Stephen Pacella
email: spacella@coas.oregonstate.edu

Benoit Lebreton

Pierre Richard

Donald Phillips

Theodore Dewitt

Nathalie Niquil

Incorporation of diet information derived from Bayesian stable isotope mixing models into

Keywords: Ecological model, Stable isotope, Inverse analysis, Food web, Seagrass

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

Current ecological questions are often complex in nature, requiring a holistic perspective in order to adequately address the multitude of variables and relationships.

There is thus an ever-increasing pressure on ecologists to address these questions at the ecosystem scale. Quantitative food web models, representing partial or whole ecosystem flux networks, are a promising methodology to address ecological questions [START_REF] Christian | Ecological network analyses and their use for establishing reference domain in functional assessment of an estuary[END_REF][START_REF] Leslie | Confronting the challenges of implementing marine ecosystem-based management[END_REF]. These models are able to simultaneously explore effects of environmental changes on ecosystem structure and function, as well as emergent properties such as system dependencies, recycling, and efficiencies [START_REF] Niquil | The effect of physical drivers on ecosystem indices derived from ecological network analysis: Comparison across estuarine ecosystems[END_REF]. [START_REF] Banašek-Richter | Sampling effects and the robustness of quantitative and qualitative food-web descriptors[END_REF] showed that ecosystem descriptors based on quantified systems models are more accurate than their qualitative counterparts. Estimation of complete flux networks of food webs in marine ecosystems is recognized for its utility to understand ecosystem functioning [START_REF] Niquil | The effect of physical drivers on ecosystem indices derived from ecological network analysis: Comparison across estuarine ecosystems[END_REF]. However, many components of ecosystem models are understood conceptually, but difficult or impossible to measure in the field, and therefore must be estimated [START_REF] Niquil | Inverse model analysis of the planktonic food web of Takapoto Atoll (French Polynesia)[END_REF][START_REF] Van Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF][START_REF] Vezina | Food web dynamics in the ocean. 1. Best-estimates of flow networks using inverse methods[END_REF].

Inverse analysis is a powerful quantitative modeling method for estimating unmeasured components in ecosystem structures (Legendre and Niquil, 2012) and has been widely used for this reason in food web modeling [START_REF] Breed | Sedimentation, carbon export and food web structure in the Mississippi River plume described by inverse analysis[END_REF][START_REF] Daniels | Food web structure and biogeochemical processes during oceanic phytoplankton blooms: an inverse model analysis[END_REF][START_REF] Degré | Comparative analysis of the food webs of two intertidal mudflats during two seasons using inverse modelling: Aiguillon Cove and Brouage Mudflat, France[END_REF][START_REF] Donali | Carbon flow patterns in the planktonic food web of the Gulf of Riga, the Baltic Sea: a reconstruction by the inverse method[END_REF][START_REF] Eldridge | Development of a stable-isotope constraint system for estuarine food-web models[END_REF][START_REF] Eldridge | Benthic trophic dynamics in California coastal basin and continental slope communities inferred using inverse analysis[END_REF][START_REF] Grami | The plankton food web of the Bizerte Lagoon (South-western Mediterranean): II. Carbon steady-state modelling using inverse analysis[END_REF]2011;[START_REF] Jackson | Food web analysis of a planktonic system off Southern California[END_REF][START_REF] Kones | Are network indices robust indicators of food web functioning? a monte carlo approach[END_REF][START_REF] Leguerrier | Network analysis and inter-ecosystem comparison of two intertidal mudflat food webs (Brouage Mudflat and Aiguillon Cove, SW France)[END_REF]2003;[START_REF] Niquil | Inverse model analysis of the planktonic food web of Takapoto Atoll (French Polynesia)[END_REF]2006). It has become commonly referred to as Linear Inverse Modeling (LIM). Similarly to ECOPATH with ECOSIM [START_REF] Christensen | Ecopath II-a software for balancing steady-state ecosystem models and calculating network characteristics[END_REF][START_REF] Pauly | Ecopath, Ecosim, and Ecospace as tools for evaluating ecosystem impact of fisheries[END_REF][START_REF] Walters | Structuring dynamic models of exploited ecosystems from trophic mass-balance assessments[END_REF], LIM produces a static, mass-balanced, temporally integrated snapshot of the complete food web. Recent methodological advances have resulted in moving from models being solved with a single objective function (frequently a minimization function, [START_REF] Vezina | Food web dynamics in the ocean. 1. Best-estimates of flow networks using inverse methods[END_REF]; Legendre and Niquil, 2012), to utilizing stochastic Markov Chain Monte Carlo methods to produce probability distributions of model results (LIM-MCMC) [START_REF] Kones | Are network indices robust indicators of food web functioning? a monte carlo approach[END_REF]2006;[START_REF] Van Den Meersche | xsample (): An R Function for Sampling Linear Inverse Problems[END_REF][START_REF] Van Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF]. This technique avoids underestimates in both the size and complexity of the modeled food web as a result of the parsimony principle [START_REF] Johnson | The effects of aggregation on the performance of the inverse method and indicators of network analysis[END_REF][START_REF] Kones | Gaining insight into food webs reconstructed by the inverse method[END_REF]. A more thorough review on the subject is covered by [START_REF] Niquil | The effect of physical drivers on ecosystem indices derived from ecological network analysis: Comparison across estuarine ecosystems[END_REF]. Few applied studies have made use of recent methodological advances in this field, despite the relevance to informing conservation and environmental management decisions [START_REF] Christian | Ecological network analyses and their use for establishing reference domain in functional assessment of an estuary[END_REF];Jorgensen

2007).

Stable isotopes are commonly used to study trophodynamics in ecosystems.

Stable isotope analyses allow determination of food sources actually assimilated in the tissues of consumers over time, properly reflecting their trophodynamics depending on food source availability (Fry, 2006). Consumption rates are often difficult or impossible to accurately measure in the field, especially for smaller organisms, resulting in a large uncertainty in the magnitude of consumption flows and trophic resource partitioning in ecosystem models. Stable isotope data can be utilized to estimate these unmeasured flows [START_REF] Navarro | Comparison of ecosystem modelling and isotopic approach as ecological tools to investigate food webs in the NW Mediterranean Sea[END_REF][START_REF] Van Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF]. While the use of stable isotopes in diet studies has become standard practice [START_REF] Moore | Incorporating uncertainty and prior information into stable isotope mixing models[END_REF][START_REF] Post | Using stable isotopes to estimate trophic position: models, methods, and assumptions[END_REF], the integration of stable isotope data with whole food web network models has not been utilized frequently [START_REF] Baeta | Modelling the effects of eutrophication, mitigation measures and an extreme flood event on estuarine benthic food webs[END_REF][START_REF] Navarro | Comparison of ecosystem modelling and isotopic approach as ecological tools to investigate food webs in the NW Mediterranean Sea[END_REF]. The merits of this technique have been discussed recently in the literature [START_REF] Navarro | Comparison of ecosystem modelling and isotopic approach as ecological tools to investigate food webs in the NW Mediterranean Sea[END_REF][START_REF] Van Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF].

Until now, only one stable isotopic marker (δ 13 C or δ 15 N) at a time has been incorporated into inverse analysis models [START_REF] Eldridge | Development of a stable-isotope constraint system for estuarine food-web models[END_REF][START_REF] Jackson | Food web analysis of a planktonic system off Southern California[END_REF][START_REF] Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF][START_REF] Van Oevelen | Carbon flows through a benthic food web: Integrating biomass, isotope and tracer data[END_REF]. Using two or more isotopic markers significantly increases model structure complexity and greatly increases model run time. This problem is compounded in situations where Monte Carlo methods are used to run the inverse analysis thousands of times [START_REF] Kones | Are network indices robust indicators of food web functioning? a monte carlo approach[END_REF][START_REF] Niquil | The effect of physical drivers on ecosystem indices derived from ecological network analysis: Comparison across estuarine ecosystems[END_REF][START_REF] Van Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF]. This has significant implications when attempting to add stable isotope information into food web models solved using the new Linear Inverse Model-Markov Chain Monte Carlo techniques [START_REF] Kones | Are network indices robust indicators of food web functioning? a monte carlo approach[END_REF][START_REF] Niquil | The effect of physical drivers on ecosystem indices derived from ecological network analysis: Comparison across estuarine ecosystems[END_REF].

Therefore, the goal of this study was to find a way to incorporate information from multiple stable isotope elements (i.e., 13 C, 15 N, etc.) into food web models using the LIM-MCMC technique, with minimum added complexity. In order to do this, we used the R package SIAR [START_REF] Parnell | Source partitioning using stable isotopes: coping with too much variation[END_REF] to analyze Bayesian mixing models using δ 13 C and δ 15 N data to estimate food source distributions of the compartments in an inverse food web model of an intertidal seagrass bed. This information was then integrated into the LIM-MCMC food web model. Results of this model were compared with a corresponding model of the same system that excluded the isotope information obtained with the SIAR mixing models. We hypothesized that incorporating the food source information gained from the stable isotope information into the LIM-MCMC model would result in a significantly more constrained food web model, with reduced uncertainty associated with each flow.

METHODS

Marennes-Oléron Bay study site and model data

The seagrass system studied was an intertial Zostera noltii meadow located in Marennes-Oléron Bay, on the Atlantic coast of France (45°54'N, 1°12'W) (Figure 1). This is a semi-enclosed, macrotidal bay, which receives freshwater inputs from the Charente River (15-500 m 3 s -1 ) (Ravail-Legrand et al., 1988). The seagrass bed studied extends for 15km along the eastern shore of Oléron Island, and is 1.5km at its widest.

Primary producer biomass, benthic consumer biomass, and stable isotope data used in this model were obtained from [START_REF] Lebreton | Food sources used by sediment meiofauna in an intertidal Zostera noltii seagrass bed: a seasonal stable isotope study[END_REF]2009). Sampling was conducted at two stations (a high flat station and a low flat station) in 2006 and 2007 (Figure 1) and the results were averaged (Table 1). Each station was a homogeneous area of 100 m 2 parallel to the coastline, about 250 m from the upper and lower limits of the seagrass bed, respectively. The stations were each broken up into 100 plots of 1 m 2 for sampling. Both sampling sites were exposed at every low tide, with the higher in elevation of the two sites being exposed for 5 hours longer on average [START_REF] Lebreton | Are epiphytes a significant component of intertidal Zostera noltii beds?[END_REF]. Average emersion times on the seagrass bed were computed for this study using bathymetric data and tidal measurements, and those processes (i.e., phytoplankton production, bird grazing, zooplankton grazing, etc.) affected by the tidal cycle were scaled accordingly in the food web model.

Linear Inverse Model (LIM-MCMC) formulation

Two inverse food web models were built to track the flow of carbon through the seagrass food web on an annual basis, with units of mgC m -2 d -1 . The first model (Traditional LIM) included all available data, with the exception of the diet constraints formed from the stable isotope mixing models. The second LIM (Isotope LIM) was identical to the Traditional LIM, but included the SIAR diet constraints. Both models were identical in structure, and intended to model the same Marennes-Oleron intertidal seagrass bed.

First, an a priori topological model was formulated of the food web based on local expert knowledge and previous studies [START_REF] Leguerrier | Numerical analysis of the food web of an intertidal mudflat ecosystem on the Atlantic coast of France[END_REF][START_REF] Ulanowicz | Quantitative methods for ecological network analysis[END_REF], defining the compartments and all probable connections between them. All macrofaunal species sampled in the system were included which had a biomass of at least 0.05 g ash-free dry weight m -2 . This biomass threshold value resulted in 96.5% of the total measured biomass during sampling being included in the inverse food web model. The benthic and pelagic fauna of the system were parsed into compartments based on similarity of species-specific characteristics such as taxonomy, habitat, known feeding habits, known predators, and stable isotope (δ 13 C and δ 15 N) values. Priority was placed on aggregating species into the compartments in such a way so as to balance between maintaining the true trophic complexity of the ecosystem versus the need to keep the model simple enough that solutions could be produced in a timely manner. As the complexity of the model scales exponentially with the number of compartments, some aggregation was necessary. However, loss in precision of stable isotope data due to aggregation of species with dissimilar signatures was considered to be undesirable for the mixing models, and was therefore avoided. Previous studies found that a priori model aggregation at low trophic levels has a greater effect on inverse model results than does aggregation of higher trophic levels [START_REF] Johnson | The effects of aggregation on the performance of the inverse method and indicators of network analysis[END_REF]. In light of these results, primary producers, bacteria, and non-living carbon pools (e.g., dissolved organic carbon) were each given their own compartment. The resulting a priori food web model consisted of 26 compartments (23 living, 3 detrital) (Table 1) and 175 flows among compartments (Table 2).

The Traditional LIM and Isotope LIM were run using a Matlab routine that was a translation of the R packages limSolve and xsample [START_REF] Kones | Are network indices robust indicators of food web functioning? a monte carlo approach[END_REF][START_REF] Van Den Meersche | xsample (): An R Function for Sampling Linear Inverse Problems[END_REF][START_REF] Van Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF]. The routine uses a Markov Chain Monte Carlo (MCMC) algorithm to sample the LIM solution space using random jumps of a user-defined length. A "mirror" algorithm within the Matlab program creates a set of hyperplanes that form a convex solution space based on the equality and inequality constraints, out of which the sampling procedure cannot exit (Van den [START_REF] Van Den Meersche | xsample (): An R Function for Sampling Linear Inverse Problems[END_REF]. These hyperplanes act as mirrors, which the random jumps are reflected by, and that ensure the samples are always taken from within the LIM feasible solution space.

This procedure reduces the number of iterations required to fully characterize the solution space when compared with a solution procedure whose searching is not constrained to within the feasible solution space, as all samples of the mirror algorithm procedure are feasible solutions. Adequate sampling of the solution space and convergence was ensured through visual inspection of the sampling and results for each flow of the food web model. Note that the models were solved using the LIM-MCMC technique as described above, but will be referred to as the Traditional LIM and Isotope LIM for simplicity.

Stable isotope mixing models

The analytical precision of the stable isotope measurements was <0.15‰ and <0.2‰ for δ13C and δ15N values, respectively [START_REF] Lebreton | Food sources used by sediment meiofauna in an intertidal Zostera noltii seagrass bed: a seasonal stable isotope study[END_REF]. Trophic enrichment factors used were 0.5‰ +/-0.5 for δ13C and 2.5‰ +/-1.0 for δ15N [START_REF] Vander Zanden | Variation in δ15N and δ13C trophic fractionation: implications for aquatic food web studies[END_REF][START_REF] Vander Zanden | Variation in δ15N and δ13C trophic fractionation: implications for aquatic food web studies[END_REF][START_REF] Vander Zanden | Variation in δ15N and δ13C trophic fractionation: implications for aquatic food web studies[END_REF].

The SIAR isotopic mixing model [START_REF] Parnell | Source partitioning using stable isotopes: coping with too much variation[END_REF] was used to characterize the proportions of food sources used by the consumers in the seagrass bed. SIAR is an open-source R package that uses Bayesian inference to address natural variation and uncertainty of stable isotope data in order to generate probability distributions of food source contributions as percentages of the total diet. SIAR allows for multiple dietary sources, incorporates variability in source, consumer and trophic enrichment factors. As a result, output probability estimates reflect uncertainties in the data better than previous mixing models [START_REF] Parnell | Source partitioning using stable isotopes: coping with too much variation[END_REF][START_REF] Phillips | Source partitioning using stable isotopes: coping with too many sources[END_REF]2001;[START_REF] Phillips | Combining sources in stable isotope mixing models: alternative methods[END_REF].

A critical assumption of isotope mixing models is that all food sources are included in the analysis. Excluding a food source will bias the apparent proportions of the other sources that were included in the analysis, and may yield a diet with apparent food source proportions inconsistent with the observed isotopic composition of the consumer [START_REF] Parnell | Bayesian Stable Isotope Mixing Models[END_REF][START_REF] Phillips | Converting isotope values to diet composition: the use of mixing models[END_REF]. In order to meet this assumption, SIAR mixing models were only run for those LIM compartments whose food sources all had both δ 13 C and δ 15 N values. Models were not run for those LIM compartments whose food sources were not all described by both δ 13 C and δ 15 N data. For example, because the fish in the seagrass bed are known to be transitory, it cannot be assumed that all of their food sources are described by isotope data only collected from the within the seagrass bed. SIAR mixing models were therefore not run for this compartment. Of the 20 heterotrophic compartments in the LIM for which mixing models could potentially be used, 12 compartments met the assumptions required for a SIAR model to be run (Table 2). The 5% and 95% credible bounds of the generated probability density functions (PDF), expressed as percent contribution to the mixture for each food source, were recorded and used as input to the inverse model, as explained below. Credible intervals are used in Bayesian statistics to define the domain of a posteriori probability distribution used for interval estimation (e.g., if the 0.90 CI of a contribution value ranges from A to B, it means that there is a 90 % chance that the contribution value lies between A and B) [START_REF] Lebreton | Food sources used by sediment meiofauna in an intertidal Zostera noltii seagrass bed: a seasonal stable isotope study[END_REF].

Incorporation of mixing model data into the food web model

The 5% and 95% credible bounds of the PDF for each food source were used as lower and upper bounds, respectively, to constrain the relative contributions of each food source to the 12 consumer compartments modeled using SIAR. In order to be incorporated into the food web model, these lower and upper bounds were transformed into linear inequalities of the form: lower bound: Ci,j -l *∑C.,j ≥ 0 upper bound: h*∑C.,j -Ci,j ≥ 0 where, Ci,j is the flow of carbon from source i to consumer j, ∑C.,j is the sum of all source flows to consumer j, l is the 5% credible bound for % mixture contribution, and h is the 95% credible bound for % mixture contribution. Using this methodology, if consumer j had three potential food sources, six inequalities were entered into the food web model to describe consumer j's diet. Note that while the food web model used carbon as the currency for mass flow, and these isotopic inequalities were written following this form, the values were informed by both δ 13 C and δ 15 N data via the SIAR modeling process.

Investigating effects of isotopic constraints on the food web model

Two versions of the food web model were created to investigate the effects of using isotopic constraints on the estimated mass flows among compartments within the food web. A first model (Traditional LIM) was built using all available data except the isotopic constraints. The second model (Isotope LIM) was identical to the first model, but included the SIAR-derived isotopic constraints. Each model was run for 50,000 solutions using the LIM-MCMC technique, and convergence to the marginal probability density function (mPDF) for individual flows was verified for both models. Nonconvergence manifests itself as a drift in the mPDF with increased iterations [START_REF] Kones | Are network indices robust indicators of food web functioning? a monte carlo approach[END_REF].

Network indices were calculated for both food web models following the techniques of ecological network analysis (ENA) [START_REF] Baird | On the consequences of aggregation and balancing of networks on system properties derived from ecological network analysis[END_REF][START_REF] Christian | Ecological network analyses and their use for establishing reference domain in functional assessment of an estuary[END_REF][START_REF] Ulanowicz | Quantitative methods for ecological network analysis[END_REF]. These indices describe ecosystem network properties, interactions, and emergent properties of the system that are not otherwise directly observable [START_REF] Fath | Ecological network analysis: network construction[END_REF]. Indices computed were total system throughput, average path length, internal ascendency, internal development capacity, ascendency, development capacity, Finn cycling index and the comprehensive cycling index [START_REF] Baird | Energy flow of a boreal intertidal ecosystem, the Sylt-Rømø Bight[END_REF][START_REF] Ulanowicz | Quantitative methods for ecological network analysis[END_REF].

RESULTS

SIAR mixing models

SIAR mixing models for the 12 consumer compartments whose food sources were fully described with δ 13 C and δ 15 N data resulted in probability distributions of food source proportions for each compartment. The 5% and 95% credible bounds for each potential food source were used as lower and upper bounds of relative contribution to the consumer diet. These resulting 90% credible intervals used in the LIM-MCMC are shown in Table 2.

Effects of isotopic constraints on the food web model

Sixty-four of the 175 flows in the Isotope LIM were constrained using SIARderived dietary constraints. The mean value for each flow and the corresponding 90% interquantile range (95% credible interval value -5% credible interval value) are presented in Table 3. Seventy-nine (45%) and 43 (24%) of the means for the 175 flows were different between the Isotope and the Traditional LIMs by at least 10% and 25%, respectively (Table 3). Of the 64 flows which were constrained with SIAR-derived dietary constraints, 50 had their means change by at least 10%, and 31 had their means change by at least 25%. On average, all flows had a 23% absolute mean difference for the Isotope LIM in comparison with the Traditional; similarly the 90% interquantile ranges of the flows were reduced by 26% for the Isotope LIM in comparison with the Traditional LIM (Table 4). Flows constrained in the Isotope LIM using SIAR-derived diet constraints had, on average, a 42% absolute mean difference in comparison with the corresponding Traditional LIM flows, and their 90% interquantile ranges were reduced 45%. Additionally, the remaining 111 flows (those that were not directly constrained with SIAR-derived diet constraints in the Isotope LIM) had, on average, a 12% absolute mean difference, and 90% interquantile ranges were reduced by 15% on average. All network indices (total system throughput, average path length, internal ascendency, internal development capacity, ascendency, development capacity, Finn cycling index and comprehensive cycling index) calculated from the Traditional and Isotope LIMs had small differences in their means (Table 5). Changes in the 90% interquantile ranges with the addition of the SIAR-derived isotope constraints in the Isotope LIM were small when compared with the Traditional LIM (Table 5).

DISCUSSION

Comparison of single flows and integrative indices between LIMs

Both individual flows and integrative indices as calculated from ENA parameters were changed as a result of the addition of the SIAR-derived dietary constraints in the Isotope LIM. However, the comparison of the ENA indices showed smaller differences in the means, uncertainty (90% interquantile ranges), and marginal probability distributions between the Traditional and Isotope LIMs when compared to those differences between individual flows. This agrees with the findings of [START_REF] Kones | Are network indices robust indicators of food web functioning? a monte carlo approach[END_REF], who found that whole network indices are better constrained and more robust than the food webs from which they are calculated. Differences between the two models were more apparent when looking at the individual flow level as compared to a more aggregate, whole system measure (i.e., ENA indices). This suggests that the integration of the stable isotope data has the largest effect when looking at specific flows within the food web. Linear inverse models are most often utilized to quantify systems with a large number of unknown flows and data deficiencies. The fact that the integrative indices calculated from the Traditional and Isotope LIMs show small differences suggests that the LIM-MCMC technique is a robust method for assessing whole-ecosystem properties, even in the absence of site-specific stable isotope data.

Generally, the largest differences seen between the Traditional and Isotope LIMs were in those flows which were directly constrained by SIAR-derived diet constraints (Table 4). However, flows not directly constrained with isotope data were still affected, as evidenced by the reduced uncertainty and changes in means. This demonstrates the interconnected nature of the food web, as well as how constraining some flows with isotope data can have widespread effects on reducing uncertainty in LIM-MCMC models.

Integration of stable isotope data in food web models

The goal of this study was to find a way to incorporate information from multiple stable isotope elements (i.e., 13 C, 15 N, etc.) into food web models using the LIM-MCMC technique, with minimum added complexity. The technique of using SIAR-derived food source contribution constraints successfully integrated δ 13 C and δ 15 N information into the LIM-MCMC models. Analysis of LIM-MCMC output showed the Isotope LIM to be significantly different, as well as significantly more precise, than the Traditional LIM.

Thus, the integration of δ 13 C and δ 15 N data into the food web model through isotope mixing model diet constraints succeeded in reducing the uncertainty of the food web model solution. [START_REF] Van Oevelen | Carbon flows through a benthic food web: Integrating biomass, isotope and tracer data[END_REF] found, similarly, that inclusion of δ 13 C data significantly constrained a conventional LIM of a benthic intertidal flat food web. This study builds on this finding by simultaneously including stable isotope information from two markers (δ 13 C and δ 15 N), as well as using stochastic techniques to fully describe the food web model solution space and associated uncertainty.

The use of the SIAR mixing models allowed for incorporation of uncertainty in both the measured stable isotope values, as well as the fractionation factors.

Incorporating the 90% credible intervals from the mixing models into the LIM-MCMC in the form of inequalities agrees well with conventional practices for building linear inverse models and is relatively simple to do, but comes at the cost of losing information regarding the tails of the marginal posterior distributions. Future models may choose to incorporate this information in a similar fashion to [START_REF] Hosack | Do microbial processes regulate the stability of a coral atoll's enclosed pelagic ecosystem?[END_REF], though this would add significant complexity. This methodology allows for data from multiple isotopic markers to be used in order to estimate contributions from all likely food sources to each consumer. It is well established that a multiple marker approach (δ 13 C and δ 15 N) is significantly more informative when estimating diet contributions when compared to a single marker (δ 13 C or δ 15 N) [START_REF] Parnell | Bayesian Stable Isotope Mixing Models[END_REF][START_REF] Phillips | Converting isotope values to diet composition: the use of mixing models[END_REF]. Due to this, use of stable isotope mixing models in ecosystem-level food web studies can be advantageous for quantifying consumption flows. These same food web flows are often the most difficult to directly observe and measure as well, making isotopic mixing models a powerful tool for coupling with ecosystem-level food web models. This study used only two isotopic markers (δ 13 C and δ 15 N), as this was the only data available at the time, although the SIAR mixing models allow for incorporation of more than two [START_REF] Parnell | Source partitioning using stable isotopes: coping with too much variation[END_REF]. However, use of isotopic mixing models utilizing more than three markers becomes problematic, as it is difficult to determine the model fit and visualize the mixing space (this would require > three dimensions) [START_REF] Parnell | Bayesian Stable Isotope Mixing Models[END_REF].

Additionally, the use of the stable isotope mixing models helped validate the a priori food web model by verifying that the consumer diet networks were possible, and not missing a potential food source as indicated by the isotope data. While no statistical test exists for missing food sources [START_REF] Parnell | Bayesian Stable Isotope Mixing Models[END_REF], visualization of the iso-space for food web compartments is a tool that ecologists can use to identify probable predatorprey relationships. As mentioned, multiple isotopic markers help to better elucidate these relationships. Perhaps most importantly, though, is the fact that the stable isotope data specifically constrain consumption flows, which are often the most difficult to obtain reliable data on. This difficulty in obtaining reliable data leads to many ecosystem network models using diet data not specific to the study site of interest, such as from databases like FishBase (www.fishbase.org) [START_REF] Coll | Food-Web Structure of Seagrass Communities across Different Spatial Scales and Human Impacts[END_REF]. This can be a dangerous practice, as it has been shown that there can be considerable inter-site variability in the diet of members of the same species. We recommend the use of local diet information in the construction of food web models, as can be provided by mixing models utilizing sitespecific stable isotope markers. It is important to note that stable isotope data obtained from the literature or other sites is not useful when building a food web model, as values are site-specific and only comparable within the site and appropriate temporal period from which the stable isotope samples were gathered.

Effects of SIAR-derived food source constraints on the modeled food web

Integration of mixing model constraints into LIM-MCMC models address an obvious weakness of stable isotope mixing models: current commonly used mixing models do not take into account the availability of food sources [START_REF] Parnell | Source partitioning using stable isotopes: coping with too much variation[END_REF][START_REF] Phillips | Source partitioning using stable isotopes: coping with too many sources[END_REF][START_REF] Semmens | Improving Bayesian isotope mixing models: a response to Jacksonet al[END_REF]. Mixture partitioning is dictated purely by the stable isotope signatures of the consumer and food sources, regardless of whether or not there are enough of those food sources in the system to support the level of consumption suggested by the mixing model. The LIM-MCMC model deals with this issue through mass balance of each compartment, and incorporating field-measured biomass estimates for each compartment into the model. This constrains the biomass of each compartment in the model, and therefore the amount available for consumption.

While a simple concept, this is nonetheless an important attribute of ecosystem models, and an example of how the combination of isotope mixing models with inverse food web models is quite beneficial.

The use of the Markov-Chain Monte Carlo method (van [START_REF] Oevelen | Quantifying Food Web Flows Using Linear Inverse Models[END_REF] to solve the models enabled the statistical comparison to be done between the Traditional and Isotope models. Previous techniques, which relied on minimization of an objective function to choose one answer for a model, did not allow for statistically rigorous comparisons between models [START_REF] Vezina | Food web dynamics in the ocean. 1. Best-estimates of flow networks using inverse methods[END_REF]. Comparison of the mPDFs of each flow allowed for utilization of all solution data from the models, as well as taking into account the uncertainty associated with each flow. The same concept applied to the comparisons of the ENA indices. The LIM-MCMC technique also allows for the repeatability of model solutions, which is imperative for future comparative ecosystem studies.

Hosack. This document has been subjected to review by the National Health and Environmental Effects Research Laboratory's Western Ecology Division and approved for publication. Approval does not signify that the contents reflects the views of the Agency, nor does mention of trade names or commercial products constitute endorsement or recommendation for use. the web represent respiration and exports from the system. Abbreviations for food web compartments are in Table 1.

Figure 1 .

 1 Figure 1. Overview of Marennes-Oléron Estuary study site, including the intertidal seagrass bed that was modeled. Sampling

Figure 2 .

 2 Figure 2. Food web diagram of the Marennes-Oléron intertidal seagrass system, formed using the mean flows from the Isotope

Table 1 .

 1 Food web compartments, along with their biomasses and stable isotope values used in the Traditional and Isotope LIMs.

	Compartment	Compartment abbreviation	Biomass (mgC m -2 )	δ 13 C mean	δ 13 C SD	δ 15 N mean	δ 15 N SD
	AUTOTROPHS
	Microphytobenthos	mpb	9,250	-14.00	1.07	5.68	1.29
	Zostera noltii	zos	6,133	-10.98	1.06	8.46	1.53
	Phytoplankton	phy	254.5	-23.70	2.37	4.90	0.49
	DETRITUS
	Dissolved Organic Carbon	doc	1,850	-	-	-	-
	Sediment Organic Matter	som	27,560	-19.00	0.92	5.80	1.08
	Particulate Organic Matter	pom	1,044	-21.09	2.84	5.80	1.08
	HETEROTROPHS
	Benthic Bacteria	bba	4,718	-	-	-	-
	Pelagic Bacteria	pba	157.3	-	-	-	-
	Zooplankton	zoo	160.0	-24.35	2.43	7.39	0.74
	Hydrobia ulvae	hyd	3,752	-12.02	1.03	9.73	0.64
	Nematodes	nem	2,748	-12.83	0.61	9.80	0.73
	Tapes spp	tap	844.1	-16.94	1.79	9.15	0.79
	Cerastoderma edule	cer	352.5	-16.99	1.19	9.83	0.97
	Copepods	cop	359.0	-15.45	1.10	7.80	0.42
	Gastropod grazers	gas	325.0	-11.50	1.11	10.18	1.29
	Scrobicularia plana	scr	258.3	-14.28	0.71	9.98	1.06
	Mytilus galoprovincialis	myt	127.1	-18.14	1.86	9.47	0.75
	Abra spp	abr	69.59	-13.52	1.07	11.47	1.91
	Macoma balthica	mac	48.31	-13.38	0.53	11.07	2.23
	Cerebratulus marginatus	ceb	14.22	-14.67	2.24	10.00	0.42
	Carcinus maenas	car	25.96	-12.58	0.82	11.44	0.46
	Crangon crangon	cra	10.66	-12.99	1.02	12.92	0.59
	Notomastus latericeus	not	18.10	-13.87	1.16	13.10	2.18
	Arenicola marina	are	11.15	-13.68	0.58	11.31	0.14
	Fish	fsh	195.0	-15.11	3.29	13.08	2.14
	Birds	brd	7.00	-	-	-	-

Table 2 .

 2 SIAR-derived dietary contribution matrix. Lower and upper bounds of the 90% credible intervals are given, with consumers by row and prey items by column. Values are in units of percent contribution to total diet.

Table 3 .

 3 Flow means and 90% interquantile ranges of the Traditional and Isotope LIMs.

	Statistics are calculated with n=50,000 for each model (the number of Monte-Carlo
	simulations). 90% interquantile ranges are calculated as the 95% quantile value minus the 5%
	interquantile value. Units are mg C m -2 d -1 . Each flow is composed of the abbreviation of the
	source compartment (see table 1) TO the abbreviation of the sink compartment. gpp = gross
	primary production, imp = import, exp = export and res = respiration.
			Traditional Model		Isotopic Model
	Flow (sourceTOsink)		90% interquantile		90% interquantile
			mean	range	mean	range
	1	gppTOmpb	1357	339	1355	338
	2	gppTOzos	55.0	19.9	55.3	13.4
	3	gppTOphy	58.4	43.9	57.6	45.5
	4	impTOpba	88.5	16.0	88.4	15.9
	5	impTOphy	150	21.4	150	21.6
	6	impTOzoo	94.0	13.6	94.0	13.7
	7	impTOfsh	160	96.6	159	96.4
	8	impTObrd	4.6	2.7	4.7	2.5
	9	impTOpom	598	106	598	106
	10	impTOdoc	1067	185	1064	186
	11	mpbTOres	323	229	324	228
	12	mpbTOdoc	695	214	695	214
	13	mpbTObba	142	235	146	208
	14	mpbTOabr*	0.8	1.9	1.0	0.8
	15	mpbTOare**	0.2	0.4	0.1	0.2
	16	mpbTObrd**	7.9	19.5	0.2	0.4
	17	mpbTOcer**	2.6	6.4	4.5	3.3
	18	mpbTOceb	0.0	0.1	0.0	0.1
	19	mpbTOcop**	21.7	43.2	30.8	28.0
	20	mpbTOfsh	40.0	7.2	40.0	7.2
	21	mpbTOgas*	2.0	4.8	1.5	0.9
	22	mpbTOhyd*	47.2	114	52.2	26
	23	mpbTOmac	0.2	0.6	0.2	0.6
	24	mpbTOmyt*	1.2	2.8	1.5	1.2
	25	mpbTOnem**	63.8	150	41.7	101

Table 4 .

 4 Comparison of means and 90% interquantile ranges for the Traditional and Isotope LIMs. The absolute mean difference for each flow was calculated as the absolute value of the difference between Traditional and Isotope LIM mean flow values. Negative values indicate a reduction in the interquantile range of the Isotope LIM when compared with the Traditional LIM.

	Average

change in statistic after incorporation of isotope information All food web flows Flows with SIAR constraints Flows without SIAR constraints

		90%		90%		90%
	Absolute mean	Interquantile	Absolute mean	Interquantile	Absolute mean	Interquantile
	difference	range	difference	range	difference	range
	23%	-26%	42%	-45%	12%	-15%

Table 5 .

 5 Comparison of the means and 90% interquantile (IQ) ranges of the Ecological Network Analysis indices for each of the models. Negative values for the percent change of 90% IQ Range represent a reduction in the range of the Isotope LIM when compared with the Traditional LIM.

		Traditional LIM	Isotope LIM	% Change
	ENA Index	Mean	90% IQ Range	Mean	90% IQ Range	Absolute Mean Difference	90% IQ Range
	Total System Throughput	11,911	1,392 11,801	1,373	0.9%	-1.4%
	Average Path Length	2.28	0.26	2.26	0.25	1.1%	-3.8%
	Internal Ascendency	9,486	2,372	9,325	2,369	1.7%	-0.1%
	Internal Development Capacity	30,733	3,860 30,047	3,770	2.2%	-2.3%
	Ascendency	19,111	2,790 18,904	2,762	1.1%	-1.0%
	Development Capacity	36,955	4,510 36,219	4,413	2.0%	-2.2%
	Finn Cycling Index	0.052	0.041	0.051	0.043	0.7%	4.9%
	Comprehensive Cycling Index	0.059	0.047	0.058	0.050	0.7%	6.4%

Acknowledgments:

The present study was carried out at the University of La Rochelle, France and Oregon State University, United States, and partially funded by the European research programs PNEC, EC2CO, COMPECO, ORIQUART, and the Région Poitou Charentes.

We are grateful to all of our colleagues who made data available and helped with the modeling process, including Boutheina Grami, Blanche Saint-Béat, and Geoffrey R.


Anis Bkakria
email: anis.bkakria@telecom-bretagne.eu

Frédéric Cuppens
email: frederic.cuppens@telecom-bretagne.eu

Nora Cuppens-Boulahia

David Gross-Amblard
email: david.gross_amblard@irisa.fr

Specification and Deployment of Integrated Security Policies for Outsourced Data

Keywords: Security policy, data confidentiality, privacy-preserving, data outsourcing, relational databases, temporal logics of knowledge

This paper presents a well-founded language allowing in one hand data owners to easily specify their security and utility requirements over the data to be outsourced and in an another hand to formalize the set of security mechanisms that can be used for the protection of outsourced data. Based on the formalization of security and utility requirements and security mechanisms properties, we formally identify the best mechanisms, and the best way to combine them to get the best trade-off between utility and security.

Introduction

Because of the rapid evolution of communication technologies, data storage and data processing, outsourcing data to a third-party has grown up over the last few years. Information system architecture adopted by public and private companies is changing for mainly two causes. First, it offers several advantages to the client companies, especially for small ones with limited IT budget as it allows them to reduce the cost of maintaining computing infrastructure and data-rich applications. Second, data collected by companies generally contain sensitive information which must be protected.

Data outsourcing gives rise to many security issues, e.g., confidentiality, integrity, authentication, copyright protection, privacy and anonymity, because outsourced data contains often highly sensitive information which will be stored and managed by third parties. These security issues are traditionally addressed by using security and cryptography mechanisms such as encryption, anonymization, watermarking, fragmentation, etc. In our work, we consider that the set of security mechanisms that can be used for the protection of outsourced data are represented as a toolbox giving security administrators the ability to enforce their security requirements. We develop a logic-based language allowing the security administrators to specify their security and utility requirements and automatically choose the best mechanisms, and the best way to combine them in order to enforce defined security requirements.

As a case of study, we address the problem of secure data integration in which two data owners storing two private tables having the same set of records on different sets of attributes want to create a joint table containing involved attributes of both private tables. The joint table must satisfy the set of security and utility requirements defined by both data owners. To meet these goals, we first develop a well-founded logic based language allowing to model the used system, the security and utility requirements defined by both data owners, and the security mechanisms that can be used to satisfy them. Second, we show how to use those specifications to choose the best combination of security mechanisms that can satisfy the selected security and utility requirements defined by both data owners.

The reminder of this paper is organized as follows, Section 2 discusses related work. Section 3 describes our approach. Section 4 presents our defined language and the specification of the used system. Section 5 shows the modeling of the policy to be applied over the outsourced information. Section 6 presents the specification of the security mechanisms that can be used to satisfy a defined policy. Section 7 shows how to choose the best combination of security mechanisms that can satisfy a defined policy. Section 8 gives a demonstration of our approach. Finally, Section 9 reports our conclusions.

Related work

Many approaches to protect confidentiality and privacy of outsourced data are based on encryption [START_REF] Boldyreva | Order-preserving symmetric encryption[END_REF][START_REF] Hacigümüs | Executing sql over encrypted data in the database-service-provider model[END_REF][START_REF] Hore | A privacy-preserving index for range queries[END_REF]. Hacigümüs et al. [START_REF] Hacigümüs | Executing sql over encrypted data in the database-service-provider model[END_REF] have proposed the first approach aiming to query encrypted data. The proposed technique is based on the definition of a number of buckets on the attribute domain which allows the server-side evaluation of point queries. Hore et al. [START_REF] Hore | A privacy-preserving index for range queries[END_REF] improve the bucket-based index methods by presenting an efficient method for partitioning the domain of attributes. Many interesting techniques providing protection of outsourced data are based on order preserving encryption OPE schemes [START_REF] Boldyreva | Order-preserving symmetric encryption[END_REF]. OPE schemes are symmetric-key deterministic encryption schemes which produce cipher-texts that preserve the order of the plain-texts. However, in all mentioned approaches, authors use only encryption to protect sensitive outsourced data which makes query execution on the outsourced encrypted data much more difficult.

Few research efforts have investigated how to combine security mechanisms to protect sensitive outsourced data. In [START_REF] Ciriani | Fragmentation and encryption to enforce privacy in data storage[END_REF], authors combine data fragmentation together with encryption to ensure confidentiality of outsourced mono-relational database. This approach was improved in [START_REF] Bkakria | Preserving multi-relational outsourced databases confidentiality using fragmen-tation and encryption[END_REF] by combining the best features of encryption and fragmentation to deal efficiently with multi-relation normalized databases. Popa et al. [START_REF] Popa | Cryptdb: Protecting confidentiality with encrypted query processing[END_REF] propose an interesting approach called CryptDB. The proposed system relies on a trusted party containing a proxy server allowing the interception of users queries which will be executed over the protected databases. The proxy stores a set of encryption keys allowing to encrypt and decrypt data and queries. In order to allow the execution of different kind of SQL queries, CryptDB system combines different encryption schemes. For range query, it use an implementation of the Order Preserving Encryption (OPE) [START_REF] Boldyreva | Order-preserving symmetric encryption[END_REF], computations on numeric data are supported using homomorphic encryption based on the Paillier cryptosystem [START_REF] Paillier | Public-key cryptosystems based on composite degree residuosity classes[END_REF] and matching keywords are supported using searchable encryption [START_REF] Song | Practical techniques for searches on encrypted data[END_REF]. The CryptDB approach offers a solution to the encryption type selection problem by proposing an adaptive scheme that dynamically adjusts encryption strategies. The idea of this approach is to encrypt each data item in many onions: onion for equal and order comparison, onion for aggregate operations and onion for word search operations. In each onion, the values is dressed in layers of increasingly stronger encryption, each of these layers provides certain kind of functionality. This approach has two main drawbacks. First, it will significantly increase the size of the encrypted database. Second, in order to enable certain functionality, some encryption layers must be removed by updating the database which can be, for big databases, very expensive in terms of execution time.

Formal verification of security protocols [START_REF] Blanchet | An efficient cryptographic protocol verifier based on prolog rules[END_REF][START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF] has been extensively used to verify security properties such as secrecy [START_REF] Blanchet | An efficient cryptographic protocol verifier based on prolog rules[END_REF] and strong secrecy [START_REF] Blanchet | Automatic proof of strong secrecy for security protocols[END_REF]. A security protocol involves two or more principal actors, these actors are classified into honest actors aiming to securely exchange information and dishonest actors (attackers) aiming to subvert the protocol. Therefore, dishonest actors are not constrained to follow the protocol rules. Despite that formal verification-based approaches are efficient in security properties verification, they cannot be used in our case as we consider that the actors are honest-but-curious. They are honest as they are constrained to follow the chosen combination of security mechanisms and they are curious in that they will try to infer protected sensitive information by analyzing the joined table.

Proposed approach

In our approach, we strive to design a support tool allowing, for a given security policy, selection of the best combination of mechanisms to enforce this security policy. To achieve this goal, we suggest the following methodology :

-Using an Epistemic Linear Temporal Logic, we defined an expressive language allowing to formally model a system composed of involved entities and the data on which the security policy should be enforced, and formally express the security policy defined by the security administrators. -We conducted a formal study of the security mechanisms allowing the achievement of a chosen goal. This formal study enables us to extract the security and utility properties that characterize each security mechanism. These properties are formally expressed using our language. -Based on the system formalization, the security policy formalization and the security mechanisms properties formalization, we formally identify the relevant combination of mechanisms to efficiently enforce the defined security policy.

4 System specification using Epistemic LTL

In this section, we will define and use the language L to formalize our system.

In particular, we will define axioms which describe the basic knowledge of each agent and the formalization of the chosen goal.

Syntax and semantics

The first-order temporal epistemic language L is made up of a set of predicates P, propositional connectives ∨, ∧, ¬, → and ↔, the quantifiers ∀, ∃. We take the usual set of future connectives (next), ♦ (Sometime, or eventually), (always) [START_REF] Gabbay | On the temporal analysis of fairness[END_REF]. For knowledge we assume a set of agents A g = {1, • • • , m} and use a set of unary modal connectives K j , for j ∈ A g , in which a formula K j ψ is to be read as "agent j knows ψ". Definition 1. Let ϕ and ψ be propositions and P i be a predicate of arity n in P. The set of well-formed formulas of L is defined as follows:

φ ::= Pi(t1, • • • , tn)| Kiψ| ¬ϕ| ϕ ∨ ψ| ϕ ∧ ψ| ϕ| ♦ϕ| ϕ|ϕ → ψ| ϕ ↔ ψ | ∃xψ | ∀xψ
Definition 2. An interpretation of the language L is the triple K = (W, I, Φ) consisting of a sequence of states W = {w 0 , w

-(wi, W) |= P (t1, • • • , tn) ⇐⇒ Iw i (P )(v(t1), • • • , v(tn)) = T rue -(wi, W) |= ¬ψ ⇐⇒ (wi, W) |= ψ -(wi, W) |= ψ → ϕ ⇐⇒ (wi, W) |= ψ or (wi, W) |= ϕ -(wi, W) |= ψ ↔ ϕ ⇐⇒ (wi, W) |= (ψ → ϕ) ∧ (ϕ → ψ) -(wi, W) |= ∀xψ ⇐⇒ (wi, W) |= ψ[x/c] for all c ∈ |Iw i | -(wi, W) |= ψ ∧ ϕ ⇐⇒ (wi, W) |= ψ and (wi, W) |= ϕ -(wi, W) |= ψ ∨ ϕ ⇐⇒ (wi, W) |= ψ or (wi, W) |= ϕ -(wi, W) |= ψ ⇐⇒ (wi+1, W) |= ψ -(wi, W) |= ♦ψ ⇐⇒ (w k , W) |= ψ for some k ≥ i -(wi, W) |= ψ ⇐⇒ (w k , W) |= ψ for all k ≥ i
In our approach, we choose to work with relational databases which are composed of tables, attributes, records and values. We suppose that relational databases schemes are known to all agents in the system. Epistemic operator K is only used to represents the knowledge of relation between objects (attribute and records) and values which represent an instantiations of these objects. These relations are represented using the three-places predicates valueOf , valueOf (R, A, V ) is to be read "the value of the attribute A in the record R is V ". In order to simplify our language L, we transform the epistemic operator K using the two-places predicate knows as following:

Ki valueOf (R, A, V ) → valueOf (R, A, V ) ∧ knows(i, V ) (1)
knows(i, v) is to be read "the agent i knows V ".

Data model

A system S = O, T , A, R, V consists of a finite set of owners O, a finite set of relational tables T , a finite set of attributes A, a finite set of records R and a finite set of values V. We use the following syntactic conventions.

Let O 1 , O 2 , • • • be variables over owners O, T 1 , T 2 , • • • be variables over relational tables T , A 1 , A 2 , • • • be variables over attributes A, R 1 , R 2 , • • • be variables over records R and V 1 , V 2 , • • • be variables over the set of values V.
We identify the following predicates :

-belongs(O 1 , T 1 ) is satisfied if the owner of the relational table T 1 is O 1 . -attribute of (T 1 , A 1 ) is satisfied if A 1 is an attribute of the relational table T 1 . -recordOf (T 1 , R 1 ) is satisfied if R 1 is a record of the relational table T 1 . -valueOf (R 1 , A 1 , V 1 ) is satisfied if V 1 is the value of the attribute A 1 in the record R 1 .
We denote by Σ the set of formulas representing the formalization of our system using previous predicates. We suppose that the set of formulas Σ are always true in the system (e.g., the table T belongs to the owner O and will belong always to the owner O). This can be formalized as follows:

∀f ∈ Σ. (w0, W) |= f (2)

Specifying Basic Knowledge Axioms

In our system, we consider each data owner as an agent. An owner's knowledge is specified using the following axioms:

∀T1, O1, A1, R1, V1. [ belongs(O1, T1) ∧ attribute of (T1, A1) ∧ recordOf (T1, R1) ∧ valueOf (R1, A1, V1) → knows(O1, V1) ] (3) ∀T1, O1, A1, R1, V1. [ ¬belongs(O1, T1) ∧ attribute of (T1, A1) ∧ recordOf (T1, R1) ∧ valueOf (R1, A1, V1) → ¬knows(O1, V1) ] (4) ∀O1, V1. knows(O1, V1) → knows(O1, V1) (5)
∀O, T1, R, A, V. attribute of (T1,

A) ∧ recordOf (T1, R) ∧ valueOf (R, A, V )∧ knows(O, V ) ↔ belongs(O, T1) ∨ ∃T2, T3.belongs(O, T2) ∧ joinOf (T1, T2, T3) ∧join involved(T1, A) ∧ ¬protected(T1, A, O) (6)
Axiom 3 means that an owner knows all information stored in tables that belong to him while axiom 4 means that an owner has no knowledge about the information stored in tables that do not belong to him. Axiom 5 states that data owners never forget information they know. Axiom

Goal representation

According to our scenario, the goal consists in joining two private relational tables. This goal is specified using the axioms 7 and 8 in which we use the following predicates:

join(T 1 , T 2 ) is satisfied if both owners of T 1 and T 2 want to join their private tables T 1 and

T 2 . -joinAttribute(T 1 , T 2 , A 1 ) is satisfied if the tables T 1 and T 2 are joined over the attribute A 1 . -join involved(T 1 , A 1 ) is satisfied if the attribute A 1 of the table T 1 is in-
volved in join operations. This predicate allows us to specify which are the attributes concerned by the joint.

Axiom 7 states that if the data owners of two tables T 1 and T 2 want to integrate their private data then eventually, there will exist a table T j representing the join of T 1 and T 2 . Axiom 8 states that the set of attributes of the joined table T j is composed of the union of sets of join-involved attributes of private tables T 1 and T 2 .

∀T1, T2. join(T1, T2) → ♦ ∃T3 JoinOf (T1, T2, T3)

∀T1, T2, Tj, A. JoinOf (T1, T2, Tj) ∧ join involved(T1, A) ∨ join involved(T2, A) → attribute of (Tj, A)

5 Security policy specification

The policy to be deployed is composed of a set of abstract-level constraints. Using these constraints, data owners will be able to model in a quite simple and powerful way, their security and utility requirements. In this section, we present different kinds of constraints: security constraint and utility constraint. We present for each kind of constraint the abstract-level representation and their corresponding transformation to the concrete level.

Security Constraint

Confidentiality Constraint: Using confidentiality constraint, a data owner will be able to require that the values assumed by some attributes are sensitive and therefore must be protected. For this purpose, we define the two-places predicate SAttributeOf . The formula SAttributeOf (t, a) means that "The attribute a of the table t is a sensitive attribute". A confidentiality constraint is transformed to the concrete level using the following rule:

∀A, T. SAttributeOf (T, A) → [∀O, R, V.recordOf (T, R) ∧ valueOf (R, A, V ) ∧ ¬belongs(O, T ) → ¬knows(O, V )] (9)
Anonymization constraints: Using this kind of constraints, a data owner will be able to require the prevention of identity disclosure by protecting personal identifiers. We define the one-place predicate withoutIDDisclosure. Thus, the formula withoutIDDisclosure(t) is to be read "Prevent identity disclosure in the table t". An Anonymization constraint is transformed to the concrete level using the following rule:

∀T. withoutIDDisclosure(T ) → ∀A, O, R, V. IDAttributeOf (T, A) ∧ recordOf (T, R) ∧ valueOf (R, A, V ) ∧ ¬belongs(O, T ) → ¬knows(O, V ) (10)

Utility Constraint

Confidentiality and privacy protection is offered at the expense of data utility. Utility constraint gives the ability to a data owner to require that particular properties on data must be respected. The violation of these properties makes the data useless. As we work with relational databases, utility requirements are properties allowing the data owner to execute certain kind of queries over the protected data. These utility requirements can be classified into four classes.

Equality check requirements. With this kind of requirements, a data owner wants to be able to perform equality checks, which means that he or she wants to be able to perform selects with equality predicates, equality joins, etc.

Order check requirements. A data owner can use this kind of requirement in order to perform order check, which means that he or she wants to have the ability to execute range queries, order joins, ORDER BY, MIN, MAX, etc. Computational requirements. With this kind of requirements, a data owner wants to have the ability to perform computation over encrypted data, which means the ability to execute queries with SUM, AVG, etc. Keyword search requirements. Using keyword search requirements, a data owner wants to have the ability to perform keyword based search over the encrypted data (e.g, to check if a word exists in an encrypted text).

To be able to express these different kinds of utility requirements, we define the one place predicate utility requirement(). Then, an utility constraint defined over the attribute A can be expressed by the axiom 11, which is to be read: "the ability to perform the utility requirement U over the attribute A". utility requirement(req) ∧ provides(req, o)

6 Security mechanisms specification

Security policies are enforced through the application of security mechanisms which can be methods or approaches for supporting the requirements of the security policies. Each security policy is specified using three groups of formulas: preconditions formulas, effects formulas, and properties formulas.

Preconditions. For each security mechanism, preconditions are represented by a set of formulas which are necessary conditions under which the security mechanism can be applied. We define the two-places predicated is applicable.

The formula is applicable(M, O) is to be read "the mechanism M can be applied over the object O", O can be a table, an attribute, or a value. Preconditions of a security mechanism M are specified using a formula of the following form:

(is applicable(M, O) → ∆ M ) (12)
Where ∆ M represents necessary conditions for the applicability of the mechanism M . A formula of the form 12 is to be read "At any state of the system, M can be applied if the preconditions ∆ M hold".

Effects. Effects of the application of a mechanism M that transits the system from a state w i to a state w j are modifications applied to the system during this transition. We use the two-places predicate apply(M, O) to say that the mechanism M is applied over the object O. For a mechanism M , effects are represented by a set of formulas Σ M such that:

Φ(w i , apply(M, O)) = w j → (w j |= Σ M ) (13)
Axiom 13 states that if the application of the mechanism M over the object O transits the system from a state w i to a state w j , therefore the set of effects Σ M of the application of the mechanism M is satisfied on the state w j .

Properties. The set of security and utility properties P 1 , • • • , P n that can be derived from the effects of the mechanism application.

Σ M → n i=1 P i (14)
In our approach, security policies are composed mainly of confidentiality constraints and anonymization constraints. In the next section, we specify using the three previously presented groups of formulas (preconditions, effects, and properties) the set of security mechanisms that can be used to enforce the security policy. We classify these security mechanisms into encryption-based mechanisms and anonymization-based mechanisms.

Encryption-based mechanism specification

Encryption-based security mechanism can be classified using two main factors: the security properties they offer and the level of security they provide (e.g, the amount of information revealed about the encrypted data). Encryption-based security mechanisms are to be applied over an attribute A if the following preconditions hold: (1) the attribute A is considered sensitive, (2) the attribute A is involved in the joint table. This can be specified as follows:

∀M, A. enc based mechanism(M ) ∧ is applicable(M, A) → ∃T. SAttributeOf (T, A) ∧ join involved(T, A) (15)
The effects of the application of encryption-based mechanisms are specified using the following axiom:

∀M, A, T, K. enc based mechanism(M ) ∧ attribute of (T, A) ∧ enc key(K) ∧ apply(M, A) → encrypted(T, A, K)

Once we have defined the above axiom describing the effects of encryption-based mechanisms, we can specify the conditions under which an encryption-based mechanism can protect the values of an attribute. Obliviously, the values of an attribute over which an encryption-based mechanism is applied are protected from unauthorized data owners if those data owners have no knowledge about the used encrypted key (axiom 17). An attribute is protected from an unauthorized data owner means that this data owner has no knowledge about the values of the protected attribute (axiom 18).

∀A, T, K, O. enc key(K) ∧ encrypted(T, A, K) ∧ ¬knows(O, K) → protected(T, A, O)

∀A, T, O, R, V. protected(T, A, O) ∧ recordOf (T, R)∧ valueOf (R, A, V ) → ¬knows(O, V ) (17)
Homomorphic encryption based mechanisms: Homomorphic encryption mechanisms are based on secure probabilistic encryption schemes which enable to perform computation over encrypted data. For efficiency, we suppose that we will use mechanisms based on partially homomorphic encryption as fully homomorphic encryption schemes have a long way to go before they can be used in practice [START_REF] Naehrig | Can homomorphic encryption be practical?[END_REF]. In our approach, we will use mechanisms based on Paillier cryptosystem [START_REF] Paillier | Public-key cryptosystems based on composite degree residuosity classes[END_REF] to support summation. Paillier cryptosystem provides indistinguishability under an adaptive chosen-plaintext attack (IND-CPA). Therefore, each attribute over which an Homomorphic encryption based mechanisms is applied will have the probabilistic (prob) security level (axiom 21).

∀M, A. hom mechanism(M ) ∧ apply(M, A) → sec level(A, prob) ∧ provides(addition, A) (21)

Searchable encryption based mechanisms: Searchable encryption mechanisms allow searching for keywords on an encrypted database without revealing the keyword. Therefore, this kind of mechanisms can be used to perform operations such as SQL's LIKE operator. We suppose that we will use the SEARCH mechanism defined in [START_REF] Di Vimercati | A data outsourcing architecture combining cryptography and access control[END_REF] which is proved to be nearly as secure as a probabilistic encryption. Based on this fact, each attribute over which the SEARCH mechanism is applied will have the probabilistic (prob) security level. Properties of the SEARCH-based mechanism is specified as follows:

∀A. searchable enc mechanism(SEARCH) ∧ apply(SEARCH, A) → sec level(A, prob) ∧ provides(keywork search, A) (22)

Anonymization-based mechanism specification

The anonymization technique aims to prevent identity disclosure by protecting personal identifier. To meet this requirement, we use the existing anonymization approach k-anonymity [START_REF] Samarati | Generalizing data to provide anonymity when disclosing information[END_REF] in which identifier attributes values are removed from the private table (axiom 25). However, a Quasi-identifier attribute value in the released table may lead to infer the value of removed identifier attributes (axiom 23). Therefore, Quasi-identifier attributes values are generalized (axiom 26) in such a way that removed identifier attributes values cannot be recovered.

∀O, T 1 , A 1 , V 1 , R. IDAttributeOf (T 1 , A 1 ) ∧ recordOf (T 1 , R) ∧ valueOf (R, A 1 , V 1 ) ∧ knows(O, V 1 ) ↔ belongs(T 1 , O) ∨ ∃T 2 , T 3 . belongs(O, T 2 ) ∧ joinOf (T 1 , T 2 , T 3 ) ∧ join involved(T 1 , A 1 ) ∨ (∃A 2 . QIDAttributeOf (T 1 , A 2 ) ∧ ¬ anonymized(T 1 , A 2 )) (23)
Anonymization mechanism is applied over a table T if and only if the table T contains at least an identifier attribute or a quasi-identifier attribute. These preconditions is specified as follows:

∀T. is applicable(kanonymity, T ) → ∃A.(IDAttributeOf (T, A) ∨ QIDAttributeOf (T, A)) ∧ ¬ encrypted(T, A) (24)
Effects of the application of Anonymization mechanism over a table T are specified using the following axioms:

∀A. IDAttributeOf (T, A) → ¬ join involved(T, A) (25)
∀A.QIDAttributeOf (T, A) ∧ join involved(T, A) → anonymized(T, A) (26)
The use of anonymization mechanisms such as k-anonymity offers the data owner the ability to ensure the prevention of identities disclosure by protecting personal identifiers at the same time supporting data analysis (e.g., data mining). In terms of security, anonymization based mechanisms are weaker than encryption based mechanisms as anonymized data can sometimes be re-identified with particular individuals by using homogeneity Attack or Background Knowledge Attack [START_REF] Machanavajjhala | l-diversity: Privacy beyond k-anonymity[END_REF]. Based on this fact, each protected identifier attribute will have the anonymization (anonym) security level. Properties of anonymization-based mechanism is specified as follows:

∀M, T.anon mechanism(M ) ∧ apply(M, T ) → provides(data analysis, T ) ∧ ∀A, O.IDAttributeOf (T, A) ∧ ¬ belongs(T, O) → protected(T, A, O) ∧ sec level(anonym, A) (27)
In order to compare different security levels provided by previously presented security mechanisms, we define the transitive predicate more secure than. The formula more secure than(l 1 , l 2 ) is to be read: "the level l 1 is more secure than the level l 2 ". A mechanism M 1 is more secure than a mechanism M 2 if the application of M 1 leaks less information about sensitive data than the application of M 2 . Therefore, based on the amount of leaked information, we define a rule (axiom 28) stating that: probabilistic security level prob is more secure than deterministic security level det, the deterministic security level det is more secure than the order-preserving security level ope, and the order-preserving security level ope is more secure than the anonymization security level anonym. more secure than(prob, det) ∧ more secure than(det, ope) ∧more secure than(ope, anonym)

7 Choosing the right mechanisms

The right mechanism or combination of mechanisms is the one that fits in the best way the sets of security and utility constraints. As we have seen in the previous section, each security mechanism offers a different level of protection and a different kind of utility properties. The main challenge then is to choose the best mechanisms allowing the satisfaction of the chosen goal while enforcing the defined security policy. In our scenario, security issues come when data is joined. Before applying the joint operation, security constraints are satisfied. This hypothesis is also suitable in the general case of data outsourcing. As we can consider that, since the data is not outsourced, there is no security issue to worry about. Based on this, we defined several steps allowing the selection of the mechanisms to be applied.

7.1 First step: Satisfy the chosen goal.

We look for the mechanisms that satisfy the chosen goal. For instance, in our scenario, we look for the suitable join method that can join the data of the two private tables. Formally speaking, a mechanism M g satisfies a goal G if from the specification of our system Σ and the effects of the mechanism Σ Mg we are able to deduce the set of formula representing the goal G (29).

Σ ∪ Σ Mg ⊢ Σ G (29)
7.2 Second step: Violated security constraints.

After getting the set of mechanisms M that can be applied to achieve the chosen goal, we start looking for the set of violated security and utility constraints for each mechanism M g ∈ M. A constraint C is violated while the chosen goal G is satisfied if from the specification of our system Σ, the effects Σ Mg of the mechanism M g and the set of formulas Σ C representing the constraint C we can deduce a logic contradiction. This is can be formally represented as follows:

Σ ∪ Σ M G ∪ Σ C ⊢ ⊥ (30)
Obviously, our toolbox may contain several mechanisms that can satisfy the chosen goal. In that case, we should be able to choose the best one.

Definition 4 (Best goal satisfier). Given the set of mechanisms

M = {M 1 , • • • , M n }
that can be used to satisfy the defined goal G. Let C i be the set of violated constraints while applying the mechanism M i . A mechanism M j is a best goal satisfier if the following condition holds:

∀i ∈ {1, • • • , n}. |C j | ≤ |C i |, where |C i | is the cardinality of C i .
7.3 Third step: Satisfying the violated constraints.

Once we get the best goal satisfier M bgs for a defined goal G and the corresponding set of violated security and utility constraints C, the challenge then is to, for each violated security constraint, looking for the properties that can satisfy that constraint. Formally speaking, a set of l properties P = {P 1 , • • • , P l } satisfies a security constraint C in a state of the system if from: (1) the sets of formulas Σ P1 , • • • , Σ P l representing respectively the specification of the properties P 1 , • • • , P l , (2) the set of formulas Σ representing the system specification, and (3) the set of formulas Σ M bgs representing the effects of M bgs , we are able to deduce the set of formulas Σ C representing the specification of the constraint C. This is can be formalized as follows:

l i=1 Σ Pi ∪ Σ ∪ Σ M bgs ⊢ Σ C (31)
Informally, 31 means that if the set of security properties P is provided, the application of the M bgs will not violate the security constraint C.

n i=1 more secure than(l i , l j ) ∨ (l i = l j ∧ |CM i | < |CM j |) (34)
8 Best mechanisms selection

In this section, we demonstrate how to to select the best combination of mechanisms to satisfy defined security policies using different steps presented in the previous section. Due to the lack of space, proofs of this demonstration which can be found in [2] will be omitted here. Consider two data owners O 1 and O 2 which store respectively two private tables T 1 (SSN, Age, Adress, Balance) and T 2 (SSN, Job, ZIP, Salary). They want to integrate data stored in both tables. In one side, O 1 defined a policy P 1 composed of two security constraints SC 1,1 = {withoutIDDisclosure(T 1 )} and SC 2,1 = {SAttributeOf (T 1 , Balance)} and two utility constraints U C 1,1 = {provides(equality, Balance)} and U C 2,1 = {provides(addition, Balance)}. O 1 specifies that the attribute SSN is an identifier attribute and that the attributes Age and Address are quasi-identifier attributes. In another side, O 2 defines a policy P 2 composed of the security constraint SC 1,2 = {withoutIDDisclosure(T 2 )}. O 2 specifies that the attribute SSN is an identifier attribute and that the attributes Job and Zip are quasiidentifier attributes. Suppose that all attributes in T 1 and T 2 are involved in the join and that our toolbox is composed of the set of security mechanisms presented in 6.1 and 6.2, and two other mechanisms, rel join and tds representing respectively the relational join operation and the top-down specialization mechanism [START_REF] Fung | Top-down specialization for information and privacy preservation[END_REF]. Axiom 36 in [2] specifies the effects Σ rel join of the application of rel join mechanism. Axiom 37 in [2] describes the effects Σ tds of the application of the mechanism tds. The first step to select the best combination of mechanisms allowing to satisfy P 1 and P 2 while achieving the chosen goal consists in selecting the set of mechanisms to achieve the chosen goal. According to 29, the mechanism rel join and tds can be applied to satisfy the jointure of the private tables T 1 and T 2 (See Proof 1 in [2]). After we select the set of mechanisms to satisfy the goal, we choose the best goal satisfier from this set of mechanisms. In this demonstration, according to Definition 4, the tds mechanism represents the best goal satisfier to join the private tables T 1 and T 2 as it violates only SC 2,1 (See Proof 2 in [2]. The next step consists in finding the set of security properties to satisfy the violated security constraints that rose from the application of the best goal satisfier. When provided for the attribute Balance, the protection property protected can satisfy the confidentiality constraint SC 2,1 even when the tds mechanism is applied (See Proof 3 in [2]. Next, we choose from our toolbox the combination of mechanisms that can usefully satisfy the security constraint SC 2,1 . Two combinations of mechanisms can usefully satisfy the security constraint SC 2,1 : (1) combines an order-preserving encryption based mechanism and an homomorphic encryption based mechanism, and (2) combines a deterministic encryption based mechanism and an homomorphic encryption based mechanism (See Proof 4 in [2]. The final step consists in choosing the best combination of mechanisms that can usefully satisfy the security constraint SC 2,1 which is (2) (See Proof 5 in [2]. In conclusion, we can say that the application of the combination of mechanisms (2) before the application of tds mechanism allows us to enforce defined security policies P 1 and P 2 while joining the two tables T 1 and T 2 .

Conclusion

We defined a well-founded language to select, from a toolbox containing a set of security mechanisms, the best combination of security mechanisms allowing the enforcement security and utility requirements for outsourced data. Our approach can be improved by detecting the incompatibilities and conflicts between security mechanisms to be able to decide which mechanisms can be applied together without losing provided utility requirements.

  1 , • • • }, a set of classical first-order structures I that assigns for each states w i ∈ W a predicate I wi (P ) : |I wi | n → {T rue, F alse} for each n-places predicate P ∈ P and Φ a transition function which defines transitions between states due to the application of mechanisms (actions). Φ(w i , m k ) = w j if the mechanism m k transits our system from states w i to state w j .

	Definition 3. Let W be a sequence of states, w i (i ≥ 0) denote a state of W
	and v an assignment. The satisfaction relation |= for a formula ψ of L is defined
	as follows:

  6 means that an owner O knows the values assumed by an attribute A of the table T 1 if and only if the table T 1 belongs to the owner O or there exists a table T 3 representing the join of a table T 2 and the table T 1 in which the attribute A is not protected.

  The previous steps allow us to select the best goal satisfier M bgs that can satisfy the goal G, the corresponding set of violated security and utility constraints C, and for each security constraint C i ∈ C, we select the set of properties P i that can satisfy C i when applying the M bgs . Now, based on those properties, the main goal is to select from our toolbox, the best combination of security mechanisms that can usefully satisfy each violated constraint in C.Definition 5 (Useful satisfaction). Given a violated security constraint C defined over an object (table or attribute) Ob, the set of security properties P that satisfy C, and the set of utility constraint U Ob defined over the object Ob. A combination of mechanisms M C usefully satisfy the constraint C if: Definition 6. Given a violated security constraint C, the set of properties P that satisfy C, and a combination of mechanisms CM = {M 1 , • • • , M n } that usefully satisfy C. The security level l provided by the combination of mechanisms CM is the lowest level provided by the application of set of mechanisms M 1 , • • • , M n . Definition 7 (Best combination of mechanisms). Given a violated security constraint C and the set of properties P that can satisfy C. Suppose that we find several combinations of security mechanisms CM 1 , • • • , CM n that provide the set of properties P. Suppose that the set of combinations of security mechanisms CM 1 , • • • , CM n provides respectively the set of security levels l 1 , • • • , l n . The combination of mechanisms CM i is the best combination of mechanisms if it has the highest provided security level. For the combinations of mechanisms that provide the same security level, we choose the one that involves the minimal number of security mechanisms. This is can be specified as follows:

		n
	Σ ∪ ∀Ob.	i=1	apply(M, Ob) |=			(33)
	∀l ′ . sec level(l, Ob) ∧ sec level(l ′ , Ob) → more secure than(l ′ , l)
	Σ ∪	apply(M, Ob) |=	P	provides(U, Ob)	(32)
	M ∈M C	P ∈P	U ∈U Ob

7.4 Fourth step: Choosing the best security mechanisms.

Acknowledgments. This work has received a French government support granted to the CominLabs excellence laboratory and managed by the National Research Agency in the "Investing for the Future" program under reference ANR-10-LABX-07-01, and to the Frag&Tag project and managed by the Dual Innovation Support Scheme (RAPID) under convention N o 132906023