Prof Mika Kivimäki
email: m.kivimaki@ucl.ac.uk

M J Shipley

G D Batty

M Hamer

T N Akbaraly

M Kumari

M Jokela

M Virtanen

G D Lowe

K P Ebmeier

E J Brunner

A Singh-Manoux

(2 nd Revision) Running title: Long-term Inflammation and Common Mental Disorder Long-term Inflammation Increases Risk of Common Mental Disorder: A Cohort Study

The inflammation hypothesis of depression, or more broadly, common mental disorders, proposes that chronic inflammation plays an important role in the pathophysiology of these conditions. 1,2 The hypothesis is supported by experiments of inflammatory stimuli, antidepressant trials and studies on depression-related genes and pathogen host defense, [2][3][4][5] but direct population-based evidence from long-term inflammation is scarce. Because of a lack of studies on the effects of chronically elevated inflammation, assessed over several years using repeat measurements, it has remained unclear whether the association between inflammation and common mental disorder is the consequence of acute or chronic inflammation. This report is from the Whitehall II cohort study. 6 In our analysis of up to 4630 adults without chronic disease, we used repeat measures of inflammatory markers and mental disorder. We Cross-sectional analysis, using data from 1997, showed IL-6 not to be associated with common mental disorder, age-and sex-adjusted odds ratio for high versus low IL-6=1.04 (95%CI 0.85-1.27, P=0.69, Study Design-A). Then we examined cumulative 10-year risk of common mental disorder among the 2757 participants without the disorder at the first GHQ-assessment in 1997.

Compared to participants with low IL-6 in 1997, those with high IL-6 had greater likelihood of common mental disorder in 2003 and/or 2008 (a total of 549 new cases), age-and sex-adjusted odds ratio=1.40 (1.07-1.82, P=0.01)(Figure 1, Study Design B). Furthermore, participants with high IL-6 at both the 1992 and 1997 assessments had higher odds of a new-onset mental disorder in 2003 and/or 2008, 1.61 (1.14-2.28, P=0.007, Figure 1) with the odds ratio being even higher, 1.75 (1.19-2.57, P=0.004) among those who had high IL-6 in 1992, 1997 and 2003.

To further examine dose-response associations, we used the number of times a participant had IL-6>2pg/ml as the exposure (Study Design B). Results show that those demonstrating high IL-6 on 0, 1, 2, and 3 occasions had odds ratios of 1.00 (reference), 1.18 (0.94-1.47), 1.38 (1.04-1.83) and 1.56 (1.10-2.21), respectively for 10-year risk of common mental disorder (total N=2757; P trend =0.002).

Multivariable adjusted results and sensitivity analyses in Table S3 (Study Design-C) show that the association between the 5-year average level of IL-6 and subsequent 10-year risk of common mental disorder was little affected by adjustments for acute inflammation, obesity, smoking and drug treatments. The relationship between IL6 and common mental disorder was evident in both men (odds ratio per doubling of IL-6 1.46, 1.19-1.78) and women (1.34, 1.00-1.79), and there was no statistical evidence of sex difference in this relationship (P sex interaction =0.67).

In the subgroup of participants without common mental disorder at the third inflammation measurement (2003, Study Design-D), odds ratio of new common mental disorder in 2008 for high IL-6 in 1992, 1997 and 2003 was 1.42 (0.78-2.57); details in Supplementary Material.

These findings support the hypothesis that persistently elevated levels of IL-6 contribute to the development of common mental disorder. 1,2 The fact that previous studies relied on a single measurement of IL-6 may partially explain mixed findings: 7 a one-off measure does not reliably capture the chronicity of inflammation. 8 The present study has limitations: common mental disorder, measured by questionnaire is not the same as clinical diagnosis of depression or anxiety. 9 Our data are from an occupational cohort where participants are likely to be healthier than the general population.

Loss to follow-up accumulated over the extended follow-up; however, there was no evidence of major differences between the analytic sample and the sample at study recruitment.

Our findings have important clinical implications. If the observed association is causal then targeting chronic inflammation with anti-inflammatory drugs could be useful in prevention of common mental disorder. Further studies are needed to clarify the underlying mechanisms, such as activation of the tryptophan degrading enzyme, changes in indoleamine 2,3-dioxygenase, and abnormalities of the hypothalamic-pituitary-adrenal axis. Future investigations should also test the side-effects since anti-inflammatory strategies might increase the risk of infection and malignancy.

  measured the pro-inflammatory cytokine interleukin 6 (IL-6) in 1992, 1997 and 2003 and common mental disorder, based on the General Health Questionnaire (GHQ), in 1997, 2003 and 2008. The IL-6-distribution was categorized as: ≤1.0pg/mL (low), 1.1-2.0pg/mL (intermediate) and >2.0pg/mL (high). Details of study designs, methods and the included/excluded study populations are presented in Supplementary Material, Figures S1-S4 and Tables S1&S2.

10

 10

Figure 1 :

 1 Figure 1: Interleukin 6 (IL-6) and common mental disorder in the Whitehall II study of British civil

local continued professional development events from Eisai, Lundbeck, Novartis, Boeringer-Ingelheim, and Pfizer.


Salvador Martínez
email: salvador.martinezperez@inria.fr

Joaquin Garcia-Alfaro
email: joaquin.garciaalfaro@telecom-sudparis.eu

Frédéric Cuppens

Nora Cuppens-Boulahia

Jordi Cabot
email: jcabot@uoc.edu

Model-driven Integration and Analysis of Access-control Policies in Multi-layer Information Systems

Security is a critical concern for any information system. Security properties such as confidentiality, integrity and availability need to be enforced in order to make systems safe. In complex environments, where information systems are composed of a number of heterogeneous subsystems, each must participate in their achievement. Therefore, security integration mechanisms are needed in order to 1) achieve the global security goal and 2) facilitate the analysis of the security status of the whole system. For the specific case of access-control, access-control policies may be found in several components (databases, networks and applications) all, supposedly, working together in order to meet the high level security property. In this work we propose an integration mechanism for accesscontrol policies to enable the analysis of the system security. We rely on modeldriven technologies and the XACML standard to achieve this goal.

Introduction

Nowadays systems are often composed of a number of interacting heterogeneous subsystems. Access-control is pervasive with respect to this architecture, so that we can find access-control enforcement in different components placed in different architectural levels, often following different AC models. However, these policies are not independent and relations exist between them, as relations exist between components situated in different architecture layers. Concretely, dependency relations exist between access-control policies, so that the decision established by rules in a policy will depend on the decisions established in another policy.

Thus, ideally, a global policy representing the access-control of the whole system should be available, as analysing a policy in isolation does not provide enough information. However, normally, this global policy only exist in an implicit and not always consistent manner. Consequently, integration mechanisms are needed in order to 1) facilitate the analysis of the security status of the whole system and 2) achieve the global security goal of the security property.

In order to tackle the aforementioned problems, we propose here a model-driven solution to integrate policies from different concrete components collaborating in an information system in a single model representation. Two requirements need to be met for achieving this goal: The use of a common access-control policy model for representing the policies of each component and the recovery/representation of the implicit dependency relations between them.

Translating all the recovered access-control policies to the same policy language, thus, representing them in a uniform way, eases the manipulation and reusability of analysis operations. In our approach, the component policies will be translated to the XACML [START_REF] Lockhart | OASIS XACML TC[END_REF] policy language while domain-specific information is added/kept by the use of profiles. Then, we complete the integration framework with a semi-automatic process for detecting the policy dependencies and to organize the policies within a single XACML model. This enables us to see the policies in our information systems as a whole. Finally, we provide a set of OCL [START_REF] Omg | OCL, version 2.0. Object Management Group[END_REF] operations making use this global model and an approach to detect inter-component anomalies.

Our framework relies on the existence of high-level model representations of the policies implemented by concrete systems and on the use of model-driven tools and techniques. Consequently, as a previous step, our solution requires to perform policy recovery tasks. Concrete components often implement access-control policies by using diverse, low-level mechanisms (low level languages, database tables) to represent the rules, adding complexity to the analysis and manipulation tasks. Conversely, recovering these implemented policies and representing them in form of higher-level, more abstract models reduces the complexity and enables the reusability of a plethora of proved model-driven tools and techniques. We rely on state of the art recovery approaches [START_REF] Martínez | Reverse Engineering of Database Security Policies[END_REF][START_REF] Martínez | Towards an Access-Control Metamodel for Web Content Management Systems[END_REF][START_REF] Martínez | Model-Driven Extraction and Analysis of Network Security Policies[END_REF] for this task.

The rest of the paper is organized as follows. In Section 2 we present a running example and motivation. Section 3 is devoted to the presentation of the proposed approach while in Sections 4, 5 and 6 we describe each of its steps. In Section 7 we provide details about the implementation. Finally, Section 8 discusses related work and Section 9 presents conclusions and future work.

Motivation

In order to motivate our approach, we present here an information system (IS) example that will be used through the rest of the paper.

In Figure 1, a simple, yet very common IS is depicted. This IS is composed of several components working in different architecture layers, namely, a network layer, providing networking services and enforcing access control through the firewalls (using Rule-based lists implementing Non-discretionary AC), a database layer, providing storage services and implementing role-based access-control (RBAC) [START_REF] Sandhu | The NIST Model for Role-Based Access Control: Towards A Unified Standard[END_REF] through its built-in permissions schema and an application level, where a Content Management System (CMS) provides publication services. This CMS also enforces RBAC by using a built-in permission schema.

As we can see, three different systems enforce access-control. These systems are not isolated but collaborate to build up the functionality of a global system that encompasses In this example, a given role is granted permission to access a table for modification between 8:00 and 16:00. However, the access to the database server in constrained by a firewall rule, that only allows local access to the server between 8:00 and 14:00. As the database policy depends on the firewall policy, when the latter is more restrictive, it prevails. This example concerns the three subsystems in our IS. A rule in the CMS forbids the access to the admin pages to users located in blacklisted countries as identified by its IP address. However, the user the CMS uses to connect to the database has access for modification to the CMS database backend as stated by the second rule. Moreover, the third rule, that belongs to the firewall systems, allows to connect to the database to users in any location. Combining these three rules, a user located in a blacklisted area may be able to access the admin information on the CMS through the database backend.

From the examples, we can conclude that Access-control policies can not be regarded as isolated when they belong to systems situated in different architecture layers. Analysing the AC rules of a component for the absence of anomalies requires information from the AC policies of other components it depends on. However, this comprehensive analysis is hampered by two factors: 1) dependencies between component's

Approach

In order to tackle the problems we have shown in Section 2, we propose a model-driven approach that integrates all the policies collaborating in the enforcement of accesscontrol in a single model. Our approach requires a previous step, namely the extraction of abstract models from concrete components, and then is structured in three steps (see Figure 2): 0. Policy recovery. AC policies are implemented in concrete systems using a diverse set of mechanisms, often low level and proprietary, like ad-hoc rule languages, specific database dictionaries, etc. As a preliminary step for our approach we require the policies of each component to be represented in the form of abstract models, from where the complexity arising from the specificities of a given vendor or implementation technology is eliminated and only the AC information is present. This requirement is met by several previous work that investigate the recovery of accesscontrol policies from diverse components [START_REF] Martínez | Reverse Engineering of Database Security Policies[END_REF][START_REF] Martínez | Towards an Access-Control Metamodel for Web Content Management Systems[END_REF][START_REF] Martínez | Model-Driven Extraction and Analysis of Network Security Policies[END_REF]. The outputs of those works are to be the inputs of our approach. 1. Policy Translation. Taking as input the models described in the preliminary step, our approach proposes to translate all the policies to the same policy language. This step includes the description of extensions of the target language to make it able to represent component-specific information. 2. Policy Integration With all the models translated to the same language, the next step is to integrate them all in a single model, along with the dependencies between them. This step requires the discovery of such dependencies, normally implicit. 3. Policy Analysis Support. Having all the policies represented in the same model and the dependencies between them made explicit enables the definition of complex analysis tasks. Prior to that, the definition of a number of operations taking advantage of the model organization is required to ease the building of those analysis tasks. The third step is meant to provide that set of operations.

The following sections are devoted to a detailed description of each of the steps.

Policy Translation

All the policies in the IS, potentially conforming to different access-control models and containing domain specific information need to be translated into the same language as a previous step for the integration in a single policy. In order to do so, first, we need to chose a policy language able to represent policies following different policy models and to represent multiple policies in the same resource.

XACML Policy Language

XACML [START_REF] Lockhart | OASIS XACML TC[END_REF] is an access control policy language and framework fulfilling these requirements. It follows the Attribute-based access-control model (ABAC) [START_REF] Jin | A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC[END_REF] what, along with its extensibility, provides to the language enough flexibility to represent policies following different access-control models. Other approaches [START_REF] Mouelhi | A Model-Based Framework for Security Policy Specification, Deployment and Testing[END_REF][START_REF] Trninic | PolicyDSL: Towards Generic Access Control Management Based on a Policy Metamodel[END_REF] describe languages and tools able to produce flexible access-control models. However, several reason inclined us to choose XACML. First of all, thanks to its ABAC philosophy, XACML is able to represent a wider range of security policies (see [START_REF] Jin | A Unified Attribute-Based Access Control Model Covering DAC, MAC and RBAC[END_REF] for the capabilities of ABAC to cover other AC models), while other extensible languages like SecureUML [START_REF] Lodderstedt | SecureUML: A UML-Based Modeling Language for Model-Driven Security[END_REF] will impose the use of RBAC. Secondly, being an standard language, we expect a wider adoption and a more consistent maintenance and evolution of the language. XACML policies are composed of three main elements PolicySet, Policy and Rule. A PolicySet can contain other PolicySets or a single Policy that is a container of Rules (Policy and PolicySet also specify a rule-combining algorithm, in order to solve conflicts between their contained elements). These three elements can specify a Target that establishes its applicability, i.e., to which combination of Subject, Resource and Action the PolicySet, Policy and Rule applies. Subject, Resource and Action identifies subjects accessing given resources to perform actions. These elements can hold Attribute elements, that represent additional characteristics (e.g., the role of the subject). Optionally, a Rule element can hold a Condition that represents a boolean condition over a subject resource or action. Upon an access request, these elements are used to get an answer of the type: permit, deny or not applicable.

Translation to XACML and Profiles

Our goal is to translate all the existing policies of the system in hand to XACML policies. However, the component-specific models will typically represent the accesscontrol information in a component-specific way, i.e., they will include concepts of the domain for easing the comprehension and elaboration of policies by domain experts. Those concepts should be preserved in order to keep the expressivity of the policy. For that purpose, XACML profiles need to be defined. These profiles will basically specialize the core concepts of the XACML policy language. In general, a profile will contribute new attributes specializing the concepts of Subject, Resource and Action although specializing other concepts may be necessary mostly when the profile needs to reflects some special feature of the original policy model (take as an example the XACML RBAC Profile 5 , where the concepts of PolicySet and Policy are extended as well as describing how to arrange these elements in a specific way to achieve the desired goal).

In order to demonstrate the process of defining a XACML profile, in the following, we describe the development of a XACML profile for the domain of relational database management systems (RDBMSs). The concepts of the domain are extracted from a security database metamodel described in [START_REF] Martínez | Reverse Engineering of Database Security Policies[END_REF].

First of all, note that the domain of relational databases usually relies on a RBAC model, what should be represented in the profile. There exists already a XACML profile for RBAC. Therefore, our profile will complement the use of this profile by contributing domain specific attributes for Subject, Resource and Action.

We start by defining the profile identifier that shall be used when an identifier in the form of a URI is required: urn:oasis:names:tc:xacml: 3 . 0 :rdbms Regarding the Resources, we will describe the following attributes. As for the actions, we will describe the following attributes, being all of type string. Finally, and regarding the subjects, the concept of role is already included in the RBAC profile. We will only add an attribute to identify the database elements owned by a subject, as this attribute influences the permissions (commonly, in RDBMS, the owner of a resource has all the permissions and moreover, is allowed to delegate those permissions to others).

urn:oasis:names:tc:xacml: 3 . 0 :rdbms:subject:owner Once the profile is available, a transformation between the metamodel of the model recovered from the subsystem and the XACML (plus profiles) metamodel is defined, providing as an output XACML instance models. Note that to reflect the access-control model used in the RDBMS, we have to explicitly create a rule that in RDBMS is implicit, i.e., the owner has all the rights on the owned element.

The definition of any other profile will follow a similar process. Concretely, for the CMS we will define attributes extending the core concepts of XACML following the types defined in [START_REF] Martínez | Towards an Access-Control Metamodel for Web Content Management Systems[END_REF] and then combining its use with the use of the RBAC profile. As for the firewalls, several mappings to use as a basis for the profile exists, including the use of roles [START_REF] Cuppens | A Formal Approach to Specify and Deploy a Network Security Policy[END_REF] or not [START_REF] Martínez | Model-Driven Extraction and Analysis of Network Security Policies[END_REF]. We decide to extend the latter to include domain concepts (as host, zone, protocol, etc), discarding the discovery/creation of implicit roles.

Integration

Once we have all the policies represented within the same policy language, the next step is to organize the policies in a single global model. A key issue in this step is to unveil the implicit dependencies between policies situated at different architecture levels to make them explicitly appear in the model.

First of all, we need to decide the structure we will follow to represent the policies and their dependencies in a single XACML resource. The policy of each component will be stored in single XACML PolicySet, so that we can use the PolicySetIdRef to link it (without inheritance semantics) to other policies in the system. Note that some scenarios will require the policy of the component to be split in several PolicySet and Policy elements as is the case when using the RBAC profile. For simplicity, in the rest of the paper we will consider the policy of a component as the element containing its rules, disregarding how they are internally organized using XACML structural elements. Note also that the proposed structure is only intended to enable analysis capabilities and not to mimic a structure suitable, for instance, for code-generation and system deployment.

Starting from the individual policies, we need a process to discover the dependencies between them, so that the references can be properly set. We propose here a process based on exploiting context information (e.g., IP address or database-backend user for a CMS) that suggests relationships between subsystem. Note that we do not deal here with the possible heterogeneity of the properties storing the context information (different names or types) by considering that the matching of such heterogeneities may be performed, if needed, as a previous step. This context information is relevant not only to unveil the dependencies but also for the analysis of the system, thus, it needs to be stored along with the policy representation. As XACML does not provide a specific place to store this kind of information and to minimize the language extension it may require, we add this information in the description field of the PolicySet element. In this field we store a string representing a key and value map with the corresponding environment values for the Policy or PolicySet:

Context{dbU serN ame : anonyme; IpAddress : 192.000.111.0}

With the context information available, the process to find the dependencies between policies is described in Algorithm 1. Basically, for each context parameter in a given policy it searches if there is any rule using that attribute value in any of the other policies. If this is the case, a dependency exists between both policies and as such it is registered. Note that the algorithm has been optimized by considering that no circular dependencies exist. The set of candidate policies for a Policy P j (i.e., policies it may depend on), initialized to all the other policies in line 3, is modified in line 13 to remove Policies P i that already depend on it. This assumption stems from the nature of multi-layer ISs where upper components depend only on components in lower layers. This optimization can be dropped for other scenarios if needed.

Figure 3 shows the result of applying our approach to the IS example in Section 2. A policySet element has been created for each of the system components: firewall, database and CMS. These policySets contain the translated to XACML access-control policy of each component along with references to its dependencies as calculated by algorithm 1.

Algorithm 1 12 for the CMS; the empty set for the firewall, the results is that the database policySet holds a dependency on the firewall policySet (due to the IP address context attribute) while the CMS policySet holds dependencies to the firewall and the database policySets (due to the database user and IP address context attributes).

Global analysis of inter-component anomalies

We are now able to perform all kinds of security analysis and manipulation tasks unavailable when focusing only on individual policies. The implementation of such tasks will benefit from the use of a common XACML representation which abstracts from irrelevant technical details and facilitates their reusability regardless the specific components those policies come from.

In this paper we focus on one of such analysis tasks that we believe is specially critical: the detection of inter-component anomalies. As a preparation, we will first present a number of basic operations introduced with the purpose of easing the manipulation of our integrated model (for this and other possible analysis).

Basic Operations

Our model can be easily queried to extract useful information by using the OCL [START_REF] Omg | OCL, version 2.0. Object Management Group[END_REF] standard query language. However, there is a set of operations that will be commonly used and as such, we consider worth it to define them as a reusable library. In that sense, we present here a list of useful model manipulation operations implemented with OCL.

Table 1 presents a description of this set of basic operations. Basically, we present operations to work with the dependencies, getDependents, getDependencies, getAllDependencies resolveDependency and getDependencySource; operations to obtain the context attributes of a policy, getContextAttributes; and operations to obtain the rules related with context attributes in a dependency relation, getRelevantRules. Given two policies, P i and P j, with P i dependent on P j, returns the rules in P j related to the context attributes of P i, i.e., the set of rules of P j P i depends on Table 1. OCL Operations

Detection of rule anomalies

One important analysis task is the detection of anomalies that appear when several policies work together, as shown in the examples in Section 2. The problems these anomalies cause vary from simply increasing the complexity of policies to the introduction of unexpected behaviour of a component w.r.t. its defined policy.

Focusing on the undesired effects these anomalies may produce and considering rule r i depending on r j (as indicated by the policy dependency structure presented in 5), we identify the following risks (defining risk as a threat caused by an anomaly that may lead to loses in terms of money and/or reputation):

-Security Risk: The combination of r i and r j may cause a security hole. This happens when r j allows requests for values r i does not allow. We consider the risk partial when r j only allows some of the r i denied values. Example 2 in Section 2 belongs to this category, as the network layer, combined with the database layer, allows request the CMS does not. -Service Risk: The combination of r i and r j may cause the component to which r i provides access-control not to be able to provide the expected service. This happens when r j denies requests for values r i allows. We consider the risk partial when r j only denies some of the r i allowed values. Example 1 in Section 2 shows a partial service risk. -Redundancy: r i or r j may be eliminated without impact to the behaviour in the system. This may happen when both rules deny requests for the same values. Policies containing those rules may be refactored to reduce complexity. -No Risk: The combination of r i and r j does not generate any risk.

As we have seen, these anomalies depend on the relations that hold between the set of request matched by a pair of rules. For determining that relation we need to compare security rules. This comparison is done for the purpose of checking if 1) Conditions in different rules hold for the same set of values 2) The rule effect when the conditions hold are conflicting. This process, which we call rule similarity evaluation following the terminology in [START_REF] Mazzoleni | XACML Policy Integration Algorithms[END_REF], can be performed following different approaches. Here, due to the relative simplicity of the syntactical analysis they propose, we adapt the approach proposed in [START_REF] Mazzoleni | XACML Policy Integration Algorithms[END_REF] to the case of policies in different architectural layers. Other approaches could however be also adapted to our specific case.

Algorithm 2 Risk evaluation 1: r← Initialrule, a← Initialattribute 2: P ← P/r ∈ P , D← getAllDependencies(P ), S← getDependencies(P ) 3: for each Di ∈ D do 4:

Pi← resolveDependency(Di) 5:

if Di in S then 6:

R← getRelevantRules(P, Pi) 7:

tagRules(R, P ) 8: else 9:

Pj ← getDependencySource(Di) 10:

R← getRelevantRules(Pj , Pi) 11:

tagRules(R, Pj ) 12:

end if 13:

for each ri ∈ R do 14:

if a ∈ ri then 15:

sim← calculateSimilarity(ri, r, a) 16:

reportAnomalyCheck(sim, ri, r, ) 17:

end if 18:

end for 19: end for another policy, each one yielding a different set of relevant rules. As this information is relevant for performing further analysis, each rule is tagged with its dependent policy (lines 10 and 14).

Let us take a look of how the risk types instantiation is calculated for the examples presented in Section 2. Regarding the first example, we want to know if given the database rule R DB and its time attribute there exists an anomaly: RDB(RoleX, T ableX, W rite,8:00 -16:00) → accept Following the proposed algorithm, the policy dependencies are retrieved, that in this case consists only in a dependency towards the firewall policy. Using the context attributes, the rules in the firewall policy related to the database are retrieved. Finally, from this set of rules, the ones containing the time attribute are checked for similarity with the database rule and tagged in consequence. We can then show only those having a similarity implying an anomaly. In that subset we will have the second rule in the example, R F W , as it uses a context attribute, the time attribute, and the calculated similarity has the value of extend, which may cause an anomaly of partial service risk, as shown in the Table 2.

RF W (Local, DBServer, Send/receive,8:00 -14:00) → accept As for the second example, the process starts in a similar way, by retrieving the dependencies of the CMS policy containing the rule R CM S and the attribute to be checked, in this case, the source IP address.

RCMS(BlacklistedIP s, Admin, Access) → deny

However, now we will have two kinds of dependencies. The CMS policy depends directly on the database and firewall policies, but it also holds an indirect dependency to the firewall policy through the database one. Thus, three sets of rules are retrieved, those of the firewall and database policies related to the CMS context attributes (IP address and database user) and those of the firewall related with the context attributes of the database (IP address of the server).

The risk type instantiation calculated on the set of retrieved rules will exhibit not only the possible anomalies the policy of the CMS has with respect to the database and the firewall directly, but also those anomalies arising from the combination of the effects of rules in the database and firewall together. Thus, among other possible anomalies present in the firewall or database configuration we will retrieve the one associated with the following rule:

RF W (0.0.0.0, DBServer, Send/receive, ) → accept It gives access to the database server (back-end of the CMS) to users in a location forbidden by the CMS policy. This rule retrieved from the database dependency and tagged that way, informs us about an anomaly (shadowing) between the CMS and the firewall involving the database system. The security expert will only need to retrieve the database relevant rules w.r.t. the CMS policy to have a complete picture of the problem. RCMS(BlacklistedIP s, Admin, Access) → deny RDB(CM SRole, CM SSchema, W rite) → accept RF W (0.0.0.0, DBServer, Send/receive, ) → accept Obtaining this information would not have been possible without the integration of the policies and the discovery of their dependencies.

Implementation

In order to validate the feasibility of our approach, a proof-of-concept prototype implementation has been developed under the Eclipse environment6 by using Model-driven tools and techniques. Concretely, our implementation is based on two features: Model Representation. Our approach takes as input domain-specific access-control models extracted from different components in order to translate them to XACML models. To be able to do that, a XACML policy metamodel (models conform to metamodels, which define the main concepts and relationships of the domain) is required, so that models conforming to it can be created. We have used, EMF, the de-facto modeling framework for that purpose.

Providing the XACML XSD schema 7 as an input to EMF, the framework allowed us to generate the XACML policy metamodel, and in turn, to generate Java code plugins for the manipulation of model instances, including a tree-based editor. Note that these models instances can be, in turn, serialized using a XML syntax. XACML identifiers, datatypes, etc, are integrated in a similar way i.e., by extracting a metamodel through EMF and linking it to the XACML metamodel.

Model Query&Transformations. Once the means to represent XACML models are available, we can perform the transformations from the domain models and the operations and algorithms described in Sections 5 and 6. We have used the ATL [START_REF] Jouault | ATL: A Model Transformation Tool[END_REF] modelto-model transformation language for that purpose. ATL is a hybrid (declarative with imperative facilities) language and framework that provides the means to easily specify the way to produce target models from source models. The following model-to-model transformation have been created:

1) A model transformation for each component model to a XACML model.

2) A library of helpers, an ATL mechanism to factorize OCL operations, representing the basic operations in section 6

3) A model transformation for the integration algorithm in 1. 4) A model query for the detection of anomalies, following the algorithm 2.

Related Work

The integration of security policies is a research problem that has attired the attention of the security research community in the recent years. Consequently, different approaches to tackle the problem have been proposed. From a formal perspective, in [START_REF] Casalino | Refactoring Multi-Layered Access Control Policies Through (De)composition[END_REF] the authors provide the foundations of a formal framework to represent policies in different architectural layers. Similarly, in [START_REF] Bonatti | An Algebra for Composing Access Control Policies[END_REF] the authors analyze different combination operations for AC policies. Among them, the combination of heterogeneous policies and the integration of hierarchical policies through refinement. [START_REF] Bauer | Access Control for the Web via Proof-Carrying Authorization[END_REF] provides a logical framework to encode multiple authorization policies into a proof-carrying authorization formalism. In [START_REF] Preda | Model-Driven Security Policy Deployment: Property Oriented approach[END_REF] Method-B is used to formalize the deployment of AC policies on systems composed of several (network) components. Finally, by using model-driven techniques, in [START_REF] Davy | The Policy Continuum-Policy Authoring and Conflict Analysis[END_REF] the authors formalize the policy continuum model, that represent policies at different inter-related abstraction layers although it does not tackle the problem of inter-related architectural layers.

The aforementioned works are valuable contributions that could be eventually used to enforce a forward engineering process to generate correct policies. However, none of these formalization works provide the bridges necessary to fill the gap between real deployed policies and the proposed formalisms as they mostly aim at providing a formal framework to deploy/analyse/manipulate synthetic policies. Conversely, our approach works the other way round by proposing a more pragmatic approach, aimed at providing a solution for the integration of real, already deployed policies.

More similar to us and working on XACML policies, in [START_REF] Hu | Anomaly Discovery and Resolution in Web Access Control Policies[END_REF] the authors describe approaches to detect anomalies while in [START_REF] Mazzoleni | XACML Policy Integration Algorithms[END_REF] integration analysis for policies belonging to different authorization entities is proposed. However, they do not deal with dependencies between policies. Finally, we have adapted the similarity process in [START_REF] Mazzoleni | XACML Policy Integration Algorithms[END_REF] to compare rules and policies for the case of inter-dependent access control policies.

Conclusions and Future Work

We have presented an approach to integrate the Access-control policies collaborating in an Information System. It translates all the policies to the XACML policy language and organizes them in an unique model by unveiling the implicit dependencies between them. Finally, we have presented useful operations taking advantage of the proposed infrastructure that lead to detect possible anomalies between the policies.

As a future work, we plan to extend our approach to include other sources of information. Concretely, we would like to integrate in our approach the information provided by the audit and logging systems of IS components. So far, we can point the security experts to possible anomalies. By analysing the audits together with them, we believe we can determine whether the anomaly is taking place/being exploited or not. Finally, we also intend to extend our approach to integrate different kinds of policies. Privacy, Integrity and Secrecy policies may collaborate between them and thus, we believe they may benefit of an integration approach as the one we have presented here.

Fig. 2 .

 2 Fig. 2. Policy Integration Approach policies are not explicit 2) the AC information may be represented following a different AC model and stored in different technical spaces requiring domain experts for its analysis.

  urn:oasis:names:tc:xacml: 3 . 0 :rdbms:resource:database urn:oasis:names:tc:xacml: 3 . 0 :rdbms:resource:schema urn:oasis:names:tc:xacml: 3 . 0 :rdbms:resource:table urn:oasis:names:tc:xacml: 3 . 0 :rdbms:resource:column urn:oasis:names:tc:xacml: 3 . 0 :rdbms:resource:view urn:oasis:names:tc:xacml: 3 . 0 :rdbms:resource:procedure urn:oasis:names:tc:xacml: 3 . 0 :rdbms:resource:trigger

  urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:tableOpt:insert urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:tableOpt:delete urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:tableOpt:select urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:tableOpt:update urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:dbOpt:alter urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:dbOpt:drop urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:dbOpt:create urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:permissionOpt:grant urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:permissionOpt:revoke urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:sessionOpt:set urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:sessionOpt:connect urn:oasis:names:tc:xacml: 3 . 0 :rdbms:action:codeOpt:execute

Fig. 3 .

 3 Fig. 3. Policy Organization

http://docs.oasis-open.org/xacml/cd-xacml-rbac-profile-01.pdf

https://www.eclipse.org/

http://docs.oasis-open.org/xacml/3.0/XSD/cs-xacml-schema-policy-01.xsd

Rule similarity type

Matched requests Diverge: Two rules 'diverge' if the sets of values do not intersect with respect to which of their conditions hold.

Restrict and extend: A rule 'restricts' (or 'extends') another rule if the sets of values with respect to which its conditions hold contain (or is contained in) the set of values computed for the other rule.

Shuffle: Two rules 'shuffle' if the sets of values for which their conditions hold intersect, but no one is contained in the other.

These values are calculated by a similarity calculation algorithm presented in [START_REF] Mazzoleni | XACML Policy Integration Algorithms[END_REF]. We instantiate the Rule similarity types for the case of rules situated in different architectural layers by assigning them the previously defined risk types.

Risk calculation. The assignment of risk types to rule similarity types depends on their effect (deny, accept) and matched request sets. Table 2 shows the assignment for all the possible combinations. Notice that the actual presence of anomalies between two rules depends on the nature of the involved systems and how they interact.

Algorithm 2 describes the process of instantiating the risks of rules over our infrastructure given a rule and an attribute to check. Basically, the algorithm iterates over the policies the policy containing the rule depends on, retrieving relevant rules (lines 9 and 13) and retrieving the similarity value (line 18) to produce an anomaly report (line 19). It is important to note that when the dependency is indirect, i.e., the dependency relationship is established through another policy, we need to get the relevant rules w.r.t. this latter policy having the direct dependency (line 11 to 15). This is specially important because a given policy may have both, a direct and an indirect dependency with


PhD Marianna Virtanen
email: marianna.virtanen@ttl.fi

PhD Jane E Ferrie

MD Adam G Tabak

PhD Tasnime N Akbaraly

MD Jussi Vahtera

PhD Archana Singh-Manoux

PhD Mika Kivimäki

Prof Marianna Virtanen

Psychological distress and incidence of type 2 diabetes in

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Type 2 diabetes is preceded by a period of marked changes in glucose regulation. The pre-diabetic period can last over 10 years [START_REF] Tabak | Prediabetes: a high-risk state for diabetes development[END_REF] providing a crucial window for effective prevention of type 2 diabetes. To date, the focus of preventive efforts has been on lifestyle and pharmacological interventions [START_REF] Tabak | Prediabetes: a high-risk state for diabetes development[END_REF][START_REF] Aroda | Approach to the patient with prediabetes[END_REF][START_REF] Fonseca | Identification and treatment of prediabetes to prevent progression to type 2 diabetes[END_REF]. However, there has been widespread interest in the role of psychological factors, such as depression and stress, in the onset of type 2 diabetes. Suggested plausible mechanisms are health risk behaviors and increased body weight, dysregulation of the hypothalamus-pituitary-adrenal (HPA) axis, overactivation of the sympathetic nervous system and increased chronic inflammation; all of which are known to adversely affect glucose metabolism [START_REF] Mcewen | Protective and damaging effects of stress mediators[END_REF][START_REF] Brotman | The cardiovascular toll of stress[END_REF].

There is some evidence that depression is an independent risk factor for type 2 diabetes [START_REF] Knol | Depression as a risk factor for the onset of type 2 diabetes: a meta-analysis[END_REF][START_REF] Mezuk | Depression and type 2 diabetes over the lifespan[END_REF][START_REF] Golden | Examining a bidirectional association between depressive symptoms and diabetes[END_REF], but findings for 'general' stress and work stress are less consistent [START_REF] Cosgrove | Work-related stress and Type 2 diabetes: systematic review and meta-analysis[END_REF][START_REF] Norberg | Work stress and low emotional support is associated with increased risk of future type 2 diabetes in women[END_REF][START_REF] Kumari | Prospective study of social and other risk factors for incidence of type 2 diabetes in the Whitehall II study[END_REF][START_REF] Heraclides | Psychosocial stress at work doubles the risk of type 2 diabetes in middle-aged women[END_REF][START_REF] Kawakami | Overtime, psychosocial work conditions, and occurrence of non-insulin dependent diabetes mellitus in Japanese men[END_REF][START_REF] Heraclides | Work stress, obesity and the risk of type 2 diabetes: gender-specific bidirectional effect in the Whitehall II study[END_REF][START_REF] Chida | An association of adverse psychosocial factors with diabetes mellitus: a meta-analysis of longitudinal cohort studies[END_REF][START_REF] Pouwer | Does emotional stress cause type 2 diabetes mellitus? A review from the European Depression in Diabetes (EDID) research consortium[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF][START_REF] Eriksson | Work stress, sense of coherence, and risk of type 2 diabetes in a prospective study of middle-aged Swedish men and women[END_REF]. A major limitation of existing research on psychological factors and diabetes risk is reliance on the crude dichotomization; no diabetes versus diabetes. This categorization does not take into account the long prediabetic period preceding manifest disease and the possibility that those at an advanced stage on the continuum between health and disease might be differentially vulnerable to the effects of psychological factors [START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF]. Some evidence to support this hypothesis was found in a study including 128 male Japanese workers with prediabetes which reported an increased risk of type 2 diabetes among those with high levels of baseline stress [START_REF] Toshihiro | Psychosocial factors are independent risk factors for the development of Type 2 diabetes in Japanese workers with impaired fasting glucose and/or impaired glucose tolerance[END_REF].

Although it captures a range of comorbid psychological factors, such as depressive and anxiety symptoms, stress and disturbed sleep, psychological distress has rarely been examined as a psychological risk factor for type 2 diabetes [START_REF] Kumari | Prospective study of social and other risk factors for incidence of type 2 diabetes in the Whitehall II study[END_REF][START_REF] Eriksson | Work stress, sense of coherence, and risk of type 2 diabetes in a prospective study of middle-aged Swedish men and women[END_REF][START_REF] Mommersteeg | Higher levels of psychological distress are associated with a higher risk of incident diabetes during 18 year follow-up: results from the British household panel survey[END_REF] and no study has examined whether the associations differ in populations at higher or lower risk of progressing to manifest diabetes. In this study we examined whether psychological distress at baseline differentially predicted incident type 2 diabetes in analyses stratified by the type 2 diabetes risk level based on (1) the presence or absence of prediabetes and (2) on the Framingham Offspring type 2 diabetes risk score [START_REF] Wilson | Predicition od incident diabetes mellitus in middle-aged adults[END_REF].

RESEARCH DESIGN AND METHODS

Participants and procedure

Recruitment to the Whitehall II study took place between 1985 and 1988 among all office staff, aged 35 to 55 years, in 20 London-based Civil Service departments [START_REF] Marmot | Cohort Profile: the Whitehall II study[END_REF]. The response rate was 73% (6,895 men and 3,413 women). Informed consent was obtained from all participants and University College London Medical School Committee on the Ethics of Human Research approved the protocol.

The target population for the present study was a sample of 5,932 participants (4,189 men, 1,743 women, mean age 54.6 years) for whom data were collected in at least 2 of the following cycles: from 1991-3 to1997-9, from 1997-9 to 2002-4, and from 2002-4 to 2007-9. Included participants had complete data on type 2 diabetes, psychological distress, Framingham Offspring type 2 diabetes risk score [START_REF] Wilson | Predicition od incident diabetes mellitus in middle-aged adults[END_REF] and covariates (age, sex, socioeconomic status, ethnicity, antidepressant use, smoking, and physical activity) at baseline. Those included in the analyses were free of diabetes at the baseline cycle(s) and had data on their pre-diabetes status and Framingham Offspring type 2 diabetes risk score (Figure 1). Each participant could thus contribute to a minimum of 1 and a maximum of 3 cycles. The 5,932 eligible participants produced 13,207 personobservations, mean follow-up time between baseline and follow-up for each cycle was 5.46 (SD=0.51) years.

Ascertainment of type 2 diabetes, prediabetes and type 2 diabetes risk status

At each clinical phase venous blood samples were taken from individuals who were fasting ≥8 hours (those whose clinic visit was in the afternoon had a light fat-free breakfast and they were asked to fast for ≥5 hours) before undergoing a standard 2-h 75g oral glucose tolerance test (1).

Diabetes was defined as fasting glucose >7.0 mmol/L, 2-hour post-load glucose >11.1 mmol/L [START_REF] Diabetes | Diagnosis and classification of diabetes mellitus[END_REF][START_REF] Alberti | Definition, diagnosis and classification of diabetes mellitus and its complications. Part 1: diagnosis and classification of diabetes mellitus provisional report of a WHO consultation[END_REF][START_REF] Brunner | Social inequality in coronary risk: central obesity and the metabolic syndrome. Evidence from the Whitehall II study[END_REF][START_REF] Tabak | Trajectories of glycaemia, insulin sensitivity, and insulin secretion before diagnosis of type 2 diabetes: an analysis from the Whitehall II study[END_REF], self-reported doctor-diagnosed diabetes, or use of diabetes medication. Blood samples were handled at all phases using similar standard protocols, and baseline cases were excluded from the prospective analyses. Prediabetes was defined as impaired fasting glucose (IFG, a fasting glucose of 5.6-6.9 mmol/L and 2-hour glucose <7.8 mmol/L) and/or impaired glucose tolerance (IGT, a fasting glucose <7 mmol/L and a 2-hour post-load glucose of 7.8-11.0 mmol/L) [START_REF] Diabetes | Diagnosis and classification of diabetes mellitus[END_REF].

The Framingham Offspring Type 2 Diabetes Risk Score is based on a previously published detailed algorithm [START_REF] Wilson | Predicition od incident diabetes mellitus in middle-aged adults[END_REF] with the following components: impaired fasting glucose (IFG), overweight or obesity, low level of high-density lipoprotein (HDL), high level of triglycerides, elevated blood pressure or antihypertensive medication, and parental diabetes. The total score ranges from 0 to 30. In the present analysis, participants with impaired glucose tolerance (IGT) received the same score as those with IFG (10 points in both cases). In the Framingham Offspring study, participants with >19 points had an 8-year incidence of type 2 diabetes >15% [START_REF] Wilson | Predicition od incident diabetes mellitus in middle-aged adults[END_REF], thus we used this score to determine high risk status. Participants with normoglycemia scored 0 to 18 in the Framingham risk score and were further classified into the low risk group (0-9 points) and intermediate risk group [START_REF] Norberg | Work stress and low emotional support is associated with increased risk of future type 2 diabetes in women[END_REF][START_REF] Kumari | Prospective study of social and other risk factors for incidence of type 2 diabetes in the Whitehall II study[END_REF][START_REF] Heraclides | Psychosocial stress at work doubles the risk of type 2 diabetes in middle-aged women[END_REF][START_REF] Kawakami | Overtime, psychosocial work conditions, and occurrence of non-insulin dependent diabetes mellitus in Japanese men[END_REF][START_REF] Heraclides | Work stress, obesity and the risk of type 2 diabetes: gender-specific bidirectional effect in the Whitehall II study[END_REF][START_REF] Chida | An association of adverse psychosocial factors with diabetes mellitus: a meta-analysis of longitudinal cohort studies[END_REF][START_REF] Pouwer | Does emotional stress cause type 2 diabetes mellitus? A review from the European Depression in Diabetes (EDID) research consortium[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF][START_REF] Eriksson | Work stress, sense of coherence, and risk of type 2 diabetes in a prospective study of middle-aged Swedish men and women[END_REF][START_REF] Toshihiro | Psychosocial factors are independent risk factors for the development of Type 2 diabetes in Japanese workers with impaired fasting glucose and/or impaired glucose tolerance[END_REF], the latter range corresponding to the lower (i.e., intermediate) risk group (10-19 points) among participants with prediabetes. Based on the baseline information on prediabetes status and the Framingham risk score, participants were classified into four groups: 1) no prediabetes, low Framingham risk score (0-9); 2) no prediabetes, intermediate Framingham risk score [START_REF] Norberg | Work stress and low emotional support is associated with increased risk of future type 2 diabetes in women[END_REF][START_REF] Kumari | Prospective study of social and other risk factors for incidence of type 2 diabetes in the Whitehall II study[END_REF][START_REF] Heraclides | Psychosocial stress at work doubles the risk of type 2 diabetes in middle-aged women[END_REF][START_REF] Kawakami | Overtime, psychosocial work conditions, and occurrence of non-insulin dependent diabetes mellitus in Japanese men[END_REF][START_REF] Heraclides | Work stress, obesity and the risk of type 2 diabetes: gender-specific bidirectional effect in the Whitehall II study[END_REF][START_REF] Chida | An association of adverse psychosocial factors with diabetes mellitus: a meta-analysis of longitudinal cohort studies[END_REF][START_REF] Pouwer | Does emotional stress cause type 2 diabetes mellitus? A review from the European Depression in Diabetes (EDID) research consortium[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF][START_REF] Eriksson | Work stress, sense of coherence, and risk of type 2 diabetes in a prospective study of middle-aged Swedish men and women[END_REF][START_REF] Toshihiro | Psychosocial factors are independent risk factors for the development of Type 2 diabetes in Japanese workers with impaired fasting glucose and/or impaired glucose tolerance[END_REF]; 3) prediabetes with intermediate Framingham risk score [START_REF] Norberg | Work stress and low emotional support is associated with increased risk of future type 2 diabetes in women[END_REF][START_REF] Kumari | Prospective study of social and other risk factors for incidence of type 2 diabetes in the Whitehall II study[END_REF][START_REF] Heraclides | Psychosocial stress at work doubles the risk of type 2 diabetes in middle-aged women[END_REF][START_REF] Kawakami | Overtime, psychosocial work conditions, and occurrence of non-insulin dependent diabetes mellitus in Japanese men[END_REF][START_REF] Heraclides | Work stress, obesity and the risk of type 2 diabetes: gender-specific bidirectional effect in the Whitehall II study[END_REF][START_REF] Chida | An association of adverse psychosocial factors with diabetes mellitus: a meta-analysis of longitudinal cohort studies[END_REF][START_REF] Pouwer | Does emotional stress cause type 2 diabetes mellitus? A review from the European Depression in Diabetes (EDID) research consortium[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF][START_REF] Eriksson | Work stress, sense of coherence, and risk of type 2 diabetes in a prospective study of middle-aged Swedish men and women[END_REF][START_REF] Toshihiro | Psychosocial factors are independent risk factors for the development of Type 2 diabetes in Japanese workers with impaired fasting glucose and/or impaired glucose tolerance[END_REF]; and 4) prediabetes with high Framingham risk score (>19).

Assessment of psychological distress

The 30-item General Health Questionnaire (GHQ-30) was used to assess psychological distress [START_REF] Goldberg | The detection of psychiatric illness by questionnaire[END_REF]. The GHQ is a screening instrument designed to detect common psychological symptoms, such as depression and anxiety. It is widely used in population-based surveys and trials, and has been validated in the Whitehall II study [START_REF] Head | Use of selfadministered instruments to assess psychiatric disorders in older people: validity of the General Health Questionnaire, the Center for Epidemiologic Studies Depression Scale and the selfcompletion version of the revised Clinical Interview Schedule[END_REF]. Each questionnaire item enquires about a specific symptom; response categories are scored as either 1 or 0 to indicate presence or absence of the symptom. A total score of 5 or more led to individuals being defined as GHQ-symptom 'cases' and scores 0-4 as 'non-cases' [START_REF] Head | Use of selfadministered instruments to assess psychiatric disorders in older people: validity of the General Health Questionnaire, the Center for Epidemiologic Studies Depression Scale and the selfcompletion version of the revised Clinical Interview Schedule[END_REF].

Assessment of covariates

Socio-demographic covariates included age, sex, socioeconomic status (SES; based on the last known occupational grade and divided into high, intermediate and low), and ethnicity (white, South Asian or other), are all based on survey responses [START_REF] Marmot | Cohort Profile: the Whitehall II study[END_REF]. Antidepressant use (yes/no) and smoking (yes/no) were based on self-reported information at the baseline survey of each cycle.

Physical activity was assessed at cycle 1 based on answers to questions about the frequency and duration of participation in mildly energetic (e.g., weeding, general housework, bicycle repair), moderately energetic (e.g., dancing, cycling, leisurely swimming), and vigorous physical activity (e.g., running, hard swimming, playing squash). At cycles 2 and 3, the questionnaire included 20 items on frequency and duration of participation in different physical activities (e.g., walking, cycling, sports) that were used to compute hours per week of each intensity level. Participants were classified as active (>2.5 hours/week of moderate physical activity or >1 hour/week of vigorous physical activity), inactive (<1 hour/week of moderate physical activity and <1 hour/week of vigorous physical activity), or moderately active (if not active or inactive) [START_REF] Stringhini | Association of socioeconomic position with health behaviors and mortality[END_REF].

Statistical analysis

After harmonization of data across cycles, we examined associations between psychological distress at baseline and incident type 2 diabetes at follow-up for each cycle. We used generalized estimation equations (GEE) with a logistic link to control for intra-individual correlation between repeated measurements to estimate odds ratios (OR) and their 95% confidence intervals. GEE analysis was used because repeated measurements were nested within participants (i.e., the same individuals could contribute more than one observation to the dataset), and the GEE method takes into account non-independence of the within-participant observations when estimating standard errors. We first analyzed the association between psychological distress and the incidence of type 2 diabetes in the total cohort. Then we grouped the participants according to their baseline prediabetes status, Framingham Offspring Type 2 Diabetes Risk Score and psychological distress into 8 groups as follows: 1) normoglycemia -Framingham risk score 0 to 9 -no distress (reference group); 2) normoglycemia -score 0 to 9 -distress; 3) normoglycemia -score 10 to 19 -no distress; 4) normoglycemia -score 10 to 19 -distress; 5) prediabetes -score 10 to 19 -no distress; 6) prediabetes -score 10 to 19 -distress; 7) prediabetes -score >19 -no distress, 8) prediabetesscore >19 -distress. Models were adjusted for age, sex, SES, ethnicity, antidepressant use, smoking, and physical activity. SAS version 9.2 (SAS, Cary, NC, USA) was used for all analyses.

RESULTS

Table 1 shows the characteristics of participants at the baseline of each study cycle and in total.

Proportion of participants who were white, high SES, without psychological distress, and who had incident type 2 diabetes were greater at the last cycle than at the first. Antidepressant use was more prevalent and smoking less prevalent, and both high and low physical activity more prevalent in the latter cycles. Overall 5-year incidence for type 2 diabetes was 4.2%.

Associations between baseline covariates for participants with normoglycemia and prediabetes by psychological distress are presented in Supplemental Table S1. Irrespective of the participant's prediabetes status, psychological distress was associated with younger age, female sex, intermediate SES, non-white ethnicity, antidepressant use, smoking, and low physical activity.

In the total cohort, psychological distress did not predict type 2 diabetes after adjustment for age, sex, SES and ethnicity (OR=1.16, 95% CI 0.94-1.42, data not shown). We found no interaction between sex and psychological distress (P=0.37) or between ethnicity and psychological distress (P=0.91) in the prediction of type 2 diabetes.

We then examined whether combinations of prediabetes status, Framingham Offspring Type 2 Diabetes Risk score and psychological distress predicted the incidence of type 2 diabetes.

Figure 2 shows the unadjusted incidences. Type 2 diabetes incidence was low among participants with normoglycemia and a low risk score, irrespective of the presence (1.9%) or absence (1.6%) of psychological distress. Among the normoglycemic participants with an intermediate risk score of 10-19, 7.6% of distressed and 6.0% of non-distressed people had type 2 diabetes at follow-up, the confidence intervals suggesting no association with psychological distress. Similarly, among participants with prediabetes and a Framingham risk score of 10-19, no difference was found in the incidence of type 2 diabetes between those with (15.6%) and without psychological distress (15.0%). However, among participants with prediabetes and a high Framingham risk score (>19) 40.9% of those with psychological distress developed type 2 diabetes at follow-up compared to only 28.5% of those without psychological distress.

Results of the multivariable adjusted logistic regression models confirm those from the unadjusted analysis by showing a strong dose-response association between prediabetes and Framingham risk score status, and risk of incident type 2 diabetes (Table 2). Moreover, comparisons indicate no difference regarding the association between psychological distress and type 2 diabetes among normoglycemic participants or among those with prediabetes and a lower Framingham risk score, whereas among participants with prediabetes and a high Framingham risk score (>19), psychological distress was associated with a doubling of the risk of type 2 diabetes. A statistically significant interaction (P=0.039) was found when comparing the prediabetes-high Framingham risk score group with the other groups combined, as regards the association between psychological distress and incident type 2 diabetes.

The findings were replicated in sensitivity analysis using an alternative, less stringent cutpoint of >18 to define high Framingham risk score (Supplemental Table S2).

CONCLUSIONS

We examined whether the association between psychological distress and incident type 2 diabetes differed between populations at different baseline risk levels of type 2 diabetes as assessed by the presence of prediabetes and the level of Framingham Offspring Diabetes Risk Score. The Framingham score is based on traditional type 2 diabetes risk factors; prediabetes, overweight or obesity, low HDL level, increased level of triglycerides, hypertension, and a history of parental diabetes. In the present study, the score was a strong predictor of incident type 2 diabetes.

Our main finding was that psychological distress is associated with a doubling of diabetes risk in high-risk populations. In the overall analysis, psychological distress was not significantly associated with type 2 diabetes. Subsequent stratified analysis revealed no association between psychological distress and type 2 diabetes in normoglycemic participants irrespective of the risk score and in participants with prediabetes and a lower Framingham risk score. However, in the group of participants with prediabetes and high risk score (>19), the 5-year incidence of diabetes was 28.5% in those without psychological distress and 40.9% in those with psychological distress at baseline. In the multivariate adjusted model the odds ratio was twofold increased among those with psychological distress compared to those without. The findings were replicated using a lower cutpoint (>18) for defining a high Framingham risk score.

Earlier literature suggests that the relationship between psychosocial factors and type 2 diabetes may be complex [START_REF] Pouwer | Does emotional stress cause type 2 diabetes mellitus? A review from the European Depression in Diabetes (EDID) research consortium[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF]. We found no overall association between psychological distress and type 2 diabetes. Earlier findings on the association between psychological factors, such as general stress and work stress, and incident type 2 diabetes have been mixed, including both null and positive findings [START_REF] Norberg | Work stress and low emotional support is associated with increased risk of future type 2 diabetes in women[END_REF][START_REF] Kumari | Prospective study of social and other risk factors for incidence of type 2 diabetes in the Whitehall II study[END_REF][START_REF] Heraclides | Psychosocial stress at work doubles the risk of type 2 diabetes in middle-aged women[END_REF][START_REF] Kawakami | Overtime, psychosocial work conditions, and occurrence of non-insulin dependent diabetes mellitus in Japanese men[END_REF][START_REF] Heraclides | Work stress, obesity and the risk of type 2 diabetes: gender-specific bidirectional effect in the Whitehall II study[END_REF][START_REF] Chida | An association of adverse psychosocial factors with diabetes mellitus: a meta-analysis of longitudinal cohort studies[END_REF][START_REF] Pouwer | Does emotional stress cause type 2 diabetes mellitus? A review from the European Depression in Diabetes (EDID) research consortium[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF]. Inconsistencies in earlier research may not only be due to the use of different stress and distress indicators across studies but also, as our present findings suggest, a failure to recognize that the 'non-diabetes' group might be heterogeneous in terms of vulnerability to distress; those at an 'advanced' stage of prediabetes may be more affected by the adverse metabolic effects of psychological distress than those at lower risk levels [START_REF] Tabak | Prediabetes: a high-risk state for diabetes development[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF]. Indeed, the effect of psychological stress factors have been suggested to be synergistic [START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF]. Rather than a general risk factor in all diabetes-free populations, it might be a stage-specific risk factor which has a much stronger effect among those at an advanced stage of progression towards manifest type 2 diabetes.

In line with our results, an earlier report from the Whitehall II study showed that work stress predicted type 2 diabetes among obese but not non-obese women [START_REF] Heraclides | Work stress, obesity and the risk of type 2 diabetes: gender-specific bidirectional effect in the Whitehall II study[END_REF].

Plausible pathways through which psychological distress may accelerate progression to type 2 diabetes among high-risk individuals include health risk behaviors and direct physiological pathways, such as long-term dysregulation of the hypothalamic-pituitary-adrenal (HPA) axis leading to increased levels of glucocorticoids, especially cortisol, and changes in immune system activity leading to increased concentrations of pro-inflammatory cytokines) [START_REF] Tabak | Prediabetes: a high-risk state for diabetes development[END_REF][START_REF] Golden | Examining a bidirectional association between depressive symptoms and diabetes[END_REF][START_REF] Pouwer | Does emotional stress cause type 2 diabetes mellitus? A review from the European Depression in Diabetes (EDID) research consortium[END_REF][START_REF] Brunner | Epidemiology: Work-related stress and the risk of type 2 diabetes mellitus[END_REF]. There is some evidence supporting inflammation and lifestyle factors as mediators between depressive symptoms and incident type 2 diabetes [START_REF] Golden | Examining a bidirectional association between depressive symptoms and diabetes[END_REF].

Healthcare implications of this study include the notion that psychological distress might hamper the outcomes of intensive lifestyle and other treatment interventions targeted at high risk groups [START_REF] Aroda | Approach to the patient with prediabetes[END_REF][START_REF] Fonseca | Identification and treatment of prediabetes to prevent progression to type 2 diabetes[END_REF]. Psychological distress symptoms, such as stress, anxiety, depression, feelings of hopelessness and sleep disturbances have previously been shown to hinder commitment to major, long-term lifestyle changes and reduce adherence to pharmacological treatments [START_REF] Gonzalez | Depression and diabetes treatment nonadherence: a meta-analysis[END_REF].

There are limitations to our study. First, although the study had a high response rate in the successive data collection phases, loss to follow-up accumulated over time, as in most long-term cohort studies. However, large differences in missing data as a function of psychological distress and type 2 diabetes seem unlikely. Second, participants of the Whitehall II study are from an occupational cohort that is likely to cover a 'healthier' end of the variation in health status compared with the general population which limits generalizability of our findings. Third, we used the GHQ-30 to detect psychological distress symptoms. As this instrument was not designed to make a psychiatric diagnosis of depression or anxiety, we cannot exclude the possibility of confounding by unmeasured depression or anxiety disorders. However, this is unlikely to be a major source of bias because the GHQ-30 has been shown to be a valid screening instrument for mental disorders, particularly depression in the Whitehall II study [START_REF] Head | Use of selfadministered instruments to assess psychiatric disorders in older people: validity of the General Health Questionnaire, the Center for Epidemiologic Studies Depression Scale and the selfcompletion version of the revised Clinical Interview Schedule[END_REF]. The strengths of this study are its large sample size and use of accurate, repeat assessments of all examined variables, use of the Framingham risk score based on clinical measurements, and ascertainment of diabetes based on the standard 75g oral glucose tolerance test at each clinical study cycle [START_REF] Diabetes | Diagnosis and classification of diabetes mellitus[END_REF][START_REF] Alberti | Definition, diagnosis and classification of diabetes mellitus and its complications. Part 1: diagnosis and classification of diabetes mellitus provisional report of a WHO consultation[END_REF]. However, part of the incident type 2 diabetes identification was based on self-report although antihyperglycemic medication was confirmed by asking the participants to take their medications or list of medications to the study clinic. Of those participants who had self-reported diagnosis of diabetes without evidence on the use of antihyperglycemic medications (33.4% of incident cases) a substantial proportion was confirmed by a repeat OGTT or by antihyperglycemic medication at the subsequent phase leaving only 23.6% of all incident diabetes cases unconfirmed.

In summary, this observational study suggests that psychological distress may be related to accelerated progression of late stage prediabetes to clinical diabetes. Further investigations are needed to examine mechanisms linking psychological distress to onset of type 2 diabetes in this group. Current prevention guidelines do not generally consider psychological factors such as stress or depression [START_REF] Ryden | ESC Guidelines on diabetes, pre-diabetes, and cardiovascular diseases developed in collaboration with the EASD: The Task Force on diabetes, pre-diabetes, and cardiovascular diseases of the European Society of Cardiology (ESC) and developed in collaboration with the European Association for the Study of Diabetes (EASD). ESC Guidelines on diabetes, pre-diabetes, and cardiovascular diseases developed in collaboration with the EASD: The Task Force on diabetes, prediabetes, and cardiovascular diseases of the European Society of Cardiology (ESC) and developed in collaboration with the European Association for the Study of Diabetes (EASD)[END_REF], although some recognize them as contributing factors to be taken into account in efforts to prevent type 2 diabetes [START_REF] Lindstrom | Take action to prevent diabetes--the IMAGE toolkit for the prevention of type 2 diabetes in Europe. Take action to prevent diabetes--the IMAGE toolkit for the prevention of type 2 diabetes in Europe[END_REF]. Given the high comorbidity between psychological problems and diabetes and the accumulation of evidence on the role of psychological distress as a predictor of type 2 diabetes, it is important to consider whether more attention should be paid to psychological status among high-risk populations in addition to lifestyle modifications.

Figure 1 .

 1 Figure 1. Flow chart of the data cycles and sample selection procedure

Figure 2 .

 2 Figure 2. Unadjusted incidence (95 % confidence interval) of type 2 diabetes among participants with normoglycemia and participants with prediabetes; participants further stratified by the Framingham Offspring Type 2 Diabetes Risk Score (FRS) and psychological distress

Table 1 -

 1 Characteristics of the participants at the baseline of the 3 cycles. Figures are number (%) unless otherwise stated

	Framingham Offspring type 2 diabetes	5.4 (5.3)	5.0 (5.3)	5.5 (5.4)	5.8 (5.3)
	risk score; mean (SD)
	Incidence of type 2 diabetes at follow-up
	No	12,657 (95.8)	5,155 (96.7)	3,482 (95.8)	4,020 (94.8)
	Yes	550 (4.2)	176 (3.3)	153 (4.2)	221 (5.2)
	*Total n refers to the sum of participants (n of person-observations) in total and across the three study cycles (one
	participantcan contribute to one or more study cycle); n in each study cycle refers to number of participants at that
	cycle.

Table 2 -

 2 Incidence of type 2 diabetes at follow-up among participants with normoglycemia and participants with prediabetes at baseline; participants further stratified by Framingham Offspring Type 2 Diabetes Risk Score (FRS) and psychological distress. Alternative reference groups are shown in comparisons 1 to 8. Unadjusted incidence (95 % confidence interval) of type 2 diabetes among participants with normoglycemia and participants with prediabetes at baseline; participants further stratified by the Framingham Offspring Type 2 Diabetes Risk Score (FRS) and psychological distress

	Figure 2 -

Acknowledgments

Funding: The Whitehall II Study is supported by grants from the Medical Research Council (K013351); British Heart Foundation; National Heart Blood and Lung Institute, NIH, US (R01HL036310), and the National Institute of Aging, NIH, US (R01AG013196 and R01AG034454). Virtanen (the guarantor) is supported by the Academy of Finland (258598, 265174), Tabak by the TÁMOP 4.2.4.A/1-11-1-2012-0001 National Excellence Program (a research fellowship co-financed by the European Union and the European Social Fund), Akbaraly by the National Heart Lung and Blood Institute (R01HL036310) and by the Languedoc-Roussillon Region (Chercheur d'avenir Grant 2011), Singh-Manoux by the National Institute of Aging, NIH, US (R01AG013196 and R01AG034454). Kivimäki is supported by the Medical Research Council (K013351), the US National Institutes of Health (R01HL036310, R01AG034454) and a professorial fellowship from the Economic and Social Research Council. The study sponsors had no role in study design, analysis, or interpretation of the data; or preparation, review, or approval of the manuscript.

Figure 1 -Flow chart of the data cycles and sample selection procedure Whitehall II Study participants at study inception, 1985-8 (n=10,308) n=6,234 with normoglycemia; with baseline data on Framingham score, psychological distress and covariates; n=736 with prediabetes; with baseline data on Framingham score, psychological distress, and covariates n=3,704 with normoglycemia; with baseline data on Framingham score, psychological distress and covariates; n=540 with prediabetes; with baseline data on Framingham score, psychological distress, and covariates n=4,076 with normoglycemia; with baseline data on Framingham score, psychological distress and covariates; n= 732 with prediabetes; with baseline data on Framingham score, psychological distress, and covariates n=5,331 with data on diabetes at follow-up (1997-9) n=3,635 with data on diabetes at follow-up (2002-4) n=4,241 with data on diabetes at follow-up (2007-9) n=13,207 person-observations Cycle 1 (baseline 1991-3; follow-up 1997-99) n=8,815 participants; 250 had diabetes at baseline Cycle 2 (baseline 1997-9; follow-up 2002-4) n=7,870 participants; 389 had diabetes at baseline Cycle 3 (baseline 2002-4; follow-up 2007-9) n=6,967 participants; 527 had diabetes at baseline n=6,970 with complete data at baseline: n=4,244 with complete data at baseline: n=4,808 with complete data at baseline:

Author contributions: M.V. wrote the manuscript and researched data and, as the guarantor, takes full responsibility for the work as a whole, including the study design, access to data, and the decision to submit and publish the manuscript. J.F. wrote the manuscript and reviewed/edited the manuscript. A.T. reviewed/edited the manuscript. T.A. reviewed/edited the manuscript. J.V. reviewed/edited the manuscript. A.S-M. reviewed/edited the manuscript. M.K. helped in study design, wrote the manuscript and reviewed/edited the manuscript.

Conflicts of