Sonia Ben Mokhtar
email: sonia.benmokhtar@insa-lyon.fr

Jérémie Decouchant
email: jeremie.decouchant@imag.fr

Vivien Quéma
email: vivien.quema@imag.fr

AcTinG: Accurate Freerider Tracking in Gossip

Gossip-based content dissemination protocols are a scalable and cheap alternative to centralised content sharing systems. However, it is well known that these protocols suffer from rational nodes, i.e., nodes that aim at downloading the content without contributing their fair share to the system. While the problem of rational nodes that act individually has been well addressed in the literature, colluding rational nodes is still an open issue. Indeed, LiFTinG, the only existing gossip protocol addressing this issue, yields a high ratio of false positive accusations of correct nodes. In this paper, we propose AcTinG, a protocol that prevents rational collusions in gossip-based content dissemination protocols, while guaranteeing zero false positive accusations. We assess the performance of AcTinG on a testbed comprising 400 nodes running on 100 physical machines, and compare its behaviour in the presence of colluders against two state-of-the-art protocols: BAR Gossip that is the most robust protocol handling non-colluding rational nodes, and LiFTinG, the only existing gossip protocol that handles colluding nodes. The performance evaluation shows that AcTinG is able to deliver all messages despite the presence of colluders, whereas both LiFTinG and BAR Gossip suffer heavy message loss. It also shows that AcTinG is resilient to massive churn. Finally, using simulations involving up to a million nodes, we show that AcTinG exhibits similar scalability properties as standard gossip-based dissemination protocols.

I. INTRODUCTION

It is well known that content sharing applications account for a large proportion of traffic over the Internet. The most popular of these applications include collaborative downloading (e.g., BitTorrent) and peer-to-peer live streaming (e.g., P2PLive). Relying on the P2P paradigm offers robustness to failures, scalability up to hundreds of thousands of nodes, and adaptability. Indeed, P2P systems can handle massive node arrival/departure and are highly resilient to churn. From the point of view of content providers, relying on a P2P system allows shifting cost (e.g., bandwidth) to clients, and avoids the need for maintaining dedicated servers.

A major problem that face large scale P2P systems deployed on the public domain is the existence of rational nodes, i.e., nodes that aim at receiving content without contributing their fair share, by forwarding it to others. Existing studies have shown that the presence of even a small portion of rational nodes significantly degrades the system performance [START_REF] Adar | Free riding on gnutella[END_REF]- [START_REF] Locher | Free riding in bittorrent is cheap[END_REF]. This is why a number of protocols have been devised in the last decade to deal with the problem of rational nodes in collaborative systems, (e.g., rational resilient live streaming [START_REF] Mol | Give-to-get: free-riding resilient video-on-demand in p2p systems[END_REF]- [START_REF]Lifting: lightweight freerider-tracking in gossip[END_REF], spam filtering content dissemination [START_REF] Mokhtar | Firespam: Spam resilient gossiping in the bar model[END_REF] and Nparty transfer [START_REF] Vilac ¸a | N-party bar transfer[END_REF]). All these protocols provide incentives that encourage/force rational nodes to participate in the system. However, apart from the protocol presented in [START_REF]Lifting: lightweight freerider-tracking in gossip[END_REF], all the existing solutions work under the assumption that rational nodes do not collude. This problem though has been demonstrated to be a reality in existing file sharing applications [START_REF] Qiao | An empirical study of collusion behavior in the maze p2p file-sharing system[END_REF]. Handling colluding nodes is a difficult problem provided that colluders generally perform unobservable actions from the point of view of the collaborative protocol [START_REF] Eidenbenz | Hidden communication in p2p networks steganographic handshake and broadcast[END_REF], which makes their deviations difficult to deter. For example, a group of colluders could be a group of nodes that collaborate to exchange content between each other "off the record" (e.g., using the silent broadcast protocol described in [START_REF] Eidenbenz | Hidden communication in p2p networks steganographic handshake and broadcast[END_REF]). Such colluders do not share with nodes not belonging to the group the content they receive off the record, thus harming the protocol.

To the best of our knowledge, the only gossip-based content dissemination protocol trying to prevent collusions is the LiFTinG protocol [START_REF]Lifting: lightweight freerider-tracking in gossip[END_REF]. In this protocol, nodes log their interactions with other nodes and perform distributed audits of each others logs. In order to be cost effective, this protocol relies on cryptography-free procedures and statistical analysis of these logs. For instance, a node is suspected of colluding with another node if the frequency of its interactions with the latter is greater than an expected average. Unfortunately, as analysed by the authors themselves, due to their statistical nature and to message losses, the mechanisms implemented in LiFTinG do not allow to catch all rational collusions (false negatives), and may even lead to wrong exclusions of correct nodes (false positives). Experiments that we performed, and that are described in Section VI-B, confirm this result and further show that, for instance, when 30% of nodes collude (either in a large group or in small collusion groups), correct nodes observe 25% of message losses.

The challenge we embrace in this paper is the design of a rational-resilient content dissemination protocol that prevents collusions to occur and that does not wrongfully exclude correct nodes. An observation one can start with is: a colluding behaviour can be considered as a Byzantine behaviour [START_REF] Lamport | The byzantine generals problem[END_REF]. A legitimate question is thus to know whether it is possible to rely on existing techniques for Byzantine fault tolerance and Byzantine fault detection, such as Nysiad [START_REF] Ho | Nysiad: practical protocol transformation to tolerate byzantine failures[END_REF], PeerReview [START_REF] Haeberlen | Peerreview: practical accountability for distributed systems[END_REF], Accountable Virtual Machines [START_REF] Andreas | Accountable virtual machines[END_REF], Trinc [START_REF] Levin | Trinc: small trusted hardware for large distributed systems[END_REF], or A2M [START_REF] Byung-Gon | Attested append-only memory: Making adversaries stick to their word[END_REF]? The answer is No. The reason is that these generic solutions for Byzantine fault tolerance and detection either assume a limited proportion of faulty nodes, or the existence of trusted nodes or hardware. Instead, we assume in this paper that all nodes can be rational, and we do not rely on any trusted entity, whether software or hardware.

In this paper, we present AcTinG a content dissemination protocol that tolerates an unlimited number of (possibly colluding) rational nodes, while guaranteeing that no correct node is ever expelled, and that all rational deviations are eventually detected. To reach this objective, we adopt a different approach than the one used in the LiFTinG protocol: rather than trying to detect collusions a-posteriori, we built AcTinG in such a way that it is not in the interest of nodes to collude. We analyse each step of the protocol and describe the incentives that force rational (possibly colluding) nodes to stick to the protocol. We perform a performance evaluation of AcTinG. Its performance is compared with two protocols: BAR Gossip, the state-of-theart gossip protocol that is able to handle non-colluding rational nodes and LiFTinG, the state-of-the-art gossip protocol that is able to handle colluding nodes. We implement a streaming application that we deploy on top of the three protocols. We deploy 400 nodes on one hundred physical machines and show that AcTinG is able to deliver the entire stream despite the presence of colluders, whereas LiFTinG and BAR Gossip, both suffer heavy message losses. We also show that AcTinG is resilient to churn, and using complementary simulations involving up to a million nodes, that it is scalable: it yields a logarithmic growth of memory and bandwidth consumption, comparable to standard gossip based protocols [START_REF] Patrick | Epidemic information dissemination in distributed systems[END_REF].

The rest of the paper is structured as follows. Section II describes our system model. Section III introduces the core ideas of AcTinG. Section IV provides a detailed presentation of AcTinG. Section V discusses its resilience to (colluding) rational nodes. Section VI presents a detailed performance evaluation. Section VII reviews the related works. Section VIII concludes the paper.

II. SYSTEM MODEL

We consider a system with N nodes, which are uniquely identified, e.g., using a hash value of their IP address. We assume that nodes can join and leave the system (gently or by crashing) at any time. We consider two classes of nodes: correct nodes and rational nodes. Correct nodes follow the protocol. Rational nodes are defined as in [START_REF] Li | Bar gossip[END_REF] extended with the notion of collusion: they aim at getting the content (i.e., missing the lowest possible number of updates) at the lowest possible overhead in terms of bandwidth consumption. This means that rational nodes would deviate in any sort from the protocol, possibly by colluding with each other, as long as the deviation saves their resources while not impacting the quality of the content they are getting.

Specifically, the benefit of colluding rational nodes can be represented along the following axes:

1) (Stream Quality) Receiving as much as possible (possibly, all) stream updates, 2) (Communication) Sending as little as possible (possibly, none) stream updates or protocol messages to nodes not belonging to their coalition, 3) (Computation) Performing as little as possible computations for other nodes.

Colluding rational nodes would typically exchange updates off the record, and, in order to save bandwidth, would not share the updates they obtained secretly with nodes outside their group. It is important to note that rational nodes are risk averse, i.e., they never deviate from the protocol if there is any risk of being evicted from the system. This assumption is commonly used in BAR systems [START_REF] Aiyer | Bar fault tolerance for cooperative services[END_REF]. Furthermore, this assumption is particularly relevant in our context as we use accountability techniques to deter faults and accuse nodes (as described in the following section). In this context, when a fault is detected, a proof of misbehaviour is produced, which can convince any correct node in the system of the necessity of evicting the misbehaving node. As eviction corresponds to an infinite penalty, no benefit is worth taking such risk. We also suppose that rational nodes join and remain in the system for a long time and seek a long-term benefit.

We refer to the source as the node that is disseminating a given content. We assume that each content is disseminated from a single source at a time but our principles can be easily applied to systems where the content is disseminated from multiple sources at the same time. We assume that all nodes but the source may be rational, or experience failures, and may organise themselves in colluding groups of arbitrary sizes. Classical fault-tolerance techniques (e.g., [START_REF] Bressoud | Hypervisor-based fault tolerance[END_REF]) can relax the assumption that the source does not fail.

We assume that the network allows every pair of nodes to exchange messages, and that they are eventually received if retransmitted sufficiently often. We also assume that hash functions are collision resistant and that cryptographic primitives cannot be forged. We assume that nodes are provided a pair of asymmetric keys, and denote a message m signed by a node i using its private key as (m) σ(i) .

As in [START_REF] Li | Bar gossip[END_REF] and [START_REF] Li | Flightpath: obedience vs. choice in cooperative services[END_REF], we assume that nodes maintain clocks synchronised within δ seconds, and we structure time as a sequence of rounds in which nodes exchange updates. We assume that nodes have a secure log that is used to check their correctness through its analysis. A secure log is a log that is tamper evident and append only. Many systems recently defined variants of secure logs among which [START_REF] Haeberlen | Peerreview: practical accountability for distributed systems[END_REF]- [START_REF] Byung-Gon | Attested append-only memory: Making adversaries stick to their word[END_REF]. We build on the secure log presented in [START_REF] Haeberlen | Peerreview: practical accountability for distributed systems[END_REF].

III. PROTOCOL OVERVIEW

We present AcTinG, a gossip-based dissemination protocol that guarantees the following two properties: (i) a correct node is never expelled, and (ii) a rational node that deviates from the protocol in a way that impacts the performance of correct nodes is eventually suspected by all correct nodes. In the remainder of this section, we describe the principles of AcTinG that allow us to guarantee the above two properties. Protocol details are then presented in Section IV.

Figure 1 shows an overview of our protocol. In this figure, the source node s, which is the node from which the dissemination originates, cuts the content into chunks that we call updates. It then periodically disseminates these updates to a set of nodes (arrows 1 in the figure). To join this content dissemination session, a new node (p n in the figure) needs node can skip mandatory interactions. We avoid this deviation by overcharging the sending of suspicion messages in such a way that it is more costly to suspect a node of omission failure than to effectively interact with it. As such, nodes would suspect other nodes of omission failures only if they are really missing a given message. Instead, if a node effectively left the system (assume node p z in the figure), its predecessors (among which, node p x in the figure) contact p z 's partners to collect evidence about the effective unresponsiveness of p z (as described in Section IV-A). Then, p x sends this evidence to the source node (arrow 7 in the figure), which eventually updates the membership list, and will also inform its partners during future exchanges. Summarising, our protocol builds on accountability techniques, and on a set of mechanisms to provide incentives to rational, possibly colluding, nodes to stick to the protocol. Specifically, to avoid nodes from selecting their partners, our protocol relies on random yet verifiable partnerships. To be efficient it relies on random yet verifiable audits. To discourage rational nodes from being falsely unresponsive, our protocol handles omission failures. Finally, to discourage nodes from wrongly suspecting their partners our protocol associates an extra cost with suspicion messages.

IV. PROTOCOL DETAILS

We have presented the principles of AcTinG in the previous section. In this section, we detail the steps of the protocol. In a nutshell, AcTinG divides time in rounds. At each round the source disseminates new updates, which come to expiration after RTE rounds, to a small set of randomly chosen nodes. To get updates, each node initiates and maintains partnerships with other nodes with whom it exchanges updates at each round. The partners are selected using a pseudo-random number generator function, i.e., PRNG, seeded deterministically (e.g., with the node's public key concatenated with the round number). At the beginning of a round, each node contacts all of its partners in order to propose updates to them and to request updates from them. Every Period rounds, each node updates its set of partners. Each time a node starts a new partnership with a node, the two nodes audit each others' log with a given probability. The membership is managed in a distributed manner by nodes who periodically inform the source of the arrival and the departure of nodes. Yet, it is the responsibility of the source to disseminate an updated list of alive nodes every Epoch rounds. The remainder of this section describes the sub protocols constituting AcTinG in detail, as follows. First, we present the membership protocol (Section IV-A), which allows dealing with new nodes joining the system, nodes leaving it and unresponsive nodes. Then, we present the partnership management (Section IV-B), the audit (Section IV-C) and the update exchange protocols (Section IV-D), which allow handling the partnerships between nodes, auditing their logs and exchanging updates between partners, respectively.

A. Membership protocol

The membership protocol handles the arrival and the departure of nodes as well as the management of the membership list. Our membership protocol is fully distributed, rational resilient, and handles massive nodes arrival and departure. Node arrival: The arrival of a new node follows the sequence of messages depicted in Figure 2. In this figure, we assume that node p n , which would like to join a given content dissemination session, has installed the AcTinG software. This means that p n has an empty secure log with the related security primitives. We also assume that p n knows an entry point in the system, say p x , which we call the contact node of p n . To join a content dissemination session, p n sends a join request to p x (step (1) in the diagram). The latter replies with the list of active nodes of the current epoch (step [START_REF] Krishnan | The impact of free-riding on peer-to-peer networks[END_REF] in the diagram). Using this list, p n computes its list of new partners using the PRNG function as described in Section IV-B and contacts them to start receiving the content. At the beginning of a new round, each node, including node p x informs the source of the arrival of new members that have contacted it (step (4)). Using theses messages, the source confirms to the new members their integration in the system and updates the membership list (step (5)). Node departure and omission failures: If a node p x is expecting a message from one of its partners p y for too long1 , it suspects p y of omission failure as depicted in the diagram of Figure 3. Specifically, p x adds p y in its local list of suspected nodes (step (1) in the figure) and sends a suspicion message to the other partners of p y (step (2)). This message includes the type of message that p x is expecting from p y . Then, each of p y 's partners pings p y (step (3)). If p y is alive, it replies to both its partners and p x with the missing message (step (4)). After a given time slot, each of p y 's partners replies to p x with a signed message certifying whether p y responded to the ping message or not (step ( 5)). Using this message, p x either removes p y from its list of suspected nodes if p y replied (step (6)) or sends an eviction message to the source including the messages received from p y 's partners. To be sure that a rational node will never suspect a correct node, in order to avoid initiating or accepting an interaction, we make the cost of sending a suspicion message higher than the cost of a normal interaction. Hence, unless it is a real suspicion, a node will never suspect another node.

Membership list update: Periodically, nodes that served as contact nodes for others send their list of new nodes to the source. Furthermore, nodes that hold an evidence of the departure of one partner send it to the source. The latter updates the membership list and sends it, at the beginning of each epoch, to the nodes along with the content. In order to fasten the removal of dead nodes from the membership list, an optimisation consists in letting the source disseminate the list of dead nodes at the beginning of each round along with the stream, instead of waiting the following epoch. As soon as a node receives these incremental updates from the source, it removes the corresponding nodes from its list of alive nodes, which avoids selecting them when new partnerships have to be established before the new epoch. In order to preserve nodes from the massive arrival of new nodes, which may consume bandwidth, we adopt the optimisation defined in [START_REF] Li | Flightpath: obedience vs. choice in cooperative services[END_REF], which allows splitting the load between the older nodes and the new ones. Specifically, this optimisation prevents new nodes from establishing too many partnerships with older nodes.

B. Partnership management

Each node p x maintains partnerships with f other nodes, which are selected with the PRNG function seeded with a deterministically computed seed (e.g., p x 's public key concatenated with the round number) among the non-suspected nodes of the last membership list. This process is depicted in the diagram of Figure 4. If a selected node is not responding, node p x has to propagate a suspicion, and once it is confirmed, p x is allowed to find a new partner. Every Period rounds, a node p x breaks the f partnerships it initiated, without informing its partners which know when the partnerships are supposed to end. A node having an identifier id will change its partnerships during round r if (id + r) mod P eriod = 0. To initiate a new partnership with a node p y , node p x sends an association request to p y (step (2) in the diagram).

At the beginning of a partnership, a node p x may trigger an in-depth audit of its new partner p y (step (4) in the diagram), by contacting the partners p y had in the RTE previous rounds, and asking them to return their own log of the last RTE rounds including the current round (step (5) in the diagram). To reduce the cost of the protocol, nodes perform these audits in a random manner, i.e., each time they are in a position to perform an audit, they flip a coin and decide whether they should audit their partner or not. Nevertheless, to avoid that rational nodes hide behind this randomness to avoid auditing their partners, we make this randomness verifiable. Towards this purpose, we use the secure log authenticators, which are signed messages computed from the node's log as detailed in Section IV-C. These values are unpredictable as they depend on the current state of a node's log. Specifically, each time a node p x is in a position to perform an audit of a new partner p y , it computes the hash of its public key concatenated with the public key of p y and the round number. The value of this hash modulo 100 gives a number that p x uses to decide whether it should audit its new partner. For instance, if the probability of auditing a node fixed by the protocol is 30%, p x audits p y if the result of the modulo function is between 0 and 29. Node p x further logs the authenticators it used to compute the value of this boolean, in order to justify, in future audits, the reason why it performed or did not perform the audit of p y . If the audit must take place, p x contacts p y 's partners, and asks for their logs.

C. Audit protocol

In our protocol, the secure log is used to keep track of the communication a node had with other nodes in the system. Specifically, each entry in the log of a node A corresponds to a message sent (resp. received) by A to (resp. from) another node B. A log entry e i is of the form e i = (seqno i , h i , c i ) where seqno i is a monotonically increasing sequence number, h i is a hash value linked with the previous entries in the log and c i is a type-specific content, which may include the message sent (resp. received) by A as well as other information such as authenticators (as defined below). The value of h i is computed as follows:

h i = H(h i-1 ||seqno i ||H(c i ))
, where h 0 = 0, H is a hash function and || stands for concatenation.

Each time a log entry e i is added to the log of a node A, an authenticator α i is generated. This authenticator, which is a signed message α i = (seqno i , h i ) σ(A) , states that A has a log entry e i with a corresponding hash h i . By sending the authenticator α i to a node B, A commits to having logged the entry e i and to the content of its log before e i . Any node that receives α i can use it to inspect e i and all the entries preceding e i in the log of A. Upon reception of a log, any node is able to recompute the hash values it contains, according to the log entries, and thus to check their validity. In addition, a log entry for a received message must include a matching authenticator, implying that a node cannot invent an entry for a message it did not receive. These two properties make the secure logs tamper-evident and append only.

As described in the partnership management protocol, when node p x must audit node p y , it asks p y 's partners to return their logs. Upon reception of these logs, node p x verifies: (i) the consistency of the logs, by recomputing the recursive hash values associated to log entries, (ii) the presence of the exchanges p y was supposed to initiate, (iii) that p y declared the updates it was supposed to receive from the source, if p y was supposed to interact with the source, (iv) that the exchanges correspond to a correct execution of the protocol, i.e., that p y proposed to all its partners all the updates that appear in its log, that p y requested from its partners all the updates it was missing, that p y served to its partner all the updates they were requesting and that p y logged all the identifiers of the updates it received, (v) that p y suspected all its partners that did not follow a given step of the protocol as prescribed by the omission failure protocol, (vi) that p y audited all the partners it was supposed to audit. As any other node, the source also maintains partnerships and regularly changes its partners, i.e., the nodes it serves. The source follows the partnership management and the updates exchange protocols, except that it does not send any log and it is not audited by nodes 2 . This forces the nodes to log the identifiers of the updates they received from the source, as they are deterministically chosen among the epoch membership list, which is known by all nodes. Hence, any node can check that the received updates were correctly declared. As the serving rate of the source is constant, the identifier of the updates that are released at each round are also known.

D. Update exchanges

At the beginning of each round and for the duration of their partnership, two partners p x and p y exchange updates as depicted in Figure 5. Specifically, node p x (resp. p y ) starts the exchange by generating a proposition message containing the identifiers of all the updates that appear in its log and that did not expire yet. Node p x (resp. p y ) logs this proposition message in its log and generates the corresponding authenticator. Then, p x (resp. p y ) sends the proposition message along with the corresponding authenticator to p y . Upon reception of the proposition message, which it logs, node p y (resp. p x ) selects the updates it is missing and replies to p x (resp. p y ) with an update request. The update request is logged at the two parties. Finally, p x (resp. p y ) serves the missing updates, and logs the serve message. Each partner then terminates the exchange by logging the identifiers of the updates it received, in its log. The nodes will then propagate the received updates during the following rounds, because we cannot ensure that nodes will immediately share them.

V. RISK VERSUS GAIN ANALYSIS

The aim of this section is to demonstrate that rational nodes will not collude with their partners, because audits will detect deviations with a high probability, and because the estimated gain of collective deviations is low. Complementary to this analysis is a proof that the protocol is a Nash equilibrium. This proof lists all the protocol steps and possible rational deviations and proves that rational nodes do not have any interest in deviating from the protocol whether individually 2 We recall that the source is assumed to be a correct node. or as a group. Due to the lack of space, this proof is available in the companion technical report [START_REF] Mokhtar | Acting: Accurate freerider tracking in gossip[END_REF].

We first evaluate the risk that two colluding partners take by deviating, for example when interacting as prescribed by the protocol, but without logging the updates they exchange. Specifically, consider two partners p x and p y that decide to collude. Assume p x holds update u. To help p y saving bandwidth in future rounds, p y sends a proposition message to p x that does not contain u, but logs that it has proposed u. As such, the logs of p x and p y appear correct if audited separately as p x can not be blamed of not requesting u (as the official proposition sent by p y does not contain u) and p y can not be blamed of not proposing u as it appears in his log that he has done so. We define the risk as the probability that such a deviation is deterred by an audit.

Let us compute this risk. If any of the two colluding nodes is audited during the time where the exchange is contained in their logs, they will be discovered. Let us consider a system of N nodes, where C nodes are part of a single colluding group. A node's log contains the entries of the last RT E rounds. A participating node initiates f partnerships with other nodes, which are changed after P eriod rounds. Let P audit the probability that a node audits each of its new partners. When establishing a new partnership, a rational node is not audited if its new partner is colluding with it (which happens with probability C N ), or if the new partner is correct but the protocol prescribes not to perform the audit. On average, each of the two nodes interacts with 2×f ×RT E P eriod partners during the time the deviation is visible. Finally, we obtain that the risk a deviation is detected is equal to:

1 -C N + 1 -C N × (1 -P audit ) 2.f.RT E P eriod 2
Let us now compute the gain of performing the above deviation. To do this we need to compute the number of interactions that a rational node may have with correct nodes that do not hold the update u after receiving it from its colluding partner, i.e., correct nodes to which the rational node would have had to send u if it has received it officially from its colluding partner. To do so, we use the algorithm of Figure 6. The principle of this algorithm is that during each of the RT E rounds that follow the round at which the deviation occurred, 2 * f interactions happen. Each of these interactions, has a probability C N to involve another colluding node. When it is not the case, this other node owns the missing update with a probability that depends on the number of rounds elapsed since its release by the source. We evaluate this probability using another algorithm, detailed in the companion technical report [START_REF] Mokhtar | Acting: Accurate freerider tracking in gossip[END_REF]. When the rational node receives the update from a correct node, it will have to share it with its future partners. Using the average of the outputs of this algorithm, we can compute the proportion of interactions in which an update will not be sent by rational nodes. To obtain the long term gain, we multiply this proportion by the probability that a rational node has to meet an accomplice to be able to execute this deviation, which is C N . Computing the risk, and the gain, with the values of the parameters used in the protocol and further described in the following section, we obtain that the risk two colluding nodes take is equal to 60%, and the long term gain of the associated deviation is equal to 3%. Thus, rational nodes are exposed with a high risk each time they execute the deviation, and can only hope for a very small benefit. As a result, we conclude that rational nodes will not collude with their partners to exchange updates off the record. As said above, a complete analysis of the incentives provided by the protocol can be found in [START_REF] Mokhtar | Acting: Accurate freerider tracking in gossip[END_REF]. Note that nodes can still collude silently with nodes that are not their partners. Yet, it they do so, they are still obliged to execute the protocol correctly, i.e., request updates they do not officially hold and propose updates they officially hold to correct nodes. Hence, their collusion will not have any impact on the quality of the stream perceived by correct nodes.

VI. PERFORMANCE EVALUATION

In this section, we present the performance evaluation of the AcTinG protocol. We start by introducing our methodology (Section VI-A). Then, we compare the impact of colluders on AcTinG, BAR Gossip, and LiFTinG (Section VI-B). We choose BAR Gossip as it is the most robust rational resilient content dissemination protocol that has been proposed so far and LiFTinG as it is the only state-of-the-art content dissemination protocol that handles colluders. We then assess the bandwidth consumption of AcTinG (Section VI-C), its performance in the case of massive node departure (Section VI-D) and its scalability in terms of memory and bandwidth con-sumption using simulations involving up to a million nodes (Section VI-E).

Overall, our evaluation draws the following conclusions: In a real deployment involving 400 nodes and in presence of colluders, correct nodes using AcTinG do not experience any degradation in the quality of the content they receive while those using BAR Gossip and LiFTinG experience heavy message loss in presence of colluders independently from their organisation (whether in small or larger groups). On the other hand, we show that nodes that decide to collude in AcTinG experience a heavy overhead, which discourages them from staying in the coalition. Moreover, we show that AcTinG bandwidth consumption is reasonable and that AcTinG is resilient to massive node departure. Finally, we show that AcTinG is scalable as simulations involving up to a million nodes exhibit that both the bandwidth and memory consumptions of AcTinG follow a logarithmic growth in the number of nodes. However, we acknowledge that the source may become a bottleneck as the number of nodes increase, as it periodically receive notifications. Solving this issue is classically done by using a tracker, i.e., a centralised server that handles membership, as in the FlightPath protocol [START_REF] Li | Flightpath: obedience vs. choice in cooperative services[END_REF], which could easily be integrated in our system. The tracker could even be replicated using classical fault-tolerance techniques (e.g., [START_REF] Bressoud | Hypervisor-based fault tolerance[END_REF]).

A. Methodology and Parameter Setting

To assess the performance of AcTinG, BAR Gossip and LiFTinG, we used them to implement three video live streaming applications. In these applications, a source node, selected randomly, diffuses a video stream at a rate of 300 kbps, during 5 minutes, and proposes each update to 5 random nodes. Updates are then disseminated using either AcTinG, BAR Gossip or LiFTinG, respectively. In order to provide a fair comparison, we implemented the three streaming applications in Java using the same code base. We deployed the three applications in 400 nodes running in one hundred physical machines of the Grid5000 cluster, interconnected with a 1Gb/s network that we limited to 1Mb/s. Each machine is composed of an Intel Xeon L5420 processor clocked at 2.5GHz with 32GB of RAM. In the three applications, to provide further tolerance to message loss (combined with retransmissions), the source groups packets in windows of 40 packets, including 4 FEC3 coded packets.

The duration of one round is set to one second, and updates are released 10 seconds before being consumed by the nodes media player. Note that nodes dynamically adapt the number of their partners according to the size of the membership list: each node establishes ln(N ) cryptographic primitives consisted in a 1024-bit RSA signature and a SHA-1 hash.

B. Impact of Colluders

In this section, we experimentally study the impact of colluders on the BAR Gossip, LiFTinG, and AcTinG protocols. We implemented colluders from the code base of correct nodes in each protocol as follows. Colluders exchange unofficially among each other all the stream updates they received from correct nodes. Furthermore, colluders execute all the possible undetectable rational deviations that exist in the underlying protocol. For instance, in BAR Gossip, colluders never take part of the optimistic push protocol, which allows nodes to altruistically push updates to other nodes. Similarly, in LiFTinG, colluders do not audit the logs of other nodes and do not reply to messages sent by other nodes asking them to assess the behaviour of their previous partners unless the considered partner is among the group. As a result, correct nodes will be blamed by their correct auditors. In this situation the system administrator has two choices: (1) adjust the detection threshold to avoid false positives (by decreasing its value), which opens the doors to colluders for freeriding or (2) adjust the detection threshold to detect colluders (by increasing its value), which results in very high values of false positive accusations. In this experiment, we considered the first situation. A complementary experiment showed that in the second situation, adjusting the threshold to exclude 20% of colluders incurred the exclusion of 43% of correct nodes in the system. Finally, in AcTinG, colluders do not forward updates they received unofficially to their correct partners unless they also received them officially.

We varied the number of colluders, as well as the size of colluding groups. We measure the percentage of missed updates observed by correct nodes in presence of a proportion of colluders. We first studied the case in which all colluders belong to the same group. Results are depicted in Figure 7. The X axis presents the proportion of nodes that collude, while the Y axis presents the percentage of missed updates experienced by correct nodes in presence of colluders. We notice that correct nodes miss up to 98% of updates with BAR Gossip and 72% of updates with LiFTinG, whereas they do not miss any update with AcTinG.

We then studied the impact of spreading colluders in multiple independent groups. More specifically, we made several experiments in which we distributed 30% of all the nodes in colluding groups of identical size. We depict the results in Figure 8. The X axis presents the size of colluding groups, while the Y axis presents the percentage of missed updates observed by correct nodes. We observe that spreading colluders in different groups has the same impact on the quality of the content downloaded by correct nodes.

BAR Gossip

Lifting AcTinG Fig. 8. Proportion of missed updates by correct nodes when 30% of the audience is rational, and collude in independent groups of equal sizes.

The reason why correct nodes do not observe missed updates when using AcTinG is that we designed AcTinG in such a way that colluders will eventually receive all the updates officially from their correct partners and will thus be obliged to forward them officially to their correct partners. Hence, engaging in a colluding group only yields an extra overhead due to the unofficial dissemination of updates among the group. We have measured this overhead and results are depicted in Table I. From this table we observe that the overhead due to collusion is at least of 34% of the size of the stream (case of a group containing only two colluders). In addition, as seen in section V, in a scenario where 10% of nodes collude, and where audits are performed 5% of the time, each deviation will be detected with a probability of 60%. Moreover, exchanging updates without declaring them will provide at most a gain equal to 3%. Consequently, nodes in AcTinG have no interest in colluding as they would not observe any increase in the quality of the stream they get, take a very high risk of being evicted, experience very low benefit, while suffering a useless waste of bandwidth.

C. Bandwidth consumption

To assess the overhead of AcTinG, we plot in Figure 9 the cumulative distribution of the average bandwidth consumption of nodes. Recall that AcTinG is used to broadcast a 300kbps stream. Figure 9 shows that AcTinG induces a reasonable overhead (that is mostly due to the transmission of logs). We also measured the memory consumption of AcTinG, which is due to the storage of secure logs and authenticators. Our measures have showed that a node consumes 3MB of memory for each partnership, in the worst case.

D. Resilience to massive node departure

In the case of a massive node departure, the remaining nodes need to quickly replace their left partners with alive nodes in order not to miss updates. In this experiment, we measure the bandwidth consumption and the percentage of missed updates when 60% and 70% of nodes suddenly leave the streaming session. Results are depicted in Figures 10 and11 respectively. Specifically, we observe in Figure 10 that the massive node departure, which happens 500 seconds after the beginning of the experiment, immediately causes a decrease in the average bandwidth consumed by the remaining nodes, as they stop exchanging messages with their left partners. This decrease (62% and 75% in the case of the departure of 60% and 70% of nodes, respectively) is followed by an increase (of up to 18% and 27% in the former two cases), which corresponds to the messages exchanged by nodes to establish new partnerships (including a given proportion of audits). Finally, we observe that 30 seconds later, the average bandwidth consumption stabilises around 430 kbs (13% less than the original value), which is due to the decrease of the necessary number of partners per node.

We also compute the percentage of nodes that do not receive a viewable stream 4 . We observe in Figure 11 that only 2,5% nodes do not receive a viewable stream during the first second when 60% nodes leave the system, and between 5% and 15% nodes do not receive a viewable during at most five seconds when 70% nodes leave the system.

E. Scalability

We performed simulations to evaluate the bandwidth, and the memory consumption, of AcTinG when the number of nodes increases in the system.

Results, depicted in Table II, show that both the bandwidth consumption and the memory consumption of AcTinG grow logarithmically with respect to the number of nodes in the system. Indeed, these values depend linearly on the number of partners a node has, which grows logarithmically with the system size.

VII. RELATED WORKS

In this section, we focus on peer-to-peer content dissemination protocols that handle rational nodes. These protocols can be classified into two categories, according to the way file chunks (called updates in the following) are exchanged between nodes. The first category of protocols is composed of symmetric protocols. These protocols force nodes to collaborate, as the number of updates they get from a node is proportional to the number of updates they have to offer (this principle is often referred to as tit-for-tat). BAR Gossip [START_REF] Li | Bar gossip[END_REF] and FlightPath [START_REF] Li | Flightpath: obedience vs. choice in cooperative services[END_REF] are symmetric protocols relying on game theory. Both provide incentives to ensure that rational nodes respectively have no, or a limited, interest in deviating from the protocol. In terms of robustness to rational nodes, the BAR Gossip protocol exhibits stronger properties than the FlightPath protocol. Indeed, nodes in FlightPath are assumed to deviate only if the benefit they get is higher than a threshold, which is not the case in BAR Gossip. While the authors of these two protocols point out the problem of colluding rational nodes in [START_REF] Li | Bar gossip[END_REF], none of them address it.

The second category of protocols is composed of asymmetric protocols. These protocols require nodes to altruistically push update identifiers to other nodes, which subsequently pull updates of interest. A first protocol in that category is the one presented in [START_REF] Van Renesse | Enforcing fairness in a live-streaming system[END_REF]. This protocol aims at adapting the contribution of nodes to the systems, according to their available resources. This protocol assumes the existence of trusted auditors that run in dedicated external nodes and does not deal with colluders. A second protocol in that category is LiFTinG [START_REF]Lifting: lightweight freerider-tracking in gossip[END_REF]. To the best of our knowledge, LiFTinG is the only existing peer-to-peer content dissemination protocol that tackles the problem of colluding rational nodes. Specifically, LiFTinG sporadically verifies the distribution of the interactions a given node performed with other nodes in the system. Nodes that collude with other nodes break the uniform distribution of partner selection, which may result in their detection. In order to be cost effective, LiFTinG only performs sporadic audits, and relies on non-secure logs that can contain wrong information, be incomplete, be tampered with and, as a consequence, be inconsistent the ones with respect to the others. As a result, LiFTinG suffers from two major limitations: correct nodes can be wrongly evicted from the system (false positives), and a proportion of colluding rational nodes can harm the system without being detected (false negatives).

VIII. CONCLUSION

A number of gossip-based content dissemination protocols tolerating rational behaviours have been proposed. A limitation of these protocols is that they do not handle rational nodes that collude, i.e. that act as a group in order to improve their benefit. The only exception is the LiFTinG protocol that performs sporadic checks on insecure logs to try to detect colluding nodes. We have shown in this paper that neither LiFTinG nor BAR Gossip, the most robust rational resilient content dissemination protocol, are effectively resilient to colluders. In this paper, we have presented AcTinG, the first content dissemination protocol that tolerates rational nodes acting both individually and in collusions, and that guarantees zero false positive accusations. Performance evaluation combining both a real deployment and simulations has demonstrated that nodes running AcTinG are able to deliver the entire content despite the presence of colluders. We have also shown that AcTinG is resilient to churn, and exhibits very desirable scalability properties with a logarithmic growth of memory and bandwidth consumption, comparable to standard gossip based protocols. Our future work includes the study of the applicability of the AcTinG principles to other types of collaborative applications for the accurate detection of rational (possibly colluding) nodes.

IX. ACKNOWLEDGEMENT Experiments presented in this paper were carried out using the Grid'5000 testbed, supported by a scientific interest group hosted by Inria and including CNRS, RENATER and several Universities as well as other organizations (see https://www.grid5000.fr).

!Fig. 2 .

 2 Fig. 2. Arrival of a new node.

Fig. 3 .

 3 Fig. 3. Handling of an omission failure.

Fig. 4 .

 4 Fig.4. Establishment of new associations between nodes, which may imply audits.

Fig. 5 .

 5 Fig. 5. Update exchanges between nodes.

Fig. 6 .

 6 Fig.6. Pseudocode of the algorithm used to estimate the number of times a colluding node avoids to send an update.

Fig. 7 .

 7 Fig. 7. Proportion of missed updates by correct nodes when a given proportion of the audience collude as a single group.

Fig. 9 .

 9 Fig. 9. Fault-free case: Cumulative distribution of average bandwidths.

Fig. 10 .Fig. 11 .

 1011 Fig. 10. Nodes average bandwidth after a massive departure.

TABLE I OVERHEAD

 I OF COLLUDERS IN ACTING.

Delays for node suspicion are configured in an implementation dependent manner

partnerships that it maintains for a duration of five rounds. For instance, in the fault free case, with N = 400, each node has

partners. At the beginning of each partnership, nodes performed audits with a probability of 5%, which, as we show in Section V, allows the system to detect deviations with a probability of 60% when up to 10% of the audience colludes in a single group. The 3 FEC stands for Forward Error Correction.

The stream is not viewable when more than

5% of the streaming windows cannot be displayed because of missed updates[START_REF] Li | Bar gossip[END_REF]


Harry Boyer
email: harry.boyer@univ-reunion.fr

Stéphane Guichard

Aurélien Jean

Teddy Jeannick Libelle

Dimitri Bigot

Frédéric Miranville

M Bojić
email: bbojic@kg.ac.rs

Aurélien

B Malet-Damour

A H Fakra

Validation of daylighting model in CODYRUN building simulation code

Keywords: Daylighting, simulation, CODYRUN

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Several software packages are available for thermal and airflow simulation in buildings. The most frequently used are ENERGY+ [START_REF]EnergyPlus engineering reference: The reference to Energy plus calculation[END_REF], ESP-r [START_REF] Clarke | Energy simulation in building design[END_REF], and TRNSYS [START_REF] Klein | TRNSYS -A transient system simulation program[END_REF]. These applications allow an increasing number of models to be integrated, such as airflow, pollutant transport, and daylighting. In the latter category, we may note ENERGY+, ESP-r and ECOTECT [START_REF] Marsh | Calculating variations in the distribution of insolation over building surfaces[END_REF] software. After more than 20 years of developing a specific code named CODYRUN, we decided to add a lighting module to our software. This paper therefore provides some details on this evolution and elements of validation.

The CODYRUN initial software and its validation

Developed by the Physics and Mathematical Engineering Laboratory for Energy and Environment at the University of Reunion Island, CODYRUN [START_REF] Boyer | Thermal building simulation and computer generation of nodal models[END_REF][START_REF] Boyer | A multi model approach of thermal building simulation for design and research purposes[END_REF][START_REF] Boyer | Building ventilation: A pressure airflow model computer generation and elements of validation[END_REF][START_REF] Soubdhan | Younès: Use of BESTEST procedure to improve a building thermal simulation program[END_REF][START_REF] Lauret | A validation methodology aid for improving a thermal building model: How to account for diffuse radiation in a tropical climate[END_REF][START_REF] Calogine | Identification of parameters in building concentration dispersion model[END_REF][START_REF] Fakra | Development of a new model to predict indoor daylighting: Integration in CODYRUN software and validation[END_REF][START_REF] Boyer | Interroom radiative couplings through windows and large openings in buildings: Proposal of a simplified model[END_REF][START_REF] Lucas | Study of moisture in buildings for hot humid climates[END_REF][START_REF] Boyer | Evolution of CODYRUN from thermal simulation to coupled thermal and daylight simulation software[END_REF] is a multi-zone software program integrating ventilation and moisture transport transfer in buildings. The software employs a zone approach based on nodal analysis and resolves a coupled system describing thermal and airflow phenomena. Numerous validation tests of the CODYRUN code were successfully applied to the software. Apart from the daylighting model, the majority applied the BESTEST procedure [START_REF] Judkoff | International Energy Agency Building Energy Simulation Test (BESTEST) and Diagnostic Method[END_REF]. The International Energy Agency (IEA) sponsors a number of programs to improve the use and associated technologies of energy. The National Renewable Energy Laboratory (NREL) developed BESTEST, which is a method based on comparative testing of building simulation programs, on the IEA's behalf. The procedure consists of a series of test cases buildings that are designed to isolate individual aspects of building energy and test the extremes of a program. As the modelling approach is very different between codes, the test cases are specified so that input equivalency can be defined thus allowing the different cases to be modelled by most of codes. The basis for comparison is a range of results from a number of programs considered to be a state-of-art in United States and Europe. Associated with other specific comparisons, a very confident level of validation was obtained for the CODYRUN initial software [START_REF] Soubdhan | Younès: Use of BESTEST procedure to improve a building thermal simulation program[END_REF].

Integration and validation of a daylight model

The model and its integration in CODYRUN :

All available daylight models require relative spatial positioning of the elements (floors, windows, openings, and light sources) to calculate the received light on each point in the working plane (or mesh). The data structures initially used by CODYRUN had to be completed with vertexes [START_REF] Judkoff | International Energy Agency Building Energy Simulation Test (BESTEST) and Diagnostic Method[END_REF] A set of related C procedures relative to the geometry of planar polygons was also incorporated into the code [START_REF] Clarke | Energy simulation in building design[END_REF][START_REF] Siret | A geometrical framework for solving sunlighting problems within CAD systems[END_REF][START_REF] Foley | Van Dam: Fundamentals of interactive computer graphics[END_REF]. It relates to, for example, the calculation of surface perimeters for polygons, the distance between a point and a plane, testing the inclusion of a point in a plane or polygon, or projections relating to shading calculations and the sunspot. Then, the daylight factor (DF) classical method was used to calculate the diffuse illuminance for all of the mesh points. This method was elaborated by the British Building Research Establishment (BRE) and published by the Chartered Institution of Building Services Engineers (CIBSE) [18]. The diffuse light falling on one point in a room is commonly considered to be composed of three distinct parts: the sky component (SC), externally reflected component (ERC), and internally reflected component (IRC). These values were calculated for each point of the defined mesh using standard formulas. The direct illumination was obtained by projecting the edges of the glazing and the outer apertures eventually illuminated by direct solar radiation in order to calculate the indoor sunspot.

Validation :

When dealing with the daylighting simulation model in particular, it is necessary to refer to some rigorous and recognized procedures used around the world. However, there is limited documentation on the procedures to follow. In most cases, laboratories implement their own experimental database to serve as a reference for comparisons between model predictions and measurements. Covering both artificial and natural lighting, we use Maamari's test cases [START_REF] Maamari | Application of the CIE test cases to assess the accuracy of lighting computer programs[END_REF] for the validation step. Indeed, this detailed study establishes methods to verify the reliability of simulation codes for indoor daylighting on the basis of analytical and experimental tests cases. This work was used as a reference in task TC3-33 of the International Commission on Illumination (CIE). Many other test cases found in scientific literature (publications from the French Scientific and Technical Center for Building, BRE, International Energy Agency's Task 21, and experimental test case from CIBSE, etc.) were applied to the CODYRUN simulation software. An inter-software comparison was also conducted, and finally, database references for the local study in dynamic conditions (from a cell called LGI) were established [START_REF] Fakra | Development of a new model to predict indoor daylighting: Integration in CODYRUN software and validation[END_REF] and are briefly presented below.

It is common in the field of lighting to consider at a given time of day the spatial distribution of the illumination, so as to determine whether the required level is sufficient. Other studies are related to longer periods, such as energy consumption or daylight autonomy. In this article, our approach is different and that monitoring with short timestep (hour or minute) lighting at certain points.

An experimental cell 1:1 was instrumented to verify the reliability of the simulation software CODYRUN photometric interior environments. The experimental cell located in Saint-Pierre (Réunion Island, France, 21°19'S, 55°28'E) was initially built to experimentally validate physical models introduced in CODYRUN. The weather station, positioned on the experimental platform, measures solar radiation (global and diffuse) and the wind speed and direction (respectively at a height of 2 m and 10 m above the ground). The datalogger is Campbell-type. Initial measurements were completed by an outdoor luxmeter measuring the global outdoor illuminance values. It is positioned on the roof of the experimental cell LGI. For this study, the instrumentation at the station consists of two pyranometers and illuminance sensors for horizontal solar irradiance and daylight illuminance data measurements. It is very common in the field of lighting to consider for a given hour the spatial distribution of the illumination, so as to determine whether the required level is sufficient. Other studies are related to longer periods, such as energy consumption or daylight autonomy, as [START_REF] Boyer | Evolution of CODYRUN from thermal simulation to coupled thermal and daylight simulation software[END_REF]. In this article, our approach is different and that monitoring with short timestep (hour or minute) lighting at certain points. On next figure, values encountered at A1 location are much greater than at A3, due to shorter distance from glazed door. In most cases, simulated values in CODYRUN (labelled CODYRUN_A1 and CODYRUN_A3) between 10:30 am and 12:45 pm are higher compared to measured values (Measures_A1 and Measures_A3). The explanation is that the studied cell is equipped with an overhang on the northern façade. This prevents a major part of the sunlight from penetrating into the room. At this time, this particular device is not taken into account by the software. Concerning the evening, we noticed that the simulated values are lower than the measured values. The fact is that South and West parts of vertical façades of the test building are opaque. Fig. 3. Indoor illuminance simulation and measurement at A1 and A3 points.

Then, the North-facing overhang does not influence skylight at these hours of the day. We obtain more coherent values between the simulation and the measurements and model is clearly sensitive to parameters as the ground albedo. The results show, on the whole day, a good accuracy of the software in the calculation of the global indoor illumination, except for the most distant points from the opening.

Conclusion

Our goal of integrating a model for lighting calculation was reached, with some details on the internal organization provided in this article. The daylight studies can be performed using other software, but as in previous CODYRUN embedded models (pollutants, airflow, etc.), we believe our own coding for this lighting model to be profitable in terms of its in-depth knowledge and flexibility, as it takes into account certain specificities or local practices. The results of actual release are satisfactory in terms of their precision and comparability to much more powerful software. They allow us, in the philosophy of CODYRUN, to conduct specific software development dedicated to research and professional audiences. In future research, we aim to explore the innovative integration of specific components for lighting (lightpipes, thermotropic layers, etc.) and interfacing the software with Google Sketchup® and OpenStudio® to improve its usability among professionals.

Fig. 1 .

 1 Fig. 1. Picture and sketch of the test cell.

Fig. 2 .

 2 Fig.2. Outdoor radiation measurements.


used in Sect. [START_REF] Pipkin | Some developments in the theory of inextensible networks[END_REF] to obtain the equilibrium equations via a variational argument. Finally, in Sect. [START_REF] Pipkin | Plane traction problems for inextensible networks[END_REF], we apply the model to the solution of a simple illustrative problem.

Related work by Wang and Pipkin [START_REF] Wang | Inextensible networks with bending stiffness[END_REF][START_REF] Wang | Plane deformations of nets with bending stiffness[END_REF] accounts for the effects of normal and geodesic bending in networks consisting of two families of inextensible fibers, thereby generalizing earlier efforts on the modeling of fabrics [START_REF] Pipkin | Some developments in the theory of inextensible networks[END_REF][START_REF] Pipkin | Plane traction problems for inextensible networks[END_REF][START_REF] Pipkin | Equilibrium of Tchebychev nets[END_REF]. The present work extends this further to accommodate fiber stretch and twist. In particular, the twisting and bending energies of fibers, regarded here as spatial Kirchhoff rods, are comparable in magnitude in a general deformation; this implies that twisting effects should be taken into account whenever bending effects are non-negligible. Moreover, fiber stretch is included to accommodate elastic resistance to the crimping/decrimping mechanism associated with woven fabrics. Preliminary work on the related problem of twisting resistance in inextensible fabrics is discussed in Refs. [START_REF] Luo | Bending and twisting effects in the threedimensional finite deformations of an inextensible network[END_REF][START_REF] Luo | Nonlinear three-dimensional mechanics of fabrics[END_REF]; see also in Ref. [START_REF] Indelicato | The influence of the twist of individual fibers in 2D fibered networks[END_REF].

We work in the setting of the direct theory of elastic surfaces. Thus we do not model the three-dimensional aspects of fabric material explicitly. Our preference for this framework is due in no small part to the difficulty in identifying a three-dimensional structure that reflects the salient features of the two-dimensional weave pattern of a typical fabric sheet. Thus, in general, there is no three-dimensional parent model that can be used to effect a dimension reduction procedure leading to a two-dimensional model of the kind desired.

Differential geometry of fabric deformation 2.1 Surface geometry

The theory of fabric deformation affords a particularly strong demonstration of the inextricable link between Mechanics and Differential Geometry. In this section we build on a number of associated results derived in Ref. [START_REF] Steigmann | Equilibrium of elastic nets[END_REF] that bear directly on the present work.

We use convected coordinates θ α to label material points of the fabric, regarded as a two-dimensional manifold. The function x(θ α ) is an embedding of this manifold into 3space, and serves to define position of a material point on a fixed reference surface Ω. Position of the same material point on a typical deformed surface ω is denoted by r(θ α ). The latter parametrization induces the associated basis elements a α = r , α ∈ T ω , the tangent plane to ω at the point with coordinates θ α ; the metric a αβ = a α • a β ; the dual metric (a αβ ) = (a αβ ) -1 and the dual tangent basis a α = a αβ a β . These in turn yield the local orientation of ω in terms of its unit normal n, defined by αβ n = a α × a β , where αβ = √ ae αβ is the covariant permutation tensor, with a = det(a αβ ) and e αβ the unit alternator (e 12 = +1, etc.). The contravariant permutation tensor is αβ = e αβ / √ a, where e αβ = e αβ .

The Gauss and Weingarten equations play a central role in the development of the theory. These are

r ,αβ = Γ λ αβ a α + b αβ n and n ,α = -b αβ a β , (1)
where Γ λ αβ are the Levi-Civita connection coefficients induced by the coordinates on ω and b αβ is the covariant curvature tensor (the coefficients of the second fundamental form).

The deformation gradient F = ∇r is given by

F = a α ⊗ e α , ( 2
)
where e α are the duals on T Ω of the basis elements e α induced by the coordinates on Ω via e α = x ,α , and the Cauchy-Green deformation tensor is

C = F t F = a αβ e α ⊗ e β . ( 3
)
The fabric is assumed to consist of two families of fibers that are continuously distributed over the surface, thus every material point lies at the intersection of a pair of fibers, each modeled as a mathematical curve endowed with kinematical and constitutive structures intended to capture the main features of the local macroscopic behavior of fabrics. The unit tangents to the fibers on ω are denoted by l and m, and their counterparts on Ω by L and M. These are necessarily tangential to ω and Ω, respectively, and so admit the representations l = l α a α , m = m α a α and

L = L α e α , M = M α e α , (4)
in terms of contravariant components, for example. The fibers are presumed to be convected as material curves with no relative slipping; this is realistic in the presence of sufficient friction between overlapping yarns of the actual weave or, in the case of a coarse-mesh network [START_REF] Steigmann | Equilibrium of elastic nets[END_REF], if the fibers are tied together at their points of intersection. Thus, [START_REF] Steigmann | Equilibrium of elastic nets[END_REF] λl = F L and μm = F M, [START_REF] Pipkin | Plane traction problems for inextensible networks[END_REF] where λ(= |F L|) and μ(= |F M|) are the fiber stretches; i.e., the stretches of the projections of the woven yarns onto the tangent plane of Ω. These yield the useful connections

λl α = L α and μm α = M α (6)
relating contravariant components only. The covariant components are related by [START_REF] Steigmann | Equilibrium of elastic nets[END_REF]Eqs. 5.20]

l α = λL α +μ sin γ M α and m α = μM α +λ sin γ L α , ( 7
)
where γ is the fiber shear angle on ω, defined by

sin γ = l • m. ( 8
)
We suppose, with minor loss of generality, that the fibers are everywhere orthogonal on Ω, so that [START_REF] Steigmann | Equilibrium of elastic nets[END_REF] e α = L α L + M α M and e α = L α L + M α M, [START_REF] Indelicato | The influence of the twist of individual fibers in 2D fibered networks[END_REF] yielding the representation

δ α β = L α L β + M α M β ( 10
)
of the Kronecker delta. The contravariant permutation tensor on Ω is defined by μ αβ = e αβ / √ e, where e is the determinant of the metric induced by the coordinates. For orthogonal fibers this may be expressed in the form [START_REF] Steigmann | Equilibrium of elastic nets[END_REF]

μ αβ = L α M β -M α L β . ( 11
)
Equations ( 2)-( 5) combine to furnish

F = λl ⊗ L + μm ⊗ M; (12)
equivalently,

a α = λl L α + μmM α . ( 13
)
The Cauchy-Green tensor follows from Eq. (3), with

a αβ = λ 2 L α L β + μ 2 M α M β + λμ sin γ (L α M β + M α L β ). ( 14
)
Using this and the dual metric induced by Eq. ( 9) 1 , it may be shown that the area stretch, J = √ a/e, is [10]

J = λμ |cos γ | , ( 15
)
and that

l × m = |cos γ | n. ( 16
)
Further, these results yield the curvature tensor in the form [START_REF] Steigmann | Equilibrium of elastic nets[END_REF] [START_REF] Coleman | On the rheology of cold drawing: I. elastic materials[END_REF] where

b αβ = λ 2 κ l L α L β + μ 2 κ m M α M β + λμτ (L α M β + M α L β ),
κ l = b αβ l α l β and κ m = b αβ m α m β (18)
are the normal curvatures of the deformed fibers, and

τ = b αβ l α m β (19)
is the torsion. Of central importance in this work are the geodesic curvatures η l and η m of the fibers, defined by [START_REF] Steigmann | Equilibrium of elastic nets[END_REF] l α l ,α = η l p + κ l n and m α m ,α = η m q + κ m n, [START_REF] Murdoch | Symmetry considerations for material surfaces[END_REF] with p = n × l and q = n × m. [START_REF] Indelicato | Symmetry properties of the elastic energy of a woven fabric with bending and twisting resistance[END_REF] We shall also require [START_REF] Steigmann | Equilibrium of elastic nets[END_REF] m α l ,α = φ l p + τ n and l α m ,α = φ m q + τ n, [START_REF] Ball | Null Lagrangians, weak continuity, and variational problems of arbitrary order[END_REF] where φ l and φ m are the Tchebychev curvatures of the fibers.

It is well known that the geodesic curvatures are determined by the surface metric. In the present context the explicit expressions are [START_REF] Steigmann | Equilibrium of elastic nets[END_REF] J η l = (μ sin γ L α -λM α ) |α and

J η m = (μL α -λ sin γ M α ) |α , ( 23
)
where (•) |α is the covariant derivative on Ω. Explicit expressions for the Tchebychev curvatures are derived in Sect. 2.4.

Fiber kinematics

Consider the orthonormal basis {l i } = {l, p, n} with p given by Eq. ( 21) 1 . This consists of the unit tangent l to the first fiber trajectory, and two vectors-p and the surface normal n-spanning the cross-sectional plane of the fiber. Let {L i } = {L, M, N}, where N is the unit normal to Ω and M = N × L. Then there is a rotation tensor, R (l) , such that

l i = R (l) L i .
The rate of change of the basis {l i } with respect to arclength along the L-trajectory, denoted by (•) , is

l i = L α l i,α = ω (l) × l i , ( 24
)
where ω (l) is the axial vector of the skew tensor

Ω (l) = R (l) R t (l)
. This has the representation ω (l) = ω (l)i l i , where ω (l)i = 1 2 e i jk Ω (l)k j and Ω (l)k j = l k • Ω (l) l j , in which e i jk is the usual permutation symbol (e 123 = +1, etc.). Here, ω (l)1 is the fiber twist, whereas ω (l)2 and ω (l)3 are the curvatures of the fiber due to flexure. In view of Eq. ( 12), we also have the connection F L = λR (l) L between the rotation and the surface deformation.

We suppose that the fiber behaves mechanically like a spatial Kirchhoff rod. This model is known to apply to sufficiently thin filaments in the presence of small axial extensions [START_REF] Dill | Kirchhoff's theory of rods[END_REF] on the order of those typically encountered in the deformations of woven fabrics. In this model the rod responds constitutively to the Galilean-invariant curvature-twist vector R t (l) ω (l) = ω (l)i L i . Our objective in this subsection is to show that this may be specified entirely in terms of surface geometry and hence in terms of the deformation of the surface.

For example, from Eq. ( 24) we have

l = ω (l) × l = ω (l)2 p × l + ω (l)3 n × l. ( 25
)
Combining this with Eq. ( 6) 1 , and comparing the result to Eq. ( 20) 1 , we conclude that

ω (l)2 = -λκ l and ω (l)3 = λη l . ( 26
)
The reduction of the twist ω (l)1 is substantially more involved. First, we form p = ω (l) × p and use the fact that p = L α p ,α , together with Eq. ( 6) 1 , to obtain

λl α p ,α = ω (l)1 n -ω (l)3 l. ( 27
)
Differentiating Eq. ( 21) 1 , using the Weingarten equation and invoking Eq. ( 17), we derive

l α p ,α = η l n × p + b αβ l α p β n, (28)
where p β = αβ l α and αβ is the contravariant permutation tensor. This combines with Eqs. ( 27) and ( 26) 2 to deliver ω (l)1 = λb αβ l α p β , and hence the conclusion that the fiber twist is proportional to the torsion of the surface on the orthonormal {l, p}-axes. However, for the purposes of the constitutive theory to be discussed in Sect. 3, it is more convenient to have an expression for the twist in terms of the components of the representation Eq. [START_REF] Coleman | On the rheology of cold drawing: I. elastic materials[END_REF]. To this end, we use Eq. ( 6) 1 to write ω (l)1 = b αβ L α p β , and then use Eq. [START_REF] Coleman | On the rheology of cold drawing: I. elastic materials[END_REF] to reduce this to

ω (l)1 = λ 2 κ l (L β p β ) + λμτ (M β p β ). ( 29
)
We recall that the permutation tensor is αβ = e αβ / √ a = J -1 e αβ / √ e, and so αβ = J -1 μ αβ . Using the representation Eq. ( 11), together with Eq. ( 7) 1 , we thus derive

J p β = λM β -μ sin γ L β , ( 30
)
which combines with Eq. ( 29) to give

ω (l)1 = λ 2 μJ -1 (τ -κ l sin γ ). ( 31
)
Proceeding in the same way, we may show, with some effort, that the components ω (m)i of the curvature-twist vector ω (m) of the second fiber family are given by

ω (m)1 = λμ 2 J -1 (κ m sin γ -τ ), ω (m)2 = -μκ m and ω (m)3 = μη m . ( 32
)
Because we regard the fabric as a surface consisting of crossed rods of the Kirchhoff type, it is natural to assume that it responds constitutively to the curvature-twist vectors of the two fiber families. In view of the results obtained here, this is equivalent to a constitutive sensitivity to the surface strain, the surface curvature, and the geodesic curvatures. We show in the next subsection that these variables are in turn determined by the first and second gradients of the deformation.

Remark It is appropriate to regard Kirchhoff rod theory as a special case of Cosserat elasticity theory, insofar as the kinematics of the former involve position and rotation fields that are at least partly independent. This viewpoint is advanced in Refs. [START_REF] Steigmann | Theory of elastic solids reinforced with fibers resistant to extension, flexure and twist[END_REF][START_REF] Steigmann | Effects of fiber bending and twisting resistance on the mechanics of fiber-reinforced elastomers[END_REF] to construct a three-dimensional model for nonlinearly elastic solids reinforced by a continuous distribution of fibers with bending and twisting resistance. In that context the fiber twist cannot be determined from the deformation of the underlying continuum; instead, it is computed from the Cosserat rotation field.

Here, however, the rotations of the two fiber families are effectively constrained to have a concurrent axis. That is, the rotation tensor of each fiber family acts on the initial surface normal N to yield the normal n to the deformed surface: R (l) N = R (m) N = n. This reflects the nature of the interactions of the yarns comprising the fabric weave; thus at the points of the actual fabric where the two fiber families cross, the fibers may pivot about a common axis (the surface normal) while maintaining congruency with the deformed surface. This implies that the normal to the surface is effectively embedded in the plane of a fiber cross section. This is the reason why fiber twist is ultimately determined by surface deformation, yielding a dramatic simplification in that the relevant kinematical fields are computable from surface geometry alone. In effect, then, the present model is subsumed under the second-gradient theory of elasticity instead of the more complicated Cosserat theory.

Second gradient of the deformation

The second gradient ∇ F = ∇∇r of the deformation is the third-order tensor ∇ F = F ,α ⊗ e α . Using Eq. ( 2), this is found to be

∇∇ r = S λ αβ a λ ⊗ e α ⊗ e β -n ⊗ κ, ( 33
)
where

S λ αβ = Γ λ αβ -Γ λ αβ , ( 34
)
in which Γ λ αβ and Γ λ αβ are the Levi-Civita connection coefficients induced by the coordinates on ω and Ω, respectively, and

κ = -b αβ e α ⊗ e β (35)
in which the b αβ is the covariant curvature on ω. Here, we have used the Gauss formula (1) 1 on ω together with its counterpart

e α ,β = -Γ α λβ e λ (36)
on Ω, which we assume, with minor loss of generality, to be a plane. The sign in Eq. ( 35) conforms to a widely adopted convention in the literature on shell theory [START_REF] Ciarlet | An introduction to differential geometry with applications to elasticity[END_REF].

We observe that the difference of two sets of connection coefficients induced by a given (convected) coordinate system is a (third-order) tensor, whereas the connection coefficients themselves do not possess tensor character [START_REF] Lovelock | Tensors, Differ. Forms Var. Princ. Dover[END_REF]. Further, as is well known, the Γ λ αβ and Γ λ αβ are determined entirely by the metrics induced by the coordinates on ω and Ω, respectively [START_REF] Ciarlet | An introduction to differential geometry with applications to elasticity[END_REF]. Accordingly, the coefficients S λ αβ represent strain gradients. These, and the b αβ , are easily seen to be Galilean invariant.

Our further work is facilitated by using the combination

r |αβ = r ,αβ -Γ λ αβ r ,λ . ( 37
)
This is the second covariant derivative of the deformation with respect to the metric of Ω. The Gauss equation (1) 1 then furnishes

r |αβ = S λ αβ r ,λ + b αβ n (38)
and Eq. ( 33) reduces to

∇∇ r = r |αβ ⊗ e α ⊗ e β . ( 39
)

Fiber decompositions

The identity

S λ αβ = S λ μγ δ μ α δ γ β ( 40
)
may be combined with Eq. ( 10) and the symmetry condition S λ αβ = S λ βα to establish the useful representation

S λ αβ a λ = g l L α L β + g m M α M β +Γ (L α M β + M α L β ), ( 41
)
where

g l = S λ αβ L α L β a λ , g m = S λ αβ M α M β a λ and Γ = S λ αβ L α M β a λ . ( 42
)
In view of the symmetry already noted, the last of these is equivalent to

Γ = S λ αβ M α L β a λ . ( 43
)
To obtain explicit expressions for the coefficient vectors in Eq. ( 41) we differentiate Eq. ( 13) directly and equate the result to the right-hand side of Eq. ( 41), thus

S λ αβ r ,λ + b αβ n = (λl) ,β L α + (μm) ,β M α + λl L α|β + μmM α|β . ( 44
)
From Eq. ( 9) 1 we see that the gradient of a function f (θ α ) may be written in the form

∇ f = f ,α e α = L α f ,α L + M α f ,α M, ( 45
) yielding f ,β = L α f ,α L β + M α f ,α M β . ( 46
)
In particular,

(λl) ,β = L α (λl) ,α L β + M α (λl) ,α M β , ( 47
)
where, from Eqs. (6) 1 and (20) 1 ,

L α (λl) ,α = (L • ∇λ)l + λ 2 (η l p + κ l n). ( 48
)
Using this and other similarly derived formulas, we find that

(λl) ,β = λ ,β l +λ 2 (η l p+κ l n)L β +λμ(φ l p+τ n)M β (49)
and

(μm) ,β = μ ,β l + μ 2 (η m q + κ m n)M β + λμ(φ m q + τ n)L β . ( 50
)
Substituting into Eq. ( 44) and projecting the resulting equation onto the surface normal leads directly to Eq. ( 17); the remaining part of this equation yields

S λ αβ a λ = (λL α ) |β l + (λ 2 η l L α L β + λμφ l L α M β ) p + (μM α ) |β m + (μ 2 η m M α M β + λμφ m M α L β )q, ( 51
)
and hence Eq. (41), with

g l = λ 2 η l p + L α L β [(λL α ) |β l + (μM α ) |β m]
and

g m = μ 2 η m q + M α M β [(λL α ) |β l + (μM α ) |β m]. ( 52
)
The two equivalent expressions for Γ are

Γ = λμφ l p + L α M β [(λL α ) |β l + (μM α ) |β m] = λμφ m q + M α L β [(λL α ) |β l + (μM α ) |β m]. ( 53
)
The Tchebychev curvatures may be eliminated by making the compatibility conditions S λ αβ = S λ βα explicit. These in turn are equivalent to the vector equation

μ αβ S λ αβ a λ = 0, (54)
where μ αβ is the referential permutation symbol; combining this in the form Eq. ( 11), with Eq. ( 51), leads, with some effort, to

λη L l +μη M m = (M •∇λ)l -(L •∇μ)m +λμ(φ l p -φ m q), (55)
where

η L = -M β |β and η M = L β |β (56)
are the geodesic curvatures of the fibers on Ω (cf. 23). Proceeding as in Ref. [START_REF] Steigmann | Equilibrium of elastic nets[END_REF], we then obtain

J φ l = J η m + λM • ∇(sin γ ) and J φ m = J η l -μL • ∇(sin γ ), ( 57
)
which combines with Eq. ( 23) to yield expressions in terms of the fiber stretches and shear angle. The same results follow from the final equality in Eq. ( 53).

Constitutive framework

In view of the complexity of the equations obtained thus far we confine our further development to the important special case in which both fiber families are initially straight and so take L and M to be fixed. This entails a minor loss of generality, which is, however, offset by increased clarity and tractability. Thus, we have the simplifications

g l = λ 2 η l p + (L • ∇λ)l, g m = μ 2 η m q + (M • ∇μ)m (58)
and

Γ = (L • ∇μ)m + λμφ m q = (M • ∇λ)l + λμφ l p. ( 59
)
The final equality is, of course, simply the compatibility condition of Eq. (55) with η L = η M = 0. We take for granted the existence of a strain-energy function that depends on the stretches of the fibers as well as their curvatures and twists. Further, as (tangential) stretch gradients appear in the constitutive equations for one-dimensional models of thin fibers that account for finite-thickness effects [START_REF] Coleman | Necking and drawing in polymeric fibers under tension[END_REF][START_REF] Coleman | On the rheology of cold drawing: I. elastic materials[END_REF], we also allow a constitutive sensitivity to the tangential derivatives of the fiber stretches. Beyond this, we refer to arguments given in Ref. [START_REF] Dell'isola | A two-dimensional gradientelasticity theory for woven fabrics[END_REF] to the effect that in tightly woven fabrics there is likely to be a constitutive sensitivity to the cross derivatives of the fiber stretches and to the gradient of the shear angle between them, the former being simply the derivatives in directions transverse to the fibers. All such effects are contained in the vectors g l , g m and Γ , and so it is natural to include these among the arguments of the strain-energy function.

To non-dimensionalize the variables appearing in this function, it is necessary to introduce a local length scale. Candidates for this are the sheet thickness, the characteristic wavelength of the fabric weave, or the widths of the constituent yarns. The latter two are roughly equal in tightly woven fabrics and somewhat larger than the thickness. If any of these are used as the length scale, then in typical applications the non-dimensionalized vectors g l , g m and Γ are so small that the dependence of the strain energy on them is quadratic at leading order, assuming the associated couple stresses and bending/twisting moments to vanish when the fibers are straight and untwisted. A simple strain-energy function of this type is

W = w(λ, μ, J ) + 1 2 A g g l 2 + g m 2 + 1 2 A Γ |Γ | 2 + 1 2 k(K 2 L + K 2 M ) + 1 2 kT 2 , ( 60
)
where

K L = b αβ L α L β = λ 2 κ l , K M = b αβ M α M β = μ 2 κ m , T = b αβ L α M β = λμτ ; (61)
and the coefficients A g , A Γ , k and k may be functions of λ, μ, and J ; here, we take them to be constants for the sake of definiteness and tractability. This is a simple generalization of the strain-energy function proposed in Ref. [START_REF] Dell'isola | A two-dimensional gradientelasticity theory for woven fabrics[END_REF] for purely plane deformations, to accommodate threedimensional flexure and twist. Other forms are, of course, possible. In particular, we might separate out the effects of geodesic curvature and tangential stretch gradient in g l or g m , and assign different elastic moduli to each, as explained in Ref. [START_REF] Dell'isola | A two-dimensional gradientelasticity theory for woven fabrics[END_REF]. Here, following Ref. [START_REF] Spencer | Finite deformations of fibrereinforced elastic solids with fibre bending stiffness[END_REF], we forego such refinements for the sake of simplicity. The energy W is easily shown to exhibit orthotropic symmetry. In particular, J is determined by λ, μ and |sin γ |, which are orthotropic invariants [START_REF] Steigmann | Equilibrium of elastic nets[END_REF]. Similarly, every term in the function W remains invariant if r |αβ is replaced by

r|αβ = r |λμ H λ α H μ β
, where H ∈ {±L ⊗ L ± M ⊗ M}, with any combination of signs. The response of the fabric, therefore, conforms to orthotropic symmetry relative to the fiber axes on the reference plane. This is an example of homogenous symmetry in the general theory of material symmetry for second-grade material surfaces [START_REF] Murdoch | Symmetry considerations for material surfaces[END_REF] (see also in Ref. [START_REF] Indelicato | Symmetry properties of the elastic energy of a woven fabric with bending and twisting resistance[END_REF]).

We take the constants A g , A Γ , k and k to be strictly positive and observe that the part of the energy depending on the second gradient r |αβ is then non-negative, vanishing if and only if g l , g m , Γ , K L , K M and T all vanish. It is, thus, a positive definite function of the r |αβ . This conclusion follows easily from

r |αβ = L α L β (g l + K L n) + M α M β (g m + K M n) + (L α M β + M α L β )(Γ + T n), (62)
which is obtained by combining Eqs. ( 17) and (41). As such, the energy is a strictly convex function of r |αβ , which is enough to secure the existence of solutions to conservative boundary value problems characterized by a potential energy functional [START_REF] Ball | Null Lagrangians, weak continuity, and variational problems of arbitrary order[END_REF]; we discuss an example in Sect. 4 below.

Trivially, it then satisfies the Legendre-Hadamard necessary condition for energy minimizers; this requires that the strain energy deliver a positive value when r ,α and r |αβ in its arguments are replaced by 0 and cb α b β , respectively, in which b α is an arbitrary non-zero 2-vector and c is any non-zero 3-vector [START_REF] Hilgers | The Graves condition for variational problems of arbitrary order[END_REF].

Let r(θ α ; ) be a one-parameter family of deformations, and let u = ṙ be the derivative with respect to the parameter at a certain fixed value; = 0, say. The relevant response functions of the theory are simply the coefficient vectors N α and M αβ in the associated expression

Ẇ = N α • u ,α + M αβ • u |αβ , (63)
for the derivative of the energy, in which we have used the fact that W depends on the deformation through r ,α and r |αβ ; that is,

N α = ∂ W/∂ r ,α and M αβ = ∂ W/∂ r |αβ .
In particular, we may impose M αβ = M βα without loss of generality. To derive the required expressions we use Eq. ( 60) and obtain

Ẇ = ẇ + A g (g l • ġl + g m • ġm ) + A Γ Γ • Γ + k(K L KL + K M K M ) + kT Ṫ , (64)
where

ẇ = w λ λ + w μ μ + w J J . ( 65
)
The objective is thus to express this as a bilinear form in u ,α and u |αβ . For example, using λ = |F L| we derive

λ λ = F L• Ḟ L = λL α l • u ,α ; then, λ = L α l • u ,α , (66)
and in the same way we obtain

μ = M α m • u ,α . (67)
Further, it is easily shown [START_REF] Steigmann | Elastic surface-substrate interactions[END_REF] that

J = J a α • u ,α (68)
and so we have

ẇ = (w λ L α l + w μ M α m + J w J a α ) • u ,α . (69)
Proceeding, we also have KL = ḃαβ L α L β , for example, where [START_REF] Ciarlet | An introduction to differential geometry with applications to elasticity[END_REF][START_REF] Steigmann | Elastic surface-substrate interactions[END_REF]

ḃαβ = n • u ;αβ , with u ;αβ = u ,αβ -Γ λ αβ u ,λ . (70)
Using

u |αβ = u ,αβ - Γ λ αβ u ,λ (71)
we conclude that

u ;αβ = u |αβ -S λ αβ u ,λ (72)
and hence that

KL = L α L β n • u |αβ -(a α • g l )n • u ,α . (73)
In the same way, we derive

K M = M α M β n • u |αβ -(a α • g m )n • u ,α (74)
and

Ṫ = L α M β n • u |αβ -(a α • Γ )n • u ,α . (75)
To obtain the remaining terms in Eq. (64) we require (cf. 38)

(S λ αβ a λ ) • = u |αβ -ḃαβ n -b αβ ṅ. (76)
Thus, for example,

g l • ġl = L α L β (S λ αβ a λ ) • = L α L β g l • u |αβ -K L g l • ṅ. (77) Using ṅ = -(n • u ,α )a α -obtained by differentiating n • a α = 0-we derive g l • ġl = L α L β g l • u |αβ + K L (g l • a α )n • u ,α . (78)
Similarly,

g m • ġm = M α M β g m • u |αβ + K M (g m • a α )n • u ,α (79)
and

Γ • Γ = L α M β Γ • u |αβ + T (Γ • a α )n • u ,α . ( 80
)
These results furnish

N α =w λ L α l + w μ M α m + J w J a α + [(A g -k)(K L g l + K M g m ) +(A -k)T Γ ] • a α n (81)
and

M αβ =L α L β (A g g l + k K L n) + M α M β (A g g m + k K M n) + 1 2 (L α M β + M α L β )(A Γ Γ + kT n), (82)
in which we have imposed the requisite symmetry with respect to interchange of the superscripts.

Equilibrium

The derivation of the Euler equations and boundary conditions in second-gradient elasticity is well known [START_REF] Toupin | Theories of elasticity with couple stress[END_REF][START_REF] Mindlin | Effects of couple-stresses in linear elasticity[END_REF][START_REF] Koiter | Couple-stresses in the theory of elasticity[END_REF][START_REF] Germain | The method of virtual power in continuum mechanics, part 2: Microstructure[END_REF][START_REF] Dell'isola | Beyond Euler-Cauchy Continua: The structure of contact actions in N-th gradient generalized continua: A generalization of the Cauchy tetrahedron argument[END_REF][START_REF] Dell'isola | How contact interactions may depend on the shape of Cauchy cuts in N-th gradient continua: Approach "à la D'Alembert[END_REF].

We present it here in outline, and in so doing, establish the constitutive connection between the applied loads and the deformation. To this end, we adopt the virtual-work statement

Ė = P, (83)
where the superposed dot refers to the variational derivative,

E = Ω W da (84)
is the strain energy and P is the virtual power of the edge loads, the form of which is made explicit below. Conservative loads are characterized by the existence of a potential L such that P = L, and in this case the problem of determining equilibrium deformations is reduced to the problem of minimizing the potential energy E -L.

We have

Ė = Ω Ẇ da, ( 85
)
where Ẇ is given by Eq. (63). Let

ϕ α = T α • u + M αβ • u ,β , (86)
with

T α = N α -M αβ |β (87)
and

M αβ |β = M βα ,β + M βα Γ λ λβ + M βλ Γ α λβ . ( 88
)
We may thus write

Ẇ = ϕ α |α -u • T α |α ( 89
)
and use Stokes' theorem to reduce Eq. ( 85) to

Ė = ∂Ω ϕ α ν α ds - Ω u • T α |α da, (90)
wherein ν = ν α e α is the rightward unit normal to ∂Ω.

In the absence of distributed loads, it follows immediately from Eq. ( 83) that the relevant Euler-Lagrange equation, holding in Ω, is

T α |α = 0. (91)
Turning to the boundary terms, a standard integrationby-parts procedure [START_REF] Dell'isola | A two-dimensional gradientelasticity theory for woven fabrics[END_REF] is used to recast the first integral in Eq. (90) as

∂Ω ϕ α ν α ds = ∂Ω T α ν α -M αβ ν α τ β • u +M αβ ν α ν β • u ,ν ds -(M αβ ν α τ β ) i • u i , (92)
where τ = τ α e α = N × ν is the unit tangent to ∂Ω (not to be confused with the scalar surface torsion defined in Eq. ( 19)), u ,ν = ν α u ,α is the normal derivative of u, (•) = d(•)/ds and the square bracket refers to the forward jump as a corner of the boundary is traversed. That is, [•] = (•) + -(•) -, where the subscripts " ± " identify the limits as a corner located at arclength station s is approached through larger and smaller values of arclength, respectively, and the sum refers to the collection of all corners. Here, we assume the boundary to be piecewise smooth in the sense that its tangent is piecewise continuous.

It follows from Eq. ( 83) that admissible powers are of the form

P = ∂Ω t t • uds + ∂Ω m μ • u ,ν ds + * f i • u i , ( 93
)
where

t = T α ν α -(M αβ ν α τ β ) , μ = M αβ ν α ν β and f i = -[M αβ ν α τ β ] i (94)
are the edge traction, edge double force, and the corner force at the ith corner, respectively. Here, ∂Ω t and ∂Ω m , respectively, are parts of ∂Ω where r and r ,ν are not assigned, and the starred sum ranges over corners where position is not assigned. We suppose that r and r ,ν are assigned on ∂Ω/∂Ω t and ∂Ω/∂Ω m , respectively, and that position is assigned at the corners not included in the starred sum.

A simple example of conservative loading is furnished by the potential

L = ∂Ω t t • rds + ∂Ω m μ • r ,ν ds + * f i • r i , ( 95
)
in which t, μ, and f i are all independent of the deformation.

To understand the role of the double force in mechanical terms, we consider the special case in which no kinematical data are assigned anywhere on ∂Ω, so that rigid-body deformations are kinematically admissible. The variational derivative of such a deformation is expressible in the form u = ω × r + c, where c and ω are arbitrary spatially uniform vectors. Because the strain-energy function is invariant under such deformations, we have Ė = 0 and Eq. ( 83) reduces to P = 0; i.e., c

• ∂Ω tds + f i + ω• ∂Ω (r × t + r ,ν × μ)ds + r i × f i = 0. (96)
We then have

∂Ω tds + f i = 0 and ∂Ω (r × t + r ,ν × μ)ds + r i × f i = 0, (97)
and hence the interpretation of r ,ν × μ is a distribution of edge couples. These couples are configuration dependent in the example of conservative loading described by Eq. (95).

In general, as is well known, a non-trivial fixed boundary couple can not be associated with a conservative boundaryvalue problem.

Example: hyperbolic paraboloid

The foregoing theory is quite involved and in practice recourse must be made to numerical methods to obtain solutions. Fortunately the convexity of the strain-energy function with respect to r |αβ ensures the convergence of minimizing sequences and hence guarantees that solutions are available via the direct method of the calculus of variations; in other words, the theory is amenable to finite-element analysis. We intend to report on its numerical treatment elsewhere.

Here, we merely illustrate the model in terms of an academic problem; in particular, we adopt a semi-inverse strategy and seek conditions under which the generalized hyperbolic paraboloids, defined by r(θ α ) = aθ 1 θ 2 + bθ 1 and thus (cf. 62) g l , g m , K L and K M all vanish, leaving

Γ + T n = a. ( 102
)
In the somewhat artificial special case when the moduli A Γ and k coincide we then have

M αβ = 1 2 A Γ (L α M β + M α L β )a. ( 103
)
Accordingly, M αβ |β vanishes, yielding

T α = N α = w λ L α l + w μ M α m + J w J a α , ( 104
)
where w J = ∂w/∂ J , etc. Experiments on fabrics [START_REF] Ferretti | Modeling the onset of shear boundary layers in fibrous composite reinforcements by second-gradient theory[END_REF][START_REF] Cusick | The response of fabric to shearing forces[END_REF][START_REF] Cao | Characterization of mechanical behavior of woven fabrics: experimental methods and benchmark results[END_REF] indicate that their resistance to shear is quite weak unless the fibers are nearly aligned; that is, unless |sin γ | is close to unity. The loci of points where |sin γ | = 1 are the curves determined by combining Eqs. (99) with (100). Elsewhere, the shear resistance may be safely ignored; this is tantamount to neglecting w J in Eq. (104), provided that the fiber stretches remain close to unity. Further, if the mesh of the fabric network is sufficiently coarse, then the mutual interactions of the fibers are also negligible; that is, coarse-mesh nets typically do not exhibit a Poisson effect. In such circumstances, the strainenergy function may be approximated by the sum of two functions, each depending on only one fiber stretch [START_REF] Indelicato | The influence of the twist of individual fibers in 2D fibered networks[END_REF]. In this case w J is negligible and we have the simplification

N α = w λ L α l + w μ M α m, ( 105
)
in which w λ depends only on λ(θ 2 ) and w μ depends only on μ(θ 1 ). We then obtain T α |α = (w λ l) ,1 + (w μ m) ,2 .

(106)

This vanishes identically, and the equilibrium Eq. ( 91) is satisfied. Using Eq. ( 94), we find, on lines of constant θ 1 and θ 2 , that t = w λ l and t = w μ m, respectively, and that μ vanishes. At the points of intersection of these lines, the corner force is f = A Γ a. If the sheet is a rectangle with edges parallel to the fibers prior to deformation, and if no corner force is applied, then a vanishes and Eq. (98) reduces to a homogeneous deformation, which is trivially in equilibrium for all strain energies of the form Eq. (60).

+ cθ 2

 2 + d,(98) in which a, b, c, d are fixed vectors, furnish equilibrium deformations. Here, θ 1 and θ 2 are Cartesian coordinates on Ω aligned with the initial fiber directions; i.e., L α = δ 1 α andM α = δ 2 α . Accordingly, λl = L α r ,α = aθ 2 + b and μm = M α r ,α = aθ 1 + c. (99)The fiber stretches are easily determined and the shear angle is given byλμ sin γ = |a| 2 θ 1 θ 2 + a • bθ 1 + a • cθ 2 + b • c. (100)Further,L α L β r |αβ = 0, M α M β r |αβ = 0 and, L α M β r |αβ = a,(101)

Acknowledgments David J. Steigmann gratefully acknowledges his appointment as a Visiting Research Professor at the Università di Roma 'La Sapienza' during the course of this research. He is also grateful for support provided by the Powley Fund for Ballistics Research.