the other hand, the solution is searched for locally, that is, we assume without loss of generality that K(y) is defined in some neighborhood of origin and

(2.1)

K(y) = n j=k c j y 2 j + O(|y| 3 )
where 2c j > 0, k ≤ j ≤ n are the positive eigenvalues of (D 2 K)(0). In order to describe the "localness", small ε > 0 is introduced by the change of variables y = ε 2 x, we fix a domain

Ω = Q π × Q δ 0 ⊂ R k-1 × R n-k+1
with δ 0 > 0 being chosen small later and

x ′ = (x 1 , • • • , x k-1 ), x ′′ = (x k , • • • , x n ), Q π = {x ′ ∈ R k-1 ; |x i | < π, 1 ≤ i ≤ k -1}, Q δ 0 = {x ′′ ∈ R n-k+1 ; n i=k |x i | 2 < δ 2 0 }.
We will determine some ε 0 > 0 and study the equation (1.3) in the following form

(2.2) S k [u] = K in Ω ε 0 = y = ε 2 0 x; x ∈ Ω with (2.3) K(y) = (1 -χ(ε -2 y ′ )) n i=k c i y 2 i + χ(ε -2 y ′ )K(y),
where

χ(x ′ ) ∈ C ∞ 0 (Q π ) is a cutoff function equal to 1 if |x ′ | ≤ π 2 , equal to zero if |x ′ | ≥ π, and 0 ≤ χ ≤ 1 .
The local solution of (2.3) is also the one of (1.3). The aim of introduce of function χ(x ′ ) is to guarantee the periodicity with respect to variable x ′ for nonhomogeneous terms and the coefficients of all the linearized equations, which is important and convenient for existence of solution because the linearized operator L G (w) of (4.1) may be degenerate in the direction x ′ .

We will construct the local solution of equation (2.2) in the following form

(2.4) u(y) = 1 2 k-1 j=1 τ j y 2 j + P(y) + ε 17 2 w(ε -2 y).
So the construction of solution is by three steps:

1) Solutions of the homogeneous equation

Let τ = (τ 1 , • • • , τ k-1 , 0, • • • , 0) with τ 1 > • • • > τ k-1 > 0, then the convex function (2.5) ϕ(y) = 1 2 k-1 j=1 τ j y 2 j
satisfies the homogenous equation S k [ϕ] = 0, and the linearized operators

(2.6) L ϕ = n j=1 σ k-1, j (τ)∂ 2 j is degenerate elliptic with σ k-1, j (τ) = 0, 1 ≤ j ≤ k -1; σ k-1, j (τ) = σ k-1 (τ) = k-1 l=1 τ l > 0, k ≤ j ≤ n.
We have also

S k+1 [ϕ] = • • • = S n [ϕ] = 0.
Remark that, in [START_REF] Tian | C ∞ local solutions of elliptical 2-Hessian equation in R 3[END_REF][START_REF] Tian | Local solvability of the k-Hessian equations[END_REF], we choose τ ∈ ∂Γ k (n) with σ k+1 (τ) < 0, so ϕ is not (k + 1)convex; also the solutions constructed in [START_REF] Chen | Smooth local solutions to Weingarten equations and k-equations[END_REF] must not be (k + 1)-convex, because in these cases every linearized operator (2.6) is uniformly elliptic. But in present work, we want to construct the local strictly convex solution, so we can't make that choice. On the other hand, the function ϕ defined in (2.5) is only weakly convex, so it is difficult to guarantee the convexity after a perturbation.

2) Approximate strictly convex solution

Using the assumption (H) on K, we construct a function P such that (2.7)

ψ(y) = 1 2 k-1 j=1 τ j y 2 j + P(y) satisfies S k [ψ] = K + O(1)ε 9 2 ,
and ψ is strictly convex on Ω ε 0 . The construction of the function P is algebraic by using the assumption (H) of K.

3) Nash-Moser-Hörmander iteration We construct finally the smooth function w such that the function u defined by (2.4) is a local solution of equation (2.2). We use the Nash-Moser-Hörmander iteration procedure:

(2.8)

w 0 = 0, w m+1 = w m + S m ρ m L G (w m )ρ m + θ m △ρ m = g m , in x ∈ Ω.
where {S m } is a family of smoothing operators, (2.9)

g m = -G(w m ) = 1 ε 9 2 S k (ψ + ε 17 2 w m (ε -2 y)) -K , θ m = sup Ω |G(w m )| = g m L ∞ ,
and

L G (w) = n i, j=1 ∂S k (r(w)) ∂r i j ∂ i ∂ j ,
where

r(w) =         k-1 l=1 δ j i δ l j τ l + P i j (ε 2 x) + ε 9 2 w i j (x)         1≤i, j≤n .
The procedure is to prove the existence and the convergence of the sequence w m → w in some Sobolev space with θ m → 0 which imply that the function u defined in (2.4) by w is a local solution of equation (2.2). We also need to prove that the perturbation doesn't destruct the strictly convexity of ψ constructed by (2.7). Remark that the linearized equation is degenerate elliptic, so that there is a loss of the regularity for the à priori estimate of solution ρ m , but the coefficients of linearized operators depends on D 2 w m , so that we need to smoothing the solution ρ m to continue the iteration (2.8) for m ∈ N. This is quite different from the procedure of iteration used in [START_REF] Tian | Local solvability of the k-Hessian equations[END_REF] where the linearized equation is uniformly elliptic.

The first order approximate solutions

Since K(y) attains its minimum 0 at origin, the critical-point theorem implies ∇K(0) = 0. Then we have Proposition 3.1. Suppose that K(y) satisfies assumption (H) and (2.1), then we have the following decomposition

K(y) = K(y ′ , 0) + 1 2 n i=k ∂ 2 K ∂y 2 i (y ′ , 0)y 2 i + R(y)
where K(y ′ , 0) vanishes at y ′ = 0 up to order greater than four and

R(y) = n i=k ∂K ∂y i (y ′ , 0)y i + 1 2 n i, j=k,i j ∂ 2 K ∂y i ∂y j (y ′ , 0)y i y j + O(1)|y ′′ | 3 .
In particulary, for y = ε 2 x, x ∈ Ω, we have

R(y) = O(1)ε 6 .
Formally, if u ∈ C 3,1 is a solution to (1.3), by Taylor expansion

(3.1) u(y) = n i, j=1 u i j (0)y i y j + o(|y| 2 )
substituting (3.1) into (1.3), we see that,

S k (D 2 u(0)) = S k (u i j (0)) = lim y→0 S k (D 2 u(y)) = K(0) = 0.
Therefore, a smooth (at least C 3,1 ) local solution to (1.3) is a solution of S k [u] = 0 plus a small perturbation o(|y| 2 ). So we wish to construct the first order approximate solution as following form

ψ(y) = 1 2 k-1 i=1 τ i y 2 i + P(y) with τ 1 > τ 2 > . . . > τ k-1 > 0, such that S k [ψ] = K + O(1)ε 9 2 ,
which is difficult to arrive at. Our observation is that σ k-1 (τ) n j=k P j j (y) is the main part of S k [ψ], so we only need to find out P(y) to satisfy the weaker version

σ k-1 (τ) n j=k P j j (y) = K -χ(ε -2 y ′ )R(y).
This is our trick how to construct P(y). Let

P(y) ≡ 1 2(n -k + 1)σ k-1 (τ) χ(ε -2 y ′ )K(y ′ , 0) n j=k y 2 j + 1 24σ k-1 (τ) χ(ε -2 y ′ ) n i=k       ∂ 2 K ∂y 2 i (y ′ , 0) -2c i       y 4 i + 1 12 n i=k c i σ k-1 (τ) -4α(n -k) y 4 i + α n j=k n i=k,i j y 2 i y 2 j (3.2)
where

(3.3) 0 < α < 1 16(n -k) 2 + 4(n -k + 1) min k≤ j≤n c j 2σ k-1 (τ)
.

Remark 3.2. Giving an example, K 1 (y) = K 1 (y ′′ ) = n i=k c i y 2 i , then

P(y) = P 1 (y ′′ ) = 1 12 n i=k c i σ k-1 (τ) -4α(n -k) y 4 i + α n j=k n i=k,i j y 2 i y 2 j .
We have

σ k-1 (τ) n j=k P 1 j j (y ′′ ) = K 1 (y ′′ ),
and the strictly convex function

ψ 1 (y) = 1 2 k-1 i=1 τ i y 2 i + P 1 (y ′′ ) satisfies S k (ψ 1 ) = K 1 (y ′′ ) + O(|y ′′ | 4 ).
The direct calculation gives Proposition 3.3. Let P(y) be defined in (3.2), then

(3.4)            σ k-1 (τ) n j=k P j j (y) = K -χ(ε -2 y ′ )R(y); P j j (y ′ , 0) = O(1)|y ′ | 4 , k ≤ j ≤ n, P i j (y) = 8αy i y j , i j, k ≤ i, j ≤ n, and
(3.5) P j j (y) ≥ 4α|y ′′ | 2 , k ≤ j ≤ n.
For small |y|, the minor matrix (P i j ) k≤i, j≤n is strictly diagonally dominant, more explicitly, for fixed k

≤ j 0 ≤ n, (3.6)
P j 0 j 0 (y) ≥ 2α|y ′′ | 2 + n i=k,i j 0 |P i j 0 (y)|.
Proof. From (3.2), we obtain, for fixed k ≤ j ≤ n,

P j j (y) = 1 (n -k + 1)σ k-1 (τ) χ(ε -2 y ′ )K(y ′ , 0) + 1 σ k-1 (τ) χ(ε -2 y ′ )        1 2 ∂ 2 K ∂y 2 j (y ′ , 0) -c j        y 2 j + c j σ k-1 (τ) -4α(n -k) y 2 j + 4α n i=k,i j y 2 i . (3.7)
By (3.7) we have

σ k-1 (τ) n j=k P j j (y) = χ(ε -2 y ′ )        K(y ′ , 0) + 1 2 n i=k ∂ 2 K ∂y 2 i (y ′ , 0)y 2 i        + (1 -χ(ε -2 y ′ )) n j=k c j y 2 j
which proves the first equality in (3.4). Since K(y ′ , 0) vanishes up to order greater than four, we have

P j j (y ′ , 0) = 1 (n -k + 1)σ k-1 (τ) χ(ε -2 y ′ )K(y ′ , 0) = O(1)|y ′ | 4 ,
then the second equality in (3.4) is true. The third equality in (3.4) is obvious. Now we return to (3.7) for P j j (y). Since K(y ′ , 0) ≥ 0, employing (2.1), choosing small |y ′ | and then taking α to satisfy (3.3), we have

P j j (y) ≥ c j 2σ k-1 (τ) -4α(n -k) y 2 j + 4α n i=k,i j y 2 i
which implies (3.5). By virtue of inequality above , for fixed j 0 with k ≤ j 0 ≤ n, we obtain by Cauchy inequality,

P j 0 j 0 (y) ≥ [ c j 0 2σ k-1 (τ) -4α(n -k)]y 2 j 0 + 4α n i=k,i j 0 y 2 i ≥2α|y ′′ | 2 + 1 n -k n i=k,i j 0 c j 0 2σ k-1 (τ) -4α(n -k + 1) y 2 j 0 + 2αy 2 i ≥2α|y ′′ | 2 + n i=k,i j 0 2 n -k |y i y j 0 | 2α c j 0 2σ k-1 (τ) -4α(n -k + 1)
≥2α|y ′′ | 2 + n i=k,i j 0 8α|y i y j 0 | = 2α|y ′′ | 2 + n i=k,i j 0 |P i j 0 (y)|,
so the minor matrix (P i j ) k≤i, j≤n is strictly diagonally dominant and (3.6) is proved.

We will construct the solution as a perturbation of the strictly convex function ψ(y) in the following form,

(3.8) u(y) = ψ + ε 17 2 w(ε -2 y) = 1 2 k-1 j=1 τ j y 2 j + P(y) + ε 17 2 w(ε -2 y), see (2.4)
, where w(x) will be proved to be a smooth function later. By a change of variable x = ε -2 y, the Hessian matrix of u defined in (3.8) is

(3.9) (D 2 u)(ε 2 x) = r =         k-1 l=1 δ j i δ l j τ l + P i j (ε 2 x) + ε 9 2 w i j (x)         .
We study firstly the minor matrix r k-1 = (r i j ) 1≤i, j≤k-1 which is real-valued and symmetric, then there is an orthogonal (k -1)

× (k -1) matrix Q such that Q(x, ε) r k-1 t Q(x, ε) = diag(λ 1 (x, ε), . . . , λ k-1 (x, ε)). Let Q = Q 0 0 I n-k+1,n-k+1 , then Q r t Q =                                        λ 1 0 . . . 0 r 1,k . . . r 1n 0 λ 2 . . . 0 r 2,k . . . r 2n . . . . . . . . . . . . . . . . . . . . . 0 0 . . . λ k-1 r k-1,k . . . r k-1,n r k,1 r k,2 . . . r k,k-1 r k,k . . . r k,n . . . . . . . . . . . . . . . . . . . . . r n,1 r n,2 . . . r n,k-1 r n,k . . . r n,n                                       
, where all terms r i j in the above matrix are in the form

(3.10) r i j (x) = P i j (ε 2 x) + ε
Noticing the existence of χ(ε -2 y ′ ) in P(y), we have

P i j (ε 2 x ′ , ε 2 x ′′ ) = O(1)ε 8 |x ′′ | 2 + O(1)ε 4 |x ′′ | 4 , 1 ≤ i, j ≤ k -1,
applying Lemma 8.1 to the minor matrix r k-1 , we obtain that (3.11)

λ i = τ i + O(1)ε 4 , λ 1 > λ 2 > . . . λ k-1 > 0,
for ε > 0 small enough.

Lemma 3.4. Let r be defined in (3.9), then S k (r

) = ① + ② + ③ with            ① = σ k-1 (λ 1 , . . . , λ k-1 )σ 1 (r kk , . . . , r nn ) -n i=k k-1 j=1 σ k-1, j (λ 1 , . . . , λ k-1 )r 2 ji ② = σ k-2 (λ 1 , . . . , λ k-1 ) σ 2 (r kk , . . . , r nn ) -n i=k n s=k,s i r 2 si + O( m≥k;i≥1 |r mi | 3 ) ③ = k-1 j=3 σ k-j (λ 1 , . . . , λ k-1 )O( m≥k;i≥1 |r mi | 3 ) + O( m≥k;i≥1 |r mi | 3 ), where r mi = r im = O(1)ε 4 for m ≥ k; i ≥ 1.
Proof. Since S k (r) is invariant under orthogonal transform, then S k (r) = S k (Qr t Q). By virtue of (3.11), we can separate S k (Qr t Q), which is the sum of all principal minors of order k of the Hessian (Qr t Q), into three parts : ① are the minors containing

σ k-1 (λ 1 , . . . , λ k-1 ) = k-1
i=1 λ i ; ② are the ones containing all of the elementary symmetric polynomials of (k -2)-order in λ 1 , • • • , λ k-1 ; ③ are the ones containing all of the elementary symmetric polynomials of order ≤ k -3 in λ 1 , . . . , λ k-1 . Proposition 3.5. We have for any w ∈ C 2 (Ω), the function u defined by (3.8) satisfy

(3.12) S k [u](y) = K + O(1)ε 9 2 ,
where O(1) depends on w C 2 and K is defined in (2.3).

Proof. By (3.10) and (3.11), we have

σ k-1 (λ 1 , . . . , λ k-1 ) = σ k-1 (τ) + O(1)ε 4 .
Noticing that r i j = P i j (ε 2 x) + ε

9 2 w i j (x) for i ≥ k or j ≥ k, we obtain S k (r) = ① + ② + ③ with                        ① = [σ k-1 (τ) + ε 4 O(1)] n l=k r ll (ε 2 x) -n l=k k-1 j=1 σ k-1, j (λ 1 , . . . , λ k-1 )r 2 jl (ε 2 x) = σ k-1 (τ) n l=k r ll (ε 2 x) + ε 8 O(1) = σ k-1 (τ) n l=k P ll (ε 2 x) + ε 9 2 O(1) ② = σ k-2 (λ 1 , . . . , λ k-1 ) k≤l 1 ,l 2 ≤n (r l 1 l 1 (ε 2 x)r l 2 l 2 (ε 2 x) -r 2 l 1 l 2 (ε 2 x)) +O(r 3 il (ε 2 x)) = ε 8 O(1) ③ = O(|r 3 il (ε 2 x)|) = ε 12 O(1).
Therefore,

S k (r) = σ k-1 (τ) n j=k P j j (ε 2 x) + O(1)ε 9 2 ,
from which, using (3.4) and recalling y = ε 2 x, we obtain (3.12).

Linearized degenerate elliptic operators

By the construction of Section 3 and Proposition 3.5, we have

(4.1) G(w) = 1 ε 9 2 S k (u) -K = 1 ε 9 2
O(1)ε

9 2 = O(1), So that for any w ∈ C 2 ( Ω), (4.2) θ(w) = sup x∈Ω |G(w)(x)| < +∞
uniformly with respect to ε, and then (4.1) is well-defined for 0

< ε ≤ ε 0 << 1. The linearized operator of G at w is L G (w) = n i, j=1 S i j k (w)∂ i ∂ j ,
where

(4.3) S i j k (w) = ∂S k ∂r i j (w) = ∂S k (r) ∂r i j (w).
Since the matrix (S i j k )(w) and r is simultaneously diagonalizable, see [START_REF] Wang | The k-Hessian equation[END_REF], that is, for any smooth function w, we can find out an orthogonal matrix T (x, ε) satisfying

(4.4)        T (x, ε)(S i j k ) t T (x, ε) = diag ∂σ k (λ(x,ε)) ∂λ 1 , ∂σ k (λ(x,ε)) ∂λ 2 , . . . , ∂σ k (λ(x,ε)) ∂λ n T (x, ε)r t T (x, ε) = diag [λ 1 (x, ε), λ 2 (x, ε), . . . , λ n (x, ε)] ,
where

T i (x, ε) is the corresponding unit eigenvectors of λ i , i = 1, 2, . . . , n.
The linearized operator L G (w) is not guaranteed to be degenerately elliptic, because (λ 1 (x, ε), λ 2 (x, ε), . . . , λ n (x, ε)), as a result of the perturbation by ε 9 2 w i j (x), may be not in Γk . But we have Proposition 4.1. Assume that w C 2 (Ω) ≤ 1 , then the second order differential operators L G (w) + θ∆ is a degenerate elliptic operator if ε > 0 is sufficiently small, where θ is defined in (4.2).

Proof. By the definition of degenerate elliptic operator, we have to prove

A = θ|ξ| 2 + n i, j=1 S i j k ξ i ξ j ≥ 0, for any ξ ∈ R n which is equivalent to prove, A = θ| ξ| 2 + ((S i j k ) t T ξ, t T ξ) = θ| ξ| 2 + (T (S i j k ) t T ξ, ξ) ≥ 0, for any ξ ∈ R n ,
where T is the orthogonal matrix in (4.4), then (4.5)

A = θ| ξ| 2 + k-1 i=1 σ k-1,i (λ(x, ε)) ξ2 i + n i=k σ k-1,i (λ(x, ε)) ξ2 i Since for small ε, we have σ k-1,i (λ(x, ε)) = k-1 j=1 τ j + O(ε) > 0, k ≤ i ≤ n, we only need to prove (4.6) θ + σ k-1,i (λ(x, ε)) ≥ 0, 1 ≤ i ≤ k -1. If σ k (λ(x, ε)) ≥ 0, together with the fact σ j (λ(x, ε)) = σ j (τ 1 , τ 2 , . . . , τ k-1 ) + O(ε) > 0 for 1 ≤ j ≤ k -1, then λ(x, ε) ∈ Γk which yields σ k-1,i (λ(x, ε)) ≥ 0, 1 ≤ i ≤ n.
It is left to consider the case σ k (λ(x, ε)) < 0, in which case, since K ≥ 0,

θ = θ(w) = max x∈Ω |G(w)| = max x∈Ω 1 ε |σ k (λ(x, ε)) -K| ≥ - 1 ε σ k (λ(x, ε)).
Now we prove (4.6) for i = 1 with σ k-1,1 (λ) < 0, the other cases can be proved similarly.

By the definition of G(w) and

σ k (λ) = λ 1 σ k-1,1 (λ) + σ k,1 (λ), θ + 2σ k-1,1 (λ) = θ + 2 σ k (λ) -σ k,1 (λ) λ 1 ≥ - 1 ε σ k (λ) + 2 σ k (λ) -σ k,1 (λ) λ 1 = (- 1 ε + 2 λ 1 )σ k (λ) - 2 λ 1 σ k,1 (λ). (4.7)
Under the assumption σ k-1,1 (λ) < 0 and σ k (λ) < 0, we will distinguish two cases. Case 1. If σ k,1 (λ) ≤ 0, we have by (4.7)

θ + σ k-1,1 > θ + 2σ k-1,1 ≥ (- 1 ε + 2 λ 1 )σ k (λ) - 2 λ 1 σ k,1 (λ) ≥ (- 1 ε + 2 λ 1 )σ k (λ) > 0 provided ε is small enough. Case 2.
Next it is left to consider the case in which

σ k (λ) < 0, σ k,1 (λ) > 0, σ k-1,1 (λ) < 0 hold simultaneously. Using Newton's inequalities for (n -1)-tuple vectors σ k,1 (λ)σ k-2,1 (λ) ≤ (k -1)(n -k) k(n -k + 1) [σ k-1,1 (λ)] 2 , λ ∈ R n
and the fact

σ k-2,1 (λ) = k-1 i=2 τ i + O(ε) > 0, σ k-1,1 (λ) = O(ε), we obtain 0 < σ k,1 ≤ (k -1)(n -k) k(n -k + 1) [σ k-1,1 (λ)] 2 σ k-2,1 (λ) ≤ |O(ε)σ k-1,1 (λ)|.
Back to (4.7), using σ k (λ) < 0, then for ε > 0 small, we have

θ + 2σ k-1,1 ≥ - 1 ε + 2 λ 1 σ k (λ) - 2 λ 1 σ k,1 (λ) ≥ - 2 λ 1 σ k,1 (λ) = -|O(ε)σ k-1,1 (λ)|, which yields θ + σ k-1,1 ≥ θ + 2σ k-1,1 + |O(ε)σ k-1,1 (λ)| ≥ 0 provided ε > 0 small enough. Proof is done.
Equality (4.5) shows that the operator L G (w) + θ∆ may be degenerate elliptic in the directions of ( ξ1 , • • • , ξk-1 ) and is uniformly elliptic in the directions of ( ξk , • • • , ξn ) after the orthogonal transform T (x, ε) which is a perturbation of unit matrix, so we can impose the Dirichlet boundary condition on ∂Q δ 0 (the x ′′ direction), but we can't do that on ∂Q π (the x ′ direction). Instead of treating a Dirichlet boundary value problem, we shall prove the existence, uniqueness and à priori estimates of the solution, which is periodic with respect to x ′ , to the degenerately linearized elliptic equation

(4.8) L G (w)ρ + θ∆ρ = g, in Ω; ρ(x ′ , x ′′ ) is periodic for x ′ ∈ Q π and ρ(x ′ , x ′′ ) = 0 for x ′′ ∈ ∂Q δ 0 ,
in some suitable Hilbert space defined below, this idea is inspired by Hong and Zuily [START_REF] Hong | Exitence of C ∞ local solutions for the Monge-Ampére equation[END_REF] where they consider the case k = n. We introduce the space H s (Ω) (s is an integer), which is the completion of the space of trigonometrical polynomials

ρ(x) = ℓ=(l 1 ,l 2 ,...,l k-1 )∈Z k-1 α ℓ (x ′′ )e √ -1 k-1 j=1 l j x j
with the (complex-valued) coefficients α ℓ subject to the condition

α ℓ (x ′′ ) = α -ℓ (x ′′ ) ∈ C ∞ (Q δ 0 )
, with respect to the norm

ρ 2 s = t+ j≤s ℓ∈Z k-1 (1 + k-1 i=1 l 2 i ) t α ℓ 2 H j (Q δ 0 )
, where H j (Q δ 0 ) is the usual Sobolev space. We define H s 0 (Ω) in the same way by taking α ℓ ∈ C ∞ 0 (Q δ 0 ). We will prove, in the next section, the following Theorem. ]+3+l 0 (Ω) ≤ 1 with nonnegative integer l 0 . Then for any s 0 ∈ N ∪ {0}, one can find a constant ε(s 0 ) such that the equation (4.8) possesses a solution ρ ∈ H s 0 (Ω) provided that g ∈ H s (Ω), 0 ≤ s ≤ s 0 and 0 < ε ≤ ε(s 0 ). If s ≥ 1, the solution is unique . Moreover, (4.9)

       ρ s ≤ C s ( g s + n i, j=1 W i j s+2 ρ L ∞ ), if s > n 2 + 1 + l 0 ; ρ s ≤ C s g s , if s ≤ n
2 + 1 + l 0 holds for some constants C s independent of w and ε. Here W i j (x) = P y i y j (ε 2 x) + ε 9 2 w y i y j (x).

Remark 4.3. Since the equation (4.8) is degenerate elliptic, we can only get the a priori estimate (4.9) with a loss of order 2. This loss of regularity of linearized equation ask us to use the Nash-Moser-Hörmander iteration to deal with the solution of (4.8). By definition of r i j by (3.9), if P(y) = 0, then n i, j=1 (W i j ) s+2 is reduced to (w) s+4 which is introduced in Theorem 1.3 of [START_REF] Hong | Exitence of C ∞ local solutions for the Monge-Ampére equation[END_REF]. When

l 0 = 0, Theorem 4.2 (2 ≤ k ≤ n) is a generalization of Theorem 1.3 (k = n) in [13]. The assumption w C [ n 2 ]+4 (Ω) ≤ 1(l 0 = 1)
is necessary in the estimates of the quadratic error in Lemma 6.2 for f = f (y, u, Du) in Lemma 6.2, although we will not give its estimates of the quadratic error ; while the assumption w C

[ n 2 ]+3 (Ω) ≤ 1(l 0 = 0) is enough in case f = f (y, u)
. The uniqueness for s ≥ 1 follows from (5.4) by taking ν = 0.

À priori estimates of solutions for linearized equations

First of all, using the change of unknown function ρ = ρe µ n j=k x 2 j , we reduce (4.8) to (5.1)

       L(w) ρ = n i, j=1 (S i j k (w) + δ j i θ)∂ i ∂ j ρ + n i=1 b i ∂ i ρ + c ρ = e µ n j=k x 2 j g, in Ω ρ = 0 on ∂Q δ 0 and periodic on Q π .
The coefficients b i and c are expressed as follows.

b i =        -4 n j=k (µx j )S i j k (w), 1 ≤ i ≤ k -1 -4(µx i )θ -4 n j=k (µx j )S i j k (w), k ≤ i ≤ n. c = -2µ n i=k (S ii k (w) + θ) + 4 n i=k n j=k (µx i )(µx j )S i j k (w) + 4θ n i=k (µx i ) 2 .
We would like to prove Theorem 4.2 for (5.1) rather than (4.8), and write ρ instead of ρ, but also not do it directly, we will consider the solution ρ ν to the regularized version of (5.1), i.e., the following uniformly elliptic equation, for 0 < ν < 1,

(5.2)

     L ν ρ ≡ n i, j=1 (S i j k + δ j i θ)∂ i ∂ j ρ + ν△ρ + n i=1 b i ∂ i ρ + cρ = g, in Ω, ρ = 0 on ∂Q δ 0 and periodic on Q π .
We first need the following Lemmas which is standard for the degenerate elliptic operators. So we only point out some important steps for the proof.

Lemma 5.1. Suppose that w is smooth and w C 4 (Ω) ≤ 1. Then there exists two positive constants µ 0 large and ε 0 small such that, for 0 < ε ≤ δ 0 , µ 0 δ 0 ≤ 1, g ∈ H 0 (Ω) and ν > 0, problem (5.2) admits an unique solution ρ ν ∈ H 1 0 (Ω) , which satisfies

(5.3) ρ ν 0 ≤ C 0 g 0 ,
where C 0 is uniform for ν ∈]0, 1[, ε ∈]0, δ 0 ] and independent of w.

Proof. We prove the existence and uniqueness of the solution ρ ν to (5.2) by applying Lax-Milgram Theorem to the bilinear form

< -L ν ρ, ̺ > where < •, • > is the dual pair on H -1 × H 1 0 . The condition w C 4 ≤ 1 yields | < -L ν ρ, ̺ > | ≤ C ρ 1 ̺ 1 , ∀ρ, ̺ ∈ H 1 0
, where C is uniform on 0 < ε < 1, 0 < ν < 1. For the coercivity, the proof of which is almost the same as that of Lemma 1.4, [START_REF] Hong | Exitence of C ∞ local solutions for the Monge-Ampére equation[END_REF], there exist ε 0 > 0 small and large µ > 0 such that (5.4) -< L ν ρ, ρ > ≥ ν Dρ 2 0 + 2σ k-1 (τ) ρ 2 0 , then by using Lax-Milgram Theorem, for g ∈ H 0 (Ω) and ν > 0, problem (5.2) admits an unique solution

ρ ν ∈ H 1 0 (Ω). Since |-< L ν ρ ν , ρ ν > | = | < g, ρ ν > | ≤ g 0 ρ ν 0 , then (5.
3) follows from (5.4).

Similarly to the proof of Theorem 1.3, [START_REF] Hong | Exitence of C ∞ local solutions for the Monge-Ampére equation[END_REF], we have the higher order à priori estimates Lemma 5.2. Suppose that w is smooth and w C [ n 2 ]+3 (Ω) ≤ 1. For s > 0, then there exists ε 0 (s) > 0 small such that, for 0 < ε ≤ ε 0 (s), and g ∈ H s (Ω), the problem (5.2) admits an unique solution ρ ν ∈ H s+1 0 (Ω) , which satisfies

(5.5)        ρ ν s ≤ C s ( g s + n i, j=1 W i j s+2 ρ ν L ∞ ), if s > n 2 + 1; ρ ν s ≤ C s g s , if s ≤ n
2 + 1 where C s is uniform for ν ∈]0, 1], ε ∈]0, ε 0 (s)] and independent of w. Proof. For s = 0, Since -(L ν ρ, ρ) = -(g, ρ), then (5.4) and Cauchy inequality yields ν Dρ 2 0 + ρ 2 0 ≤ C 0 (τ) g 2 0 , where C 0 (τ) is independent of ν, w and ε. On the other hand, for α ∈ N n , |α| ≤ s

(L ν (∂ α ρ), (∂ α ρ)) = (∂ α g, (∂ α ρ)) + ([L ν , ∂ α ]ρ, (∂ α ρ)),
where the commutators is

[L ν , ∂ α ] = - β≤α,|β|≥1 n i, j=1 C αβ ∂ β (S i j k )∂ i ∂ j + n i=1 ∂ β b i ∂ i + ∂ β c ∂ α-β ,
here the coefficients depends on D 2 w, by using the interpolation inequalities, we can get:

1) If s ≤ n 2 + 1, then the condition w C [ n 2 ]+3 (Ω) ≤ 1 imply |([L ν , ∂ α ]ρ, (∂ α ρ))| ≤ εC ρ 2 s . 2) If s > [ n 2 ] + 1, a little involved computation also give |([L ν , ∂ α ]ρ, (∂ α ρ))| ≤ C s ε ρ 2 s + ρ s g s + ρ L ∞ n i, j=1 W i j s+2 ,
where C s depends only on s, so we finish the proof.

With Lemmas 5.1 and 5.2, we can now prove Theorem 4.2.

Proof. The proof of Theorem 4.2. To simplify the computation, we consider only the case l 0 = 0, and prove (4.9) under the assumption w C

[ n 2 ]+3 (Ω) ≤ 1. Now for 0 ≤ s ≤ [ n 2 ]
+ 1, we can apply Banach-Saks Theorem to find a subsequence ρ ν j with ν j = j -2 and an element ρ 0 ∈ H s 0 such that

ρ ν 1 + • • • + ρ ν m m -ρ 0 s → 0 (m → ∞).
Since

ρ ν 1 +•••+ρ νm m
is periodic in x ′ for each m, so is ρ 0 . Back to (5.2), we have

        n i, j=1 (S i j k + δ j i θ)∂ i ∂ j + n i b i ∂ i + c         ρ ν 1 + • • • + ρ ν m m + 1 m m j=1 ν j △ρ ν j = g.
For any test function φ ∈ C ∞ 0 , Lemma 5.1 yields

|( 1 m m j=1 ν j △ρ ν j , φ) L 2 | ≤ △φ 0 1 m m j=1 ν j ρ ν j 0 ≤ C 0 △φ 0 g 0 1 m m j=1 ν j → 0,
taking m → ∞, we have that ρ 0 is a solution of (4.8) in the sense of distribution :

n i, j=1 (S i j k + δ j i θ)∂ i ∂ j ρ 0 + n i b i ∂ i ρ 0 + cρ 0 = g.
Moreover, by Lemma 5.2

ρ 0 s = lim m→∞ ρ ν 1 + • • • + ρ ν m m s ≤ C s g s , for 0 ≤ s ≤ [ n 2 ] + 1.
Now we prove (4.9) for s >

[ n 2 ] + 1. Since Lemma 5.2 yields ρ ν [ n 2 ]+1 ≤ C [ n 2 ]+1 g [ n 2 ]+1 ,
by Sobolev imbedding theorem , ρ ν L ∞ < ∞, moreover if n i, j=1 W i j s+2 < ∞, then (5.5) shows that

ρ ν s ≤ C < ∞ for s > [ n 2 ] + 1,
then, by weak compactness theorem, there is a subsequence ρ v j of ρ v and ρ 0 such that ρ ν j → ρ 0 in the weak topology of W s,2 (Ω) and

ρ ν j -ρ 0 L ∞ (Ω) → 0, ρ ν j -ρ 0 W 1,2 (Ω) → 0,
therefore ρ 0 is periodic in x ′ , ρ 0 ∈ H s 0 (Ω), and by Lemma 5.2 again

ρ 0 s ≤ lim inf j→∞ ρ ν j s ≤ C s ( g s + n i, j=1 W i j s+2 ρ 0 L ∞ ),
so we complete the proof of (4.9).

Nash-Moser-Hörmander iteration

We prove firstly the existence of k-convex local solution of (2.2) as a perturbation of ψ constructed in Section 3 by employing the Nash-Moser-Hömander iteration, which is based on the à priori estimates established in last section. Since the linearized operators is degenerate elliptic, a loss of regularity of order 2 has occurred for the solution of linearized equation, so we need to mollify the solution by taking a family of smoothing operators S (t), t ≥ 1 such that S (t) : ∪ s≥0 H s 0 (Ω) -→ ∩ s≥0 H s (Ω) with the following properties: (6.1)

S (t)u s 1 ≤ C s 1 s 2 u s 2 , if s 1 ≤ s 2 , (6.2) S (t)u s 1 ≤ C s 1 s 2 t s 1 -s 2 u s 2 , if s 1 ≥ s 2 , (6.3) S (t)u -u s 1 ≤ C s 1 s 2 t s 1 -s 2 u s 2 , if s 1 ≤ s 2 ,
where C s 1 s 2 is independent of t and depends only on s 1 , s 2 , see [START_REF] Alinhac | Opérateurs pseudo-différentiels et théorème de Nash-Moser[END_REF] for more detailed properties of smoothing operators. Now we define S m = S (µ m ) with µ m = σ γ m where σ > 1, γ > 1 to be determined later, we use the following iteration procedure:

(6.4)            w 0 = 0, w m+1 = w m + S m ρ m , L(w m )ρ m = L G (w m )ρ m + θ m △ρ m = g m , x ∈ Ω ρ m ∈ H s 0 (Ω), g m ∈ H s (Ω).
where g m and θ m are defined in (2.9), G(w) is defined in (4.1).

Remember we are studying the equation (4.3) in the variables x rather than y = ε 2 x, and

u m (y) = 1 2 k-1 j=1 τ j y 2 j + P(y) + ε Denoting M(s) = g 0 s + ε 4 n i, j=1 P i j (ε 2 •) s-1 , N(s) = M(s) + n i, j=1 P i j (ε 2 •) s+2 1 + M n 2 + 1
which are small if ε > 0 small. We prove the à priori estimates by induction.

Lemma 6.1. Suppose that w l C [ n 2 ]+3 ≤ 1 for 0 ≤ l ≤ m. Then (6.5) g m s ≤ C s (M(s) + w m s+2 )
and

(6.6) w m+1 s+4 ≤ C m+1 s µ β m+1 N(s), for β = 4 γ -1 ,
where C s is independent of m and γ.

Proof. We prove first (6.5). Remembering

r m =         k-1 l=1 δ j i δ l j τ l + P i j (ε 2 x) + ε 9 2 (w m ) i j (x)        
using Taylor expansion and w 0 = 0, we have

-g m = G(w m ) = G(w 0 ) + 1 0 ∂ ∂t [G(tw m )]dt = -g 0 + 1 0 n i, j=1 S i j k (r m (t)) ∂ 2 w m ∂x i ∂x j dt.
Hence

g m s ≤ g 0 s + n i, j=1 |α|+β|≤s C β α ∂ α S i j k (r m )∂ β ( ∂ 2 w m ∂x i ∂x j ) 0 . By using w m C [ n 2 ]+3 ≤ 1, we have |α|+|β|≤s,|α|≤[ n 2 ]+1 ∂ α S i j k (r m )∂ β ( ∂ 2 w m ∂x i ∂x j ) 0 ≤ C |β|≤s ∂ β ( ∂ 2 w m ∂x i ∂x j ) 0 ≤ C w m s+2 .
On the other hand, by interpolation and

w m C [ n 2 ]+3 ≤ 1, |α|+|β|≤s,|α|>[ n 2 ]+1 ∂ α S i j k (r m )∂ β ( ∂ 2 w m ∂x i ∂x j ) 0 = |α|+|β|≤s,|α|>[ n 2 ]+1 ∂ α-[ n 2 ]-1 ∂ [ n 2 ]+1 S i j k (r m )∂ β ( ∂ 2 w m ∂x i ∂x j ) 0 ≤C |α|+|β|≤s,|α|>[ n 2 ]+1 ∂ [ n 2 ]+1 S i j k (r m ) L ∞ ∂ i ∂ j w m |α|+|β|-[ n 2 ]-1 + ∂ [ n 2 ]+1 S i j k (r m ) |α|+|β|-[ n 2 ]-1 ∂ i ∂ j w m L ∞ ≤C |α|+|β|≤s,|α|>[ n 2 ]+1 w m |α|+|β|-[ n 2 ]+1 + ∂ [ n 2 ]+1 S i j k (r m ) |α|+|β|-[ n 2 ]-1 ≤C w m s-[ n 2 ]+1 + C n i, j=1 (W m ) i j s ,
where

(W m ) i j (x) = P y i y j (ε 2 x) + ε 9 2 (w m ) y i y j (x).
Therefore

S i j k (r m ) ∂ 2 w m ∂x i ∂x j s ≤ C w m s+2 + C w m s-[ n 2 ]+1 + C n i, j=1 (W m ) i j s ≤ C w m s+2 + C n i, j=1
(W m ) i j s .

Thus

g m s = G(w m ) s ≤ G(w 0 ) s + 1 0 ∂ ∂t [G(tw m )] s dt ≤ g 0 s + C w m s+2 + C ∂ 3 u m s-2 . Remembering ∂ x ∂ x i ∂ x j [u m (y) | y=ε 2 x ] = ε 4 ∂ x (W m ) i j (x) = ε 4 ∂ x [P i j (ε 2 x) + ε 9 2 (w m ) i j (x)],
we have

g m s ≤ g 0 s + Cε 4 n i, j=1 P i j (ε 2 •) s-1 + C w m s+2 ≤ C s (M(s) + w m s+2 ),
this completes the proof of (6.5).

We prove now (6.6). By using (6.2) and (6.4), we have

w m+1 s+4 ≤ w m s+4 + S m ρ m s+4 ≤ w m s+4 + C s µ 4 m ρ m s .
The à priori estimate (4.9) and Sobolev imbedding theorem yield

ρ m s ≤ C( g m s + n i, j=1 (W i j ) s+2 ρ m L ∞ ) ≤ C( g m s + n i, j=1 (W i j ) s+2 ρ m [ n 2 ]+1 ) ≤ C( g m s + n i, j=1 (W i j ) s+2 g m [ n 2 ]+1 ) ≤ C M(s) + w m s+2 + C n i, j=1 P i j (ε 2 •) s+2 + w m s+4 × M([ n 2 ] + 1) + w m [ n 2 ]+3
≤ C (N(s) + w m s+4 ) .

(6.7)

Thus we get (6.8)

w m+1 s+4 ≤ w m s+4 + C s µ 4 m ρ m s ≤ Cµ 4 m (N(s) + w m s+4 ),
then by using w 0 = 0 and µ m = σ γ m , the iteration of (6.8) gives

w m+1 s+4 ≤ C m s (m + 1)σ 4 γ m+1 -1 γ-1 N(s), if we choose C s > 1, C ′ s = 2C s , and β = 4 γ-1 , then w m+1 s+4 ≤ (C ′ s ) m+1 µ β m+1 N(s)
. This completes the proof of (6.6). Lemma 6.2. Suppose w l C [ n 2 ]+4 ≤ 1 for l = 0, 1, . . . , m. Then for any given s * > s > 1, there exists σ > 1, γ > 1 and a > 0 such that (6.9)

g m+1 0 + g m+1 L ∞ ≤ µ -a m+1 N(s * ).
Proof. By Taylor formula with remainder and (6.4), we consider the quadratic error of G(w m+1 )

-g m+1 = G(w m+1 ) = G(w m + S m ρ m ) = G(w m ) + L G (w m )S m ρ m + 1 0 (1 -t) ∂ 2 ∂t 2 [G(w m + tS m ρ m )]dt = [G(w m ) + L(w m )ρ m ] + L(w m )(S m -I)ρ m -θ m △S m ρ m + 1 0 (1 -t) ∂ 2 ∂t 2 [G(w m + tS m ρ m )]dt = L(w m )(S m -I)ρ m -θ m △S m ρ m + 1 0 (1 -t) ∂ 2 ∂t 2 [G(w m + tS m ρ m )]dt = (A) + (B) + 1 0 (1 -t)(C)dt .
For the last terms, we have

(C) = ∂ 2 ∂t 2 [G(w m + tS m ρ m )] = n i, j,p,l=1 ∂ 2 S k ∂r i j ∂r pl (w m + tS m ρ m )(S m ρ m ) i j (S m ρ m ) pl
Noticing ∂ 2 S k ∂r i j ∂r pl (r) is a polynomial of order k -2, we have, by Sobolev imbedding theorem, à priori estimate (4.9), (6.5) and (6.2),

S m ρ m [ n 2 ]+3 ≤ Cµ 2 m ρ m [ n 2 ]+1 ≤ Cµ 2 m g m [ n 2 ]+1 ≤ Cµ 2 m (M([ n 2 ] + 1) + w m [ n 2 ]+3 ) ≤ Cµ 2 m ,
and

∂ 2 S k ∂r i j ∂r pl (w m + tS m ρ m ) L ∞ ≤ D 2 w m + tD 2 S m ρ m k-2 L ∞ ≤ [ D 2 w m L ∞ + D 2 S m ρ m L ∞ ] k-2 ≤ [1 + S m ρ m [ n 2 ]+3 ] k-2 ≤ (C ′ ) k-2 µ 2(k-2) m . Then (6.2) yields (C) 0 ≤ n i, j,p,l=1 ∂ 2 S k ∂r i j ∂r pl (w m + tS m ρ m ) L ∞ (S m ρ m ) i j L ∞ (S m ρ m ) pl 0 ≤C k-2 µ 2(k-2) m S m ρ m [ n 2 ]+3 S m ρ m 2 ≤ C k-2 µ 2(k-2)+[ n 2 ]+5 m ρ m 2 0 ≤C k-2 µ 2(k-2)+[ n 2 ]+5 m g m 2 0
. By (6.3), (6.7) and (6.6), we have

(A) 0 = L(w m )(S m -I)ρ m 0 ≤ C (S m -I)ρ m 2 ≤ CC s * µ -(s * -2) m ρ m s * ≤ C ′ s * µ -(s * -2) m C m+1 s * µ β m N(s * ).
By (6.2) and the à priori estimate (4.9),

(B) 0 = θ m △S m ρ m 0 ≤ Cθ m S m ρ m 2 ≤ Cθ m µ 2 m ρ m 0 ≤ Cθ m µ 2 m g m 0 .
Now by combining the estimates of (A), (B) and (C) , we obtain (6.10)

g m+1 0 ≤ C µ -(s * -2-β) m C m+1 s * N(s * ) + θ m µ 2 m g m 0 + µ 2(k-2)+[ n 2 ]+5 m g m 2 0 .
Since θ m = g m L ∞ by (2.9), we need to prove two estimates in (6.9) together. By same computation, using Sobolev imbedding, we have (6.11)

g m+1 L ∞ ≤ Cµ [ n 2 ]+1 m [µ -(s * -2-β) m C m+1 s * N(s * ) + g m L ∞ µ 2 m g m 0 + µ 2(k-2)+[ n 2 ]+5 m g m 2 0 ].
By comparing the powers of µ m on both sides of (6.10) and (6.11), we can choose a > 0 and large s * > s such that (6.12)

2(k -2) + 2[ n 2 ] + 6 + aγ ≤ 2a -1 s * -[ n 2 ] -3 -β ≥ aγ + 1 .
Noticing that µ m+1 = µ γ m , we can change (6.10) and (6.11) as

Cµ a m+1 g m+1 0 ≤C 2 µ -(s * -2-β-aγ) m C m+1 s * N(s * ) + g m L ∞ µ aγ+2 m g m 0 + µ aγ+2(k-2)+[ n 2 ]+5 m g m 2 0 , Cµ a m+1 g m+1 L ∞ ≤C 2 µ [ n 2 ]+1 m µ -(s * -2-β-aγ) m C m+1 s * N(s * ) + g m L ∞ µ aγ+2 m g m 0 + µ aγ+2(k-2)+[ n 2 ]+5 m g m 2 0
, from which we obtain, by using (6.12) and µ m > 1, (6.13)

       Cµ a m+1 g m+1 0 ≤ C 2 µ -1 m C m+1 s * N(s * ) + g m L ∞ µ 2a-1 m g m 0 + µ 2a-1 m g m 2 0 Cµ a m+1 g m+1 L ∞ ≤ C 2 µ -1 m C m+1 s * N(s * ) + g m L ∞ µ 2a-1 m g m 0 + µ 2a-1 m g m 2 0 . Noticing γ > 1, we can choose σ = σ(s * ) > 1 so large that µ -1 m = σ -γ m < 1 2 and (6.14) C 2 µ -1 m C m+1 s * = C 2 σ -γ m C m+1 s * = C 2 C s * σ 1 m+1 γ m m+1 ≤ 1 4 .
Inserting such σ(s * ) into (6.13), we have

Cµ a m+1 g m+1 0 ≤ 1 4 N(s * ) + 1 2 C 2 g m L ∞ µ 2a m g m 0 + 1 2 C 2 µ 2a m g m 2 0 Cµ a m+1 g m+1 L ∞ ≤ 1 4 N(s * ) + 1 2 C 2 g m L ∞ µ 2a m g m 0 + 1 2 C 2 µ 2a m g m 2 0 . Set d m+1 = max{Cµ a m+1 g m+1 0 , Cµ a m+1 g m+1 L ∞ }, we get Cµ a m+1 g m+1 0 ≤ 1 4 N(s * ) + d 2 m Cµ a m+1 g m+1 L ∞ ≤ 1 4 N(s * ) + d 2 m . So we obtain, (6.15) d m+1 ≤ 1 4 N(s * ) + d 2 m .
Since

g 0 0 = G(w 0 ) 0 = G(0) 0 = O(ε), g 0 L ∞ = O(ε),
we choose ε(σ) > 0 small such that N(s * ), g 0 L ∞ and g 0 0 small. By (6.13), (6.14) and g 0 0 ≤ g 0 s * ≤ N(s * ), we have

d 1 ≤ 1 4 N(s * ) + 1 4 g 0 0 ≤ 1 2 N(s * ).
By induction and (6.15), we see that

d m+1 ≤ 1 2 N(s * ),
this completes the proof of (6.9).

Remark 6.3. The estimates in Lemma 6.1 and 6.2, obtained only in the special case f = f (y), are also true for the general case f = f (y, u) or f = f (y, u, Du). Here we only give it as an example the estimate of (C) 0 in the proof of Lemma 6.2. In fact, from (6.5), and à priori estimate (4.9), it follows that if

w m [ n 2 ]+3 ≤ 1, w m + tS m ρ m L ∞ ≤ w m L ∞ + S m ρ m L ∞ ≤1 + S m ρ m [ n 2 ]+1 ≤ 1 + C ρ m [ n 2 ]+1 ≤1 + C g m [ n 2 ]+1 ≤ 1 + C(M([ n 2 ] + 1) + w m [ n 2 ]+3 ) ≤ C ′ . and similarly, if w m [ n 2 ]+4 ≤ 1, ∇w m + t∇S m ρ m L ∞ ≤ ∇w m L ∞ + ∇S m ρ m L ∞ ≤ C ′ , so we have similar estimates (C) 0 ≤ Cµ 2(k-2)+[ n 2 ]+5 m g m 2 0 . for the quadratic error of f = f (y, u) or f = f (y, u, Du).
Existence of k-convex solution of Theorem 1.1

Now we employ the Nash-Moser-Hörmander iteration to prove the existence of solution of main theorem with s ≥ 2[ n 2 ] + 5. We shall prove by induction that, there exists ε 0 > 0 small such that, for any ε ∈]0, ε 0 ] (6. [START_REF] Liu | A Brunn-Minkowski inequality for the Hessian eigenvalue in threedimensional convex domain[END_REF] w m s ≤ 1, ∀m ∈ N.

Since w 0 = 0, we may assume that (6.16) holds for 0 ≤ l ≤ m, which, by Sobolev imbedding theorem, guarantees the assumption of Lemma 6.1 and 6. .

By (6.6), it follows that, for 0 ≤ l ≤ m,

ρ l s * ≤ (C ′ s * ) l µ β l N(s * ) with µ l = σ γ l , σ > 1, γ > 1, β = 4
γ-1 , and by (6.9), ρ l 0 ≤ C g l 0 ≤ C ′ µ -a l N(s * ), thus

w m+1 s ≤ C s m l=0 (C ′ s * ) l s s * µ β s s * -a(1-s s * ) l N(s * ).
So that we can choose s * large enough such that

β s s * -a(1 - s s * ) = -ã < 0. We choose ε 0 = ε 0 (σ) > 0 smaller to make N(s * ) small enough such that for s ≥ 2[ n 2 ] + 5, w m+1 s ≤ C s ∞ l=0 (C ′ s * ) l s s * µ -ã l N(s * ) ≤ 1
This completes the proof of (6.16). On one hand, by (6.16) there is a subsequence of w m , still denoted by itself, such that w m → w in weak topology of H s (Ω), s ≥ 2[ n 2 ] + 5 and w m → w in C [ n 2 ]+4 . Hence

g m = -G(w m ) → -G(w) in C [ n 2 ]+2 (Ω).
On the other hand, by using (6.16), Lemma 6.2 can be applied for all m ∈ N, letting m → ∞ in (6.9) and recalling (2.9), we see that G(w) = 0, thus

u(y) = 1 2 k-1 i=1 τ i y 2 i + P(y) + ε 17 2 w(ε -2 y) ∈ H s (Ω)
is a local solution of the Hessian equation (1.1).

Strict convexity of local solution

In this section, we will prove that the smooth k-convex local-solution obtained in Section 6 is locally strict convex under the hypothesis of Theorem 1.1, that is, by (1.2) we need to prove that, for 0 < t < 1, y, z ∈ Ω, y z,

(7.1) n i, j=1 1 0 1 0 u i j (x(s, µ))dµds(y i -z i )(y j -z j ) > 0 with x(s, µ) = (sµ + (1 -s)t)y + (s(1 -µ) + (1 -s)(1 -t))z. Recalling from (3.9), (u i j ) 1≤i, j≤n = r =         k-1 l=1 δ j i δ j τ l + P i j (ε 2 x) + ε 9 2 w i j (x)         ,
we separate this matrix into two parts: one is

r i j = k-1 l=1 δ j i δ l j τ l + P i j (ε 2 x) + ε 9 2 w i j (x), 1 ≤ i, j ≤ k -1,
the principal term of which is k-1 l=1 δ j i δ l j τ l and obviously can control the perturbation term P i j (ε 2 x) + ε 5 w i j (x) for small ε > 0. The other is r i j = P i j (ε 2 x) + ε 9 2 w i j (x), i ≥ k or j ≥ k, for which, in order to control the perturbation term, our idea is to prove (7.2)

w i j (x ′ , 0) = w i jp (x ′ , 0) = 0, k ≤ p ≤ n, if i ≥ k or j ≥ k.
Then the Taylor expansion with respect to

x ′′ = (x k , • • • , x n ) w i j (x) = w i j (x ′ , x ′′ ) = w i j (x ′ , 0) + n p=k w i jp (x ′ , 0)x p + O(|x ′′ | 2 ), yields r i j (x) = P i j (ε 2 x) + ε 9 2 O(|x ′′ | 2
), i ≥ k or j ≥ k, which, together with (3.6), implies the minor matrix (r i j ) k≤i, j≤n is strictly diagonally dominant with

       |r i j | ≤ O(1)ε 4 |x ′′ | + O(1)ε 9 2 |x ′′ | 2 , 1 ≤ i ≤ k -1, k ≤ j ≤ n, r j 0 j 0 (x) = P j 0 j 0 (ε 2 x) + ε 9 2 w j 0 j 0 (x) ≥ αε 4 |x ′′ | 2 + n i=k,i j 0 |r i j 0 |, k ≤ j 0 ≤ n. Choose ε > 0 small (ε ≪ α) enough such that, for k ≤ j ≤ n, r j j (x) - n i=k,i j |r i j (x)| ≥ α ε 4 |x ′′ | 2 , Then Cauchy inequality yields n i, j=1 r i j ξ i ξ j ≥ 1 2 k-1 i=1 τ i |ξ i | 2 + 2 1≤i≤k-1,k≤ j≤n O(1)[ε 4 |x ′′ | + ε 9 2 |x ′′ | 2 ]ξ i ξ j + n i=k αε 4 |x ′′ | 2 |ξ i | 2 ≥ 1 4 k-1 i=1 τ i |ξ i | 2 + 1 2 n i=k αε 4 |x ′′ | 2 |ξ i | 2 , ∀ξ ∈ R n
from which, it follows that (7.1) holds. In fact , setting ξ = yz and recalling

x ′′ = x ′′ (s, µ) = (sµ + (1 -s)t)y ′′ + (s(1 -µ) + (1 -s)(1 -t))z ′′ , we have n i, j=1 1
0 1 0 u i j (x)dµds(y i -z i )(y j -z j ) ≥         1 4 k-1 i=1 τ i |y i -z i | 2 + 1 2 αε 4 b(t) n i=k |y i -z i | 2         > 0 with b(t) = 1 0 1 0 |[sµ + (1 -s)t]y ′′ + [s(1 -µ) + (1 -s)(1 -t)]z ′′ | 2 dµds > 0,
for any 0 < t < 1 and y ′′ z ′′ , this inequality is true because

(s, µ) ∈ [0, 1] × [0, 1]; sµ + (1 -s)t y ′′ + s(1 -µ) + (1 -s)(1 -t) z ′′ = 0
lies on a hyperbolic curve in the (s, µ)-plane and then its Lebesgue measure for dµds is zero. So that u is strictly convex on Ω.

We prove now (7.2) by the following two lemmas. From the explicit expression of P(y) in (3.2) together with u(0) = 0 and ∇u(0) = 0, we see that w(0) = 0 and ∇w(0) = 0. Moreover, we have Lemma 7.1. Let u be a solution of equation (2.2) in the form of (3.8) with w C 3 ≤ 1, then

(7.3) w i j (x ′ , 0) = 0, i ≥ k or j ≥ k. Proof. By (3.2), P i j (ε 2 x) | x ′′ =0 = 0 for i j, i ≥ k or j ≥ k, then r i j | x ′′ =0 = ε 9 2 w i j (x ′ , 0), i j, i ≥ k or j ≥ k. and n i=k k-1 j=1 r 2 ji (x ′ , 0)σ k-2, j (λ 1 , . . . , λ k-1 ) = O(1)ε 9 . P ii (ε 2 x ′ , 0) = O(1)ε 8 for k ≤ i ≤ n, thus, for k ≤ j ≤ n, r j j (x ′ , 0) = P j j (ε 2 x ′ , 0) + ε
Inserting the above estimates into S k (r) = ① + ② + ③ in Lemma 3.4 and then multiplying both sides by ε -9 2 , we obtain

σ k-1 (λ 1 , . . . , λ k-1 ) n j=k w j j (x ′ , 0) = ε 9 2 O(1).
Letting ε → 0 + , we get n j=k w j j (x ′ , 0) = σ 1 (w kk (x ′ , 0), w k+1,k+1 (x ′ , 0), . . . , w nn (x ′ , 0)) = 0.

Using now the identity

2σ 2 (λ) = [σ 1 (λ)] 2 - m i=1 λ 2 i , ∀λ = (λ 1 , • • • , λ m ) ∈ R m , it follows that 2σ 2 (r kk (x ′ , 0), r k+1,k+1 (x ′ , 0), . . . , r nn (x ′ , 0)) =[ n j=k r j j (x ′ , 0)] 2 - n j=k [r j j (x ′ , 0)] 2 =[ε 8 O(1) + ε 9 2 n j=k w j j (x ′ , 0)] 2 - n j=k [ε 8 O(1) + ε 9 2 w j j (x ′ , 0)] 2 =O(1)ε 16 - n j=k [O(1)ε 8 + ε 9 2 w j j (x ′ , 0)] 2 .
Multiplying by ε -9 on both sides of S k (r) = ① + ② + ③ in Lemma 3.4, taking x ′′ = 0 and letting ε → 0, we obtain

n i=k k-1 j=1 w 2 ji (x ′ , 0) = n j=k [w j j (x ′ , 0)] 2 = n i=k n s=k,s i w 2 si (x ′ , 0) = 0
and then (7.3) is true.

Using now (7.3), the Taylor expansion of r i j = P i j (ε 2 x) + ε 9 2 w i j (x) for i ≥ k or j ≥ k is of the following version

r i j (x) = P i j (ε 2 x) + ε 9 2 n p=k w i jp (x ′ , 0)x p + 1 2 ε 9 2 n p,q=k w i jpq (x ′ , 0)x p x q + O(1)ε 9 2 |x ′′ | 3 , where w C [ n 2 ]+3 ≤ 1 is required. Similar to the proof of Lemma 7.1, we can obtain n i=k w iip (x ′ , 0) = n i=k w iipp (x ′ , 0) = 0, k ≤ p ≤ n.
And also :

Lemma 7.2. Let u be a solution of equation (2.2) in the form of (3.8), and w C

[ n 2 ]+4 ≤ 1, then w i jp (x ′ , 0) = 0, i ≥ k or j ≥ k, k ≤ p ≤ n.

Appendix

In this section, we will estimate the eigenvalues and eigenvectors of the following Hessian matrix

r = (r i j ) 1≤i, j≤n =         k-1 l=1 δ j i δ l j τ l + ε wi j (x)         1≤i, j≤n
which is a small perturbation of diagonal matrix k-1 l=1 δ j i δ l j τ l 1≤i, j≤n . For any function w ∈ C 2 , we can find out an orthogonal matrix T (x, ε) satisfying

T (x, ε) r t T (x, ε) = diag [λ 1 (x, ε), λ 2 (x, ε), . . . , λ n (x, ε)] , Let T (x, ε) =                    T 1 T 2 . . . T n                    , T (x, ε) | ε=0 = Id
with T i = (T i1 , T i2 , . . . , T in ) the corresponding unit eigenvectors of λ i , i = 1, 2, . . . , n. In [START_REF] Hong | Exitence of C ∞ local solutions for the Monge-Ampére equation[END_REF], there also exists such an orthogonal matrix T (x, ε), the estimates of good regularity for all of its entries can be easily obtained because all of its eigenvalues are different from each other. Now we can only give the estimates of T i for 1 ≤ i ≤ k -1, because in our case λ j (x, ε) (k ≤ j ≤ n) are around zero and there is no distinct gap among them, they are not necessarily smooth in x and ε, so are the corresponding eigenvectors

T i (x, ε) (k ≤ i ≤ n).
But the following estimates are enough for us.

Proposition 8.1. Suppose that w is smooth and w

C 3 ≤ 1. Then, T i (x, ε), 1 ≤ i ≤ k -1, is smooth in (x, ε) ∈ Ω × [0, ε 0 ] for some positive 0 < ε 0 ≪ 1, and k-1 i=1 |λ i -τ i | ≤ Cε n i, j=1 | wi j (x)|, n i=k |λ i | ≤ Cε 1 2 ( n i, j=1 | wi j (x)|) 1 2 , (8.1) k-1 i=1 |T ii (x, ε) -1| + k-1 i=1 n j=1, j i |T i j (x, ε)| ≤ Cε n i, j=1 | wi j (x)|, (8.2) k-1 i=1 n j=1 |DT i j (x, ε)| ≤ Cε n i, j,l=1 | wi jl (x)| (8.3) with C independent of ε and w. Moreover, if w(x) is periodic in x i (1 ≤ i ≤ k -1)
, then so is each of T i j , while T i j has the same regularity as D 2 w and is C

∞ in ε for 1 ≤ i ≤ k -1, 1 ≤ j ≤ n. Proof. Noting F(t) = det(r -t I).
Now we denote R(x, ε), R i (x, ε) and R i j (x, ε) as the different functions, which are smooth in x , ε and w, with the properties

(8.4) |R(x, ε)| + |R i (x, ε)| + |R i j (x, ε)| ≤ Cε n i, j=1 | wi j (x)|
and C being independent of x and ε. Firstly, using the condition w C 2 ≤ 1 and 0 < ε 0 ≪ 1, we have

F(t) = k-1 i=1 (τ i -t)t n-k+1 + R(x, ε). Noticing τ 1 > τ 2 > . . . > τ k-1 > 0, we take δ = 1 4 min 1≤i≤k-2 (1 -τ i+1 τ i , τ i τ i+1 -1) > 0 if k > 2 and δ = 1 4 if k = 2. For fixed i 0 with 1 ≤ i 0 ≤ k -1, we have F((1 -δ)τ i 0 ) = i 0 -1 i=1 (τ i -(1 -δ)τ i 0 )δτ i 0 k-1 i=i 0 +1 (τ i -(1 -δ)τ i 0 )((1 -δ)τ i 0 ) n-k+1 + R 1 (x, ε)
and

F((1 + δ)τ i 0 ) = - i 0 -1 i=1 (τ i -(1 + δ)τ i 0 )δτ i 0 k-1 i=i 0 +1 (τ i -(1 + δ)τ i 0 )((1 + δ)τ i 0 ) n-k+1 + R 2 (x, ε).
By the choice of δ, we have

τ i -(1 + δ)τ i 0 > δτ i 0 -1 , 1 ≤ i ≤ i 0 -1 and τ i -(1 -δ)τ i 0 < -δτ i 0 +1 , i 0 + 1 ≤ i ≤ k -1,
therefore, when 0 < ε ≪ δτ k-1 , we obtain F((1δ)τ i 0 )F((1 + δ)τ i 0 ) < 0 and, by virtue of intermediate value theorem, there exists an eigenvalue, denoted by λ i 0 , such that

(1δ)τ i 0 < λ i 0 < (1 + δ)τ i 0 , F(λ i 0 ) = 0, which yields

τ i -λ i 0 ≥ τ i -(1 + δ)τ i 0 > δτ k-1 , 1 ≤ i ≤ i 0 -1 and τ i -λ i 0 ≤ τ i -(1 -δ)τ i 0 < -δτ k-1 , i 0 + 1 ≤ i ≤ k -1.
From 0 = F(λ i 0 ) = i 0 -1 i=1 (τ iλ i 0 )(τ i 0λ i 0 ) k-1 i=i 0 +1 (τ iλ i 0 )(λ i 0 ) n-k+1 + R 3 (x, ε), it follows that

τ i 0 -λ i 0 = - R 3 (x, ε) i 0 -1
i=1 (τ iλ i 0 ) k-1 i=i 0 +1 (τ iλ i 0 )(λ i 0 ) n-k+1 and then λ i 0 = τ i 0 + R 4 (x, ε). Now we have proved that there are eigenvalues (λ i ) k-1 i=1 such that

λ i = τ i + R(x, ε), 1 ≤ i ≤ k -1.
Let us express all the eigenvalues as (λ i ) n i=1 . Then, since w This completes the proof of (8.1). Now we pass to prove (8.2). Let T 1 be the eigenvector corresponding to λ 1 , then T 1 satisfies the linear equation rT 1λ 1 T 1 = 0 and rank(rλ 1 I) ≤ n -1. To solve T 1 , we will use the Gaussian elimination procedure. Noticing λ i = τ i + R(x, ε) for 1 ≤ i ≤ k -1, we can write the matrix rλ 1 I as

                                      
T 1n                                        = T 11                                          1 R 21 (x,ε) τ 1 -τ 2 -R 22 (x,ε) . . . R k-1,1 (x,ε) τ 1 -τ k-1 -R k-1,k-1 (x,ε) R k,1 (x,ε) τ 1 -R k-1,k-1 (x,ε) . . . R n,1 (x,ε) τ 1 -R nn (x,ε)                                         
, with T 11 0, (8.6) and each R i j (x, ε) has the property (8.4). Because we need T 1 (x, ε) | ε=0 = (1, 0, . . . , 0), we can choose suitable T 11 > 0 such that T 1 = 1, then T 1 = (T 11 , T 12 , . . . , T 1n ) satisfies (8.2). The vectors T i (2 ≤ i ≤ k -1) can be obtained by the same way as T 1 . Also it follows from (8.6) that (8.2) and (8.3) hold.

Because each entry of the matrix r = (r i j ) is periodic in x 1 , . . . , x k-1 and the elementary operations above do not change the periodicity, then each T i (1 ≤ i ≤ k -1) is also periodic. Also by (8.6), when 1 ≤ i ≤ k -1, T i j has the same regularity as D 2 w and is C ∞ in ε.

Remark 8.2. Since λ i , k ≤ i ≤ n, are all around 0, then (8.5) shows that they are not necessarily smooth in x and ε, so are the corresponding eigenvectors T i .

Theorem 4 . 2 .

 42 Let w be smooth and w C [ n 2

  2. Interpolation inequality and (6.1) yield, for any 0 ≤ s ≤ s * ,

C 3 ≤ 1 ,τ| 1 2

 11 i + R(x, ε), S 2 (r) = σ 2 (τ 1 , . . . , τ k-1 ) + R(x, ε). Since S k (r) is invariant under orthogonal transformation, then k-1 i=1 τ i + R(x, ε) = S 1 (r) = σ 1 (λ) = τ 1 , . . . , τ k-1 ) + R(x, ε) = S 2 (r) = σ 2 (λ). from which, using 2σ 2 (λ) = σ 1 (λ) 2λ) = σ 2 (τ 1 , . . . , τ k-1 )wi j (x)|) , k ≤ i ≤ n.

 21 R 22 + τ 2 -τ 1

 212221                                       Since each R j j , 2 ≤ j ≤ k -1, is dominated by τ jτ 1 and each R ii , k ≤ i ≤ n, is dominated by τ 1 , then rank(rλ 1 I) = n -1.Taking the (row) elementary operations repeatedly, we can transform rλ 1 I and still denote it as                                       R n,nτ 1 .                                       Since rank(rλ 1 I) = n -1, we see that R 11 ≡ 0 and the solutions of the equation rT1λ 1 T 1 = 0 is in the form                                       

w i j (x).

w m (ε -2 y).

w j j (x ′ , 0) = ε 8 O(1) + ε

w j j (x ′ , 0).

Acknowledgements. The research of first author is supported by the National Science Foundation of China No.11171339 and Partially supported by National Center for Mathematics and Interdisciplinary Sciences. The research of the second author was supported partially by"The Fundamental Research Funds for Central Universities of China".


Hongxin Hu
email: hxhu@asu.edu

Gail-Joon Ahn
email: gahn@asu.edu

Multiparty Authorization Framework for Data Sharing in Online Social Networks

Keywords: Social network, Multiparty, Access control, Privacy, Data sharing

Online social networks (OSNs) have experienced tremendous growth in recent years and become a de facto portal for hundreds of millions of Internet users. These OSNs offer attractive means for digital social interactions and information sharing, but also raise a number of security and privacy issues. While OSNs allow users to restrict access to shared data, they currently do not provide effective mechanisms to enforce privacy concerns over data associated with multiple users. In this paper, we propose a multiparty authorization framework that enables collaborative management of shared data in OSNs. An access control model is formulated to capture the essence of multiparty authorization requirements. We also demonstrate the applicability of our approach by implementing a proof-of-concept prototype hosted in Facebook.

Introduction

In recent years, we have seen unprecedented growth in the application of OSNs. For example, Facebook, one of representative social network sites, claims that it has over 500 million active users and over 30 billion pieces of shared contents each month [START_REF]Facebook Statistics[END_REF], including web links, news stories, blog posts, notes and photo albums. To protect user data, access control has become a central feature of OSNs [START_REF]Facebook Privacy Policy[END_REF][START_REF]Myspace Privacy Policy[END_REF].

A typical OSN provides each user with a virtual space containing profile information, a list of the user's friends, and web pages, such as wall in Facebook, where users and friends can post contents and leave messages. A user profile usually includes information with respect to the user's birthday, gender, interests, education and work history, and contact information. In addition, users can not only upload a content into their own or others' spaces but also tag other users who appear in the content. Each tag is an explicit reference that links to a user's space. For the protection of user data, current OSNs indirectly require users to be system and policy administrators for regulating their data, where users can restrict data sharing to a specific set of trusted users. OSNs often use user relationship and group membership to distinguish between trusted and untrusted users. For example, in Facebook, users can allow friends, friends of friends, specific groups or everyone to access their data, relying on their personal authorization and privacy requirements.

Although OSNs currently provide simple access control mechanisms allowing users to govern access to information contained in their own spaces, users, unfortunately, have no control over data residing outside their spaces. For instance, if a user posts a comment in a friend's space, s/he cannot specify which users can view the comment. In another case, when a user uploads a photo and tags friends who appear in the photo, the tagged friends cannot restrict who can see this photo, even though the tagged friends may have different privacy concerns about the photo. To address such an issue, preliminary protection mechanisms have been offered by existing OSNs. For example, Facebook allows tagged users to remove the tags linked to their profiles. However, removing a tag from a photo can only prevent other members from seeing a user's profile by means of the association link, but the user's image is still contained in the photo. Since original access control policies cannot be changed, the user's image continues to be accessed by all authorized users. Hence, it is essential to develop an effective and flexible access control mechanism for OSNs, accommodating the special authorization requirements coming from multiple associated users for collaboratively managing the shared data.

In this paper, we propose a multiparty authorization framework (MAF) to model and realize multiparty access control in OSNs. We begin by examining how the lack of multiparty access control for data sharing in OSNs can undermine the protection of user data. A multiparty authorization model is then formulated to capture the core features of multiparty authorization requirements which have not been accommodated so far by existing access control systems and models for OSNs (e.g., [START_REF] Carminati | Rule-based access control for social networks[END_REF][START_REF] Carminati | Enforcing access control in web-based social networks[END_REF][START_REF] Fong | Relationship-Based Access Control: Protection Model and Policy Language[END_REF][START_REF] Fong | A privacy preservation model for facebook-style social network systems[END_REF][START_REF] Kruk | D-FOAF: Distributed identity management with access rights delegation[END_REF]). Meanwhile, as conflicts are inevitable in multiparty authorization specification and enforcement, systematic conflict resolution mechanism is also addressed to cope with authorization and privacy conflicts in our framework.

The rest of the paper is organized as follows. Section 2 gives a brief overview of related work. In Section 3, we present multiparty authorization requirements and articulate our proposed multiparty authorization model, including multiparty authorization specification and multiparty policy evaluation. Implementation details and experimental results are described in Section 4. Section 5 concludes this paper.

Related Work

Access control for OSNs is still a relatively new research area. Several access control models for OSNs have been introduced (e.g., [START_REF] Carminati | Rule-based access control for social networks[END_REF][START_REF] Carminati | Enforcing access control in web-based social networks[END_REF][START_REF] Fong | Relationship-Based Access Control: Protection Model and Policy Language[END_REF][START_REF] Fong | A privacy preservation model for facebook-style social network systems[END_REF][START_REF] Kruk | D-FOAF: Distributed identity management with access rights delegation[END_REF]). Early access control solutions for OSNs introduced trust-based access control inspired by the developments of trust and reputation computation in OSNs. The D-FOAF system [START_REF] Kruk | D-FOAF: Distributed identity management with access rights delegation[END_REF] is primarily a Friend of a Friend (FOAF) ontology-based distributed identity management system for OSNs, where relationships are associated with a trust level, which indicates the level of friendship between the users participating in a given relationship. Carminati et al. [START_REF] Carminati | Rule-based access control for social networks[END_REF] introduced a conceptually-similar but more comprehensive trust-based access control model. This model allows the specification of access rules for online resources, where authorized users are denoted in terms of the relationship type, depth, and trust level between users in OSNs. They further presented a semi-decentralized discretionary access control model and a related enforcement mechanism for controlled sharing of informa-tion in OSNs [START_REF] Carminati | Enforcing access control in web-based social networks[END_REF]. Fong et al. [START_REF] Fong | A privacy preservation model for facebook-style social network systems[END_REF] proposed an access control model that formalizes and generalizes the access control mechanism implemented in Facebook, admitting arbitrary policy vocabularies that are based on theoretical graph properties. Gates [START_REF] Carrie | Access Control Requirements for Web 2.0 Security and Privacy[END_REF] described relationship-based access control as one of new security paradigms that addresses unique requirements of Web 2.0. Then, Fong [START_REF] Fong | Relationship-Based Access Control: Protection Model and Policy Language[END_REF] recently formulated this paradigm called a Relationship-Based Access Control (ReBAC) model that bases authorization decisions on the relationships between the resource owner and the resource accessor in an OSN. However, none of these existing work could model and analyze access control requirements with respect to collaborative authorization management of shared data in OSNs.

Recently, semantic web technologies have been used to model and express finegrained access control policies for OSNs (e.g., [START_REF] Brands | Rethinking public key infrastructures and digital certificates: building in privacy[END_REF][START_REF] Elahi | Semantic Access Control in Web Based Communities[END_REF][START_REF] Masoumzadeh | Osnac: An ontology-based access control model for social networking systems[END_REF]). Especially, Carminati et al. [START_REF] Brands | Rethinking public key infrastructures and digital certificates: building in privacy[END_REF] proposed a semantic web based access control framework for social networks. Three types of policies are defined in their framework, including authorization policy, filtering policy and admin policy, which are modeled with the Web Ontology Language (OWL) and the Semantic Web Rule Language (SWRL). Access control policies regulate how resources can be accessed by the participants; filtering policies specify how resources have to be filtered out when a user fetches an OSN page; and admin policies can determine who is authorized to specify policies. Although they claimed that flexible admin policies are needed to bring a system to a scenario where several access control policies specified by distinct users can be applied to the same resource, the lack of formal descriptions and concrete implementation of the proposed approach leaves behind the ambiguities of their solution.

The need of joint management for data sharing, especially photo sharing, in OSNs has been recognized by the recent work [START_REF] Besmer | Moving beyond untagging: Photo privacy in a tagged world[END_REF][START_REF] Squicciarini | Collective privacy management in social networks[END_REF][START_REF] Wishart | Collaborative Privacy Policy Authoring in a Social Networking Context[END_REF]. The closest work to this paper is probably the solution provided by Squicciarini et al. [START_REF] Squicciarini | Collective privacy management in social networks[END_REF] for collective privacy management in OSNs. Their work considered access control policies of a content that is co-owned by multiple users in an OSN, such that each co-owner may separately specify her/his own privacy preference for the shared content. The Clarke-Tax mechanism was adopted to enable the collective enforcement of policies for shared contents. Game theory was applied to evaluate the scheme. However, a general drawback of their solution is the usability issue, as it could be very hard for ordinary OSN users to comprehend the Clarke-Tax mechanism and specify appropriate bid values for auctions. In addition, the auction process adopted in their approach indicates that only the winning bids could determine who can access the data, instead of accommodating all stakeholders' privacy preferences. In contrast, our work proposes a formal model to address the multiparty access control issue in OSNs, along with a general policy specification scheme and a simple but flexible conflict resolution mechanism for collaborative management of shared data in OSNs.

Other related work include general conflict resolution mechanisms for access control [START_REF] Fisler | Verification and changeimpact analysis of access-control policies[END_REF][START_REF] Fundulaki | Specifying access control policies for XML documents with XPath[END_REF][START_REF] Jajodia | A logical language for expressing authorizations[END_REF][START_REF] Jin | Patient-centric authorization framework for sharing electronic health records[END_REF][START_REF] Jin | Patient-centric authorization framework for electronic healthcare services[END_REF][START_REF] Li | Access control policy combining: theory meets practice[END_REF] and learn-based generation of privacy policies for OSNs [START_REF] Fang | Privacy wizards for social networking sites[END_REF][START_REF] Shehab | User Centric Policy Management in Online Social Networks[END_REF][START_REF] Squicciarini | PriMa: an effective privacy protection mechanism for social networks[END_REF]. All of those related work are orthogonal to our work.

Multiparty Authorization for OSNs

In this section, we analyze the requirements of multiparty authorization (Section 3.1) and address the modeling approach we utilize to represent OSNs (Section 3.2). We also introduce a policy scheme (Section 3.3) and an authorization evaluation mechanism (Section 3.4) for the specification and enforcement of multiparty access control policies in OSNs.

Requirements

OSNs provide built-in mechanisms enabling users to communicate and share data with other members. OSN users can post statuses and notes, upload photos and videos in their own spaces, and tag others to their contents and share the contents with their friends. On the other hand, users can also post contents in their friends' spaces. The shared contents may be connected with multiple users. Consider an example where a photograph contains three users, Alice, Bob and Carol. If Alice uploads it to her own space and tags both Bob and Carol in the photo, we call Alice an owner of the photo, and Bob and Carol stakeholders of the photo. All of these users may specify access control policies over this photo. Figure 1(a) depicts a data sharing scenario where the owner of a data item shares the data item with other OSN members, and the data item has multiple stakeholders who may also want to involve in the control of data sharing. In another case, when Alice posts a note stating "I will attend a party on Friday night with @Carol" to Bob's space, we call Alice a contributor of the note and she may want to make the control over her notes. In addition, since Carol is explicitly identified by @-mention (at-mention) in this note, she is considered as a stakeholder of the note and may also want to control the exposure of this note. Figure 1(b) shows another data sharing scenario where a contributor publishes a data item to someone else's space and the data item may also have multiple stakeholders (e.g., tagged users). All associated users should be allowed to define access control policies for the shared data item.

OSNs also enable users to share others' data. For example, when Alice views a photo in Bob's space and selects to share this photo with her friends, the photo will be in turn posted to her space and she can specify access control policies to authorize her friends to see this photo. In this case, Alice is a disseminator of the photo. Since Alice may adopt a weaker control saying the photo is visible to everyone, the initial access control requirements of this photo should be complied with, preventing from the possible leakage of sensitive information via the procedure of data dissemination. For a more complicated case, the disseminated data may be further re-disseminated by disseminator's friends, where effective access control mechanisms should be applied in each procedure to regulate sharing behaviors. Especially, regardless of how many steps the data item has been re-disseminated, the original access control policies should be always enforced to protect the data dissemination.

Modeling Social Networks

An OSN can be represented by a relationship network, a set of user groups and a collection of user data. The relationship network of an OSN is a directed labeled graph, where each node denotes a user, and each edge represents a relationship between users. The label associated with each edge indicates the type of the relationship. Edge direction denotes that the initial node of an edge establishes the relationship and the terminal node of the edge accepts the relationship. The number and type of supported relationships rely on the specific OSNs and its purposes. Besides, OSNs include an important feature that allows users to be organized in groups [START_REF] Zheleva | To join or not to join: the illusion of privacy in social networks with mixed public and private user profiles[END_REF][START_REF] Wondracek | A practical attack to de-anonymize social network users[END_REF], where each group has a unique name. This feature enables users of an OSN to easily find other users with whom they might share specific interests (e.g., same hobbies), demographic groups (e.g., studying at the same schools), political orientation, and so on. Users can join in groups without any approval from other group members. Furthermore, OSNs provide each member with a web space where users can store and manage their personal data including profile information, friend list and user content.

We now formally model and define an online social network as follows:

Definition 1 (Online Social Network). An online social network is modeled as a 9tuple OSN =< U, G, P C, RT, RC, T T, CC, U U, U G >, where -U is a set of users of the OSN. Each user has a unique identifier; -G is a set of groups to which the users can belong. Each group also has a unique identifier; -P C is a collection of user profile sets, {p 1 , . . . , p n }, where p i = {pi 1 , . . . , pi m } is the profile set of a user i ∈ U . Each profile entry is a <attribute: profile value> pair, pi j =< attr j : pvalue j >; -RT is a set of relationship types supported by the OSN. Each user in an OSN may be connected with others by relationships of different types; -RC is a collection of user relationship sets, {r 1 , . . . , r n }, where

r i = {ri 1 , . . . , ri m }
is the relationship set of a user i ∈ U . Each relationship entry is a <user: relationship type> pair, ri j =< u j : rt j >, where u j ∈ U and rt j ∈ RT ; -T T is a set of content types supported by the OSN. Supported content types are photo, video, note, event, status, message, link, and so on; -CC is a collection of user content sets, {c 1 , . . . , c n }, where c i = {ci 1 , . . . , ci m } is a set of contents of a user i ∈ U . Each content entry is a <content: content type> pair, ci j =< cont j : tt j >, where cont j is a content identifier and tt j ∈ T T ; with their groups of interest and their own spaces of data. Note that two users may be directly connected by more than one edge labeled with different relationship types in the relationship network. For example, in Figure 2, Alice (A) has a direct relationship of type colleagueOf with Bob (B), whereas Bob (B) has a relationship of friendOf with Alice (A). Moreover, in this example, we can notice there are two groups that users can participate in: the "Fashion" group and the "Hiking" group, and some users, such as Alice (A) and Edward (E), may join in multiple groups.

Multiparty Authorization Specification

To enable a collaborative authorization management of data sharing in OSNs, it is essential for multiparty access control policies to be in place to regulate access over shared data, representing authorization requirements from multiple associated users. Our policy specification scheme is built upon the above-mentioned OSN model (Section 3.2).

Recently, several access control schemes (e.g., [START_REF] Carminati | Rule-based access control for social networks[END_REF][START_REF] Fong | Relationship-Based Access Control: Protection Model and Policy Language[END_REF][START_REF] Fong | A privacy preservation model for facebook-style social network systems[END_REF]) have been proposed to support fine-grained authorization specifications for OSNs. Unfortunately, these schemes can only allow a single controller (the resource owner) to specify access control policies. Indeed, a flexible access control mechanism in a multi-user environment like OSNs is necessary to allow multiple controllers associated with the shared data item to specify access control policies. As we discussed in Section 3.1, in addition to the owner of data, other controllers, including the contributor, stakeholder and disseminator of data, also desire to regulate access to the shared data. We formally define these controllers as follows: In the context of an OSN, user data is composed of three types of information: User profile describes who the user is in the OSN, including identity and personal information, such as name, birthday, interests and contact information. User relationship shows who the user knows in the OSN, including a list of friends to represent the connections with family members, coworkers, colleagues, and so on. User content indicates what the user has in the OSN, including photos, videos, statuses, and all other data objects created through various activities in the OSN. Formally, we define user data as follows:

Definition 6 (User Data). The user data is a collection of data sets, {d 1 , . . . , d n }, where d i = p i ∪ r i ∪ c i is a set of data of a user i ∈ U representing the user's profile p i , the user's relationship list r i , and the user's content set c i , respectively.

User data in OSNs can be organized as a hierarchical structure, whose leaves represent the instances of data, and whose intermediate nodes represent classifications of data. Figure 3 depicts a hierarchical structure of user data where the root node, user data, is classified into three types, profile, relationship and content. The content is further divided into multiple categories, such as photo, video, note, event, status, etc. In this way, access control policies can be specified over both data classifications and instances. Especially, access control policies specified on classifications can be automatically propagated down in the hierarchy. For instance, if access for the parent node photo is allowed, access for all children nodes of photo is also allowed. As a consequence, such a hierarchical structure of user data can be used to improve the expressiveness of access control policies and simplify the authorization management.

To summarize the aforementioned features and elements, we introduce a formal definition of multiparty access control policies as follows:

-data ∈ d i ∪ T T ∪ DT is a data item di j ∈ d i , a content type tt ∈ T T , or a data type dt ∈ DT = {prof ile, relationship, content}
, where i ∈ U ; -action = view is an action being authorized or forbidden;1 and -ef f ect ∈ {permit, deny} is the authorization effect of the policy.

Note that different representations of accessor in our policy specification scheme have different semantics. If the accessor is represented with a set of user names {u 1 , . . . , u n }, the semantics of this user name set can be explained as u 1 ∨ . . . ∨ u n , which means that any user contained in the user name set is treated as an authorized accessor. On the other hand, if the accessor is expressed as a set of relationship types {rt 1 , . . . , rt n } or a set of group names {g 1 , . . . , g n }, the semantics of the relationship type set or group name set are interpreted as rt 1 ∧ . . . ∧ rt n or g 1 ∧ . . . ∧ g n . Examples of multiparty access control policies are as follows:

1. p 1 = (Alice, OW, {f riendOf }, RN, < statusId, status >, view, permit): Alice authorizes her friends to view her status identified by statusId. In this policy, Alice is an owner of the status. 2. p 2 = (Bob, CB, {colleageOf }, RN, photo, view, permit): Bob authorizes his colleagues to view all photos he publishes to others' spaces. In this policy, Bob is a contributor of the photos.

p 3 = (Carol, ST, {f riendOf, colleageOf }, RN, < photoId, photo >, view, permit):

Carol authorizes users who are both her friends and her colleagues to view one photo photoId she is tagged in. In this policy, Carol is a stakeholder of the photo. Edward authorizes users who are in both groups, f ashion and hiking, to view a video videoId that he disseminates. In this policy, Edward is a disseminator of the video.

Multiparty Policy Evaluation

In our proposed multiparty authorization model, each controller can specify a set of policies, which may contains both positive and negative policies, to regulate access of the shared data item. Two steps should be performed to evaluate an access request over multiparty access control policies. The first step checks the access request against policies of each controller and yields a decision for the controller. Bringing in both positive and negative policies in the policy set of a controller raises potential policy conflicts.

In the second step, decisions from all controllers responding to the access request are aggregated to make a final decision for the access request. Since those controllers may generate different decisions (permit and deny) for the access request, conflicts may occurs again. Figure 4 illustrates potential conflicts identified during the evaluation of multiparty access control policies. In order to make an unambiguous final decision for each access request, it is crucial to adopt a systematic conflict resolution mechanism to resolve those identified conflicts during multiparty policy evaluation.

Policy Conflict Resolution in One Party

In the first step of multiparty policy evaluation, policies belonging to each controller are evaluated in sequence, and the accessor element in a policy decides whether the policy is applicable to a request. If the user who sends the request belongs to the user set derived from the accessor of a policy, the policy is applicable and the evaluation process returns a response with the decision (either permit or deny) indicated by the effect element in the policy. Otherwise, the response yields NotApplicable. In the context of OSNs, controllers generally utilize a positive policy to define a set of trusted users to whom the shared data item is visible, and a negative policy to exclude some specific untrusted users from whom the shared data item should be hidden. Some general conflict resolution strategies for access control have been introduced [START_REF] Fisler | Verification and changeimpact analysis of access-control policies[END_REF][START_REF] Fundulaki | Specifying access control policies for XML documents with XPath[END_REF][START_REF] Jajodia | A logical language for expressing authorizations[END_REF]. For example, deny-overrides (this strategy indicates that "deny" policy take precedence over "allow" policy), allow-overrides (this strategy states that "allow" policy take precedence over "deny" policy), specificity-overrides (this strategy states a more specific policy overrides more general policies), and recencyoverrides (this strategy indicates that policies take precedence over policies specified earlier). We can adopt these strategies to resolve policy conflicts in our conflict resolution mechanism when evaluating a controller's policies. Since some strategies, such as specificity-overrides and recency-overrides are nondeterministic, and deny-overrides strategy is too restricted in general for conflict resolution, it is desirable to combine these strategies together to achieve a more effective conflict resolution. Thus, a strategy chain can be constructed to address this issue, which has been discussed in our previous work [START_REF] Jin | Patient-centric authorization framework for sharing electronic health records[END_REF][START_REF] Jin | Patient-centric authorization framework for electronic healthcare services[END_REF].

Resolving Multiparty Privacy Conflicts When two users disagree on whom the shared data item should be exposed to, we say a privacy conflict occurs. The essential reason leading to the privacy conflicts is that multiple controllers of the shared data item often have different privacy concerns over the data item. For example, assume that Alice and Bob are two controllers of a photo. Each of them defines an access control policy stating only her/his friends can view this photo. Since it is almost impossible that Alice and Bob have the same set of friends, privacy conflicts may always exist considering multiparty control over the shared data item.

A naive solution for resolving multiparty privacy conflicts is to only allow the common users of accessor sets defined by the multiple controllers to access the data. Unfortunately, this strategy is too restrictive in many cases and may not produce desirable results for resolving multiparty privacy conflicts. Let's consider an example that four users, Alice, Bob, Carol and Dave, are the controllers of a photo, and each of them allows her/his friends to see the photo. Suppose that Alice, Bob and Carol are close friends and have many common friends, but Dave has no common friends with them and also has a pretty weak privacy concern on the photo. In this case, adopting the naive solution for conflict resolution may turn out that no one can access this photo. Nevertheless, it is reasonable to give the view permission to the common friends of Alice, Bob and Carol.

A strong conflict resolution strategy may provide a better privacy protection. In the meanwhile, it reduces the social value of data sharing in OSNs. Therefore, it is important to consider the tradeoff between privacy and utility when resolving privacy conflicts. To address this issue, we introduce a flexible mechanism for resolving multiparty privacy conflicts in OSNs based on a voting scheme. Several simple and intuitive strategies can be derived from the voting scheme as well.

Our voting scheme contains two voting mechanisms, decision voting and sensitivity voting. In the decision voting, an aggregated decision value from multiple controllers with respect to the results of policy evaluation is computed. In addition, each controller assigns a sensitivity level to the shared data item to reflect her/his privacy concern. Then, a sensitivity score for the data item can be calculated as well through aggregating each controller's sensitivity level value. Based on the aggregated decision value and the sensitivity score, our decision making approach provides two conflict resolution solutions: automatic conflict resolution and strategy-based conflict resolution. A basic idea of our approach for automatic conflict resolution is that the sensitivity score can be utilized as a threshold for decision making. Intuitively, if the sensitivity score is higher, the final decision is likely to deny access, taking into account the privacy protection of high sensitive data. Otherwise, the final decision is very likely to allow access. Hence, the utility of OSN services cannot be affected. In the second solution, the sensitivity score of a data item is considered as a guideline for the owner of shared data item in selecting an appropriate strategy for conflict resolution. Several specific strategies can be used for resolving multiparty privacy conflicts in OSNs. For example, owner-overrides (the owner's decision has the highest priority), full-consensus-permit (if any controller denies the access, the final decision is deny), majority-permit (this strategy permits a request if over 1/2 controllers permit it), strong-majority-permit (this strategy permits a request if over 2/3 controllers permit it), and super-majority-permit (this strategy permits a request if over 3/4 controllers permit it).

Conflict Resolution for Disseminated Data A user can share others' contents with her/his friends in OSNs. In this case, the user is a disseminator of the content, and the content will be posted in the disseminator's space and visible to her/his friends or the public. Since a disseminator may adopt a weaker control over the disseminated content but the content may be much sensitive from the perspective of original controllers of the content, the privacy concerns from the original controllers of the content should be always complied with, preventing inadvertent disclosure of sensitive contents. In other words, the original access control policies should be always enforced to restrict access to the disseminated content. Thus, the final decision for an access request to the disseminated content is a composition of the decisions aggregated from original controllers and the decision from the current disseminator. In order to eliminate the risk of possible leakage of sensitive information from the procedure of data dissemination, we leverage the restrictive conflict resolution strategy, Deny-overrides, to resolve conflicts between original controllers' decision and the disseminator's decision. In such a context, if either of those decisions is to deny the access request, the final decision is deny. Otherwise, if both of them are permit, the final decision is permit.

Prototype Implementation and Evaluation

To demonstrate the feasibility of our authorization model and mechanism, we implemented a Facebook-based application called MController for supporting collaborative management of shared data. Our prototype application enables multiple associated users to specify their authorization policies and privacy preferences to co-control a shared data item. We currently restrict our prototype to deal with photo sharing in OSNs. Obversely, our approach can be generalized to handle other kinds of data, such as videos and comments, in OSNs as long as the stakeholders of shared data can be identified with effective methods like tagging or searching.

MController is deployed as a third-party application of Facebook, which is hosted in an Apache Tomcat application server supporting PHP and MySQL database. MCon- troller application is based on the iFrame external application approach, adopting the Facebook REST-based APIs and supporting Facebook Markup Language (FBML), where Facebook server acts as an intermediary between users and the application server. Facebook server accepts inputs from users, then forwards them to the application server. The application server is responsible for the input processing and collaborative management of shared data. Information related to user data such as user identifiers, friend lists, user groups, and user contents are stored in the MySQL database. Once a user installs MController in her/his Facebook space, MController can access user's basic information and contents. In particular, MController can retrieve and list all photos, which are owned or uploaded by the user, or where the user was tagged. Then, the user can select any photo to define the privacy preference. If the user is not the owner of selected photo, s/he can only edit the privacy setting and sensitivity setting of the photo. Otherwise, if the user is an owner of the photo, s/he can further configure the conflict resolution mechanism for the shared photo.

A core component of MController is the decision making module, which processes access requests and returns responses (either permit or deny) for the requests. Figure 5 depicts a system architecture of the decision making module in MController. To evaluate an access request, the policies of each controller of the targeted content are enforced first to generate a decision for the controller. Then, the decisions of all controllers are aggregated to yield a final decision as the response of the request. During the procedure of decision making, policy conflicts are resolved when evaluating controllers' policies by adopting a strategy chain pre-defined by the controllers. In addition, multiparty privacy conflicts are resolved based on the configured conflict resolution mechanism when aggregating the decisions of controllers. If the owner of the content chooses automatic conflict resolution, the aggregated sensitivity value is utilized as a threshold for making a decision. Otherwise, multiparty privacy conflicts are resolved by applying the strategy selected by the owner, and the aggregated sensitivity score is considered as a recommendation for the strategy selection. Regarding access requests to the disseminated contents, the final decision is made by combining the disseminator's decision and original controllers' decision through a deny-overrides combination strategy.

A snapshot of MController for owner control is shown in Figure 6, where an owner of a photo can assign weight values to different types of controllers of the shared photo, and select either automatic or manual mechanism for conflict resolution. If the owner chooses manual conflict resolution, s/he can further select an appropriate conflict resolution strategy referring to the recommendation derived from the sensitivity score of the photo. Note that MController currently requires all controllers of a shared photo should define their privacy preferences before applying our authorization mechanism to evaluate the requests. Otherwise, the photo is only visible to the controllers. Since a user may be involved in the control of hundreds of photos, manual input of the privacy preferences is a time-consuming and tedious task. As part of our future work, we would study inference-based techniques [START_REF] Fang | Privacy wizards for social networking sites[END_REF] for automatically configuring controllers' privacy preferences.

To evaluate the performance of the policy evaluation mechanism in MController, we changed the number of the controllers of a shared photo from 1 to 20. Also, we considered two cases for our evaluation. In the first case, each controller has only one positive policy. The second case examines two policies (one positive policy and one negative policy) of each controller. Figure 7 shows the policy evaluation cost while changing the number of the controllers. For both cases, the experimental results show that the policy evaluation cost increased slightly with the increase of the number of the controllers. Also, we can observe that MController performs fast enough to handle even a large number of controllers for collaboratively managing the shared data.

Conclusion and Future Work

In this paper, we have proposed a novel authorization framework that facilitates collaborative management of the shared data in OSNs. We have given an analysis of multiparty authorization requirements in OSNs, and formulated a multiparty access control model. Our access control model is accompanied with a multiparty policy specification scheme and corresponding policy evaluation mechanism. Moreover, we have described a proofof-concept implementation of our approach called MController, which is a Facebook application, along with performance analysis.

As our future work, we will incorporate a logic-based reasoning feature into our approach to provide a variety of analysis services for collaborative management of the shared data. Also, we are planning to conduct extensive user studies to evaluate the usability of our proof-of-concept implementation, MController. In addition, as effective automated algorithms (e.g., facial recognition [START_REF] Choi | Collaborative Face Recognition for Improved Face Annotation in Personal Photo Collections Shared on Online Social Networks[END_REF][START_REF] Stone | Autotagging Facebook: Social network context improves photo annotation[END_REF]) are being developed to recognize people accurately in contents such as photos and then generate tags automatically, access and privacy controls will become even more problematic in the future. Consequently, we would extend our work to explore more sophisticated and effective solutions to address emerging security and privacy challenges for sharing various data in OSNs.

Fig. 1 .

 1 Fig. 1. Scenarios of Multiparty Authorization in OSNs.

Fig. 2 .

 2 Fig. 2. An Example of Social Network Representation.

Fig. 3 .Definition 4 (

 34 Fig. 3. Hierarchical User Data in OSNs.

Fig. 4 .

 4 Fig. 4. Conflict Identification for Multiparty Policy Evaluation.

Fig. 5 .

 5 Fig. 5. System Architecture of Decision Making in MController.

Fig. 6 .

 6 Fig. 6. MController for Owner Control on Facebook.

Fig. 7 .

 7 Fig. 7. Performance of Policy Evaluation Mechanism.

  Definition 7 (Multiparty Access Control Policy). A multiparty access control policy is a 7-tuple P =< controller, ctype, accessor, atype, data, action, ef f ect >, where -controller ∈ U is a user who can regulate access to data; -ctype ∈ {OW, CB, SH, DS} is the type of the controller (owner, contributor, stakeholder, and disseminator, respectively); -accessor is a set of users to whom the authorization is granted, representing with a set of user names, a set of relationship types or a set of group names. Note that patterns are allowed to specify any set by using the the wildcard (*) instead of a specific name; -atype ∈ {U N, RN, GN } is the type of the accessor specification (user name, relationship type, and group name, respectively);

We limit our consideration to view action. The support of more actions such as post, comment, tag, and update does not significantly complicate our approach proposed in this paper.

This work was partially supported by the grants from National Science Foundation (NSF-IIS-0900970 and NSF-CNS-0831360) and Department of Energy (DE-SC0004308).