Romuald Thion
email: romuald.thion@univ-lyon1.fr

François Lesueur
email: francois.lesueur@insa-lyon.fr

Meriam Talbi
email: meriam.talbi@insa-lyon.fr

Tuple-Based Access Control: a Provenance-Based Information Flow Control for Relational Data

Keywords: access control, relational databases, provenance, information flow, personal data server

This paper proposes a flexible control framework for relational personal data that enforces data originators' dissemination policies. Inspired by the sticky policy paradigm and mandatory access control, dissemination policies are linked with atomic data and are combined when different pieces of data are merged. The background setting of relational provenance guarantees that the policy combining operations behave accordingly to the operations carried out on the data. We show that the framework can capture a large class of policies similar to those of lattice-based access control models and that it can be integrated seamlessly into relational database management systems. In particular, we define a path oriented dissemination control model where policies define authorized chains of transfers between databases.

Promising ongoing research work include the generalization of the theoretical framework to more expressive query languages including aggregation and difference operators as well as experiments on secure tokens.

Introduction

The digitization of personal files has proved to be a convenient procedure to store, find, query and transfer these files. Its advantages have led to the large amount of digitized personal data we own today. Since such data contain private information by nature, it is mandatory to offer document and file owners some control over the diffusion of their personal data. Secure Personal Data Servers (PDSs) built upon portable and secure devices have emerged as a possible technical solution to deal with the issues raised by the proliferation of personal data by providing secure storage. A PDS is a USB-sized token equipped with a tiny processor, cryptographic capabilities and protection against physical tampering. It has been shown that a Relational DataBase Management System (R-DBMS) can be embedded into a secure smart card, to provide a real breakthrough in the management of sensitive data [START_REF] Anciaux | Milo-db: a personal, secure and portable database machine[END_REF]. However access control and information flow control solutions need to be developed for such environments and for personal relational databases as well.

This paper defines an information flow control model, namely Tuple-Based Access Control (TBAC), inspired by lattice-based and Mandatory Access Control (MAC) models [START_REF] Sandhu | Lattice-based access control models[END_REF] as well as by the sticky policy paradigm [START_REF] Karjoth | Platform for enterprise privacy practices: Privacyenabled management of customer data[END_REF] and Hippocratic DBMS [START_REF] Agrawal | Hippocratic databases[END_REF]. The objective of TBAC is to provide a mechanism that controls How to combine security policies?

Figure 1: Data transfer between PDS the dissemination of tuples between R-DBMS according to the authorizations defined by the producers of the initial tuples. TBAC authorization policies are attached to tuples as a specific form of provenance information, then, when tuples are accessed by means of relational queries, the related policies are combined accordingly to the queries' structures. In this paper we emphasize PDS-based applications, but the TBAC approach is more generally applicable to relational databases. Figure 1 illustrates a typical data transfer scenario between three participants that own personal relational databases powered by PDSs: the PDSs both act as clients that send queries to other participants' PDSs as well as servers that compute queries and send results to requesters. The point of TBAC is to filter results in such a way that tuples owners' policies are enforced along chains of transfers. In the scenario of Figure 1, Alice is the initial producer who tags each of her tuples at insertion time with an authorization policy that stipulates who has access to her personal information. Bob, one of Alice's colleagues, executes a query on Alice's PDS. Bob does not receive the complete answer to his query but only a subset of it, filtered according to Bob's credentials. Then Charlie asks Bob for Alice's data combined with others' tuples under Bob's sovereignty: at this point, we aim at enforcing an access control complying with both the access rights Alice initially put on her tuples as well as the access rights stipulated by Bob on his ones. Doing so, we can control the transfer of information between the participants of the system made of all PDSs with the guarantee that the initial will of tuple producers are satisfied.

In Section 2, we provide background information on the provenance model on which TBAC relies. In Section 3 we define the TBAC access-control models family: a flexible tuple-grained model that integrates with the core engine of a R-DBMS. More precisely, we define an abstract settings, give its semantics and exemplify it with several kinds of authorization policies. The two key differences between TBAC and traditional MAC in R-DBMS (e.g., Oracle Label Security) are the treatment of alternation and the seamless integration of control into query evaluation. In Section 4, we focus on dissemination control to show how to express authorized path policies that control where data can flow from one PDS to another. In Section 5, we compare TBAC against standard access control models used in R-DBMS and we survey related work on dissemination control and provenance-based access control models. Finally, in Section 6, we discuss the design of TBAC, its usability and we show how to use Ciphertext-Policy Attribute Based Encryption to enforce TBAC, before concluding this paper and suggesting further research work in Section 7.

Relational provenance

In TBAC, security policies are labels called s-tags, for security tags, associated to tuples, as are labels in MAC models. However, we do not assume that labels are automatically deduced from the users' credentials

r A B C s-tag t 0 a b c k 0 t 1 d b e k 1 t 2 f g e k 2 q(r) A C s-tag s 0 a c (k 0 ⊗ k 0 ) ⊕ (k 0 ⊗ k 0 ) s 1 a e (k 0 ⊗ k 1 ) s 2 d c (k 0 ⊗ k 1 ) s 3 d e (k 1 ⊗ k 1 ) ⊕ (k 1 ⊗ k 1 ) ⊕ (k 1 ⊗ k 2 ) s 4 f e (k 2 ⊗ k 2 ) ⊕ (k 2 ⊗ k 2 ) ⊕ (k 1 ⊗ k 2 )
Table 1: Instance r and result q(r)

but are rather user-defined statements. The main building block to implement a sticky policy approach is a mechanism that deals with s-tags consistently with the operations carried out on the tuples. Green, Karvounarakis and Tannen have introduced a formal framework -the extended Relational Algebra (RA + ) -that provides a positive and elegant answer to this problem [START_REF] Karvounarakis | Semiring-annotated data: queries and provenance[END_REF] in the setting of the positive relational algebra (Selection (σ), Projection (π), Join ( ), Renaming (ρ) and Union (∪)). In the RA + model each tuple is annotated with a value from a set K of s-tags. When tuples are combined by SPJRU expressions their related metadata are combined accordingly using two operations: ⊕ : K × K → K and ⊗ : K × K → K that act as generalized versions of the boolean operators ∨ and ∧ used in the classical relational algebra with set semantics. Informally, ⊕ combines s-tags of tuples involved in unions and projections while ⊗ is used by joins and cartesian product operations. Relational algebra obeys some identities (e.g., R (S ∪ T ) = R S ∪ R T ), a key result of RA + that we will use in Section 3 is to show that the algebraic structures that reflect and preserve fundamental identities of the positive relational algebra are precisely commutative semirings. A commutative semiring on an underlying set K is an algebraic variety K, ⊕, ⊗, 0, 1 made of two different binary operations ⊕ and ⊗ with two distinguished elements 0 and 1. The substructures K, ⊕, 0 and K, ⊗, 1 are both commutative monoids, with the additional properties that ⊗ distributes over ⊕ and that 0 is absorbing for ⊗. Thus, it is basically a distributive lattice without the idempotency requirement. A homomorphism (of semirings) between

K 1 , ⊕ 1 , ⊗ 1 , 0 1 , 1 1 and K 2 , ⊕ 2 , ⊗ 2 , 0 2 , 1 2 is a function f : K 1 → K 2 that satisfies the usual requirements of a structure-preserving map, f (x ⊕ 1 y) = f (x) ⊕ 2 f (y), f (x ⊗ 1 y) = f (x) ⊗ 2 f (y), f (0 1 ) = 0 2 , f (1 1 ) = 1 2
. Details are to be found in [START_REF] Karvounarakis | Semiring-annotated data: queries and provenance[END_REF].

As an example, consider the instance r given by Table 1 which contains three tuples annotated respectively with k 0 , k 1 and k 2 . We assume that the instance r is held by Alice in her PDS. Bob runs the following SPJRU query q on Alice's secure PDS: q(r) = π AC (π AB (r) π BC (r) ∪ π AC (r) π BC (r)) Table 1 illustrates the RA + semantics, for example, s 3 's annotation (k

1 ⊗ k 1 ) ⊕ (k 1 ⊗ k 1 ) ⊕ (k 1 ⊗ k 2 )
indicates that there are three different ways to obtain (d, e), one for each monomial: by joining t 1 with itself on B (first monomial k 1 ⊗ k 1 ); by joining t 1 with itself on C (second monomial k 1 ⊗ k 1 ); by combining t 1 with t 2 (monomial

k 1 ⊗ k 2 ).

The TBAC models family

The key idea behind the design of the TBAC model is to think about a semiring on K as the algebraic structure of security policies, similar to the lattices used in lattice-based access control and MAC. The first ingredient is the semiring K, ⊕, ⊗, 0, 1 of access rights that are attached to tuples. The two distinguished elements 0 ∈ K and 1 ∈ K represent the deny-all and the allow-all s-tag respectively. Operators ⊕ and ⊗ are policy combinators that captures summation (a.k.a., disjunction) and product (a.k.a., conjunction) of policies. The second ingredient is the set C of credentials that are associated with users. The last ingredient is the decision function f : C × K → B (with B = { , ⊥}) that decides whether a tuple with s-tag k ∈ K should be authorized or not by comparing it against the requester's credentials c ∈ C. The decision function captures the access control semantics of TBAC: a user with credentials c has access to a tuple t, tagged with k, in a query result q(r) only if the decision function f (c)(k) is . In the rest of this section we introduce motivating instances of the framework, entitled UserSet, AttributeSet and Deadline TBAC, we show the core semantic property of the framework and prove that different TBAC policies can be integrated. From now on, we will write (t : k) for a tuple t and its s-tag k.

Example instances

UserSet TBAC

In UserSet TBAC a user is allowed to access a tuple based on his/her identity and the set of authorized users. We note by U the set of all the users in the system. Each tuple t is annotated by an element k ⊆ U , which means that every user in k is allowed to read t. Formally, we have K = P(U ) with P the powerset operator and C = U . UserSet TBAC amounts to instantiating the RA + framework by choosing the structure P(U ), ∪, ∩, ∅, U as the domain of s-tags. For a user u requesting a tuple (t : k), access is granted if u ∈ k. The decision function is thus defined by f (c)(k) = c ∈ k.

AttributeSet TBAC

We can go a bit further to capture attribute-based access control. In AttributeSet TBAC an s-tag is given as a set of sets of authorized attributes, that is an s-tag is an element of P(P(G)) where G denotes the set of all attributes. The access control semantics is the following: the outer set level captures alternation, that is, an access to t is authorized if it is granted by {g 0 0 , . . . , g 0 l(0) } or . . . or by {g n 0 , . . . , g n l(n) }; the inner set level captures conjunction, that is, an access is granted if all the g i j of one group are satisfied. The operation that captures the addition of policies is naturally ⊕ = ∪. Multiplication of policies is formally defined by the operation

X Y = {x ∪ y | x ∈ X ∧ y ∈ Y }.
The resulting semiring is P(P(G)), ∪, , ∅, {∅} . In AttributeSet TBAC, a credential c ∈ C = P(G) is a subset of attributes the requester is assigned to. An access to (t : k) is granted if the requester can fulfil all the requirements of at least one of the groups of attributes in k, formally: 2 recasts the example relation of Section 2 with the concrete structure of AttributeSet TBAC. For the tuple (t 0 : k 0 ), the s-tag k 0 = {{g 0 , g 1 }, {g 2 }} means that any user who has attributes g 0 and g 1 or who has attribute g 2 has access to (a, b, c). Query result q(r) of the Table 2 can be filtered using Bob's credentials c = {g 1 , g 3 } as shown in the last column. Bob has access to (d, e) and (f, e) because his credentials cover one group of attributes of k 1 and another of k 2 . Note that AttributeSet TBAC policies can be simplified by keeping only the minimal sets of attributes w.r.t. set inclusion. For instance, the element {{g 0 , g 1 }, {g 0 }, {g 1 }} ∈ P(P(G)) can be simplified to {{g 0 }, {g 1 }}. Such a property is used in formal proofs and can be seen as an optimization to keep the size of s-tags as small as possible. This simplification has been carried out on Table 2 for the sake of readability.

f (c)(k) = ∃g ∈ k.g ⊆ c. Table
r A B C s-tag t 0 a b c k 0 = {{g 0 , g 1 }, {g 2 }} t 1 d b e k 1 = {{g 0 }, {g 3 }} t 2 f g e k 2 = {{g 1 }, {g 2 , g 3 }} q(r) A C s-tag f (c)(k) s 0 a c {{g 0 , g 1 }, {g 2 }} ⊥ s 1 a e {{g 0 , g 1 }, {g 0 , g 2 }, {g 2 , g 3 }} ⊥ s 2 d c {{g 0 , g 1 }, {g 0 , g 2 }, {g 2 , g 3 }} ⊥ s 3 d e {{g 0 }, {g 3 }} s 4 f e {{g 1 }, {g 2 , g 3 }} Table 2: AttributeSet TBAC example

Deadline TBAC

Among the rights covered by the 95/46/EC European directive on the processing of personal data, Article 6 (e) stipulates that personal data should be collected no longer than necessary. This right has been coined as the right to oblivion, which states that personal data will eventually vanish. The idea behind Deadline TBAC is to use s-tags as "best before dates": one should have access to a tuple if the current time is before the deadline. In this setting, access rights are elements of K = N ∪ {∞}, where ∞ captures the lack of constraint. Credentials in N \ {0} denote the current time and are degenerated in the sense that they are not user-dependent. The decision function is defined by f (c)(k) = c ≤ k with n ≤ ∞ for all n ∈ N. The full semiring is finally N ∪ {∞}, max, min, 0, ∞ .

Properties of the TBAC models family

A fundamental property of given TBAC instances is that for any given credentials the decision function behaves well in the following sense: 0 is the deny all policy, 1 is the allow all policy, one can read a tuple tagged with X ⊕ Y if he/she can read either X or Y , and one can read a tuple tagged with X ⊗ Y if he/she can read both X and Y . Informally, the decision functions of UserSet, AttributeSet and Deadline TBAC preserve the intuitive meaning of disjunction and conjunction of policies. This property is formally captured by stating that for all c ∈ C, f (c) is an homomorphism from K, ⊕, ⊗, 0, 1 into the boolean semiring B, ∨, ∧, ⊥, . This is a key property of the approach: first it captures the semantics of access control, then it proves that TBAC fits into the RA + framework, and finally, Corollary 1 ensures that TBAC can be seamlessly integrated into an R-DBMS in the sense that it is independent of the evaluation order of queries. The Fundamental Theorem of RA + [13, Theorem 3.3] shows that the semiring structure works nicely with SPJRU operations: homomorphism of semirings and RA + queries commutes. Applied to TBAC, the Fundamental Theorem ensures that the decision function can be applied either before or after the evaluation of a query without loss. This guarantees that algebraic query optimization, query rewriting and other techniques that rely on equivalent algebraic expressions can still be used transparently in the presence of TBAC.

When a query is executed, its result is filtered through the decision function f (c). The filtered result of q(r) is formally defined by the following function eval 1 that selects the subset of authorized tuples after the evaluation of q(r): eval 1 (r)(q, c) = {(t : k) | (t : k) ∈ q(r) ∧ f (c)(k)}. Alternatively, it is possible to apply the decision function before the evaluation of q(r), that is, we define another evaluation function eval 2 : eval 2 (r)(q, c) = q(r ) with r = {(t : k) | (t : k) ∈ r ∧ f (c)(k)}. Corollary 1 is obtained by applying the Fundamental Theorem of RA + to Proposition 1.

Corollary 1

The filtering function of TBAC can be applied before or after the evaluation of a query without loss, that is eval 1 (r)(q, c) = eval 2 (r)(q, c).

Integrating heterogeneous policies

We show now that we can exploit the structure of semirings to combine heterogeneous instances of TBAC together into larger ones, mimicking an important property of lattice-based access control models.

Let K i , ⊕ i , ⊗ i , 0 i , 1 i be a finitely I-indexed family of semirings and let K = K 0 × . . . × K n be the Cartesian product of their underlying sets. We denote by π i : K → K i the ith projection of the product that maps a tuple to its ith component. The set K equipped with componentwise addition k 0 , . . . , k n ⊕ k 0 , . . . , k n = k 0 ⊕ 0 k 0 , . . . , k n ⊕ n k n and componentwise multiplication is itself a semiring called the product semiring [START_REF] Gondran | Dioids and Semirings: New Models and Algorithms[END_REF]. For instance, we can integrate UserSet, AttributeSet and Deadline TBAC structures altogether by building the following product structure P(U ) × P(P(G)) × (N ∪ {∞}) with addition of policies defined by (x, y, z)⊕(x , y , z ) = (x∪x , y∪y , max(z, z )) and multiplication defined by (x, y, z)⊗(x , y , z ) = (x ∩ x , y y , min(z, z )).

The decision function f : C × K → B can be defined from the f i s using either a Deny Takes Precedence (DTP) conflict resolution rule defined by f (c)(k) = ∀i ∈ I.f i (c)(π i (k)) or a Permit Takes Precedence (PTP) conflict resolution rule defined by f (c)(k) = ∃i ∈ I.f i (c)(π i (k)). Following the example mixing UserSet, AttributeSet and Deadline, we obtain the following definition of the combined function in the PTP case:

f (u, gs, n)(X, Y, Z) ⇔ u ∈ X ∧ ∃g ∈ Y.g ⊆ gs ∧ n ≤ Z.
However, if we want to combine two existing relations already tagged with different structures into a large one we need a method to consider each atomic policy as a member of the large one. In other words, we need a way to canonically inject the existing policies K i into the product structure K. This can be done using the following family of functions: ι i : K i → K, one for each i ∈ I, defined by combining a given s-tag with the "authorize all" policies for other components: ι i (k) = (1 0 , . . . , 1 i-1 , k, 1 i+1 , . . . , 1 n ). For example, the injection ι 0 : P(U ) → K is defined by ι 0 (x) = (x, {∅}, {∞}). Proposition 2 By combining semirings and decision functions as defined above, the product structure is a semiring and the decision function is an homomorphism, with both DTP and PTP conflict resolution rules.

Interestingly, Proposition 2 ensures that one does not need to always use the same conflict resolution rule. For instance, by integrating two semirings at a time: first P(U ) and P(P(G)) and then (N ∪ {∞}), one can select DTP for the first pair and then PTP.

Path-based dissemination

In the previous section we have defined and illustrated the TBAC framework with three standard access control structures. In this section we present a new structure for s-tags, called Path TBAC. The motivation driving Path TBAC is to introduce the concept of consumption in s-tags to be able to control the depth of a data dissemination. The security semantics is not only to filter the tuples pertaining to a query result but also to modify the s-tags obtained during query evaluation. We obtain a resource-limited information flow model where security tags are consumed when tuples are transferred from one PDS to another.

Let the set U denote the set of PDS identifiers. The set U of finite strings over the alphabet U can be endowed with the prefix partial order by defining x y ⇔ ∃z.(x :: z) = y with (x :: y) being the concatenation of two words. This partial order is equipped with a greatest lower bound operator on pairs of strings which is the longest common prefix written lcp(x, y). An s-tag is a set of authorized paths with label taken from U . To capture the lack of constraints on data dissemination, we add an extra element * , thus the set of all Path TBAC policies becomes K = P(U ) ∪ { * }. For instance, the s-tag k 0 = {(B, D)} captures the fact that the tuple t 0 can go first to Bob (B) and then to Denise (D). The ⊕ policy combinator is the union of sets of paths X ∪ Y with X ⊕ * = * . The empty set plays the role of neutral element for ∪. The ⊗ combinator is defined similarly to the operator by X ⊗ Y = {lcp(x, y) | x ∈ X ∧ y ∈ Y }. In order to control the depth of the dissemination, the decision function f (c) is defined according to the locality of who is requesting the tuple. If the destination PDS is the current PDS, then f (c) returns . If the destination is remote, f (c) returns only if at least one of the paths of the s-tag begins with the remote destination, that is f (c)(k) = ∃ps.(c :: ps) ∈ k. The following proposition ensures that this structure is indeed a semiring and that f (c) is another semiring homomorphism.

Proposition 3 K = P(U ) ∪ { * }, ⊕, ⊗, ∅, * is a commutative semiring and f (c) is an homomorphism.
When a tuple leaves a PDS its s-tag must be updated to reflect this hop. For each tuple transferred to c, each path of the annotation is modified by popping c from the beginning of each path. The update function upd : C × K → K is formally defined by: upd(c)(k) = {p | (c :: p) ∈ k}. The evaluation function is now upgraded to the following definition where q(r) is filtered and the s-tags modified: eval

(r)(q, c) = {(t : upd(c)(k)) | (t : k) ∈ q(r) ∧ f (c)(k) = }.
Table 3 recasts the running example with Path s-tags. The transfer scenario is made of two steps. First, Bob queries Alice's PDS to obtain q(r) and store it in his own PDS. Then, Charlie asks Bob for the whole content of q(r) and obtains q (r) which is a strict subset of q(r). At this point Charlie holds the tuple s 3 but cannot transfer it anymore, however, s 4 can be freely distributed. If Charlie had asked Alice directly, the disclosure would have been limited to {(f, e) : { * }} because Charlie has only access to t 2 .

This ability to define fine-grained control policies with different results according to the previous step is a key feature of Path TBAC. In the example, Charlie receives less information by querying Alice, who is

r A B C s-tag t 0 a b c k 0 = {(B, D)} t 1 d b e k 1 = {(B, C), (B, D)} t 2 f g e k 2 = { * } Alice's relation r ⇒ q(r) A C s-tag s 0 a c {(D)} s 1 a e {(D)} s 2 d c {(D)} s 3 d e {(C), (D)} s 4 f e { * } Bob's result q(r) ⇒ q (r) A C s-tag s 3 d e {()} s 4 f e { * } Charlie's result q (r)
Table 3: Path TBAC example supposed to be the originator of data, than by querying Bob. Such a scenario is relevant in many contexts and is coined as intransitive information flow. For instance, Bob may be a trusted party that ensures encryption, or Bob may be Charlie's boss who has to control the data sent to his subordinates. In this last example, Alice trusts Bob to select the right subset of data Charlie is authorized to.

Related Work

According to the classification used in the monograph entitled Access Control for Databases [5, Section 5], the TBAC control model can be categorized as a tuple-labeled access control model. View-based access control is the most common access control mechanism in R-DBMS but lacks flexibility and scalability because of the necessary proliferation of views. A more flexible and transparent approach is to try to rewrite the user's query using authorized views and to grant access if the rewriting succeeds [START_REF] Rizvi | Extending query rewriting techniques for fine-grained access control[END_REF]. Even so, privileges are still not attached to the data items themselves but to their containers.

Whereas MAC and related information flow models provide strong guarantees [START_REF] Rjaibi | A multi-purpose implementation of mandatory access control in relational database management systems[END_REF][START_REF] Cuppens | Logical foundations of multilevel databases[END_REF], we advocate that the context of personal information management and PDSs presented in Section 1 would benefit from a softer user-based approach. In TBAC, the classification of a tuple is not derived from the user's credentials but is user-specified at insertion time. TBAC relates to the Hippocratic database paradigm where owners specify to where data can flow. According to the classification of LeFevre et al. on Hippocratic databases [START_REF] Lefevre | Limiting disclosure in hippocratic databases[END_REF], TBAC follows the query semantics disclosure model : a tuple is discarded or not, without partial releases using NULL for forbidden attributes.

The TBAC dissemination function is close to the concepts of originator control, sticky policies and dissemination control. We give hereafter a brief overview of some related work. Park and Sandhu [START_REF] Park | Originator control in usage control[END_REF] study the combination of originator control with usage control. Thomas and Sandhu [START_REF] Thomas | Towards a multi-dimensional characterization of dissemination control[END_REF] provide an overview of dissemination control characteristics. Sandhu et al. [START_REF] Sandhu | Secure information sharing enabled by Trusted Computing and PEI models[END_REF] propose a Policy, Enforcement, Implementation model for secure information sharing, targeting TPM-enabled architectures (trusted software), which share similarities with PDSs. Bandhakavi et al. [START_REF] Bandhakavi | Super-sticky and declassifiable release policies for flexible information dissemination control[END_REF] define a logic framework to specify release control policies. Sticky release policies are used to control future dissemination of the data, and also of the aggregated data. Finally, Cerbo et al. [START_REF] Cerbo | Sticky policies for mobile devices[END_REF] propose to use sticky policies to integrate usage control conditions in mobile devices. The main purpose of the dissemination function in TBAC is to tackle the problems of data combinations of relational data for which it is tailored.

Provenance-Based Access Control have been coined in 2011 by Cadenhead et al. [START_REF] Cadenhead | A language for provenance access control[END_REF] and then by Park et al. [START_REF] Park | A provenance-based access control model[END_REF] with the following manifesto: "we strongly feel that access control systems built upon provenance data by fully utilizing its unique characteristics will provide a foundation for new access control mechanisms that are highly capable of supporting features that were not easily achievable with traditional access control solutions". The initial proposal by Cadenhead et al. turned its focus to the RDF triple-oriented data model and the applicability of access control technologies, whereas the second one by Park et al. sticks to the TBAC rationale. However, this second contribution provides a very wide vision on such models and does not define any specific model.

Provenance-based access control has received attention from the semantic web community. Lopes et al. [START_REF] Lopes | A logic programming approach for access control over rdf[END_REF] focus on the provenance machinery for the RDF-S paradigm. They use attribute-based policies with negation. Papakonstantinou et al. [START_REF] Papakonstantinou | Access control for rdf graphs using abstract models[END_REF] provide a similar system with more detailed experiments. Whereas these papers specify a unique concrete annotation domain, TBAC provides several different ones with a mechanism to integrate them. Moreover, we broaden the scope of applicability with the Path TBAC model that controls dissemination in a distributed environment.

Discussion

In this section we discuss different issues related to the implementation of TBAC. The first issue is the formal language of s-tags. Elements of UserSet, AttributeSet and Deadline TBAC all have a formal representation and a natural implementation. In general, it is also the case that any semiring has a syntactical representation because the category of semirings has an initial element, namely N[X]: the set of formal polynomials with integer coefficients freely generated from a set X of variables [START_REF] Gondran | Dioids and Semirings: New Models and Algorithms[END_REF]. As N[X] can be easily implemented using a recursive datatype, it is an adequate generic formal representation of s-tags. For instance, AttributeSet is obtained from N[G] by dropping coefficients and exponents.

Regarding user-friendliness, one may not assume that end-users will express their security policies by writing formal polynomials. The idea is rather to provide high-level, possibly graphical, languages to users and then to compile these expressions into concrete s-tags. As an example, one can introduce a set R of roles with a GUI to graphically define user-role assignments (U R ⊆ U × R) and tuple-role assignments (RT ⊆ R × T ) to help end-users writing (possibly large) UserSet expressions. The s-tag k associated with a tuple t is computed by k = {u|∃r ∈ R.(u, r) ∈ U R ∧ (r, t) ∈ T R}. As ongoing work, we are studying high-level statements such as "I authorize any member of this group to access this class of data as long as the data are served by x and that I have access to my own data" to be translated into Path TBAC expressions.

Enforcement is a key issue for access control models. The use of cryptographic systems can ensure the security of data while transferred between PDSs. Whereas PDSs are assumed to be trusted by all users in the system, it is not the case for communication services. A solution is to encrypt tuples according to their s-tags by using related work on the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [START_REF] Bethencourt | Ciphertext-policy attribute-based encryption[END_REF]. In CP-ABE, attributes are used to describe users' credentials, and a party encrypting data determines a policy for who can decrypt. Once applied to TBAC, the idea amounts to letting PDSs encrypt the tuples they emit according to the s-tags. CP-ABE deals with ciphertext-policies that can represent positive boolean formulae. As AttributeSet policies are isomorphic to positive boolean formulae, CP-ABE can be used for it. Extending CP-ABE to deal with richer semirings and ultimately N[X] is left open.

Conclusion

Motivated by personal information management in a federation of personal databases, this paper has introduced a tuple-grained control model for relational data named TBAC. The model is grounded in the algebraic foundations of the provenance data model, guaranteeing transparent integration of MAC into classical query evaluation engines of R-DBMSs. Moreover, we showed that the framework can be used to provide fine-grained user-based dissemination control using Path TBAC.

We have developed a proof-of-concept implementation of TBAC using the Perm prototype: a R-DBMS that handles provenance [START_REF] Glavic | Perm: Processing provenance and data on the same data model through query rewriting[END_REF]. Perm is used as the database tier of an n-tiers application, where the TBAC filtering process is integrated into the application server that acts as a proxy between users and the DB tiers. An ongoing funded research project is to integrate TBAC into an existing R-DBMS, small enough to fit into a secure smart card. We have also developed a second proof-of-concept where PDSs are used control collection and dissemination of personal data in a smart building scenario [START_REF] Lesueur | Palpable privacy through declarative information flows trackingfor smart buildings[END_REF].

Besides experiments, an ongoing research direction is to provide a completely algebraic definition of the TBAC models family. Actually, the filtering functions are not defined using the ⊗ and ⊕ operators but directly on the concrete structures of C and K. For instance, the condition f (c)(k) ⇔ c ∈ k for UserSet is equivalent to k ∪ {c} = k and f (c)(k) ⇔ c ≤ k for Deadline is equivalent to max(c, k) = k. These evidences suggest that the class of interesting semirings for security applications is the class of canonically ordered semirings, where the relation a ≤ b given by ∃c.a ⊕ c = b is a partial order [START_REF] Gondran | Dioids and Semirings: New Models and Algorithms[END_REF].

Our last research avenue is to extend the positive fragment of the provenance framework to richer languages, including aggregation or difference. Theoretical results that extend the RA + framework have been obtained [START_REF] Amsterdamer | Provenance for aggregate queries[END_REF], however, the algebraic structures are more ad-hoc than semirings and their applicability to access-control purposes is left open. Being able to provide a systematic definition of the decision function without reference to the internal structure of C and K may lead to a more generic framework, suitable for these extensions.

Proposition 1

 1 The curried decision function f (c) : K → B of UserSet (resp., AttributeSet and Deadline) is a homomorphism for all c ∈ C.

Acknowledgments

The authors gratefully thank the anonymous referees for their constructive suggestions and thorough reviews. This research was partially funded by the French ANR KISS project under grant No. ANR-11-INSE-0005.


Sophie Aubin

Pascal Aventurier

Ivo Júnior Pierozzi

Leandro Henrique Mendonça

Interlinking two institutional KOS about Agroecology: using LOD Agrovoc to circumvent the language barrier in identifying terminological intersections

come

•The exact match relation between Thesagro and Agrovoc-PT and was used to build the final Embrapa term subset.

• Agrovoc LOD allows

(1) the identification of common terms used for the two institutions and (2) a set of specific terms in each language that might be incorporated into each other's vocabularies;.

• This work also highlights some difficulties in the translation of certain terms in Agrovoc which will improve this multilingual vocabulary;

• The alignment between the INRA and Embrapa vocabularies prepares these two vocabularies to be linked when published in LOD;

• This conciliatory methodological model can be strengthened and systematized so that Embrapa and INRA can consider their contribution to broader initiatives in the agricultural domain like the project for a Global Agricultural Concept Scheme (Baker and Suominen, 2014).

  Data (Agrovoc LOD) serialized in RDF SKOS and offering concept labels in French and Portuguese was chosen as the key solution.. Knowledge Organization System subsets: • INRA: 3,140 French terms from VocINRA used to manually index 2,145 publications about Agroecology in the institutional repository ProdINRA;• Embrapa : semi-automatic term extraction from 260 full papers about Agroecology and a term matching using a specific tool(Pierozzi Júnior et al., 2014) towards Thesagro (a Brazilian Portuguese thesaurus) and Agrovoc-PT.Alignment• Onagui(Mazuel and Charlet, 2010), an open source tool designed to help alignment of vocabularies in SKOS or OWL, was used to align the VocINRA concepts with those in Agrovoc.

Context and aims of the work

Material and methods

Conclusions Results

Agrovoc URI

VocINRA EmbrapaVoc agrovoc:c_6701, "rural development" vi:1000006218, "développement rural" "desenvolvimento rural" agrovoc:c_7645, " technology transfer" vi:10000019611, "transfert de technologie" "transferência de tecnologia" agrovoc:c_7973, "tropical climate" vi:1000004499, "climat tropical" "clima tropical" agrovoc:c_10195, "cucumbers" vi:1000004499, "concombre" "pepino" agrovoc:c_2746, "ewes" vi:1000002777, "brebis" "ovelha"

Agrovoc URI VocINRA EmbrapaVoc agrovoc:c_14187, "selective grazing" vi:10000047526, "système de pâturage" -agrovoc:c_1394, "cauliflowers" vi:1000004244, "chou fleur" -agrovoc:c_16096, "agrosilvopastoral systems" vi:10000018929, "système agrosylvopastoral" -agrovoc:c_2595, "environmental control" vi:10000089386, "protection de l´environnement" --Agrovoc URI VocINRA EmbrapaVoc agrovoc:c_8086, "urban population" ---"população urbana" agrovoc:c_4889, "molasses" ---"melaço" agrovoc:c_15521, "social indicators" ---"indicador social" agrovoc:c_13127, "passion fruits" ---"maracujá"


Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 7/21/15 A. Grattan-Guinness" Cycle (GGC), of 391 years was applied to dates of intense eclipse cycles. A normal year will have 2 solar (S) and 2 lunar (L) eclipses for a total of 4 eclipses. Some say the maximum number of eclipses that can happen in a year is seven. This review found that 8 eclipses can happen in a little as 370 days, or possibly less. Consider the year 26 to 27AD. Here are found 3 Solar and 5 lunar eclipses in 370 days from August 1/26AD unto August 6/27AD. These eclipses are detailed in the following Table . The column JD# is the Julian Day number. The difference of e#-1 less e#-8 is 369.67 Julian days, very close to 1 solar year.

A. Grattan-Guinness" Cycle, of 391 years was applied to dates around 27AD as shown in the next table. Two separate 4,000 year long sequences were reviewed. Both sequences were found to contain the 7 eclipse pattern. These rare seven year sequences all match AGG"s 391 year cycle. 1 Visible? AD mo dy ty JD# e# Israel 26 aug 1 S 1730767.04 1 noVis 26 aug 17 L 1730782.54 2 Vis 27 jan 11 L 1730929.90 3 noVis 27 jan 26 S 1730945.17 4 Vis 27 feb 9 L 1730959.34 5 Vi s .mr 27 jly 7 L 1731107.07 6 noVis 27 jly 22 S 1731121.69 7 noVis 27 aug 6 L 1731136.71 8 Vis 26 feb 6 S 1730590.94 0 Vis 26/27AD 8 eclipses in 370D

Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 6.15/15 A. Grattan-Guinness" Cycle, of 391 years was verified by dates of intense eclipse cycles, with start end sequences detailed in the below Table .

As all 22 eclipses matched the GGC, it was decided to take a different approach. Simply find a beginning year with 7 or 8 eclipses, then evaluate the end year. This was done for another date set also. It was seen that about 1 in 10 Years have the 7+ pattern. The more rare eight (8) eclipse sequence is found less than once in 80 years.

The Saros -Inex method was conceived by a Dutch astronomer in 1955. Since then, it gained acceptance as one way to verify eclipse and lunar cycles. In this system, each cycle is an integer combination of these 2 cycles.

Six thousand years of civilized history may be counted by combination of GGC start years and the ending 7 or 8 eclipse cycle date. Between 1865 and 2027, there were five of an 8 eclipse start year or 1 in 33 and about 1 in 7 years have the 7 eclipse sequence. The base of the 1865AD year is 4000BC by the GGC sequence. The base of year 2027 is 3839BC by GGC sequence. This shows the "End from start" idea.

Start EclPttrn End EclPttrn 4S+3L=7 -1993 4S+3L=7 5S+3L=8 -1975 4S+3L=7 4S+3L=7 -1928 4S+3L=7 4S+3L=7 -1910 5S+3L=8 3S+5L=8 -1908 3S+5L=8 4S+3L=7 -1900 A. Grattan-Guinness Cycle, of 391 years may also be arrived at using the Saros-Inex method, as shown below: Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 6.15/15

Here is an evaluation of some GGC"s showing Spring Equinox dates near or on a new moon conjunction of nearly same date.

The alignment of double conjunctions can be seen to last about 6 cycles of 391 years. Ridgeway showed the GGC to develop an error of 1 day in 1738 year, or about 5 cycles. From J. Geisen & use RMS average at 82% Inex, on page2, expected stability is: ((0.18*1700*0.82*26680)^½ = 2587 YR or about 7 cycles. By the Eclipse patterns of page1, a stability of 3900 years is indicated. For example look at the 1681 series for +/one day alignment near the plus to minus node. There one can count off about 12 cycles of 391 years each, or around 4700 years for near alignment. 0.352 0.110 1*ABS((JD#-JD#tbc)/411.78-INT((JD#-JD#tbc)/411.78))) 2 -0.039 -0.007 (1*ABS((JD#-JD#tbc)/3232-INT((JD#-JD#tbc)/3232))) 3 0.001 0.001 (1*ABS((JD#-JD#tbc)/6939.69-INT((JD#-JD#tbc)/6939.69))) 4 -0.224 -0.117 (1*ABS((JD#-JD#tbc)/365.2422-INT((JD#-JD#tbc)/365.2422))) 5 -0.007 -0.015 1*ABS((JD#-JD#tbc)/206.71-INT((JD#-JD#tbc)/206.71)) 6 0.022 0.023 (1*ABS((JD#-JD#tbc)/142809.9-INT((JD#-JD#tbc)/142809.9))) Here are results of correcting average lunation time by a Fourier Series using the Grattan Guinness cycle. Without correction the error ranged between -1 and plus 0.8 days. After correction, the error ranged between +/-0.5 day. The statistical error ranged +/-0.25 days. The six terms used were: 1-Sidereal cycle 2-Anomalistic cycle 3-Metonic cycle, 4-Tropical Year, 5-Long Semester, and 6 Grattan Guinness cycle Plus the delta T. A review of lunar orbital patterns shows there are natural variations to the Synodic month, that cannot be simply predicted. 1 0.0071 0.0358 1*ABS((JD#-JD#tbc)/6939.69-INT((JD#-JD#tbc)/6939.69))) 2 0.0226 0.0059 (0.22801011*JD#-558976) Delauny Lunar term Rads 3 0.0531 0.1022 (0.017200608*JD#-42162) Delauny Solar term, rads 4 0.3686 0.0781 (1*ABS((JD#-JD#tbc)/411,78-INT((JD#-JD#tbc)/411.78))) 5 0.2162 0.1050 1*ABS((JD#-JD#tbc)/365.2422-INT((JD#-JD#tbc)/365.2422)) 6 0.0014 0.0060 (2*(0.22801011*C4-558976)) 2*Delauny Term, Rads 7 0.0705 0.0122 1*ABS((JD#-JD#tbc)/346.62-INT((JD#-JD#tbc)/346.62)) 8 0.0028 0.0031 (1*ABS((JD#-JD#tbc)/10571.95-INT((JD#-JD#tbc)/10571.95)))

Mean NewMoon Correction by Fourier Series True=Mean+∆ T+a+∑(AsinF+BCosF)

1-Metonic, 2, 3, 6-Delauny Terms, 4-FUMOCY, 5-Tropical Yr, 7-eclipse Yr 8.Inex In this example, the average lunation time is corrected by an eleven term Fourier Series. This yields improved results. After correction of same data, the average error ranged between +/-0.17 day. The statistical error ranged +/-0.20 days. The extra three terms used were variants of the lunar month.

Although the natural variations in Synodic month cannot be simply predicted, even with the Metonic Cycle, it is likely that addition of more terms of longer and shorter cycle times, corresponding to system frequencies, the error could be reduced to uncertainty of the Delta T. However to accurately implement such a system would likely require four to five times more data points to be significant.

The GGC is also useful to get lunar series falling upon the same Gregorian date. As previously shown there exist variations in the data of experts. For example Nasa tables only go back to 2000BC. For NASA concluded the dT uncertainty is so great that calculations are meaningless. Such factors need be reviewed when using existing calculation routines.

The key points of this work were: 1) show both Synodic corrections and dT corrections are necessary; 2) this correction is possible using a Fourier Series concept.

In this example, the average date of spring new moon is corrected by an eleven term Fourier Series. This yields greatly improved results. After correction, the average error ranged between +/-0.09 day. The statistical error ranged +/-0.05 days. The terms used were same as the prior example. The natural variations in Synodic month cannot be simply predicted, even with the Metonic Cycle. Since larger errors were associated with non-spring moons; all dates that were not spring moons were changed to spring moons for same year. This yielded greatly improved results. Most likely another set of data for moon dates around autumn equinox would also have very low error. 1 0.0035 0.0014 1*ABS((JD#-JD#tbc)/6939.69-INT((JD#-JD#tbc)/6939.69))) 2 0.0035 0.0003 (0.22801011*JD#-558976) Delauny Lunar term Rads 3 0.0351 0.1006 (0.017200608*JD#-42162) Delauny Solar term, rads 4 0.0485 0.0312 (1*ABS((JD#-JD#tbc)/411,78-INT((JD#-JD#tbc)/411.78))) 5 3.8336 3.0777 1*ABS((JD#-JD#tbc)/365.2422-INT((JD#-JD#tbc)/365.2422)) 6 0.0034 0.0003 (0.22801011*2*C4-558976)) 2*Delauny Term, Rads 7 0.0066 0.0036 1*ABS((JD#-JD#tbc)/346.62-INT((JD#-JD#tbc)/346.62)) 8 0.0006 0.0030 (1*ABS((JD#-JD#tbc)/10571.95-INT((JD#-JD#tbc)/10571.95))) 9 0.0327 0.0319 1*ABS((JD#-JD#tbc)/27.5545-INT((JD#-JD#tbc)/27.5545)) 10 3.4406 2.8621 (1*ABS((JD#-JD#tbc)/27.32158-INT((JD#-JD#tbc)/27.32158))) 11 0.2873 0.4318 1*ABS((JD#-JD#tbc)/27.32166-INT((JD#-JD#tbc)/27.32166))

Mean NewMoon Correction by Fourier Series True=Mean+∆ T+a+∑(AsinF+BCosF)

1-Metonic, 2, 3, 6-Delauny Terms, 4-FUMOCY, 5-Tropical Yr, 7-eclipse Yr 8.Inex Another issue is variation between delta T of various researchers. For example Nasa tables only go back to 2000BC. The NASA data is slightly different from the others. The following graph shows the data of Walker, likely omitted a delta T correction. Plotting a second order correction factor on Walkers" data proves the point. Namely that his dates can be corrected to match others with near perfect statistical certainty, R 2 =1. Determination of Dr. Bromberg's JD# for new moon is by: JD#NM=JD#-(HR.Age/24+MIN.Age/60/24)

The above plot of Walker new moon date (recommended save as offline) shows increased error with increasing time difference from present error . The NASA (Mr. Eclipse) data show slight variance to that of Kalendar and Torah Times results. However all three NASA, Kalendis, and Torah Times show Walker"s new moon date to be in error for all but more recent dates. Since his date is easily corrected by a second order polynomial, it is concluded that Walker neglected to utilize a delta T correction factor. Here are other methods to find dates of near conjunction of Equinox and New Moon. In the 1 st instance, the Hermetic Systems & Kalendis calendar programs were used to find some early Equinox Solar Eclipses. These eclipses tend to run in bands of various density. The Metonic cycle starting in year (-3139) had several. From there, steps of the Daniel Cycle were used to find additional years, see The reason JDD"s theory fails is shown in this 2 nd Table . The better Lunar-Solar Cycles are found as: 2300, 1727, 391(Grattan Guinness Cycle), 372(Gregoriana), 315, and 1040(Daniel) years. The cycle of 1656 years was fudged to be a lunar or eclipse cycle. Mr. Dwyer made his eclipse cycle work by adding 5 days. For 1656 years is 604841 days, but Dwyer used 604846 days to make the eclipse or lunar cycle. In so doing he destroyed the solar side of the cycle so it cannot reproduce equinox cycles. Years near the Seder Olam creation date also did not conform to JDD"s theory.

The years when a new moon and the Equinox happened concurrently were -4054, -4016, -3997, -3978, -3940, & -3921. Because an eclipse is a vector quantity, not all new moons are eclipses. The years of eclipses on equinox new moon dates were only; -3997, -3978, -3940, & -3921. Adding Dwyer's 604841 day eclipse cycle to these dates determined the following dates for eclipses about 1656 years future: -4005/-2349; 3986/2330; -3978/-2322, -3940/-2284, & -3921/-2265. None of these future year eclipses happened on a spring equinox. Thus the Dwyer theory is a bust, there are no double concurrences to be found. This is likely the reason he only speculated, but did not calculate.

Start Year NewMoon Equinox ∆ Day Start Note Flood, greg JD# Flood Result -4062M20.13:55 237523.07 237525.21 2.14 EclipseNoEqnx -2406Mr26 842371. Year Equinox Eq-NM Year Equinox Eq-NM Year Equinox Eq-NM -2946 645135.6 1.2 -2023 982254.1 -1.3 -600 1501993.8 -0.6 -2927 652075.2 1.0 -2015 985176.1 -3.2 -581 1508933.4 -0.3 -2908 659014.8 1.2 -2004 989193.7 -1.1 -562 1515873.0 -0.1 -2889 665954.4 1.5 -1754 1080504.3 0.7 -543 1522812.6 - 2042 975314.5 -1.6 -619 1495054.2 -0.5 1624 2314292.7 1.0 -2023 982254.1 -1.3 -608 1499071.9 1.3 2015 2457102.4 0 Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 7.15/15 -4165n -3774n -3383n -2992n -2601 -2210 -1819 -1428 -1037 -646 -255 136 527 918 1309 1700n -4146n -3755n -3364 -2973 -2582 -2191 -1800 -1409 -1018 -627 -236 155 546 937n 1328n 1719n -4138n -3747n -3356n -2965n -2574n -2183n -1792n -1401n -1010n -619 -228 163 554 945 1336 1727 -4127 -3736 -3345 -2954 -2563 -2172 -1781 -1390 -999 -608 -217n 174n 565n 956n 1347n 1738n -4119n -3728n -3337n -2946 -2555n -2164n -1773n -1382 -991 -600 -209 182 573 964 1355 1746 -4108 -3717 -3326 -2935 -2544 -2153 -1762 -1371 -980n -589n -198n 193n 584n 975n 1366n 1757n -4100n -3709n -3318n -2927 -2536n - 2145 -1754 -1363 -972 -581 -190 201 592 983 1374 1765 -4089 -3698 -3307 -2916 -2525 -2134 -1743n -1352n -961n -570n -179n 212n 603n 994n 1385n 1776n -4081n -3690n -3299 -2908 -2517 -2126 -1735 -1344 -953 -562 -171 220 611 1002n 1393n 1784n -4062 -3671 -3280 -2889 -2498 -2107 -1716 -1325 -934 -543 -152 239n 630n 1021n 1412n 1803n -4054n -3663n -3272n -2881n -2490n -2099n -1708n -1317 -926 -535 -144 247 638 1420 1811 -4043 -3652 -3261 -2870 -2479 -2088 -1697 -1306 -3970n -3579n -3188n -2797n -2406n -2015 -1624 -1233 -842 -451 -60 331 722 1504 1895n -3959 -3568 -3177 -2786 -2395 -2004 -1613n -1222n -831n -440n -49n 342n 733n 1124n 1515n 1906n -3940 -3549 -3158 -2767n -2376n -1985n -1594n -1203n -812n -421n -30n 361n 752n 1143n 1534n 1925n -3932n -3541 -3150 -2759 -2368 -1977 -1586 -1195 -804 -413 -22 369n 760n 1151n 1542n 1933n -3921 -3530 -3139n -2748n -2357n -1966n -1575n -1184n -793n -402n -11n 380n 771n 1162n 1553n 1944n -3913 -3522 -3131 -2740 -2349 -1958 -1567 -1176 -785n -394n -3n 388n 779n 1170n 1561n 1952n -3894 -3503 -3112 -2721 -2330 -1939 -1548n -1157n -766n -375n 16n 407n 798n 1189n 1580n 1971n -3875 -3484 -3093 -2702 -2311n -1920n -1529n -1138n -747n -356n 35n 426n 817n 1208n 1599n 1990n -3856 -3465n -3074n -2683n -2292n -1901n -1510n -1119n -728n -337n 54n 445n 836n 1227n 1618n 2009n -3850n -3459n -3068n -2677n -2286n -1895n -1504n -1113n - -3997 -3606 -3215 -2824 -2433 -2042 -1651 -1260 -869 -478n -87n 304n -3978 -3587 -3196 -2805 -2414 -2023 -1632 -1241 -850n -459n -68n 323n -3940 -3549 -3158 -2767n -2376n -1985n -1594n -1203n -812n -421n -30n 361n -3921 -3530 -3139n -2748n -2357n -1966n -1575n -1184n -793n -402n -11n 380n -2851 -2460 -2069n -1678n -1287n -896n -505n -114n 277n 668n 1059n 1450 -2843 -2452 -2061 -1670 -1279 -888 -497 -106 285 676 1067 1458n -2479 -2088 -1697 -1306 -915n -524n -133n 258n 649n 1040n 1431n 1822n - 2471 -2080 -1689 -1298 -907 -516 -125 266 657 1439 1830 -2145 -1754 -1363 -972 -581 -190

  I=Innex or 28.945Yr, S=Saros or 18.03Yr 16I-4S=16(28.95)-4(18.03)=391=17*23 10I-15S=10(28.95)-15(18.03

  If on the other hand the alignment is limited to +/-one-half a day, the cycle count is about 6 or 7 cycles or nearly 2300 years. The 19 year Metonic cycle can find additional GG cycles. In the plot, 1681 less 1662 is 19 years. A missing cycle is found for year 1643AD by adding 19 to 1624.The Metonic 19 year cycle only holds for about 4 GGC, as seen for the 1624 to 1681 series. Other cycles possibly useful to find additional Equinox conjunction dates are: 353, Unidos, and Gregoriana. The Gregoriana cycle of 372 years (135870.2d) gives same Gregorian date and weekday. The 353 cycle (128930.6d) also finds same Gregorian date. The equinox is nearly same Gregorian calendar date from year to year, these cycles offer a way to find different start points of Equinox dates near a new moon conjunction. The astronomical or true Equinox is not exactly the same Gregorian calendar date due to calendar leap year cycles. Also a 220 (half Babylon) year cycle is seen for minimum error, 1844,1624,1404,1184.

  2π) & (2π=2*3.142) & a= 0.002 & JD#tbc=2421251.82 1

  ∆T per IBC=((LN2k)^4*(3.6E-22)-(7.8E-17)*(LN2k)^3+1.01E-10*(LN2k)^2+2.87E-8*(LN2k)+8.95E-5) Mean NewMoon Correction by Fourier Series True=Mean+∆ T+a+∑(AsinF+BCosF) 1-Sidereal, 2-anomalistic, 3-Metonic, 4-Tropical Yr, 5-Long Semester, 6-GrattenG cycle LN2k = ((JD# -2451550.098)/29.53059) for 207 data point StdDev=0.16, see chart

  2π) & (2π=2*3.142) & a= 0.002 & JD#tbc=2421251.82

  ∆T per IBC=((LN2k)^4*(3.6E-22)-(7.8E-17)*(LN2k)^3+1.01E-10*(LN2k)^2+2.87E-8*(LN2k)+8.95E-5) LN2k = ((JD# -2451550.098)/29.53059)+C, 207point StdDev=0.14, see chart

  2π) & (2π=2*3.142) & a= -0.18 & JD#tbc=2421251.82

  ∆T per IBC=((LN2k)^4*(3.6E-22)-(7.8E-17)*(LN2k)^3+1.01E-10*(LN2k)^2+2.87E-8*(LN2k)+8.95E-5) LN=((JD# -2451550.1)/29.531)+C, 196point StdDev=0.027, Spring New Moon Only

  -04 5.396E-04 1.000E-04 error = C-bX-aX 2 X=((JD#-2458195.05)/36525) JD# = 316045.36 & err = -1.051

  18:57 258342.29 258344.01 1.72 EclipseNoEqnx -2349Mr25 863190.0 EclipNoEqnx21 -3997M22.12:43 261266.02 261265.96 -0.06 Eclipse&Eqnx -2341Mr26 866112.0 NoEqNoEclip21 -3986M20.02:22 265281.60 265283.62 2.03 EclipseNoEqnx -2330Mr26 870129.6 EclipNoEqnx21 -3978M21.21:21 268205.38 268205.56 0.18 Eclipse&Eqnx -2322Mr26 873051.6 EclipNoEqnx21 -3940M20.20:52 282084.37 282084.77 0.41 Eclipse&Eqnx -2284Mr26 886930.8 EclipNoEqnx21 -3921M21.19:12 289024.31 289024.37 0.06 Eclipse&Eqnx -2265Mr26 893870.4 EclipNoEqnx21 Review James D. Dwyer Equinox Eclipse Creation & Flood Day Cycle Theory 1656Y 604841D Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 7.07/15 This

  .7 -1.0 -1670 1111184.6 -1.7 -190 1651743.1 -0.2 -2563 785023.3 2.7 -1651 1118124.2 -1.4 -171 1658682.7 -0.4 -2517 801824.5 1.4 -1632 1125063.8 -1.2 -152 1665622.3 -0.4 0.2 -888 1396804.0 -1.6 964 2073232.7 -1.5 -2080 961435.3 -1.2 -665 1478253.1 1.5 1140 2137515.4 -6.7 -2061 968374.9 -1.6 -646 1485192.7 1.2 1562 2291647.7 5.9 -

  -915n -524n -133n 258n 649n 1040n 1431n 1822n -4035n -3644n -3253n -2862n -2471 -2080 -1689 -1298 -907 -516 -125 266 657 1439 1830 -4024 -3633 -3242 -2851 -2460 -2069n -1678n -1287n -896n -505n -114n 277n 668n 1059n 1450 1841n -4016n -3625n -3234n -2843 -2452 -2061 -1670 -1279 -888 -497 -106 285 676 1458n 1849n -3997 -3606 -3215 -2824 -2433 -2042 -1651 -1260 -869 -478n -87n 304n 695n 1086n 1477n 1868n -3978 -3587 -3196 -2805 -2414 -2023 -1632 -1241 -850n -459n -68n 323n 714n 1105n 1496n 1887n

  722n -331n 60n 451n 842n 1624 2015 -3839n -3448n -3057n -2666 -2275 -1884 -1493n -1102 -711 -320 71 462 853 1635 2026n -3831n -3440n -3049n -2658n -2267n -1876n -1485n -1094n -703n -312n 79 470 861 1643 2034 -3812n -3421n -3030n -2639n -2248n -1857n -1466n -1075n -684 -293 98 489 880 1662 2053 -3793n -3402n -3011n -2620n -2229n -1838n -1447 -1056 -665 -274 117 508Equinox & (n-no)Eclipse +/-2.5day of Equinox (EQ), +/->2.5 to 5 Day of EQ >5day/EQ

  201 592 983 1765 2156n -2107 -1716 -1325 -934 -543 -152 239n 630n 1021n 1412n 1803n 2194n -1838n -1447 -1056 -665 -274 117 508 899 1290 2072 2463 -1857n -1466n -1075n -684 -293 98 489 880 1271 2053 2444 -1876n -1485n -1094n -703n -312n 79 470 861 1252 2034 2425 -1895n -1504n -1113n -722n -331n 60n 451n 842n 1233 2015 2406 -1735 -1344 -953 -562 -171 220 611 1002n 1393n 1784n 2175n 2566n -1382 -991 -600 -209 182 573 964 1355 1746 2528 2919 -684 -293 98 489 880 1271 1662 2053 2444 ND ND -619 -228 163 554 945 1336 1727 2118 2509 ND ND n: no eclipse.L Some Years of GG Equinox & Eclipse Cycles +/-1.5day Equinox, +/->2Day

  Table & upper graph. At each Daniel cycle start year the Metonic cycle can be used to find additional alignments, chart 2. Alternatively, there are a series of equinox Lunar Eclipse cycles when the moon moves behind or in opposition, years: -3010, -2991 and -2972. These may also be mapped by the Daniel Cycle. The Daniel cycle was discovered by Swiss Astronomer Jean-Philippe de Cheseaux as the difference between Daniels" numbers of 2300 and 1260. The error in this cycle is about 1 day in 15,000 years. It is seen in lower graph that each series has a point of minimum error or maximum alignment of New Moon with Spring Equinox. Another accurate bible cycle is the Dawson Cycle of 630773.3 days, an average of 2300 and 1260 years. The bible periods of 391 (GGC), 486, (706=391+1260/4), and 2520 years are other bible based solar lunar cycles that may be used to predict alignments.-4445 -3405 -2365 -1325 -285 755 1795 2835 Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 7.03/15 This correction applied in 5 th column is value from Fourier Series listed on page 7. This correction was found to be 85% effective and only valid for absolute values less than 0.70. For values of year 2015, Kalendis program shows Equinox JD# to be 2457102.448 and new moon conjunction as JD# 2457101.9. So the moon age by 2015 Equinox lunation number becomes: 29.531{(2457101.9-JD.Eqnx)/29.531 -INT((2457101.9-JD.Eqnx)/29.531)}.This value, if over 2 days, is made negative by subtraction of 29.531. The negative lower values make it easier to screen for dates when Equinox is close to new moon. The result in Table are screened from about 8,000 years. The years3970, 1146, 793, 934, and -4016 (Col.B) were found with closest approach of new moon and vernal equinox. One author claimed a series of Equinox eclipses but upon review, less than 1/3 were eclipses on the day of equinox. The others were just month of March eclipses. This Tableshowssome example results. First column is common year, 2 nd is Equinox date corrected per terms of graph, A or 3 rd is lunar age on corrected Equinox date; B or 4 th is Equinox date less new moon & both values from Kalendis program; C or 5 th is A column (3) corrected.

	Considerations on Mr. James D. Dwyer
	calendar method to (JDD) proposed that the
	find years of near year of Creation was on
	conjunction a day of Vernal Equinox of
	Equinox and New and also the flood was
	Moon. The first step likewise on an Equinox
	is and an Eclipse. The 1 st to determine
	Julian Day number Table reviewed the
	of the Astronomical possibility of such
	Equinox. The 1 st concept. In 1 st instance
	approximation is by all dates +/-100 years
	JD# using year 2015 from 4000BC were
	as a basis, as reviewed for such
	explained in graph. possibility.
	This date is then
	corrected by the 4 th
	order polynomial as
	described	by
	millennial year count
	from 2015. Year
	2015 was selected
	because an eclipse
	happened on vernal
	equinox.

  Table reviews Solar Eclipses near the Vernal Equinox, (+/-1 day). By this data, a Spring Equinox eclipse happens about once every 200 years. Not every new moon (NM) is an eclipse, for example 30AD, but a Solar Eclipse only happens on date of a new moon. This means there are more equinox new moons than equinox eclipses. As seen on page-12, there are several cycles that predict new moon dates near the equinox. But only the GGC cycle of 391 years (and Metonic variants of the GGC) can predict dates of both equinox and eclipse. Most of Luis Vega"s claimed equinox eclipses are only eclipses in Month of March, as seen in the table at right side. For example, his dates of 722, 1140, and 1562 and others of his claimed Equinox Eclipses are only eclipses in March. However they miss the Equinox date by more that 24 hours. Also Vega indicates that there are only 18 Equinox Solar Eclipses between 2015AD and 2250BC. If one counts only solar eclipses +/-24 hours of Spring Equinox, then the count is about 20 eclipses. If a criteria of plus minus 2 days of Vernal Equinox, then this table counts over 40 such eclipses. Thus timing rapture date based on a theory of 18 Equinox Eclipses is not likely a correct procedure. By this Table, the eclipse or new moon Julian Day number is the difference of "Equinox" less "Eq-NM". For year -2927, the New Moon or Eclipse time is 652075.2 less 1.0 or 652074.2.

  .5 Review of Some Near Equinox Eclipses with Equinox less Eclipse days Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 7.15/15

	This table looks at cycles that may predict eclipses on an equinox date. The year -934 was selected because	+/-1 Cycle Analysis-934base -D&Ecc CY Yr +D&Ecc AvErr	The eclipse dates prior to year -2999 were taken from the windows program EmapWin3.11 by Dr. Takesako.
	an eclipse happened near a perfect Lunar Conjunction with the Vernal Equinox (see pages 11 & 13, 0.03 days difference). From the start date of -934, one cycle up and one cycle	M22ND 2520 M20No 0.50 M22ND 2300 M20No 0.19 M21No 1780 M20No 0.04 M22No 1727 M20No 0.02	Eclipses data prior to -2999 are from Tables at Eclipse-wise. The dates of new moon and equinox were taken from Kalendis. The difference in time and date was calculated by Julian day
	down was evaluated. The evaluation	M22No 1260 M21No 0.47	numbers at Walker's page.
	results are given in the columns to left and right of the cycle length. If an eclipse happened, a YES is given and NO for no eclipse. The average error is sum of absolute value of Equinox	M21Yes 1154 M20Yes 0.60 M21No 1040 M21No 0.29 M21No 725 M21Yes 0.39 M20No 706 M20Yes 0.49	The next table shows results of the GGC predictions for a Solar Eclipse happening on or near the Vernal Equinox. Years in red are for equinox and new moon alignment +/-2.5 days of
	less new moon divided by 2, with	M21No 486 M21No 0.87	equinox. Years in brown are for equinox
	result in days. The 1727 and 391 year cycles had the lowest error, 0.02 days. Some cycles are good at predicting equinox and new moon alignment but fail at eclipse prediction. Examples of	M21Yes 391 M21Yes 0.02 M21Yes 345 M21No 1.49 M20No 190 M20No 0.85 M21Yes 19 M21No 0.15	and new moon alignment greater than +/-2.5 but less than 5 days of equinox, Blue values are dates more than +/-5 days away from spring equinox. The longest running cycle of good alignment
	these types of cycles are 2300 and	A	B	C	D	was for start year -2451. This alignment
	1727 years. Only two cycles, 1154 and 391 years, can predict New	Reader is advised to review the graph on page 3. It shows how	was for 10 cycles or 3910 years. The longest running cycle of solar eclipses
	Moon-Equinox alignment together	the GGC pattern works. The	was for start year -1382 and lasted
	with eclipse. However, only Grattan Guinness cycle , GGC, does all three with a very low error, 0.02 days. The 1154 year cycle error was 0.60 day. This means the equinox alignment	sinusoid nature of the Grattan Guinness Cycle, GGC, can lead to alignment fluxuations. Such as seen for start year -4035. For in that cycle are seen alternating dates of good alignment with	4301 years. The shortest eclipse cycle was 2, starting -3921. The shortest Equinox new moon cycle was also just 2. The average alignment was 5 or 6 cycles, or 2000 years.
	rapidly will degrade quickly.	dates of lesser alignments.

  Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 7.15/15

	This is an
	expanded
	Table	of
	Grattan
	Guinness
	Cycle
	Eclipses on
	or near a
	Spring
	Equinox. It
	differs from
	other table
	by using a
	larger range
	of alignment
	criteria, The
	eclipses or
	new moons
	in red are
	+/-2.5 days
	of	Vernal
	Equinox.
	When date
	is appended
	with "n" that
	means
	there was
	NOT a solar
	eclipse by
	the Equinox
	new moon.

F/(2π) & (2π=2*3.142) & a= -0.0001 & JD#tbc=2421251.82 1 0.0068 0.0261 1*ABS((JD#-JD#tbc)/6939.69-INT((JD#-JD#tbc)/6939.69))) 2 0.0053 0.0093 (0.22801011*JD#-558976) Delauny Lunar term Rads 3 0.1005 0.0398 (0.017200608*JD#-42162) Delauny Solar term, rads 4 0.6116 0.2587 (1*ABS((JD#-JD#tbc)/411,78-INT((JD#-JD#tbc)/411.78))) 5 1.2380 1.5434 1*ABS((JD#-JD#tbc)/365.2422-INT((JD#-JD#tbc)/365.2422)) 6 0.0001 0.0093 (0.22801011*2*C4-558976)) 2*Delauny Term, Rads 7 0.0392 0.0050 1*ABS((JD#-JD#tbc)/346.62-INT((JD#-JD#tbc)/346.62)) 8 0.0115 0.0018 (1*ABS((JD#-JD#tbc)/10571.95-INT((JD#-JD#tbc)/10571.95))) 9 0.3312 0.2744 1*ABS((JD#-JD#tbc)/27.5545-INT((JD#-JD#tbc)/27.5545)) 10 1.3758 1.3768 (1*ABS((JD#-JD#tbc)/27.32158-INT((JD#-JD#tbc)/27.32158))) 11 0.0115 0.0249 1*ABS((JD#-JD#tbc)/27.32166-INT((JD#-JD#tbc)/27.32166))Mean NewMoon Correction by Fourier Series True=Mean+∆ T+a+∑(AsinF+BCosF) 1-Metonic, 2, 3, 6-Delauny Terms, 4-FUMOCY, 5-Tropical Yr, 7-eclipse Yr 8.Inex ∆T per IBC=((LN2k)^4*(3.6E-22)-(7.8E-17)*(LN2k)^3+1.01E-10*(LN2k)^2+2.87E-8*(LN2k)+8.95E-5) LN=((JD# -2451550.098)/29.53059)+C, 207point StdDev=0.086, see chart

Considerations on Grattan Guinness Cycle, of 391Yrs by OP Armstrong 7.20/15

Find mean new moon of equinox by Julian day number (JD#) Epact Epact is age of moon (in days) upon January 1, for any year, Y, expressed in proleptic Gregorian reform of Julian calendar system. Linear method to find Epact is a counting method to determine moon age at 1January using average lunation time. The Metonic counting method was one of 1st ways to determine lunar age. The JD# of January 01 for any Gregorian year from -4010 to 3055 is calculated with high precision by Formula 3 of Table . Given JD# of 1January in a particular year, the moon age is the Epact, formula 1 or 2 of Table .  Sundry Epact systems have been proposed, this proposal uses the simplicity of the Julian Day number system. The counting of days by JD# for astronomical events is the natural order. The calendar conversion, then orders the date in any calendar of choice and thusly reckons the effect of leap years. Leap days are calendar events that are not associated with astronomical events. A mean lunation is about 29.51 day. Thus, days unto end of Epact Moon is 29.51 less Epact. This means the 1st moon in January is also (29.51-E) days from 1January. There are then 2 more moons from this time unto the first moon in March, this being an additional 59 days. This is by Table formula 5, March's first moon. For any proleptic Gregorian year, Y, the JD# of astronomical Vernal/Spring equinox is by Table formula 4, JD#.Equinox The Catholic system calls the 1st Sunday after the 1st full moon after spring equinox to be Easter Sunday. The full moon is about 14.75 days after new moon. Thus 14.75 added to JD# of first March moon and it is just simple counting to find Easter Sunday JD#. If the first March moon JD# plus 14.75 is less than VE, then increment by (28.5 +14.75) days to 1st March moon and find next Sunday. All this is calculated by JD# and the final JD# is converted to Gregorian calendar date, if needed. Because the Catholic VE is artificially set to 21 March, then to get the Gregorian Easter date, simply substitute JD# of 21March for year, Y. This JD# is by Table Formula 7. The counting of week days from a JD# is by Table formula 6. The original 19 year Metonic cycle was eventually found to be deficient by one day in 228 years. This secondary correction is still linear.

However for holiday dates, the Epact method is deemed suitable. Typical Epact tables or Easter formula are given for years after 1900 and valid for about 300 years forward. If a larger range of dates are desired then another method such as this is needed. The below graph compares the methods over 7000 year range. From this graph, is seems the Lunation Number Epact is better than a Metonic Cycle.