Maurizio Falcone
email: falcone@mat.uniroma1.it

Dante Kalise
email: dante.kalise@oeaw.ac.at

Axel Kröner
email: axel.kroener@oeaw.ac.at

A semi-Lagrangian scheme for L p -penalized minimum time problems

In this paper we consider a semi-Lagrangian scheme for minimum time problems with L p -penalization. The minimum time function of the penalized control problem can be characterized as the solution of a Hamilton-Jacobi Bellman (HJB) equation. Furthermore, the minimum time converges with respect to the penalization parameter to the minimum time of the non-penalized problem. To solve the control problem we formulate the discrete dynamic programming principle and set up a semi-Lagrangian scheme. Various numerical examples are presented studying the effects of different choices of the penalization parameters.

I. INTRODUCTION

In this paper we consider L p -penalized minimum time problems for dynamical systems with 1 ≤ p < ∞. In the literature there exist several publications considering these type of problems. In [START_REF] Maurer | On L 1 -minimization in optimal control and applications to robotics[END_REF] the authors analyzed optimal control problems for dynamical systems with different cost functionals involving L p -norms of the control. They present several approaches how to handle the nonsmooth case p = 1. Further, in a recent preprint [START_REF] Alt | Linear-quadratic control problems with l 1control cost[END_REF] L 1 -regularization for open-loop optimal control for finite horizon problems of a dynamical system is considered and regularization and discretization error estimates are derived. In [START_REF] Kunisch | Semi-smooth Newton methods for the time optimal control of nonautonomous ordinary differential equations[END_REF] a minimum time problem is solved by regularization. In contrast to these open-loop approaches we present a closed-loop approach leading to robust controls and only minimal changes in the implementation are necessary when considering different pnorms in the penalization. Results for closed-loop optimal control problems with exit times can be found in Masiloff [START_REF] Masiloff | Viscosity solutions of the Bellman equation for exit time optimal control problems with non-Lipschitz dynamics[END_REF] and Bardi, Capuzzo-Dolcetta [START_REF] Bardi | Optimal Control and Viscosity Solutions of Hamilton-Jacobi-Bellman Equations[END_REF]Chapter IV]. Error estimates for a semi-Lagrangian scheme for the classical minimum time problem are presented in [START_REF] Bardi | An approximation scheme for the minimum time function[END_REF]. In the context of differential games error estimates are derived in [START_REF] Soravia | Estimates of convergence of fully discrete schemes for the isaacs equation of pursuit-evasion differential games via maximum principle[END_REF]. Numerical examples for semi-Lagrangian schemes for optimal control problems with exit times are shown in [START_REF] Cristiani | Initialization of the shooting method via the Hamilton-Jacobi-Bellman approach[END_REF], where also an error estimate for the fully discretized problem is presented under an assumption on the approximation error of the value function.

In this paper we consider a minimum time problem with different L p -penalizations. We show that for given p the corresponding minimum time converges to the minimum time of the non-penalized problem if the penalization parameter tends to zero. Moreover, the minimum time function can be characterized as the solution of a Hamilton-Jacobi Bellman (HJB) equation. To solve the problem numerically we formulate the discrete dynamic programming principle and set up a semi-Lagrangian scheme. Various numerical examples are presented illustrating the effect of the choice of the penalization parameters on the value function and the trajectory. For p = 1 we observe sparse controls.

Semi-Lagrangian schemes were first introduced to solve linear and nonlinear hyperbolic problems in [START_REF] Courant | On the solution of nonlinear hyperbolic differential equations by finite differences[END_REF], since the 60's they have been very popular among the meteorological community since they have good stability properties which allow to use large time steps in the integration of evolutionary problems. In the framework of control problems it has been shown that they can be obtained in a very natural way by applying a discrete dynamic programming principle, see e.g. [START_REF] Falcone | A numerical approach to the infinite horizon problem of deterministic control theory[END_REF], [START_REF]The minimum time problem and its applications to front propagation[END_REF]. For a general overview about semi-Lagrangian schemes we refer to the monograph [START_REF] Falcone | Semi-Lagrangian Approximation Schemes for Linear and Hamilton-Jacobi Equations[END_REF]. Convergence and a priori error estimates have been proved for many classical control problems such as the minimum time problem, the infinite horizon, see [START_REF] Bardi | An approximation scheme for the minimum time function[END_REF], [START_REF] Ferretti | Convergence of semi-Lagrangian approximations to convex Hamilton-Jacobi equations under (very) large Courant numbers[END_REF], [START_REF] Falcone | Convergence analysis for a class of high-order semi-Lagrangian advection schemes[END_REF]. In view of control applications, it is also important to note that an efficient algorithm for Hamilton-Jacobi Bellman equations in high dimensions has been presented in [START_REF] Carlini | An efficient algorithm for Hamilton-Jacobi equations in high dimensions[END_REF].

The presented results are interesting for optimal feedback control of partial differential equations, in particular, L 1control costs have given increasing attention in the last years leading to sparse controls which is interesting, e.g., in actuator placement problems, see [START_REF] Stadler | Elliptic optimal control problems with L 1 -control cost and applications for the placement of control devices[END_REF]. The approximation of sparse controls for semilinear elliptic equations was analyzed in [START_REF] Casas | Approximation of sparse controls in semilinear elliptic equations[END_REF]. Directional sparsity for optimal control of partial differential equations was considered in [START_REF] Herzog | Directional sparsity in optimal control of partial differential equations[END_REF]. Convergence and regularization results for optimal control problems with sparsity functional are derived in [START_REF] Wachsmuth | Convergence and regularization results for optimal control problems with sparsity functional[END_REF].

The paper is organized as follows. In Section II we introduce the control problem and characterize the value function as the solution of an HJB equation. Furthermore, we show a convergence result for the solution of the regularized problem with respect to the penalization parameter γ. In Section III we discretize the problem and formulate the discrete dynamic programming principle. In Section IV we present several numerical examples studying the behaviour for different penalization parameters γ and p on the value function and the trajectory.

II. THE CONTROL PROBLEM

In this section the minimum time problem with penalization is introduced and the corresponding value function is characterized as the solution of a stationary HJB equation. We recall some regularity results and consider the convergence of the optimal time, state, and control of the penalized problems for penalization parameter γ tending to zero.

Throughout the paper we consider the Banach space R n , n ∈ N, equipped with the norm

x p := n i=1 |x i | p 1 p , x ∈ R n
for 1 ≤ p < ∞ and for time horizon T > 0 we use the usual notation for Lebesgue spaces

L p ((0, T ), R n ) = f : (0, T ) → R n measurable | T 0 f (t) p p dt < ∞ . (II.1)
Further, we define the set of admissible controls by

A = L p ((0, T ), A) (II.2)
with A ⊂ R m , m ∈ N, compact. We define a target

T = { x ∈ R n | x ≤ δ } (II.3)
for δ > 0 small. • denotes the Euclidean norm in R n . Further, let C > 0 be a generic constant. Throughout the paper we make the following assumptions: Assumption 2.1: Let the dynamics f : R n × A → R n be continuous and locally Lipschitz uniformly in α ∈ A. Further we make the following controllability assumption: Assumption 2.2: There holds

inf α∈A f (x, α) • n(x) < 0 ∀x ∈ ∂T ,
where n(x) is the outer normal to T at x. Under these assumptions on the dynamics we introduce the controlled dynamical system

y (s) = f (y(s), α(s)), y(0) = x (II.4)
for control α ∈ A and initial point x ∈ R n . Sometimes we write y α x to indicate that we mean the state corresponding to control α with initial point x.

The discounted minimum time problem for (II.4) is given by

                     v(x) = min α∈A tx(α) 0 e -λs ds, subject to the constraint d ds y α x (s) = f (y α x (s), α(s)), s ∈ (0, t x (α)), y α x (0) = x and y α x (t x (α)) ∈ T (P 0 T ) with t x (α) = +∞, if { t > 0 | y α x (t) ∈ T } = ∅, min { t > 0 | y α x (t) ∈ T } , else
and λ ≥ 0. Here we use the notation y α x for the state to express its dependence on the initial state x and the control α.

The regularized minimum time problem for (II.4) is given by

                     v(x) = min α∈A tx(α) 0 e -λs ds + γ tx(α) 0 α(s) p p e -λs ds, subject to the constraint d ds y α x (s) = f (y α x (s), α(s)), s ∈ (0, t x (α)), y α x (0) = x, and y α x (t x (α)) ∈ T (P γ T ) for 1 ≤ p < ∞, λ ≥ 0, γ > 0.
We assume that both problems have a solution, which is guaranteed under local controllability assumptions on the target (see [START_REF] Bardi | Optimal Control and Viscosity Solutions of Hamilton-Jacobi-Bellman Equations[END_REF] for more precise definitions and general conditions for existence). For a discussion of necessary optimality conditions we refer to [START_REF] Maurer | On L 1 -minimization in optimal control and applications to robotics[END_REF]. To shorten the notation we introduce

l γ : R N × A → R, l γ (x, α) = 1 + γ α p p .
(II.5) Furthermore, we define

R = { x ∈ R n | v(x) < ∞ } ,
which depends in particular on γ. The dynamic programming principle for these problems is given by

v(x) = inf α∈A tx(α)∧t 0 l γ (y α x (s), α(s))e -λs ds + χ { t<tx(α) } v(y α x (t))e -λt (II.6)
for all x ∈ R N if λ > 0, for all x ∈ R if λ = 0, all t ≥ 0, and given γ ≥ 0, see [4, pp. 254]. Here, χ denotes the characteristic function. The corresponding Hamiltonian is given by

H γ (x, p) = sup α∈A (-f (x, α)p -l γ (x, α)) (II.7) for x, p ∈ R n .
Under this assumption we obtain from [4, Chapter IV, Proposition 3.13] the following characterization of the value function.

Proposition 2.3: Let Assumption 2.1 and 2.2 be satisfied. Then, (i) if λ > 0 the value function v is the complete solution in the space of bounded and continuous functions BC(T c ),

T c = R n \ T , of λu + H γ (x, ∇u(x)) = 0 in T c , u(x) = 0 on ∂T . (II.8) (ii) if λ = 0 the value function v is the unique solution of      H γ (x, ∇u(x)) = 0 in R \ T , u(x) = 0 on ∂T , lim x→x0 u(x) = +∞ for x 0 ∈ ∂R (II.9) continuous in R \ int T , (iii) if λ = 0, the function u defined by Kruzkov transform u(x) = 1 -e -v(x) , x ∈ R, 1, else (II.10)
for given value function v is the complete solution in BC(T c ) of

u(x) + sup -f (x, α) T ∇u(x) -l γ (x, α) + (l γ (x, α) -1)u = 0 in T c , u(x) = 0 in ∂T .
A formal definition of "complete solution" can be found in [START_REF] Bardi | Optimal Control and Viscosity Solutions of Hamilton-Jacobi-Bellman Equations[END_REF]Chapter IV,p. 256]. For γ = 0 we obtain the HJB equation for the minimum time problem (P 0 T ). In the following we will prove convergence of the minimum time of the penalized problem with respect to the regularization parameter γ and weak convergence of the optimal state and control to the corresponding state and control of the nonpenalized problem. Thereby we restrict the consideration to linear systems of the type

y (s) = F y(s) + Bα(s), y(0) = x (II.11)
with matrices F ∈ R n×n and B ∈ R m×n . In case of a nonlinear dynamics the specific character of the nonlinearity has to be taken into account when analyzing the weak convergence. Theorem 2.4: Let α 0 be a minimizing control of the nonregularized problem (P 0 T ) and α γ of the regularized problem (P γ T ). We denote the corresponding state and time by (y 0 , t 0 ) and (y γ , t γ ), respectively. Then there holds t γ → t 0 ∈ R for γ → 0. Further, after reparametrization of both solutions such that they satisfy y (s) = t(F y(s) + Bα(s)) in (0, 1),

y(0) = x,
(II.12) there exists subsequences with

(α γ , y γ ) (α 0 , y 0 ) ∈ L p ((0, 1), R m ) × H 1 ((0, 1), R n ) (II.13) for γ → 0 and 1 < p < ∞.
Proof: The minimum time t 0 and corresponding control α 0 are feasible for the regularized problem. Therefore for given γ ≥ 0 the minimum time t γ and corresponding optimal control α γ of (P γ T ) satisfy After reparameterization the triple (α γ , y γ , t γ ) satisfies y (s) = t γ (F y(s) + Bα(s)) in (0, 1),

t γ + γ t γ 0 α γ (s) p p ds ≤ t 0 + γ t 0 0 α 0 (
y(0) = x (II.16)
and there holds

y γ H 1 ((0,1),R n ) ≤ C α γ L ∞ ((0,1),R m ) + x (II.17)
using (II.15), Gronwall's inequality, and the boundedness of A. Since the controls are bounded we obtain that the state y γ is uniformly bounded in H 1 ((0, 1), R n ). Thus there exist

(α * , y * , t * ) ∈ L p ((0, 1), A) × H 1 ((0, 1), R n ) × R + 0 , 1 < p < ∞, such that for a subsequence α γ α * in L p ((0, 1), A), y γ y * in H 1 ((0, 1), R n ), t γ → t * in R + 0 .
Thereby we used the fact that A is closed with respect to weak convergence. We further obtain

y γ → y * in C 0 ((0, 1), R n ).
(II.18)

Consequently, the limit satisfies the state equation

y * t (s) = t * (F y * (s) + Bα * (s)) y * (0) = x. (II.19)
Furthermore using the continuity of y * and the convergence of y γ in C 0 ((0, 1), R n ) we have

y * (t * ) -y γ (t γ ) ≤ y * (t * ) -y γ (t * ) + y γ (t γ ) -y γ (t * ) ≤ y * (t * ) -y γ (t * ) + y γ (t γ ) -y * (t γ ) + y * (t γ ) -y * (t * ) + y * (t * ) -y γ (t * ) -→ 0
for γ → 0 implying that y * (t * ) = 0. Hence, (α * , y * , t * ) is feasible for the non-regularized problem.

With the condition t * ≤ t 0 from (II.15) and since t 0 is minimal we conclude t 0 = t * . Since t 0 is unique, the whole family t γ converges to t 0 .

III. DISCRETIZATION OF THE SEMI-LAGRANGIAN

SCHEME

In this section we apply the discrete dynamic programming principle to obtain a characterization of the time discrete value function. Furthermore we formulate a semi-Lagrangian scheme.

For the discretization of the dynamical system we choose an explicit Euler scheme. For fixed time step h > 0 we define the temporal mesh

0 = t 0 < t 1 < • • • < t N with t i+1 -t i = h, i = 0, . . . , N -1.
For solving the dynamical system we apply an explicit Euler scheme

y m+1 = y m + hf (y m , α m ), y(0) = x (III.1)
for α m ∈ A and x ∈ R n . The control is given by

α h (s) = α m , s ∈ [t m , t m+1 ), m = 0, . . . , N -1.
We consider the discrete minimum time problem with penalization and characterize the value function using the dynamic programming principle.

Theorem 3.1: For λ = 0 the value function of the minimum time problem is characterized by

v h (x) = min α h ∈A νv h (x + hf (x, α h )) -ν + 1 (III.2) with ν = e -h(1+γ α h p p )
and x ∈ R n . Proof: The dynamic programming principle for the time discrete minimum time problem is given as follows

v h (x) = inf α h ∈A h 1 + γ α i p p +v h (x+hf (x, α h )) , for x ∈ R n , see [4, Proposition 4.1, p. 389]. We have e -v h (x) = sup α h ∈A e -h-γh α h p p -v h (x+hf (x,α h ))
and applying Kruzkov transform

V h (x) := 1 -e -v h (x) , if x ∈ R, 1, if x ∈ R
we obtain

V h (x) = 1 -sup α h ∈A e -h-γh| α h p p -V h (x+hf (x,α h )) = inf α h ∈A 1 -e -V h (x+hf (x,α h )) -1 e h(1+γ α h p p ) + 1 .
Again applying Kruzkov transform we obtain

v h (x) = inf α h ∈A v(x + hf (x, α h )) -1 e h(1+γ α h p p ) + 1
and hence,

v h (x) = min α h ∈A νv(x + hf (x, α h )) -ν + 1, with ν = e -h 1+γ α h p p
which gives the assertion. Equation (III.2) is the starting point for the numerical scheme applied to the minimum time problem. We discretize equation (III.2) in space. The HJB equation is defined on the full space. To solve the equation numerically we consider a bounded computational domain Ω ⊂ R n . Let

Ω = j S j
be a regular triangulation of the computational domain for a family of simplices S j and let x i denote the nodes of the triangulation with i = 1, . . . , L, L ∈ N. We set

k = max j diam(S j )
and define

I T = { i ∈ I | x i ∈ T ∩ Ω } , I out = { i ∈ I | x i + hf (x i , α) ∈ Ω ∀α } , I in = I \ (I out ∪ I T ), I = { 1, . . . , L } . (III.3)
Then we consider

v h (x i ) = min νv h (x i + hf (x i , α h )) -ν + 1 i ∈ I in , v h (x i ) = 0 i ∈ I T , v h (x i ) = 1 i ∈ I out .
(P kh T ) For the computation of the numerical examples we solve (P kh T ).

IV. NUMERICAL EXAMPLES

In this section we present two numerical examples illustrating the properties of our scheme, in terms of the effects produced by including a penalization term of the control in the minimum time problem formulation. The numerical implementation follows the general guidelines for the construction of low-order semi-Lagrangian schemes for HJB equations, and in particular is based on the solvers described in, for instance, [4, Appendix A] and [START_REF] Alla | An efficient policy iteration algorithm for dynamic programming equations[END_REF]. For the scheme (P kh T ), the computation of the arrival point

v h (x i + hf (x i , α h )) is replaced by a linear interpolation I 1 [V ] defined upon the grid point values V = {v h (x i )} L i=1
(we refer to [13, pp. 46-47] for specific details), and the resulting system is solved via the fixed point iteration

V n+1 = S(V n ) [S(V )] i =        min νI 1 [V ](x i + hf (x i , α h )) -ν + 1 i ∈ I in , 0 i ∈ I T , 1 i ∈ I out
which in our case is stopped when two consecutive iterations hold V n -V n+1 ≤ k 2 . We set the discount factor λ = 0.01 for both examples.

A. 2D Eikonal equation

The first test case that we consider is a minimum time problem for a two-dimensional Eikonal equation. The domain is Ω = [-1, 1] 2 , and the system dynamics are given by

f (x, y, a) = a x a y , a 2 = (a x , a y ) T 2 ≤ 1 .
The control set A = { a 2 ≤ 1, a ∈ R 2 } is discretized into 32 different directions, whereas the grid contains 81 2 points with k = 0.025. The target set T is specified as

T = { x ∈ R 2 | x 2 ≤ 0.
2 }, and the discretization parameters hold h = 0.9k. It is well-known that for the unpenalized minimum time problem, the exact solution corresponds to the distance function to the target, and the optimal trajectories point to the origin.

For the penalized optimal control problem, such symmetry is preserved for any value of γ, as long as p = 2, as shown in Figure 1. Note that with this choice of parameters, all the controls lying in the boundary of the control set (the unitary ball with p = 2) introduce the same control cost; although the value function is different from the unpenalized control problem, the optimal control field remains the same. A radically different situation is observed when p = 1, as the introduction of such a norm leads to optimal sparse solutions. In Figure 2, it can be observed that the optimal trajectories computed with p = 1 differ from those with p = 2 around a vicinity of the coordinate axis, i.e. there is a non-trivial section of the state space where the optimal trajectories are related to the directions (1, 0), (0, 1), (-1, 0), and (0, -1) instead of the directions pointing to the origin.

B. Van der Pol oscillator

In a second example, we consider a two-dimensional, nonlinear system dynamics given by the Van der Pol oscillator

f (x, y, a) = y (1 -x 2 )y -x + a ,
with test parameters given by In the top, with γ = 0, the minimum time problem yields a bang-bang control structure. The inclusion of a penalization with p = 1 (middle), preserves the shape of the value function, but replaces the bangbang control field with an (approximate) bang-zero-bang structure. Finally, for p = 2 (bottom), the control field transits along all the available discrete values, whereas there is no significant change in the value function with respect to the case p = 1. The control space is discretized into 10 equidistant points, and the target set is specified as

Ω = [-2 , 2] 2 , A = [-1 , 1] , h = 0.3k .
T = { x ∈ R 2 | ||x|| 2 ≤ 0.2 }.
The grid contains 101 2 grid points with k = 0.04. An interesting result can be observed in Figures 3 and4, in the sense that the inclusion of penalization costs in the control changes the bang-bang structure of the control field (see for instance [START_REF] Alla | An efficient policy iteration algorithm for dynamic programming equations[END_REF]), and replaces it by an approximated bang-zero-bang control for the case p = 1, whereas for p = 2 it translates in the uses of all the discrete control values. The phenomenon of a zero-arc was already mentioned in [START_REF] Maurer | On L 1 -minimization in optimal control and applications to robotics[END_REF] and was later also analyzed in [START_REF] Alt | Linear-quadratic control problems with l 1control cost[END_REF]. In Figure 3, it can be seen that there is a change in the control field when the control penalization is considered, whereas no significant change in the shape of the value function is observed, which differs from the previous test.

The effect in the computation of a trajectory can be observed in Figure 4; variations on the optimal trajectories are not significant, while the associated control signals exhibit a different use of the control capabilities of the system. This result is relevant from a point of view of applications where it is desirable to have a setting avoiding the use of maximum control energy over long periods of time.

V. CONCLUDING REMARKS

In this paper we have introduced a semi-Lagrangian scheme for the solution of a Hamilton-Jacobi-Bellman equation related to penalized minimum time problems. Although the minimum time problem with penalization in the control has been studied in an open loop context, the present work aims at developing a discrete dynamic programming framework yielding to feedback controllers. In this context, the extension of the existing results for minimum time problems is not trivial, and further developments in this direction are currently undertaken. The numerical experiments presented are consistent with what is reported in the literature of both semi-Lagrangian schemes and penalized minimum time optimal control problems, and suggest that the application of dynamic programming is a correct approach to follow.

Fig. 1 :

 1 Fig. 1: Eikonal equation. Results with p = 2: value function (left) and optimal trajectories (right). Note that this setting yields similar trajectories as in the unpenalized minimum time problem (top).

Fig. 2 :

 2 Fig. 2: Eikonal equation. Results with p = 1: value function (left) and optimal trajectories (right). The application of the || • ||1norm induces a change in the shape of the value function and a sparsity pattern in the control field which is reflected in the optimal trajectories, creating a sector in the state space where sparse controls are preferred instead of directions pointing to the origin.

Fig. 3 :

 3 Fig.3: Van der Pol oscillator. Value functions (left) and associated control fields (right), with different values of γ and p. In the top, with γ = 0, the minimum time problem yields a bang-bang control structure. The inclusion of a penalization with p = 1 (middle), preserves the shape of the value function, but replaces the bangbang control field with an (approximate) bang-zero-bang structure. Finally, for p = 2 (bottom), the control field transits along all the available discrete values, whereas there is no significant change in the value function with respect to the case p = 1.

Fig. 4 :

 4 Fig. 4: Van der Pol oscillator: computations along a trajectory. Left: different control signals for different values of p. Right: Optimal trajectories associated to the control signals.

-Marie Curie Grant n. 264735-SADCO.


Elio Goettelmann
email: elio.goettelmann@benjamin.gateau

Karim Dahman
email: karim.dahman@benjamin.gateau

Benjamin Gateau

Eric Dubois
email: eric.dubois@tudor.lu

Claude Godart
email: claude.godart@loria.fr@benjamin.gateau

A Security Risk Assessment Model for Business Process Deployment in the Cloud

Keywords: Business Process, Security Risk Management, Cloud Cloud Provider(s) Cloud Broker(s) Cloud Consumer Modeling Tool Risk Assessment Tool Deployment Tool Security Needs Business Processes Cloud Offers Configuration

Managing security risks on information systems is essential to guarantee their security while handling costs. However, the complexity of risk assessments is greatly increased when data is spread on multiple environments. In this paper we present a security risk assessment model for distributing business processes in a multi-cloud environment. We aim at offering the full power of cloud computing to composite applications while shielding companies from the complexity related to security risk assesments in the Cloud. We also want to give them the capablility to automatically generate secure and cost-effective applications across multiple clouds. Our approach is based on existing risk assessment methodologies, while using the industry recognized IT standards.

I. INTRODUCTION

Cloud computing avoids upfront infrastructure costs, and helps organizations to focus on their core business activities, instead of their system infrastructure [START_REF] Armbrust | A view of cloud computing[END_REF]. It enables to rapidly adjust resources to meet unpredictable demand and transforms investment costs in operating expenses through a pay-as-yougo approach. So, cloud computing can be of great benefit, especially in times where cost reduction plays a vital role.

But recent events, like the NSA spying scandal, underscore the threats of such services. Using off-premise and shared infrastructures exposes the information systems of companies to new kind of security risks. A taxonomy of these risks are published by CSA [START_REF]The Notorious Nine -Cloud Computing Top Threats in 2013[END_REF] and ENISA [START_REF]Benefits, risks and recommendations for information security[END_REF]. New techniques and solutions, to prevent harms that can adversely affect companies business activities, must be defined before broader adoption.

One technique, proposed by Jensen et al. [START_REF] Jensen | Security prospects through cloud computing by adopting multiple clouds[END_REF] or by AlZain et al. [START_REF] Alzain | Cloud computing security: From single to multi-clouds[END_REF], consists in spreading applications over different locations to increase the complexity for a third party to gather sensitive business information. In previous work [START_REF] Goettelmann | Partitioning and cloud deployment of composite web services under security constraints[END_REF], we presented how to implement automatically such a solution by working on business processes, which formally structure and describe the activities of a company. However, it does not obviate the realization of security risk assessments [START_REF] Mayer | Model-based Management of Information System Security Risk[END_REF] to understand all of the security risks. And current assessment methods, if applicable for on-premises architectures, need to be adapted for multi-cloud environments.

In this sense, our goal is to reduce the complexity of security risk assessment in a cloud context, in order to generate secure and cost-effective applications on multi-cloud platforms. In fact, existing cloud solutions offer different types of services regarding security, whereas the business processes have their own security requirements. As a consequence, two important questions arise when outsourcing processes in a cloud enviroment. How to compare different cloud offers when considering security? How to align process requirements with existing cloud offers? To answer these questions, we present an approach for assessing security risks in a cloud context before distributing a business process execution accross multiple clouds.

The paper is organized as follows. Section II presents some background about security risk assessment applied to cloud computing, a motivating example and an overview of our framework. Section III formally defines our concepts and presents our approach on security risk assesment in a multicloud environment. In Section IV, we demonstrate a proof-ofconcepts implementation and experimental evaluations. Then, we situate our work in the related research in Section V, and we finally present future extensions in Section VI.

II. BACKGROUND, MOTIVATING EXAMPLE AND OVERVIEW

Here we give some definitions to explain why current risk assessment methodologies need to be adapted for cloud computing. We also present a motivating example used all along this paper and overview our approach.

A. Security Risk Assessment Background and Cloud Computing

Roughly speaking, a risk is defined as the combination of the probability that an event occurs and its consequences [START_REF]Information Security -Guide for Conducting Risk Assessments[END_REF]. In the IT security context, where IT components (ex. hardware, network, etc.) support business assets (ex. information, processes, etc.), the security risk is defined in a more fine-grained fashion. The event is usually seen as a threat which uses one or more vulnerabilities of the IT components in order to create a negative impact (ex. destruction, alteration, theft, etc.) on the business assets [START_REF] Mayer | Model-based Management of Information System Security Risk[END_REF]. For instance, an attacker steals customers' information (i.e., threat) through a compromised interface (i.e., vulnerability) which leads to the business reputation loss (i.e., impact).

In this sense, a security risk assessment consists usually in evaluating the following formula: risk = vulnerability × threat × impact ( [START_REF]AS/NZS 4360 SET Risk Management[END_REF], [START_REF]Information Security -Guide for Conducting Risk Assessments[END_REF]). The goal is to estimate security risks in a quantitative and/or qualitative manner, to select those that need to be reduced and to develop countermeasures. Developing countermeasures involves the implementation of security controls by constraining technical solutions and by reducing vulnerabilities on the business settings. Security controls are management, operational, or technical safeguards prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. Examples are firewalls or intrusion detection systems.

In a Cloud context, the major problem of security risk assessments is that parts of the IT are outsourced. Thus, Cloud consumers have no control over the equipment hosting their assets and must integrate with an architecture defined by the Cloud provider. So, the identification of vulnerabilities becomes a complex task, especially as Cloud providers may be tempted to conceal the vulnerabilites of their technical solutions. However, we are convinced that in a mature market, Cloud consumers will be able to select Cloud providers with favorable terms, especially, secure Cloud offers at suitable prices. In such a direction, standards like CSA Cloud Control Matrix [START_REF]Cloud Control Matrix[END_REF] or ISO 27017 [11] help Cloud providers to secure their installations and service offers.

Nevertheless, the impact of given cloud security risks, i.e. the potential financial losses, are still related to Cloud consumers, as they hold the value of their business assets. So, security risk assessments cannot be delegated to Cloud providers. Thus, in order to leverage the global quality of the security risk assessments, some Cloud brokers have emerged. Cloud brokers are entities managing the use, performance and delivery of Cloud services [START_REF]Cloud Computing Reference Architecture[END_REF]. They can help customers to choose adequate Cloud providers according to their security requirements. They are responsible for evaluating the likelihood of risks by analyzing the security controls that are implemented by Cloud providers.

B. Motivating Example -Insurance Recovery Chain

To illustrate the goal of our proposal, we define an insurance claim recovery chain [START_REF] Fdhila | Optimized decentralization of composite web services[END_REF] as a business process model using BPMN notation (depicted in Fig. 1). In this business scenario, a beneficiary initiates the claim recovery chain by sending a declaration to the insurance company. First, to handle an incident declaration, the insurance invokes the emergency service to obtain a statement on the incident details. Second, with the details provided by the emergency service, the insurance collects in parallel the different reports from the hospital and the police. They are needed by the expert to decide on the reimbursement amount. Finally, the bank is optionally requested for a transfer and a reimbursement decision is sent to the beneficiary in order to complete the claim recovery chain.

The data associations (dotted arrows) between tasks show the data dependencies between the service-component that implement the processes. For example, the Initiate Claim activity transfers the Claim document to the Obtain Incident Details activity. Now, suppose this company wants to outsource this process to the cloud to save money. The problem is, that the company has not necessarily the competencies to do this on its own. First of all, it does not know the cloud specific security risks and how to evaluate them for this process handling private data about its clients. Then, the selection of adapted cloud providers can be really time consuming, as there are many providers and it is not always easy to compare their offers. Finally, the company knows that for cost-effectiveness and security reasons it would be better to distribute the process on multiple providers, but it does not know how the decomposition for this purpose is done. Thus, the company needs some support.

Note that it can also have additional requirements about the distribution of a process. As example, the dotted boxes in Fig. 1 describe some design decisions (modeled as constraining groups on tasks) made for this insurance service. The inclusion means that the tasks have to enact in the same context. The exlusion means that the tasks must be distributed among different contexts. See [START_REF] Goettelmann | A general approach for a trusted deployment of a business process in clouds[END_REF] for more about that.

C. Overview of the approach

To support such requirements for security risk assessment and secure deployment of a business process in the Cloud, we have defined the following approach. It consists of a design-time framework for generating secure and costeffective process-centered applications in cloud environments.

First, a Cloud consumer (e.g. the insurance company) models a business process extended with non-functional requirements (security needs). He transmits them to a Cloud broker who analyzes the cloud offers coming from different Cloud providers. The broker realizes a risk assessment by evaluating the risk of the different available offers for the given needs.

Then, the broker conducts a cloud selection based on the functional requirements and the costs of the available offers. At this point there are two possibilities. Either the risk is taken as a constraint (the offers where the risk is too important are excluded) and the selection optimizes the cost. Or the cost is taken as a constraint and the selection is done in order to minimize the risk.

Finally, the broker undertakes the process decomposition to split down the process into sub-processes. As each task can be assigned to a different cloud provider, the structure of the process needs to be adapted. The process is automatically decomposed, and the different fragments are assigned to their respective environments. The assignment of fragments to clouds is what we call a configuration. This part is based on a tool we developed in the context of composite service deployment. It is not the objective of the paper to enter in the details of the algorithm for splitting a process. A detailed description of the process decomposition and servicecomponent configurations can be found in [START_REF] Dahman | Alignment and change propagation between business processes and service-oriented architectures[END_REF] and [START_REF] Goettelmann | Partitioning and cloud deployment of composite web services under security constraints[END_REF].

III. FORMAL FRAMEWORK

This section specifies the concepts of our risk assessment model and formalizes it. Its structure is depicted in Fig. 3. As our approach is based on the duality between risk management and cost optimization, the section is arranged in two parts. First we discuss our risk assessment model (Section III-A), our main target. Then we present a synthesized cost management model (Section III-B). SizeCost : Data → N * , defines data size costs (in bytes), A security objective helps to determine the impact of a security risk. It is frequently defined in terms of confidentiality, integrity, availability, non-repudiation and authenticity (CIANA) 1 . These objectives must be fulfilled to ensure the security of a technical solution and its data [START_REF]Information Security -Guide for Conducting Risk Assessments[END_REF].

AssetType ExecutionCost SizeCost

Asset Consumer

Different levels of security needs are usually expressed on process data objects ( [START_REF] Grandison | Elevating the discussion on security management: The data centric paradigm[END_REF], [START_REF] Zhou | Towards a data-centric view of cloud security[END_REF]). As business processes are mainly task-centric (typically a task represents a web service call), we need to relate these data-centric security needs to the tasks of the business process. This is achieved by appliying a simple Bell-LaPadula model as in [START_REF] Watson | A multi-level security model for partitioning workflows over federated clouds[END_REF]. Thus, we define the security need of a task as the highest needed value of the data it handles. Formally, for a task ta, in-and out-going data elements d of ta, and an objective o, the security need is:

N eed(ta, o) = max di∈Data(ta) N eed(d i , o) (1)
The threshold is a global value used for the final Cloud provider selection. It indicates the acceptable level of risk, below which the risk will be retained. It will determine which Cloud provider can be used and which not. This is further illustrated in Section IV-B.

Definition 2 (Cloud Provider): An entity which can hold multiple Cloud offers. It is responsible for the implementation of security controls (typically controls defined by the CSA [START_REF]Cloud Control Matrix[END_REF] Coverage(p, t)

= c∈Control (Implementation(p, c) × M itigation(t, c)) c∈Control M itigation(t, c) (2)
or the ISO 27017 [11]), to protect its offers from attacks and to comply with regulations. It is specified as follows: Offer, as a set of Cloud offers, Control, is a set of controls, Implementation : Offer × Control → {0,1}, defines if a control is implemented or not by an offer. UsageCost, StorageCost, TransferCost : Offer → N * , defines offers' costs in terms of usage (in $/second), storage (in $/byte) and transfer (in $/byte) Instead of focusing on vulnerabilities, as in [START_REF] Sackmann | A risk based approach for selecting services in business process execution[END_REF], our risk assessment approach focuses on security controls. As example, the CSA defines 197 controls in its Cloud Control Matrix [START_REF]Cloud Control Matrix[END_REF]. Due to a lack of space, we do not show an exhaustive list of these controls, but examples are:

• IS-19.4 Do you maintain key management procedures?

• RI-01.1 Is your organization insured by a 3rd party for losses? • SA-02.7 Do you allow tenants to use third party identity assurance services? We indicate the implementation of each control by a provider offer with a boolean function. If the offer implements the given security control, the function returns 1, otherwise 0. This choice is recommended by the CSA in [START_REF]Cloud Control Matrix[END_REF].

Definition 3 (Cloud Broker): An entity which can provide three types of services [START_REF]Cloud Computing Reference Architecture[END_REF]: enhance existing services (service intermediation) like security, combine multiple services (aggregation) or measure different providers and select the best (arbitrage). It is specified as follows:

Threat, as a set of security threats Control, the same set of controls as the Cloud provider Objective, the same set of objectives as the Cloud consumer Mitigation : Threat × Control → {0,1} indicates if the control mitigates the threat or not, Consequence: Threat × Objective → {0,1} indicates if the threat has a consequence on the objective or not, As explained previously, there are different cloud-specific security threats (ex. data breaches, data losses, malicious insiders, etc.). Each threat has a consequence on one or more security objectives. We use the CIANA list of objectives and the CSA list of threats, where each threat is related to multiple objectives of a business asset (see [START_REF]The Notorious Nine -Cloud Computing Top Threats in 2013[END_REF]). For example, data breaches have only a consequence on confidentiality. Whereas, data losses have a consequence on avaibility and non-repudiation. Also, malicious insiders have a consequence on all five objectives. This binary relation can be represented in a matrix relating the threats to the objectives.

The threats are mitigated by one or multiple security controls. We use the matrix from [START_REF]The Notorious Nine -Cloud Computing Top Threats in 2013[END_REF] to relate controls to threats. For example, data breaches are mitigated by the controls IS-19.4 and SA-02.7. Control IS-19.4 also mitigates malicious insiders, whereas control RI-01.1 mitigates insufficient due diligence.

In order to quantify the risk, we combine the previously defined concepts for calculating two different values for each threat: the coverage of a provider, and the harm on an asset, as defined below.

Definition 4 (Coverage): A score calculated for a given provider and a given threat. It is calculated with the security controls implemented by the provider and their mitigations on the threat. Formally, for a threat t by a provider p, the coverage is defined in Formula.2. Mostly, a provider who implements many controls will be more secure than one who implements fewer controls. In our approach this score allows us to compare the response of a provider to a specific threat, it corresponds to a percentage of implemented controls. In [START_REF]The Notorious Nine -Cloud Computing Top Threats in 2013[END_REF] for example, the CSA shows for each provider, their implemented controls. So, if the CSA gave 10 controls to mitigate a threat, and a provider implemented 5 of them, he gets a coverage of 50%.

Definition 5 (Harm): A level calculated for a given task and a given threat. It is obtained by combining the security needs of the task and the corresponding consequences of the threat. Formally, the harm of a threat t on a task ta is:

Harm(t, ta) = o∈Objective (Consequence(t, o)×N eed(ta, o)) (3)
Basically, some threats will be more important for some assets than others. Thus, we sum the needs of the asset, when there is a consequence on the objective. It corresponds to the exposition of a task to a specific threat. A denial of service, for example, has only a consequence on the availability. Whereas in our motivating example, the process reimbursement task has a sparse need in availability. So the denial of service will not really be harmfull for the process reimbursement task, indeed it does not prevent the reimbursement itself and could be done later.

Definition 6 (Risk Level): A level calculated for a given threat, a given task and a given provider. It is the sum of the harm of the threat on the task, and the vulnerability of the provider to this threat. The vulnerability is obtained by using the coverage of the provider and a score denoted Covg max , which represents the maximum possible value for covering a threat 2 . Formally, the risk of a threat t, a task ta and a provider p is:

Risk(t, ta, p) = Harm(t, ta) + (Covg max -Coverage(p, t)) (4
) With the risk level we are able to compare providers. It classifies the providers towards their risk for deploying a specific task (e.g. Table . III in Section IV). It is similar to the risk formula stated in Section II-A. However, we use a sum to better reflect the independence of the vulnerabilities from the impacts in the cloud context (as the consumer cannot reduce the vulnerabilities of the provider, and the provider cannot be involved for the evaluation of the impact).

B. Cost Model

As the main goal of risk management is to balance the risk against the costs, we define the following cost model. It takes into account three types of costs: Usage Costs, Storage Costs and Transfer Costs. We find that these three types are the most characteristic of the Cloud business model and we can generally map each pricing model to these three attributes.

Usage Costs correspond to the CPU power needed to execute the process. Generally, on IaaS Cloud offers, the consumer can select which computer power he needs (often in terms of GigaHertz 3 ). In our case, we have decided to express these costs in Dollars per GigaHertz on a monthly basis, as many providers still remains to this type of pricing scheme. So, we annotate each activity of our business process model with the need in terms of CPU power (per month), called the ExecutionCost.

Storage Costs correspond to the storage space needed by the data used by the process. This is expressed in our model in Dollars per GigaByte (per month). Each data of the process is annotated with its estimated size, the SizeCost.

Transfer Costs correspond to the amount of incoming and outgoing data. Generally, Cloud providers bill their consumers according to the transferred Gigabytes of data. These costs are usually expressed in Dollars per GigaByte. We calulate this amount using the SizeCost of the data exchanged between the process fragments.

Table IV gives examples of such costs for offers used in our experimentations.

IV. EXPERIMENTATION AND EVALUATION

To demonstrate the feasibility and the interest of our approach, we have developed a use case, based on our motivating example and a particular cloud offering. The objective is to study the balance between security risk and cost, and to see how much more expensive it is to use a less risky configuration.

A. Risk Assessment

We start by applying our risk assesment tool to our use case in three stages: security needs definition, risk evaluation for each provider, too risky cloud provider exclusion.

1) Security needs definition: To assess the risk, first we define the security needs for our motivating example (Fig. 1). We define three levels for each CIANA objective and annotate the data objects of the process with them (see Table I). Each level is mapped to a value between 0 and 2 (for example {P ublic = 0, Restricted = 1, Secret = 2} for Confidentiality and {P assable = 0, Alterable = 1, F ixed = 2} for Integrity). We assume that the terms used are self-documenting.

As explained in Section III-A (Formula. 1) we calculate with these values the task-centric security needs. For 3 Amazon proposes another type of measure, Elastic Compute Unit (ECU) 2) Risk evaluation for each provider: Then, we use the consequences to get the harm of each task (Formula. 3). For example, the Malicious Insider threat (t) has the following harm on Obtain Incident Details (ta):

Harm(t, ta) = (1×0)+(1×1)+(1×2)+(1×1)+(1×1) = 5.
The first value of each bracket is the consequence (always 1 because the Malicious Insider threat has a consequence on all five CIANA objectives), the second value is the need obtained previously.

Since consequences are binary values, and the five CIANA objectives are defined on levels from 0 to 2, the harm is a value between 0 and 10.

For the security controls and the mitigations, we use the STAR Registry and the matrix defined by the CSA [START_REF]Security, Trust and Assurance Registry[END_REF], [START_REF]Cloud Control Matrix[END_REF].

In order to perform realistic tests we selected five Cloud offers from the CSA STAR Registry [START_REF]Security, Trust and Assurance Registry[END_REF]. Examples are, for the previously given controls (III-A) and the five providers:

• CloudSigma AG 4 To equally take into account the harm and the coverage, we brought the percentage value of the coverage on a scale of 0 to 10 (and thus Covg max = 10). So each risk is a value between 0 and 20.

For example, in the case of Obtain Incident Detail (ta) on CloudSigma (p 2 ), it is the Malicious Insider (t) threat which has the greatest risk value (Formula.4): Risk(t, ta, p 2 ) = Harm(t, ta) + (Covg max -Covg(p, t)) = 5 + (10 -9) = 6 According to [START_REF]Security, Trust and Assurance Registry[END_REF], CloudSigma has a coverage for this threat of 10, and the harm of this threat on Obtain Incident Detail is equal to 5. The risk values for the other threats (as Data Loss or Data Breach) are below this value. We can not show the details for all the threats, as it would be extraneous for this paper.

Table III shows the maximum acceptable risk value for the nine CSA threats, for the tasks of our motivating example, of the five providers. Note that, as our approach is model driven, it can also work with different type of objectives (not only CIANA) and other kind of threats (as the 35 ENISA threats).

3) Too risky provider exclusion: In accordance with the consumer, the broker defines the level of acceptable risk (referred to as threshold). For a given asset, this threshold is used to exclude providers above this value. This eliminates all deployment options where the risk is too high.

Back to our example, supposing that the threshold is set to 9 by designers, the cells of eliminated providers are grayed out in Table . III. Respectively a white cell means that the asset can be deployed on the provider.

B. Cloud Selection

Here we select the best cloud in two stages: different configurations evaluation and final clouds selection.

1) Configurations evaluation: The problem is how to assign n different tasks to p different Cloud offers. Thus, we are facing a Quadratic Assignment Problem (QAP) [START_REF] Fdhila | Optimized decentralization of composite web services[END_REF]. Therefore we have proposed a heuristic approach to find a good configuration in an acceptable time. We do not show details about our algorithm, as it is not the primary objective of our proposal, but the principle is as follows. First, we build an initial solution (so-called Greedy solution) in an iterative way for all process tasks. The result is then improved by a second algorithm (T abu search). Details about these algorithms are available in [START_REF] Fdhila | Optimized decentralization of composite web services[END_REF].

We have tested our algorithms applied to our use case in four different ways to compare the different outputs. It is based on the pricing models of our 5 Cloud offers available in Table IV. The results can be seen in Table II.

1) The first run does not contain any constraint relative to the risk. We take only into account the inclusion and exclusion constraints and the costs. This is done in order to get a "cheap" solution by neglecting the security risks. 2) For the second run we constrain the configuration with a global threshold for the risk of 6. This means that the first configuration is no longer possible. It results in an output where some tasks are moved to another more "secured", but also more expensive offer. 3) For the third run we decrease the global risk threshold to 5, in order to get a even more "secured" solution than the previous one. This time, the tasks are located on three different offers. The configuration is even more expensive, but with a more acceptable global risk level. 4) In the last run we check if moving a maximum of tasks on the most "secured" offer has some significant changes on the risk or the costs. For our example this has no impact on the risk value, whereas a very significant impact on the costs. It is possible that no configuration is found if the threshold risk value is too low. In this case, either the user increases the threshold value, or he considers the Cloud context as too risky and decides not to move the process to the Cloud.

For our motivating example we constrained the risks and optimized the costs. But our algorithm also allows constraining the cost while optimizing the risk, which could be interesting in some other cases.

2) Final configuration selection: At this point we have a set of possible configurations (Table II). By making a balance between risk level and costs, a risk manager can make a choice.

Suppose that finally he chooses the Third run. The problem is now to deploy our example process on the selected clouds.

C. Process deployment in the cloud

Process deployment is done in two parts: first we decompose the initial process into fragments and then we deploy these fragments on the corresponding clouds.

1) Process decomposition: The decomposition transforms a single process, into a new collaboration between separate process fragments (a fragment groups activities executed on the same cloud). The combined behavior of those fragments provides the same execution behavior as the initial process. Each resulting fragment represents an autonomous business process with additional synchronization tasks. These synchronization tasks are added to the process for garanteeing the control flow of the initial process. They send messages to notify remote fragments about their execution status. More details about process decomposition can be found in [START_REF] Fdhila | A flexible approach for automatic process decentralization using dependency tables[END_REF] and in [START_REF] Goettelmann | Partitioning and cloud deployment of composite web services under security constraints[END_REF].

Fig. 4 depicts the decomposition of our motivating example in the selected configuration (grey activities are synchronization tasks).

2) Deployment in clouds: The last step of our approach consists in deploying this configuration on the selected Cloud offers. In [START_REF] Goettelmann | Partitioning and cloud deployment of composite web services under security constraints[END_REF] we presented how we deploy such service composition as BPEL programs on remote service orchestration engines (e.g., Apache ODE). But as current Cloud offers do not support this kind of services, we selected offers providing infrastructure services and used them to deploy our own execution engines. We are confident that such type of platforms will rapidly emerge in the future, WSO2 Stratoslive9 is such a PaaS even if still not available through web services. For some type of processes, tasks could be mapped to existing offers at the SaaS layer of the Cloud. For others, not service based, a development phase can be required before deploying them on the Cloud.

V. RELATED WORK

In [START_REF] Leymann | Moving applications to the cloud: an approach based on application model enrichment[END_REF] authors present abstract design methods to split an application such that various parts of it can be moved to different target Cloud environments. This split can be done manually or use optimization algorithms. One key feature of these methods is that the moving-to-Cloud problem is considered in the early stages of business process and service modelling. However, these related work do not propose an approach to directly relate partitioned processes to the existing Clouds. Also they do not consider security aspects.

Managing security risks in business processes is currently a hot topic [START_REF] Ahmed | A taxonomy for assessing security in business process modelling[END_REF]. But most of the current researches mainly focus on process execution, as in [START_REF] Conforti | Supporting risk-informed decisions during business process execution[END_REF] where manual decisions are supported by a risk-prediction algorithm. At the opposite, we focus on automating decisions at design-time, before deployment. These approaches are complementary, but also focus on different kind of risks.

Other related work as [START_REF] Altuhhova | Towards definition of secure business processes[END_REF] try to secure business processes by modifying them through patterns after a risk assessment. In [START_REF] Wenzel | Securing processes for outsourcing into the cloud[END_REF] the authors even work on processes in a cloud context; they propose a tool for analysing processes and decide if their outsourcing is possible. But none of these methods explain how the risk is calculated and the process is broken down. Some models like the Common Vulnerability Scoring System 10 or this presented in [START_REF] Sackmann | A risk based approach for selecting services in business process execution[END_REF] try to evaluate security vulnerabilities for SOA. However, they present some limitations in the Cloud context as vulnerabilities are more difficult to establish and need to be verified. Emerging standards as [11] or [START_REF]Cloud Control Matrix[END_REF] seem to indicate that our coverage approach using security controls is more adapted.

Another important aspect of our proposal is the ability to combine risk assessment with other constraints (cost, quality of service, etc.), which are rarely considered together in similar approaches. In [START_REF] Watson | A multi-level security model for partitioning workflows over federated clouds[END_REF] a cost model is presented and used to decompose processes among a set of cloud providers. But the security model is limited as it defines arbitrary security levels for each provider. Moreover, the author considers all deployment options, whereas when working in a realistic cloud environment with many different providers, this is not always feasible. Our previous work in [START_REF] Goettelmann | Partitioning and cloud deployment of composite web services under security constraints[END_REF], [START_REF] Fdhila | A flexible approach for automatic process decentralization using dependency tables[END_REF] is on this vein, but limited to simple security constraints without risk measurement.

More generally, cloud computing costs are investigated in many studies, like the the Total Cost of Ownership Approach presented in [START_REF] Martens | Costing of cloud computing services: A total cost of ownership approach[END_REF]. Even if they are defined in a more detailled fashion and are considering many other aspects, they are not yet adapted for an automated treatment, and especially not considered in the business process context.

VI. CONCLUSION AND FUTURE WORK

In this paper, we have proposed a technique for assessing security risks of business processes before deploying them in a multi-Cloud environment. This technique relies on two main aspects, on the one side business process security needs and on the other side Cloud providers guideline conformance. By combining the impact evaluation on the Cloud consumer and the vulnerability assessment of the Cloud provider, a Cloud security broker can help companies to deploy securely their applications on a multi-Cloud environment. We also included a

Fig. 2 .

 2 Fig. 2. Our design-time framework for multi-cloud business process deployment.

Fig. 3 .

 3 Fig. 3. Risk Assessment Model for multi-Cloud environments

  and SHI International 5 declare implementing IS-19.4, SA-02.7 and RI-01.1. • Terremark 6 implements IS-19.4 and RI-01-1. • FireHost 7 and Softlayer 8 only implement RI-01.1.

  Fig. 1. Business Process Motivation Example: Insurance Claim Recovery Chain.

		Inclusion	Initiate Claim	Claim	Request Claim Documents	Medical Report	Send Reimbursement Decision
	Insurance	Exclusion		Obtain Incident Details	Obtain Hospital Report	Obtain Expert Report	Expert Report Amount
				Hospital Details	Obtain Police Report	Hospital Report Police Report	Validate Reimbursement
			Account	Incident Details

TABLE I SECURITY

 I NEEDS ON THE MOTIVATION EXAMPLE.

	Data Associations	Confidentiality	Integrity	Availabillity	Non-repudiation	Authenticity
	Claim	Public	Passable	Continuous	Tolerable	Irrelevant
	Hospital det.	Public	Alterable	Usual	Futile	Common
	Incident det.	Public	Alterable	Usual	Futile	Common
	Hospital rep.	Restricted	Fixed	Usual	Trusted	Verified
	Police rep.	Restricted	Fixed	Usual	Trusted	Verified
	Medical rep.	Secret	Fixed	Usual	Trusted	Verified
	Expert rep.	Restricted	Fixed	Usual	Trusted	Verified
	Account	Secret	Fixed	Sparse	Futile	Verified
	Amount	Restricted	Fixed	Sparse	Trusted	Verified
	example, Obtain Incident Details is associated to the data
	objects Claim, Incident Details and Hospital Details. So, by
	taking the maximum of each data object's need we get the
	need of Obtain Incident Details: {0 (P ublic), 1 (Alterable),
	2 (Continuous), 1 (T olerable), 1 (Common)} for re-
	spectively {Conf identiality, Integrity, Availability, N on-
	Repudiation, Authenticity}.

Legality, robusteness, minimal performance or scalability can also be listed[START_REF]Information Security -Guide for Conducting Risk Assessments[END_REF].

Basically, the maximum coverage is reached by implementing all controls that mitigate the threat.

http://www.cloudsigma.com

http://www.shi.com

http://www.terremark.com

http://www.firehost.com

http://www.softlayer.com

WSO2 BusinessProcess Server, http://wso2.com/products/ business-process-server

http://nvd.nist.gov/cvss.cfm

cost model as a representation to confront security dimensions with other QoS properties.

To illustrate our approach, we have used the example of an insurance company. We have defined the security needs on the five CIANA objectives, and we used the CSA security controls to evaluate the risk levels of five Cloud providers taken from an industry-recognized registry: STAR [START_REF]Security, Trust and Assurance Registry[END_REF]. But remember that our approach is model driven, so it can be extended to other sets of controls or objectives.

The approach has some limitations which will be addressed in future works. The first one is the shortage of empirical evaluation on real case studies. This is planned in the future with domain experts and industrial partners. Another one is that the risk assessment and the provider selection is done at design-time, it would be interesting to extend our approach for a configuration at run-time. As the Cloud is a very dynamic context, taking into account the change of either the business process or the Cloud providers would be an interesting improvement. We also argue that for the presented example, the binary values for the implementations and mitigations are sufficient for comparing the different solutions. But an extension could be to add a weighting. For instance, some controls could be rated as "better" mitigations than others, and a provider could also implement "partially" a control.