Stephan Wiefling
email: stephan.wiefling@h-brs.de

Tanvi Patil
email: tpatil@uncc.edu

Markus Dürmuth
email: markus.duermuth@rub.de

Luigi Lo Iacono
email: luigi.loiacono@h-brs.de

Evaluation of Risk-based Re-Authentication Methods

Keywords: Risk-based Authentication (RBA), Re-authentication, Usable Security

Risk-based Authentication (RBA) is an adaptive security measure that improves the security of password-based authentication by protecting against credential stuffing, password guessing, or phishing attacks. RBA monitors extra features during login and requests for an additional authentication step if the observed feature values deviate from the usual ones in the login history. In state-of-the-art RBA re-authentication deployments, users receive an email with a numerical code in its body, which must be entered on the online service. Although this procedure has a major impact on RBA's time exposure and usability, these aspects were not studied so far. We introduce two RBA re-authentication variants supplementing the de facto standard with a link-based and another code-based approach. Then, we present the results of a betweengroup study (N=592) to evaluate these three approaches. Our observations show with significant results that there is potential to speed up the RBA re-authentication process without reducing neither its security properties nor its security perception. The link-based re-authentication via "magic links", however, makes users significantly more anxious than the code-based approaches when perceived for the first time. Our evaluations underline the fact that RBA re-authentication is not a uniform procedure. We summarize our findings and provide recommendations.

Introduction

Passwords were and continue to be the predominant authentication mechanism of online services [START_REF] Quermann | The State of User Authentication in the Wild[END_REF]. However, threats to password-based authentication are increasing, e.g, by large-scale password database leaks and credential stuffing [START_REF] Thomas | Protecting accounts from credential stuffing with password breach alerting[END_REF]. Therefore, website operators have to provide additional or alternative authentication mechanisms to adequately protect their users. Two-factor authentication (2FA) is one such measure which is widely used but has proven to be unpopular among users [START_REF] Milka | Anatomy of Account Takeover[END_REF]. Biometric authentication is considered impractical for large-scale online services since it requires special hardware and active participation from the user [START_REF] Gaddam | Usage of Behavioral Biometric Technologies to Defend Against Bots[END_REF]. For these reasons, several large online services deployed risk-based authentication (RBA) to protect their users [START_REF] Wiefling | Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild[END_REF]. RBA is an adaptive authentication measure that provides high security with minimal impact on user interaction, and thus has the potential to be more accepted by users than 2FA. Moreover, RBA is recommended in the NIST digital identity guidelines to mitigate account takeover [START_REF] Grassi | Digital identity guidelines[END_REF].

During password entry, RBA monitors additional features, e.g., IP address or user agent, and requests for re-authentication when a particular risk is detected [START_REF] Freeman | Who Are You? A Statistical Approach to Measuring User Authenticity[END_REF]. In state-of-the-art deployments, the re-authentication is mostly based on email address verification [START_REF] Wiefling | Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild[END_REF]. Here, the user receives an email with a multidigit code in the email body that has to be entered on the online service.

Despite its clear presence in RBA deployments, there are, to the best of our knowledge, no studies that evaluate this state-of-the-art re-authentication method. Investigating different devices is important for RBA because push notifications from mobile email apps can make it possible to check emails on mobile devices faster than on desktop devices. Furthermore, using the website on a desktop PC and checking email on a mobile device can slow down the re-authentication process since the code has to be typed in manually. We also discovered that online services using RBA offer different email verification methods for account registration than for RBA re-authentication. When registering an account, the user received either an email with a digit code in the email subject and body, or a verification link. Thus, we wondered why these verification methods are not being used in the RBA re-authentication context so far and whether they have the potential to improve the RBA experience while maintaining the same level of security. To close this gap, we formulated the following research questions.

Research Questions. With these questions, we aim to give answers as to whether the widespread email-based re-authentication method can be improved by other approaches and how all of these methods are perceived by users. Contributions. We designed and conducted a between-group study with 592 participants recruited from the online service Mechanical Turk (MTurk) [START_REF] Kelley | Conducting Usable Privacy & Security Studies with Amazon's Mechanical Turk[END_REF] and evaluated the usability and perception of email-based re-authentication meth-ods. Since there is still only one method used in practical deployments, we introduce two alternative RBA re-authentication methods, both of which have not yet been seen in the RBA context: a code-based and a link-based re-authentication scheme. We compared these approaches with the state-of-the-art RBA re-authentication method based on prior findings [START_REF] Wiefling | Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild[END_REF].

Our results show that code-based methods have the potential to significantly speed up the re-authentication process while keeping the security properties at a similar level. We also identify significant differences in the perception of the re-authentication methods and provide recommendations.

Our work helps developers and website owners decide whether they should consider alternative re-authentication methods for RBA in their use case scenarios. Researchers obtain first insights on the perception of different email-based RBA re-authentication methods.

Study

To compare different RBA re-authentication methods, we designed a betweengroup usability study based on a specifically developed website. On this website, the participants registered a user account, providing a username and password as login credentials. After registering, participants were prompted to log in. When submitting the login credentials, the participants were asked for reauthentication through an email associated with the user account. Each participant perceived one of three different re-authentication methods, depending on the three study conditions below:

(i) State of the Art (SOTA): The email had a six-digit authentication code in the body, which needed to be entered on the online service. (ii) Subject (SUBJ): The email contained the authentication code in both subject line and body, which had to be entered on the online service. (iii) Link (LINK): The email body contained an URL link, which had to be opened to confirm the authentication.

We chose these re-authentication methods based on state-of-the-art RBA deployments [START_REF] Wiefling | Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild[END_REF] and email based verification methods known from popular online services. For the evaluation, we also subdivided the devices into three combinations, which we found realistic for practical RBA use case scenarios:

(i) Desktop/Desktop: The participants used a desktop PC on the website and also checked the email with this device. (ii) Desktop/Mobile: The participants used a desktop PC on the website and checked the email with a mobile device. (iii) Mobile/Mobile: The participants used a mobile device on the website and also checked the email with this device.

We did not test Mobile/Desktop since we considered it to be an unrealistic use case scenario for RBA. We assume that most mobile devices have a preinstalled email app, making it unnecessary for users to check their email on a desktop PC while using a mobile device for the website.

Design Decisions

The dialogs and email contents for re-authentication differed in each condition. We outline the differences and design criteria in the following (see Figure 1).

State of the Art (SOTA). In previous work, we measured how RBA is used on popular online services [START_REF] Wiefling | Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild[END_REF]. We analyzed the Alexa Top 50 for RBA properties and extracted the RBA dialogs, if RBA was in use. Based on these observations on state-of-the-art RBA deployments, we designed a generic RBA dialog and confirmation email that we used in the study. We put text characteristics of dialogs and emails into categories and took the characteristics with the highest occurrences into the final dialog and email (see Figure 1a).

Subject (SUBJ). Authentication codes in the email subject line have been unknown in terms of RBA so far. However, we see potential in improving authentication speed and usability since the code is visible before opening the email, e.g., via push notifications on mobile devices. Codes in both subject line and email body are often used in email verification when registering a new user on a website. Both re-authentication dialog and email body are similar to those presented in SOTA. For the subject line, we collected account registration emails of popular online services that were using authentication codes in both subject line and body. Based on emails of LinkedIn, Facebook, and Slack, we created a generic subject line.

Link (LINK). The link re-authentication method has not been seen in the context of RBA yet. We based this method on similar methods using a link for signing in ("magic links"), used by the popular online services Tumblr, Medium, and Slack [START_REF] Van Amstel | Should we embrace magic links and leave passwords alone?[END_REF]. We adjusted the workflow for the RBA use case as follows: After entering the correct login credentials, the user received an email containing a link. The link contained a random verification string only known to the online service. We slightly changed the confirmation dialog to match the link confirmation use case (see Figure 1b). When opening this link, the user was asked to confirm the device for signing in (see Figure 2a). We based the dialog on Google's Android device confirmation dialog [START_REF]Google: Sign in faster with 2-Step Verification phone prompts[END_REF]. After the user confirmed the device, this confirmed device was signed in. If the device that confirmed the login differed from the confirmed device, e.g., mobile device in the Desktop/Mobile use case, the user was advised to check the signed in device to proceed (see Figure 2b). We did the additional confirmation to prevent that link prefetching via GET requests [START_REF] Komoroske | Prerendering in Chrome[END_REF] would cause the confirmation to be successful, i.e., we required an additional POST request to confirm the device. We tested this reauthentication method since the lack of entering a code has the potential to improve authentication speed and usability.

Attacker Models

In order to analyze our re-authentication methods in terms of usability metrics, their security properties have to be comparable with state-of-the-art deployments. Thus, we compare their online guessing security properties with three attacker models derived from known attacks on password-based authentication [START_REF] Freeman | Who Are You? A Statistical Approach to Measuring User Authenticity[END_REF].

We assume that the victim uses different passwords for the targeted online service and the email account. We also assume that the email provider blocks access to accounts after a number of wrong password entries (rate limiting). The attacker does not have physical access or eye contact with the victim's devices.

The password guesser is a weak attacker that tries to guess the password of the victim, either by using brute-force or a list of popular passwords. When guessing the victim's password correctly, attackers still need to guess the email password, making the attack rather impractical. Thus, this attacker will not be able to bypass all targeted re-authentication methods with reasonable effort.

The credential stuffing attacker is a rather strong attacker that has access to login credentials of the victim. The credentials are sourced from a password database leak of a different online service but are identical to the targeted one. Assuming that the password of the email account is not leaked, this attacker will not be able to bypass all targeted re-authentication methods.

The phishing attacker is a very strong attacker that tricks the victim to reveal the correct login credentials. The attacker sets up a website on a phishing domain imitating the appearance of the targeted online service. The degree of imitation varies from simply copying the HTML code of the targeted online service to forwarding the complete traffic between victim and online service (man in the middle, MITM). On success, attackers obtain the victim's login credentials. For MITM, attackers can even forward the entered authentication code to the online service, bypassing the re-authentication. However, attackers cannot bypass email verification links, since the phishing domain is not included in the email verification link. Thus, the link verification is conducted at the real online service. Assuming that the email password is not leaked, a phishing attacker could bypass SOTA and SUBJ but not LINK.

Study Design

We decided to conduct a two-part between-group study to compare different re-authentication methods of RBA in terms of authentication time and user perception, and to measure the behavior when perceiving this re-authentication on the website for the first time. The study consisted of two parts:

Login. First, the participants registered on the study website with username and password. The website was reachable via HTTPS via an internet domain not linked to our university to mitigate social desirability bias [START_REF] Nederhof | Methods of coping with social desirability bias: A review[END_REF]. After registering, the participants tried logging into the website. After submitting the correct login credentials, the website asked for re-authentication, which differed between the three conditions SOTA, SUBJ, and LINK.

Exit Survey. After completing the re-authentication, the participants answered a short survey. The questions were presented in random order to randomly distribute ordering effects [START_REF] Kalton | The Effect of the Question on Survey Responses[END_REF]. The order of response options were also randomized in each question to randomly distribute response order bias [START_REF] Chan | Response-Order Effects in Likert-Type Scales[END_REF][START_REF] Hartley | Some thoughts on Likert-type scales[END_REF].

In the survey, the participants stated in a free text answer the device on which they opened the identity verification email on, to determine if the device used for verification is a desktop or a mobile device. They also listed in free text answers three feelings they had when they were asked to verify their identity. This question was inspired by Golla et al. [START_REF] Golla | What was that site doing with my Facebook password?[END_REF]. We used it to discover the user perceptions of the re-authentication. The participants also answered, by ticking checkboxes, which online services they used in the last month. The list of online services included the response option MTurk as an attention check to verify the quality of our results [START_REF] Abbey | Attention by design: Using attention checks to detect inattentive respondents and improve data quality[END_REF]. The survey concluded with demographic questions.

Data Collection

To answer our research questions, we collected the following data: (i) Timing and event information: We collected timestamps of when certain events occurred on the website. We used the timestamps to calculate durations for parts of the re-authentication process. In addition, we used the recorded events to analyze the participants' behavior during re-authentication. (ii) Device information: We collected the user agent string of the device that the participant used to log in on the website. On the LINK condition, we also collected the user agent string of the device that opened the verification link. We used this information to determine the devices as mobile or desktop devices. We also used this information to verify in the LINK condition if the survey answer regarding the used device was correct. This enabled us to increase the quality of the collected data. (iii) Survey answers: We stored the survey responses digitally and analyzed them after the study.

Data Processing

After collecting the data, we processed the data as follows:

Devices. We subdivided our data set into the three different device combinations Desktop/Desktop, Desktop/Mobile, and Mobile/Mobile. We determined the device used for logging in with the recorded user agent string. Due to the different properties of the code and link-based conditions, we determined the email checking device as follows. For the code based conditions SOTA and SUBJ, we checked the corresponding free text responses given by the participants and classified them into the categories mobile or desktop device. For LINK, we also checked the user agent string of the device that clicked the link.

In the Desktop/Mobile use case, we furthermore analyzed the recorded browser events to verify the given answer of the participant. If the event log showed that the participant copied and pasted the code, which is not possible for all setups except for those using the macOS Universal Clipboard feature, we assumed that the participant gave an invalid response and filtered this response.

Times. We calculated different types of times from the timestamp information. We measured the times to find out whether one of the re-authentication methods is completed faster in parts of the re-authentication process than the other.

(i) Challenge Completion Time: We measured the time needed to complete the re-authentication challenge. In the code-based challenges (SOTA and SUBJ), the time was calculated as the timestamp differences between submitting the code and the last focus event before entering the code. We decided to take the last focus event since we needed to consider the delay between understanding the user interface and conducting the code entering action. Also, when opening the link in the LINK condition, the window is focused in that moment as well, making LINK comparable to SOTA and SUBJ. In the Desktop/Mobile case, we took the timestamp differences between submitting the code and the beginning of the code entering. Though we took a different timestamp in this case, we expect the overall time for Desktop/Mobile to be higher than for Desktop/Desktop and Mobile/Mobile anyway since the code has to be entered manually. By doing this, we aimed to ensure comparability between the code and link-based re-authentication methods in any use case scenario. (ii) Re-Authentication Duration: We also measured the time needed for the re-authentication in total. We calculated this time as the difference between finishing the re-authentication challenge and loading the identity confirmation dialog for the first time.

Feelings. From the feelings provided in the open ended question, we corrected the grammar, and converted nouns and verbs to adjectives with the WordNet [START_REF] Miller | WordNet[END_REF] database where applicable. We did this to correct misspellings and differences in tenses. We also clustered the feelings with Emolex [START_REF] Mohammad | Crowdsourcing a word-emotion association lexicon[END_REF] into the categories positive, neutral, and negative, to analyze the sentiment towards the perceived re-authentication method. This approach was similar to Golla et al. [START_REF] Golla | What was that site doing with my Facebook password?[END_REF].

Piloting

We did a pilot study with 10 participants to test and verify our study procedure. After the pilot study, we added additional measurements and slightly changed some dialogs on the website as a result of piloting. Participants involved in the pilot study were excluded from the final study to avoid bias.

Recruiting

We recruited participants via the crowdworker platform MTurk, which has shown to be applicable for usability studies involving short reactional tasks [START_REF] Kelley | Conducting Usable Privacy & Security Studies with Amazon's Mechanical Turk[END_REF]. We required the participants to be 18 years or older, and have a 95% task approval rate. The study was advertised as a website testing study that is expected to take 10 minutes. We did not mention that we test authentication schemes to avoid bias. Each participant was compensated with $1.64 after study completion.

Each participant was randomly assigned to one of the three conditions while keeping the group size of each condition as equal as possible.

Ethical Considerations

We made sure to meet the needs of the MTurk participants (clickworkers) for ethical issues and to improve our data quality. We offered the clickworkers more flexibility by increasing the task time to 24 hours since it has shown to both speeding up task completion and improving the result quality [START_REF] Yin | Running Out of Time: The Impact and Value of Flexibility in On-Demand Crowdwork[END_REF]. Rejected work on MTurk can result in clickworkers losing qualifications on the platform, affecting their monthly income. Thus, we communicated to the workers that we do not reject any work to make them feel comfortable [START_REF] Hara | A Data-Driven Analysis of Workers' Earnings on Amazon Mechanical Turk[END_REF]. We followed the paying recommendations by Hara et al. [START_REF] Hara | A Data-Driven Analysis of Workers' Earnings on Amazon Mechanical Turk[END_REF], having in mind that workers are not paid between MTurk tasks. In order for the clickworkers to make a living, we set the compensation so high that it is possible for them to earn more than the hourly minimum wage of their home country, i.e., $7.25/hr in the US. We did not collect any email addresses, as this is against MTurk's acceptable use policy. Instead, the MTurk service sent the emails out to the participants. All participants gave informed consent. All questions offered a "don't know" option.

We do not have a formal IRB process at TH Köln, where we conducted this study, but besides our ethical considerations above, we made sure to minimize potential harm by complying with the ethics code of the German Sociological Association (DGS) as well as the standards of good scientific practice of the German Research Foundation (DFG). We also made sure to comply with the terms of the EU General Data Protection Regulation.

Results

The study took place between July and October 2019 and a total of 592 users participated. 499 participants completed the study. From these participants, 48 were excluded from the set for the following reasons: (i) They copied and pasted the authentication code while stating that they used a specific Desktop/Mobile setup in which this is technically not feasible (n=19). (ii) They failed the attention check (n=13). (iii) They used a mobile device on the website and checked the email with a desktop PC, which we did not test in our study (n=11). (iv) We were unable to determine the device based on the participant's free text answer (n=5). The dropouts were similarly distributed across all conditions. At the end, we retained 451 participants for the analysis. Table 1 shows how these were distributed among the different conditions and device combinations. The participants completed the study in four minutes on median average.

Our participants were 53.6% female, 45.0% male, and 0.2% non-binary. The age of the participants ranged from 18 to 74. The majority of participants were between 25 and 34 years old (41.9%), while 11.3% were younger and 46.4% were older. The remaining percentages preferred not to answer the corresponding demographical question. The majority of participants had an associate degree or higher (62.8%) and did not have a computer science background (75.4%).

For statistical analysis of the timing data, we used Kruskal-Wallis tests for the omnibus case and Dunn's multiple comparison test with Bonferroni correction for post-hoc analysis. For categorical data, i.e., the feelings and number of login attempts, we used Pearson's chi-square test for contingency table analysis (χ 2 ). We set 0.05 as the threshold for statistical significance, i.e., p < 0.05 is significant. In the following, we outline the results ordered by the research questions given in Section 1. A discussion follows after the results of each research question.

Authentication Times (RQ1)

Challenge Completion Time. The participants completed the re-authentication challenge with median times between three and six seconds (see Figure 3). There were significant differences in some conditions and device combinations.

For Desktop/Desktop, the challenge completion time for LINK was significantly higher than those for SOTA and SUBJ (LINK/SOTA: p=0.0024; LINK/ SUBJ: p=0.0009). For Desktop/Mobile, the challenge completion time for LINK was significantly lower than for SOTA (p=0.0038). For Mobile/Mobile, there were no significant differences between all three conditions.

Completing the re-authentication challenge took significantly more time on Desktop/Mobile than on Desktop/Desktop for the code-based conditions (SOTA: p<0.0001; SUBJ: p=0.0002). For SOTA in addition, challenge completion took significantly more time on Desktop/Mobile than on Mobile/Mobile (p=0.0069). Concluding the results, link-based authentication challenges were solved faster than the code-based ones when they were not solved on the same device that they used for the login attempt. In the other cases, they were either solved slower (Desktop/Desktop) or with similar speed (Mobile/Mobile). Showing the authentication code inside the email subject did not have a significant effect on the challenge completion time.

Discussion: In contrast to SOTA and SUBJ, LINK participants had to check their device in an extra confirmation dialog and therefore loaded an additional web page, which is why we assume that they needed more time on Desktop/Desktop to complete the challenge. Since all participants on Desktop/Mobile could only manually enter the code, this explains the increased challenge completion time for the code-based challenges on this device combination.

Re-Authentication Duration. In summary for all participants, it took a median of 33.82 seconds to re-authenticate (mean: 71.89s, std: 398.22s). For the Desktop/Desktop combination (see Figure 4a), the overall re-authentication time for SUBJ was significantly lower than for LINK (p=0.0226). For all the other conditions, we could not find any significant differences.

Concluding the results, showing the authentication code inside the email subject decreased the re-authentication time compared to link-based authentication. However, it did not significantly affect the re-authentication time compared to showing the authentication code only inside the email body. Also, link-based authentication did not significantly affect the authentication time compared to the state-of-the-art code-based authentication.

Discussion: Since there were significant differences, we assume that showing the code in the subject line affected the login duration in total. Opening a link introduces a delay to load the target website. Some email providers also introduce additional delays when clicking on a link, mostly to advise their users that they are redirected to another website. As a result, participants using login links will always experience a constant delay. This explains the significantly longer login duration for LINK. We assume that the faster login duration for SUBJ with Desktop/Desktop combination lies in the fact that the participants saw the authentication code earlier and thus did not have to open the email to receive it. In summary, the email delivery and opening is the biggest factor affecting the login duration. Thus, we suggest that this email based re-authentication should not be asked too often, which is the case with RBA.

Behavior During Authentication (RQ2)

Most SUBJ and SOTA users and all LINK users passed the re-authentication challenge on the first attempt (SOTA: 95.2%, SUBJ: 98.0%, LINK: 100%). The remaining participants passed the challenge on the second attempt.

The majority of participants in the code-based conditions copied and pasted the code into the code entering form when the device combination allowed it (Desktop/Desktop: 88.1%; Mobile/Mobile: 59.1%). Concluding these results, code-based re-authentication schemes have the tendency to cause users to copy and paste the code when conducted on the same device.

Discussion: We assume that copying and pasting the code was the main reason why the code-based challenges were solved faster than the link-based challenges when solved on the same device. Our results reflect findings of Doerfler et al. [START_REF] Doerfler | Evaluating Login Challenges as a Defense Against Account Takeover[END_REF] regarding a high success rate for email-based re-authentication.

Perceptions (RQ3)

All participants listed three feelings they had after they were asked to verify their identity. Figure 5 shows the 25 most mentioned feelings ordered by the number of occurrences. The re-authentication methods resulted in mixed emotions. While there was no clear tendency for positive or negative feelings in SOTA and LINK, the top 25 feelings in SUBJ were more negative. The feelings security and annoying were the most mentioned ones in all three conditions. We discovered significant differences between the three conditions for anxious, nervous and neutral (see Table 2). The other feelings were mentioned in similar occurrences across all categories. The most mentioned positive feelings were curiosity, happy, safe, calm, and good. For the neutral direction, these were security, concerned, relaxed, substitute, and accept. The most mentioned negative feelings were annoying, confuse, nervous, anxious, and worried. (c) LINK Fig. 5. Feelings the participants had when asked to verify their identity Discussion: Due to phishing awareness campaigns and trainings, users are trained not to open links in emails [START_REF] Sheng | Who falls for phish?: a demographic analysis of phishing susceptibility and effectiveness of interventions[END_REF]. Being asked to click on a link in an email for authentication contradicts the trained behavior, resulting in an insecure feeling. We assume that this explains why participants named the anxious feeling significantly more often in LINK. However, it is possible that this anxious feeling declines when repeating the link-based re-authentication procedure multiple times [START_REF] Zajonc | Attitudinal effects of mere exposure[END_REF]. There are differences between re-authentication emails and phishing emails that support this assumption. First, the website accessed by the link does not require login credentials. Second, we assume that users expect this re-authentication email to appear in their email inbox shortly.

SUBJ participants did not need to open the email to get the authentication code. SOTA and LINK participants had to open an email whose contents they had never seen before, i.e., the code or link. We assume that this is why SUBJ participants named a nervous feeling less often than those of SOTA and LINK.

Limitations

The results are limited to a part of a population of a specific country. We assume that the self-reported answers were typical for participants from the US with college education that are younger than 50 years [START_REF] Redmiles | How well do my results generalize?[END_REF]. Due to the restrictions of MTurk, we could only test email address verification for plain text emails. It is possible that HTML emails are perceived differently by participants [START_REF] Karakasiliotis | Assessing end-user awareness of social engineering and phishing[END_REF].

Since the participants were only authenticating once, we assume that they expected the re-authentication for every login attempt when reporting the feelings. Following that, we assume that the results were more related to 2FA than for RBA. Since users tend to disable re-authentication when asked too often [START_REF] Crawford | Understanding user perceptions of transparent authentication on a mobile device[END_REF], we assume that the feelings results would be more positive in the real world.

Related Work

RBA re-authentication challenges were not evaluated in literature so far. There are related studies evaluating other authentication methods. De Cristofaro et al. [START_REF] De Cristofaro | A Comparative Usability Study of Two-Factor Authentication[END_REF] compared three 2FA solutions with a study involving MTurk participants. In contrast to our study, their participants were not exposed to RBA solutions. Agarwal et al. [START_REF] Agarwal | Ask Me Again But Don't Annoy Me: Evaluating Re-authentication Strategies for Smartphones[END_REF] evaluated four re-authentication methods for smartphones. Similar to our study, they introduced new re-authentication methods and exposed their participants to them. However, these re-authentication methods were only applicable for mobile apps and thus were not suitable for RBA in general. Doerfler et al. [START_REF] Doerfler | Evaluating Login Challenges as a Defense Against Account Takeover[END_REF] evaluated the effectiveness of Google's re-authentication challenges by analyzing login attempt data. Their results showed that code-based re-authentication protected against more than 90% of all phishing attempts. Although this shows the effectiveness of RBA against phishing, no usability metrics are examined in their work that study its characteristic and potentials.

Conclusion

As long as online services continue to use password-based authentication, RBA is becoming increasingly important as a complementary protection measure. This is further underlined by the fact that RBA is explicitly recommended by NIST [START_REF] Grassi | Digital identity guidelines[END_REF]. However, there is little scientific research focused on RBA so far. Its development is mainly driven by online services that already use RBA. Since these are popular online services, they have a major impact on the state-of-the-art deployment as can be derived from the single re-authentication method. No scientific evaluation indicates that this is the most appropriate approach to use for implementation.

Our study closes this gap and compares the state-of-the-art email-based RBA re-authentication method with two introduced alternatives regarding their time exposure, security, and user-perceived security. Our results indicate that linkbased re-authentication results in higher time requirements and anxiety when perceived for the first time. Code-based re-authentication has proven to be more advantageous in this respect. More specifically, showing the authentication code in the subject line has the potential to reduce re-authentication time with perceptions comparable to the state-of-the-art deployment. Following that, website owners should carefully adjust their RBA re-authentication design to be appropriate for their applications. In general, our research suggests that further research should study RBA more consistently so that all services can benefit from reliable scientific results while hardening password authentication with RBA.

  RQ1: a) How does link-based re-authentication affect the authentication time compared to the state-of-the-art with code-based re-authentication? b) How does showing the authentication code inside the email subject line and body affect the authentication time compared to showing the authentication code only inside the email body? RQ2: a) Does the re-authentication method (e.g., code or link-based) affect the user behavior? b) Do the devices used for re-authentication (e.g., desktop or mobile) affect the user behavior? RQ3: How do users perceive different re-authentication methods?

Fig. 1 .Fig. 2 .

 12 Fig. 1. Presented dialog types for the different study conditions

Fig. 3 .Fig. 4 .

 34 Fig. 3. Challenge completion times for the conditions and device combinations. There are significant differences in Desktop/Desktop and Desktop/Mobile.

Table 1 .

 1 Number of participants in each condition and device use case scenario

	Website/Email	SOTA SUBJ LINK
	Desktop/Desktop 67	67	72
	Desktop/Mobile	50	45	48
	Mobile/Mobile	30	36	36

Table 2 .

 2 Significant χ 2 results for the mentioned feelings in each condition and the percentage of mentions in each condition.

	Feeling	χ 2	p SOTA SUBJ LINK
	anxious 7.8053 0.0202	7.5% 6.8% 15.4%
	nervous 6.9677 0.0307 15.6% 6.1% 10.9%
	neutral 6.6667 0.0357	4.1% 0.7% 0.6%

Acknowledgments. This research was supported by NERD.NRW sponsored by the state of North Rhine-Westphalia. The research was also supported by a RISE Germany scholarship granted by the German Academic Exchange Service (DAAD) and sponsored by the German Federal Foreign Office.


A Resmini
email: andrea.resmini@onera.fr

J Peter

D Lucor

Mono-block and non-matching multi-block structured mesh adaptation based on aerodynamic functional total derivatives for RANS flow

Keywords: mesh, adaptation, adjoint, RANS, airfoil, wing

An enhanced goal-oriented mesh adaptation method is presented based on aerodynamic functional total derivatives with respect to mesh nodes in a Reynolds-Averaged Navier-Stokes (RANS) finite-volume monoblock and non-matching multi-block-structured grid framework. This method falls under the category of methods involving the adjoint vector of the function of interest. The contribution of a Spalart-Allmaras turbulence model is taken into account through its linearization. Meshes are adapted accordingly to the proposed indicator. Applications to 2D RANS flow about a RAE2822 airfoil in transonic, and detached subsonic conditions are presented for the drag coefficient estimation. The asset of the proposed method is patent. The obtained 2D anisotropic mono-block mesh well captures flow features as well as global aerodynamic functionals. Interestingly, the constraints imposed by structured grids may be relaxed by the use of non-matching multi-block approach that limits the outward propagation of local mesh refinement through all of the computational domain. The proposed method also leads to accurate results for these multi-block meshes but at a fraction of the cost. Finally, the method is also successfully applied to a more complex geometry, namely, a mono-block mesh in a 3D RANS transonic flow about an M6 wing.

INTRODUCTION

The extensive use of computational fluid dynamics (CFD) models and resources in the aeronautical community has required the need of accurate predictions. The verification and validation process is then of primary importance. The validation approach of a CFD code with respect to (w.r.t.) experimental data must take into account the estimation of the discretization error [START_REF] Oberkampf | Issues in computational fluid dynamics code verification and validation[END_REF], modeling error, and the impact of parameters uncertainty [START_REF] Roache | Quantification of uncertainty in computational fluid dynamics[END_REF][START_REF] Resmini | Sparse grids-based stochastic approximations with applications to aerodynamics sensitivity analysis[END_REF]. This study is focused on the discretization error and more precisely on the accuracy of the output functionals. Often, only some quantities of interest (QoI), for example, forces and moments, rather than the overall flow-field, are scrutinized in aerodynamic simulations. In this framework, the development of goal-oriented mesh adaptation techniques has seen a rapid growth since the mid 1990s. Most of the time, these methods involve the adjoint vector of the QoI.

Successful theory of a posteriori error and goal-oriented mesh adaptation has been developed in the finite-element framework. Important contributions have been given by Johnson et al. [START_REF] Johnson | Numerics and hydrodynamics theory: towards error control in CFD[END_REF][START_REF] Becker | Weighted a posteriori error control in FE methods[END_REF][START_REF] Becker | An optimal control approach to a posteriori error estimation in finite element methods[END_REF],

Giles et al. [START_REF] Giles | Adaptative error control for finite element approximation of lift and drag coefficient in viscous flow[END_REF], Prudhomme et al. [START_REF] Prudhomme | On goal oriented error estimation for elliptic problems: application to the control of pointwise error[END_REF], Larson and Barth [START_REF] Larson | A posteriori error estimation for discontinuous Galerkin approximation of hyperbolic systems[END_REF], Machiels et al. [START_REF] Machiels | A posteriori finite element output bounds for the incompressible Navier-Stokes equations. Application to a natural convection problem[END_REF], Hartman et al. [START_REF] Hartmann | Adaptative discontinuous Galerkin methods for the compressible Euler equations[END_REF][START_REF] Leicht | Error estimation and anisotropic mesh refinement for 3D laminar aerodynamic flow simulations[END_REF][START_REF] Hartmann | Adjoint-based error estimation and adaptative mesh refinement for the RANS and (k-!) turbulence model equations[END_REF], and Alauzet et al. [START_REF] Loseille | Fully anisotropic goal-oriented mesh adaptation for 3D steady Euler equations[END_REF]. Concerning finite volume, the major reference is the Venditti and Darmofal method [START_REF] Venditti | Adjoint error estimation and grid adaptation for functional outputs: application to quasione-dimensional flow[END_REF][START_REF] Venditti | Grid adaptation for functional outputs: application to two-dimensional inviscid flow[END_REF][START_REF] Venditti | Anisotropic grid adaptation for functional outputs: application to two-dimensional viscous flow[END_REF]. A list of main applications involving the latter method can be found in [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF].

The present paper presents an enhanced goal-oriented mesh adaptation method based on aerodynamic functional total derivatives w.r.t. mesh nodal coordinates in a finite-volume-structured grid framework for RANS flow. The method principles have been already introduced by Peter et al. [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF] and Nguyen-Dinh et al. [START_REF] Nguyen-Dinh | Mesh quality assessment based on aerodynamic functional output total derivatives[END_REF] with applications to Euler flows. In contrast to the Venditti and Darmofal method that requires two levels of meshes, the proposed method is based on a scalar indicator for one mesh level only. The use of only one mesh level is quite rare in literature; nevertheless, it is possible to notice the contribution of Dwight [START_REF] Dwight | Goal-oriented mesh adaptation using a dissipation based error indicator[END_REF][START_REF] Dwight | Heuristic a posteriori estimation of error due to dissipation in finite volume schemes and application to mesh adaptation[END_REF] where only one mesh level is needed but limited to the classical Jameson et al. numerical scheme [START_REF] Jameson | Numerical solution of the Euler equations by finite volume methods using Runge-Kutta time stepping schemes[END_REF].

Using the proposed method, this paper's objectives are twofold: to properly adapt the mesh taking into account the precious information coming from the complete linearization of the complete Navier-Stokes equations and to show the flexibility of the approach in engineering applications where non-traditional mesh configurations may be used. In this context, adaptations are carried out on standard mono-block-structured grid (2D and 3D RANS flows) as well as on non-matching ‡ multi-block-structured mesh (2D RANS flows). The latter kind of adaptations are uncommon in literature, while their use seems quite natural for complex geometry configuration in the presence of structured mesh. A structured grid may be disadvantageous w.r.t. an unstructured one in terms of the number of nodes (a local refinement spreads through the entire computational domain) and in terms of mesh design flexibility (a structured mesh with well defined quadrilateral elements is hardly compatible with complex configurations). Nevertheless, from a numerical point view, they turn out to be algorithmically efficient because of their simple addressing approach based on regular connectivity, that is, through only two (or three) indices for 2D case (or 3D case). The use of non-matching multi-block meshes alleviates the constraints given by structured mesh. An example of this is shown.

The paper is organized as follows. Section 2 recalls the proposed method and defines the refinement indicator. Section 3 describes the numerical setup used as well as the method verification and the used meshes, while in Section 4, applications to 2D RANS flow about a RAE2822 airfoil in transonic and detached subsonic conditions for the drag coefficient estimation are presented. 3D RANS transonic flow application is shown in Section 5. Conclusions and perspectives are given in Section 6.

PROJECTED TOTAL DERIVATIVE OF THE FUNCTIONAL OUTPUT WITH RESPECT TO MESH NODAL COORDINATES

In this section, the proposed method based on the projected total derivative of the functional output w.r.t. mesh nodes is detailed. The derivation follows the papers of Peter et al. [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF] and Nguyen-Dinh et al. [START_REF] Nguyen-Dinh | Mesh quality assessment based on aerodynamic functional output total derivatives[END_REF]. The refinement indicator is presented as well.

The discrete adjoint method for gradients computation

Given an aerodynamic object where the geometry is subject to N l shape parameters ˛l , l 2 OE1; N l , it is denoted by J m , m 2 OE1; N J and the N J objective/constraints functions that need to be differentiated in a gradient-based optimization framework. Concerning the numerical scheme, the discretization of the Navier-Stokes equations leads to a nonlinear equations system defined by the following:

R.W ; X / D 0; (1)
where R represents the discrete residual vector on each cell, W is the steady flow solution, and X defines the mesh coordinates. In order to compute first-order derivatives, it is assumed that 1. X is C 1 regular, function of ˛l ; 2. R is C 1 regular w.r.t. its two vector arguments; and 3. detOE@R=@W .W ; X / ¤ 0 where R.W ; X / D 0.

In this framework, the implicit function theorem ensures that W .˛l / is a C 1 regular function of ˛l . The objective/constraints functions read as follows:

J m .˛l / D J m .W .˛l /; X .˛l //: (2)
In the discrete adjoint method scheme, in order to compute the derivative of the function J m .˛l / w.r.t. ˛l , a Lagrangian functional is introduced:

L m .W ; X ; ƒ m / D J m .W ; X / C ƒ T m R.W ; X /; (3)
where ƒ m is the Lagrange multiplier (or adjoint vector) for the objective function J m . Given the aforementioned hypothesis, it is possible to define the aerodynamic function J m as a function of the mesh only, that is, J m .X .˛l // D J m .W .X .˛l //; X .˛l //. The Lagrange multiplier is then the solution of d L m =d W D 0:

ƒ T m @R @W D @J m @W : (4)
The right-hand side of ( 4) is computed through analytical differentiation, while the Jacobian matrix in the left-hand side is built at steady solution. The derivative of objective functions is then given by the following:

d J m d˛l D d L m d˛l D @J m @X d X d˛l C ƒ T m @R @X d X d˛l D @J m @X C ƒ T m @R @X d X d˛l : (5)
Between the previous parenthesis, it is possible to identify the following:

dJ m d X D @J m @X C ƒ T m @R @X ; (6)
where the first term (@J m =@X ) represents the direct dependency of J m to the mesh nodes location and the second term (ƒ T m .@R=@X )) corresponds to the flow field modification on the support of J m because of a change of mesh nodes location.

In order to avoid the storage of the mesh sensitivity w.r.t. design variables, Nielsen and Park [23] used the implicit, D.X ; S / D 0,orexplicit, X D X .S /, dependence between X and S , where the latter is the surface mesh. In the first case, the equations read as follows:

ƒ T m @R @W D @J m @W ; (7)
T @D @X D @J m @X C ƒ T m @R @X D dJ m d X ; (8)
d J m d˛l D T @D @S d S d˛l ; (9)
while for an explicit dependence, the following equations replace Equation ( 5):

ƒ T m @R @W D @J m @W ; (10)
d J m d˛l D dJ m d X d X d S d S d˛l : (11)
Therefore, the dJ m =d X terms are the standard outputs of a modular memory-efficient adjoint solver where the complex parametrization (i.e., d X =d˛l ) is not addressed anymore. The proposed goal-oriented method is based on this quantity.

Derivation of the Spalart-Allmaras turbulence model

In this paper, the Spalart-Allmaras (SA) turbulence model [START_REF] Spalart | A one-equation turbulence model for aerodynamic flows[END_REF] is considered. Namely, the sixth steady RANS equation already coupled with SA reads as follows:

I @V Q U T 1 . C Q /rQ T ndS Z V SdV D 0; (12)
where is the density, U D .u;v;w/ T the velocity vector, § and Q the kinematic turbulent viscosity that is defined by the turbulence model, in this case SA. V is the cell volume, and the unit normal vector to @V is denoted by n. S is the source term composed of a production P, destruction D, and cross-diffusion C terms. As mentioned earlier, the analytical differentiation of R w.r.t. flowfield (W ) and metric (X ) terms needs to be undergone. It is possible either to differentiate only the five mean flow equations without differentiating the turbulent dynamic viscosity T , that is, (12) (frozen T assumption, N T ), or to fully differentiate the equations system including the turbulence model ( lin T ). The convection term is discretized using first-order Roe's flux. The discrete diffusion term is based on cell-centered gradient of Q

. The gradients at two adjacent cells are averaged at the common interface and corrected in the direction linking the two cells' centers, from Q cell values in order to have a short stencil in the considered direction. Discrete P, D,andC terms are calculated from cell-centered values and gradients. It is then needed to derive these schemes w.r.t. discrete flowfield (Equation ( 5)) and mesh nodes coordinates (Equation ( 6)).

The refinement indicator

The dJ =d X ¶ field provides valuable information about the sensitivity of J w.r.t. the mesh coordinates X . Considering the following first-order Taylor expansion:

J.X C d X i;j / J.X / C dJ d X i;j d X i;j ; (13)
the first-order effect on J due to an isolated move of a node X i;j || in the polygon defined by the neighboring nodes is linked to the sensitivity dJ =d X i;j . The latter is true for a displacement d X i;j -for Euler flows, please refer to Section 5 in [START_REF] Todarello | Finite-volume goal-oriented mesh adaptation for aerodynamics using functional derivative with respect to nodal coordinates[END_REF]. This relation suggests that the objective function J is highly sensitive to the X i;j node if dJ =d X i;j is large ** and the distance of node X i;j to the closest neighboring node (denoted as h i;j ) is significant. A refinement in that node location is then needed.

Some cautions need to be made about the obtained dJ =d X field. In particular, it will be projected according to the mesh node location. Namely, P.dJ =d X / D dJ =d X .dJ =d X n/ n if the node is on the support † † of J , walls, farfield (or mesh block) borders; P.dJ =d X / D 0 if the node is on a § The superscript T defined the transpose operator while the subscript T the turbulent component.

¶ The pedices m and l drop for the sake of brevity. || For structured grid, .i; j / indices uniquely identify a mesh node. ** In this framework, there is no quantitative link between .i;j/ and its effect on J .Thetermlarge is always w.r.t the ensemble of all .i;j/ for a given W and X . This justifies the use of the term indicator instead of estimator. † † In the current paper applications, the support of J ,w h e r eJ is a global aerodynamic function, is typically the airfoil surface.

corner of the support of J or on a corner of farfield (or mesh block) domain, while P.dJ =d X / D dJ =d X elsewhere. In this paper, the -criterion introduced by Peter et al. [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF] and Nguyen-Dinh et al. [START_REF] Nguyen-Dinh | Mesh quality assessment based on aerodynamic functional output total derivatives[END_REF] will be exploited. This indicator follows directly from the second term of the right-hand side of relation [START_REF] Hartmann | Adjoint-based error estimation and adaptative mesh refinement for the RANS and (k-!) turbulence model equations[END_REF], and it reads as follows:

.i;j/ D P dJ d X

h i;j 2 : (14)
The presence of h i;j in the refinement indicator is important in situations where large vector of P .dJ =d X / is encountered in a mesh that is already fine. In this case, it is not possible to perform a mesh refinement by either adding or moving the nodes. The comparison of the results obtained with the -(the -criterion without h i;j ) and the -criteria has been already performed for Euler flows by Peter et al. [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF]. has been identified as the correct indicator for mesh adaptation.

Venditti and Darmofal method.

The classical goal-oriented error-based approach for finitevolume schemes has been introduced by Venditti and Darmofal. The error expression given by Venditti et al. in equation ( 12) of their article [START_REF] Venditti | Grid adaptation for functional outputs: application to two-dimensional inviscid flow[END_REF] is reported here after:

J h .W h / ' J h W H h C ƒ H h T R h W H h " ƒ' … Computable Correction C R ƒ h ƒ H h T 2 4 @R h @W h ˇW H h 3 5 1 R h W H h ; " ƒ' …
error in computable correction [START_REF] Venditti | Adjoint error estimation and grid adaptation for functional outputs: application to quasione-dimensional flow[END_REF] where H and h are the characteristic mesh size of the coarse and fine grids, respectively, and R ƒ h is the adjoint residual operator. In this framework, the improved functional evaluation consists in the first two terms of the right-hand side of relation ( 15) and the refinement strategy is to reduce the error in computable correction (ECC).

Previous studies for Euler flows have shown good consistency between the refinement zones detected by the -criterion and the ECC of the classic error-based method; please refer to Section 2.8 in [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF] and to Appendix B in [START_REF] Todarello | Finite-volume goal-oriented mesh adaptation for aerodynamics using functional derivative with respect to nodal coordinates[END_REF]. This comparison is also given for a 2D transonic turbulent flow in Section 4.4.1.

NUMERICAL SETUP

The elsA code

The ONERA Navier-Stokes finite-volume compressible elsA [START_REF] Cambier | The ONERA elsA CFD software: input from research and feedback from industry[END_REF] solver has been used. The numerical scheme is based on Roe flux using a second-order MUSCL scheme (van Albada limiter) for the convective term while first-order Roe flux for the turbulent flow. The viscous fluxes of the averaged and turbulent flows are discretized through a centered scheme with cell-centered gradients corrected at the cell faces. The turbulence closure is assured by the SA turbulence model [START_REF] Spalart | A one-equation turbulence model for aerodynamic flows[END_REF].

Non-matching structured meshes.

The elsA code mainly deals with structured meshes. This kind of grids clearly shows some limitations in the case of complex geometry and generally results in a high number of nodes needed w.r.t. unstructured meshes. In order to alleviate the latter drawback, elsA can handle domain decomposition with discrete meshes that do not have match at their common interface. Thanks to this capability, non-matching joint between the different structured mesh blocks limits the spread of the local mesh refinement through the entire computational domain. The interface between the different domains may be straight or curved. In the first case, the conservation property is ensured, while in the second case, this approach is quasi-conservative [START_REF] Fillola | Numerical simulations around wing control surfaces[END_REF]. In the examples given in Section 4, the non-matching multi-block strategy limits the local refinement along the i -direction over all of the domain by splitting the mesh in three concentric O-meshes. Despite this flexibility, the optimality of the domain decomposition choice remains an open question. Comparison of the derivative of C D w.r.t shape parameters obtained from FD and discrete adjoint method (AdjParam) with both frozen ( N T ) and linearized T ( lin T /. Comparison of the derivative obtained through the derivation of C D w.r.t mesh nodes is also given (AdjMesh). FD, finite differences.

Verification

A test case on a OAT15A airfoil has been recently performed [START_REF] El Din | PR ADER -Rapport d'avancement[END_REF] in order to assess the contribution of the turbulence model derivation. The following results are representative of the actual accuracy of the elsA adjoint [START_REF] Peter | Discrete adjoint method for shape optimization and mesh adaptation in the elsa code[END_REF]. The flow is at Ma D 0:73, Re D 13 10 6 with AoA D 1:5 ı . Three shape parameters have been considered: angle of incidence, thickness through an affinity operator in the thickness coordinates, and camber through a local modification of the camber line.

Recalling Equation ( 5), in the elsA implementation, the d J m =d˛l may be computed in two fashions:

d J m d˛l AdjParam D @J m @X d X d˛l C ƒ T m @R @X d X d˛l ; (16)
d J m d˛l AdjMesh D dJ m d X d X d˛l ; (17)
where d X =d˛l is computed through finite differences in both cases. Table I shows the results of dC D =d˛l given by finite differences, AdjParam (for both N T and lin T ), and AdjMesh (only for lin T ) for the three shape parameters. It is possible to identify three main patterns:

1. As expected, the results given by AdjParam and AdjMesh with lin

T agree very well one to each other. 2. The linearization of the turbulence model leads to a significant improvement of the sensitivity estimation; namely, the error is two-third less for the rotation case and halved for the other two cases. 3. The adjoint module of elsA behaves very well for global shape parameters, for example, rotation. Some issues rise for local shape modifications.

The adjoint elsA has some approximations on farfield boundaries and walls. Matching and nonmatching joins pose limit to the adjoint precision because of ghost cells construction in the direct computation ‡ ‡ . It is recalled that because a linear system needs to be solved, local errors in the adjoint derivation spread over the domain and impact the final solution. Nevertheless, the adjoint elsA is able to capture the correct QoI sensitivity trend in a wide range of applications, for example, Euler, RANS, 2D and 3D, full aircraft configuration, and matching and non-matching mesh.

APPLICATION TO 2D RANS FLOW ABOUT A RAE2822 AIRFOIL

The proposed mesh adaptation technique is applied to a 2D RANS flow about a RAE2822 airfoil at two different operational conditions: a transonic condition that corresponds to case 6 of ‡ ‡ Two raw of ghost cells in the direct computation would need 3 raw of ghost cells in the adjoint one for Roe-MUSCL flux.

Cook et al. [START_REF] Cook | Aerofoil RAE 2822 -pressure distributions, boundary layer and wake measurements[END_REF] equally used by Venditti et al. [START_REF] Venditti | Anisotropic grid adaptation for functional outputs: application to two-dimensional viscous flow[END_REF] and a detached subsonic condition derived from the latter by keeping the same Reynolds to Mach number ratio as in helicopter rotor operational condition. The efficiency of the proposed method is tested over a mono-block mesh as well as on a non-matching multi-block configuration. Refinement based on the functional C D is considered which estimation is in general harder than the C L one. For the C D -based adapted mesh, the C L value is also given for the sake of completeness. The considered tolerance is equal to 0.0005, that is, five drag counts. This value is in line with Li et al. [START_REF] Li | Adjoint-based airfoil optimization with discretization error control[END_REF]. Higher [START_REF] Fraysse | Comparison of mesh adaptation using the adjoint methodology and truncation error estimates[END_REF][START_REF] Hartman | Error estimation and adaptive mesh refinement for aerodynamic flows[END_REF] and lower [START_REF] Venditti | Anisotropic grid adaptation for functional outputs: application to two-dimensional viscous flow[END_REF] tolerances are also considered in literature.

Mesh characteristics

For all applications in this section, structured O-meshes have been used where the index i runs clockwise along the airfoil from the trailing edge, while j goes from the airfoil wall to the farfield boundary. The circular farfield boundary is placed at 150 chords from the airfoil leading edge. The hierarchy of NACA0012 meshes from Vassberg et al. [START_REF] Vassberg | In pursuit of grid convergence, Part I: two-dimensional Euler solution[END_REF] has been modified for a RAE2822 airfoil. Moreover, they have been adapted for RANS flows by adding a boundary layer (BL) growth in j direction. The number of mesh nodes in the BL can be imposed where the BL height is computed by using the estimation of the turbulent BL over a flat plate through the one-seventh-power law. The first cell height h 0 is fixed but differs in the two operational conditions in order to have y C lower than 1 in both cases. The cell height h in j direction is given by h j C1 D .h j /p where p varies as 1<p<1:1based on the number of nodes in j , N j .

Concerning the non-matching multi-block configuration, the original mono-block mesh has been split in three concentric O-meshes. In many engineering applications, the surface mesh refinement is constrained or needs special care. In this context, it has been decided to test the proposed method in the case where the first block mesh (which contains the airfoil) is frozen through all the adaptation procedure. This block is uniformly refined in i with 401 nodes with 40 nodes in the BL (Figure 1(a)). For the two operational conditions, the first block dimension (in j direction) varies. In the subsonic case, it has been enlarged in order to ensure that the recirculation bubble is fully included in the first block. The second and third blocks are adapted following the -criterion. The cell height growth is conserved through the fixed block interfaces.

Refinement procedure.

The refinement is carried out by adding lines in both directions i and j . The new mesh is interpolated in the reference fine grid with a number of nodes N i D N j D 2049. The nodes position is defined through the following interpolation operators and B:

¹1; N i º¹1; N j º ! OE1; 2049OE1; 2049 B ! R 2 : (18)
In order to add lines in the current mesh, a criterion is introduced based on the -criterion ( 14). For the sake of brevity, only the i direction is considered. Introducing N c as

N c iC 1 2 D c i C c i C1 2 where c i D 1 N j v u u u t N j X j D1 2 ; (19)
the method consists in adding a number of lines at i C 1 2 , which is proportional to N c i C 1 2 value. A maximum number equals to 4 is retained for each i C 1 2 location. In the particular case of i direction, the mesh lines (cell widths) are regularized in order to ensure a smooth nodes location § § . An explicit third-order dissipation flux is used. The cell widths are obtained through n C 1 iterations through the relation

nC1 i C 1 2 D n iC 1 2 C D 4 i C1 D 4 i where D 4 i D k 4 . iC 3 2 3 i C 1 2 C 3 i 1 2 i 3 2
/.These fluxesaresetto0ati equals 1 and N i , while

1 2 D 3 2 ,and N i C 1 2 D N i 1 2 .

Transonic flow

As mentioned earlier, a transonic condition is retained as in Section 6.2.1 of the paper of Venditti et al. [START_REF] Venditti | Anisotropic grid adaptation for functional outputs: application to two-dimensional viscous flow[END_REF]. The flow is at Reynolds number equals to 6.5 10 6 and Mach number at 0.725 with AoA D 2:466 ı . A shock wave appears at the pressure side at x=C 0:55 where C is the chord.

The starting mesh is the same for the standard base refinement (i.e., by doubling N i;j at each step) and for the C D -based mono-block adaptation, namely, with N i D N j D 51 uniformly distributed in i direction and N BL D 10. Concerning the multi-block adaptation, the first block is frozen and uniformly refined in i with 401 nodes with 40 nodes in the BL as mentioned in Section 4.1. This first block has been extracted from the second last base mesh of the black curve in Figure 2. The remaining blocks have N i D 101.TheC D convergence is plotted in Figure 2 where the asset given by the proposed method is patent for the mono-block adaptation w.r.t. the standard refinement. The method equally managed to refine the non-matching multi-block case where the physical shock crosses the § § For j direction, there is no need for a smoothing operator because the cell height h follows the aforementioned rule from the wall to the farfield boundary.

non-matching interface between blocks 1 and 2. The limit values may be found in Table II. For both kind of meshes, the C D estimation error is under four drag counts. A very good agreement also between numerical results and experiments is proved. The underestimation of C D is visible also in figure 8 (right) of the paper of Venditti et al. [START_REF] Venditti | Anisotropic grid adaptation for functional outputs: application to two-dimensional viscous flow[END_REF] through the Allmaras's computation. The C L values show excellent agreement one to each other. The nodes saving for the mono-block case are of the order of 75% w.r.t. the second last base mesh. While concerning the multi-block case, please note that almost 19,000 nodes out of 39,500 are imposed by the frozen first block. The precision scatter between the results of the mono-block and multi-block meshes may be explained by the quasi-conservative approach at high curvature interfaces (e.g., leading edge) between the two non-matching blocks, as mentioned in Section 3.1.1.

Subsonic detached flow

For the subsonic detached case, the operational condition has been derived from the transonic one by keeping the same Reynolds to Mach number ratio as in helicopter rotor operational condition. Namely, the flow is at Reynolds number equals to 2.7 10 6 and Mach number at 0.3 with AoA D 11 ı . The converged flow exhibits a trailing edge separation bubble at x=C > 0:9.

Figure 3 shows the C D convergence. The starting mesh is equal to the one used for the transonic case except for the first cell height h 0 and the physical size of the first block in the case of multiblock refinement as mentioned in Section 4.1. This justifies the different starting point in terms of number of nodes of the blue curves in Figures 2 and3. Also in this case, the proposed method well behaved w.r.t. the standard base refinement. In Table III, the limit values are reported. The C D estimation error is also in this case of maximum three drag counts while of 0 drag count for the mono-block case. The C L values are also all coherent. The nodes saving for the mono-block case are of the order of 82% w.r.t. the second last base mesh. For the multi-block mesh, almost 24,000 nodes out of 45,000 are imposed by the frozen first block.

Analysis of the obtained mesh pattern

In order to deepen the analysis of the proposed method and of the results, it is interesting to get a closer look to the obtained anisotropic C D -based adapted meshes as well as to the values of thecriterion. This analysis is carried out only for the mono-block case for the sake of brevity. The same considerations apply to the multi-block case.

Figure 4 shows the starting mesh as well as the C D -based adapted ones for both operational conditions. The image layout is similar to the one of figure 9 of the paper of Venditti et al. [START_REF] Venditti | Anisotropic grid adaptation for functional outputs: application to two-dimensional viscous flow[END_REF], which allows a straightforward comparison between the obtained meshes. Taking into account the intrinsic construction differences between structured and unstructured grids, in the transonic case (b), similar areas are highlighted, namely, the upstream flow region (typical for adjoint-based adaptation), the wake, the shock region at x=C 0:55, and leading and trailing edge. In structured mono-block grid, it is clear that these local refinements are convected through all the computational domain. For the subsonic case (c), refinement is performed in the upstream flow region, separation region at x=C > 0:8, wake, and leading and trailing edge.

In Figure 5, the starting mesh and the C D -based adapted ones for both operational conditions for the multi-block case are shown. The block interfaces are depicted in green. The same area highlighted in Figure 4 is visible here. In this case, the use of non-matching multi-block approach limits the convection of these refinements to the farfield boundaries. For the upstream flow region, the refinement crosses the interfaces and equally for the wake region but in a lightly fashion.

The Mach iso-contours are given in Figures 678for the starting mesh as well as for the finest mesh of the standard base refinement and for the C D -based adapted meshes for both operational conditions. Good agreement is proved between Figure 7(a) with Figure 8(a) and Figure 7(b) with Figure 8(b). Please note the poor initial estimation of the flow for the starting meshes (Figure 6).

The -criterion and comparison with the Venditti and Darmofal indicator.

The -criterion for the mono-block transonic case adaptation is shown in Figure 9 for all adaptation steps. It is possible to notice the progressive reduction of the values as well as the crucial zones for this operational condition, for example, region of the flow upstream, the airfoil, and the wake and the shock regions at x=C 0:55. Please note that the relation ( 14) that defines depends both on the local mesh size through r i;j a n da l s oo nt h edJ =d X. For this reason, m a ya l s ov a r yi nr e g i o n s where no mesh refinement has been performed, for example, pressure side in Figure 9(e)-(f).

A comparison between the refinement zones detected by the -criterion (Figure 9) and by the ECC of the classic error-based method (Figure 10) has been performed on the six meshes of the -based adaptation. As expected, the two different indicators highlight the same zones, namely, the wake, the zone upwind the profile, and the shock regions. Please refer to previous studies [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF][START_REF] Todarello | Finite-volume goal-oriented mesh adaptation for aerodynamics using functional derivative with respect to nodal coordinates[END_REF] where the use of the more flexible unstructured grid allows to properly appreciate the agreement between the two approaches.

APPLICATION TO 3D RANS FLOW ABOUT AN M6 WING

In this section, a tri-dimensional application is presented. In this context, the proposed mesh adaptation technique is expected to reduce the mesh nodes needed for a proper estimation of the global aerodynamic functions. Nevertheless, the growth of mesh nodes due to the spread through the entire computational domain following a local refinement is expected to be stronger than in 2D case. The adaptation is carried out for 3D RANS transonic flow about an ONERA M6 wing [START_REF] Schmitt | Pressure distributions on the ONERA-M6-wing at transonic Mach numbers. Experimental data base for computer program assessment[END_REF]. The wing is symmetric w.r.t. ´D 0. The most common flow condition used for CFD simulations corresponds to the test number 2308 of [START_REF] Schmitt | Pressure distributions on the ONERA-M6-wing at transonic Mach numbers. Experimental data base for computer program assessment[END_REF]. The efficiency of the proposed method is tested over a mono-block mesh configuration. As in Section 4, refinement based on the functional C D is considered with the same convergence tolerance, namely, 0.0005. . Thus, all i -mesh planes are identified by the vector i , similarly by vector j and k for all j -mesh and k-mesh planes. The interpolated mesh is then uniquely identified by the three vectors i , j ,and k with dimension N i , N j ,andN k , respectively.

Mesh characteristics and refinement

Transonic flow

As mentioned earlier, a transonic condition is retained. The flow is at Re D 11:72 10 6 based on the mean aerodynamic chord of 0.64607 m and Mach number at 0.8395 with AoA D 3:06 ı and null angle of sideslip. Under this condition, the classical -shock structure is observed on the wing surface. For this study, the trailing edge closure leads to a root chord of length 0.8131, and the trapezoidal part of the original M6 wing leads to a reference surface of 0.7532 [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF][START_REF] Mayeur | Reynolds-averaged Navier-Stokes simulations on NACA0012 and ONERA-M6 wing with the ONERA elsA solver[END_REF]. The starting mesh prior to adaptation is the same for the standard base refinement (i.e., by doubling the total number of nodes at each step) and for the C D -based mono-block adaptation: namely, with N i D N j D 65 and N k D 33, uniformly distributed in i and k directions and N BL D 20.The C D convergence is plotted in Figure 12 for regularly refined and -based adapted grids. The asset given by the proposed method is patent. The limit values may be found in Table IV. The C D estimation error in the C D -based adapted mesh is under five drag counts w.r.t. both the estimation from the finest standard grid and from the Richardson method [START_REF] Richardson | The approximate arithmetical solution by finite difference problems involving differential equations, with an application to the stresses in a masonry dam[END_REF]. Concerning the C L , the estimation error is under one lift count. In the context of 3D meshes, in order to easily identify the refinement zones, Figure 13 has been added. The figure shows the index vectors for the mesh interpolation of the starting base mesh and of the C D -based adapted mesh. Please note the uniform distribution in i and k while the exponential distribution in j (due to the BL) for the starting base mesh. The low slope areas in the distribution of the C D -based adapted mesh correspond to refinement areas. For instance, in Figure 13(a), a refinement is undergone around i min and i max (trailing edgeplease recall the mesh topology explained in Section 5.1) as well as around i D 0:5 (leading edge). Similarly, in Figure 13(c), a refinement is identified around k min (wing tip) and k max (symmetry plane). This kind of analysis is more difficult for j indices because of the exponential growth in the BL.

CONCLUSION

An enhanced goal-oriented mesh adaptation method has been presented based on aerodynamic functional total derivatives w.r.t. mesh nodes in a finite-volume mono-block and non-matching multi-block-structured grid framework for RANS flow. The linearization of the SA turbulence model improves the precision of the estimated adjoint. The retained refinement indicator b a s e do nt h e dJ =d X and on the local mesh size has been proved to be a robust tool for identifying zones considered as influential in the QoI estimation. Applications to 2D RANS flow about a RAE2822 airfoil have been presented. For the mono-block mesh case, for both aerodynamic conditions, the obtained C D -based adapted meshes lead to a good estimation of forces. Although structured grid has been used, a clear anisotropy in the mesh pattern is visible. The constraints given by this kind of meshes have been relaxed thanks to non-matching multi-block technique, which limits the spread of local mesh refinement through all the domain. In this context, the proposed method has proven to be efficient also to adapt the multi-block mesh in the presence of a more refined frozen-wall mesh block. This recalls how also regions of the domain, which are not close to the airfoil boundary, need refinement. This is equally true for QoI (thus J ) whose support is only the airfoil surface mesh (e.g., C D ), which is entirely included in the well-refined frozen-wall mesh block. The 3D RANS transonic flow about a M6 wing case has proven the asset of the refinement approach even for a more complex geometry. The numerical method has anyway shown its efficiency and versatility in terms of flow types (Euler [START_REF] Peter | Goal oriented mesh adaptation using total derivative of aerodynamic functions with respect to mesh coordinates -with applications to Euler flows[END_REF] and RANS here), of aerodynamic operational conditions (transonic and detached subsonic), and of mesh types (mono-block and multi-block under constraints). It has been recently extended to unstructured grids [START_REF] Todarello | Finite-volume goal-oriented mesh adaptation for aerodynamics using functional derivative with respect to nodal coordinates[END_REF] for Euler flows, and this could be the next line of work for RANS flows.

Figure 1 .

 1 Figure 1. Starting non-matching multi-block mesh. In the special case of the starting mesh, the interface between blocks 2 and 3 is match. During the adaptation steps, mesh nodes are free to move in a non-matching framework; see, for instance, Figure 5(b) and (c). (a) Blocks 1 and 2 and (b) blocks 2 and 3.

Figure 2 .

 2 Figure 2. Convergence of C D for the base solution, mono-block, and multi-block adaptation in the transonic flow condition.

Figure 3 .

 3 Figure 3. Convergence of C D for the base solution, mono-block, and multi-block adaptation in the subsonic detached flow condition.

Figure 4 .

 4 Figure 4. Comparison of mono-block meshes. The starting mesh is given in (a) starting mesh (2061 nodes) while final adapted meshes in (b) C D -based adapted mesh, transonic flow (39,559 nodes) and (c) C D -based adapted mesh, subsonic flow (29,117 nodes).

Figure

  Figure Comparison non-matching multi-block The starting mesh is given in (a) while final adapted meshes in (b) and (c). (a) Starting mesh -transonic (22,284 nodes) and subsonic (26,603 nodes), (b) C D -based adapted mesh, transonic flow (40,005), (c) C D -based adapted mesh, subsonic flow (45,027 nodes).

Figure 6 .Figure 7 .Figure 8 .

 678 Figure 6. Comparison of the Mach iso-contour with the mono-block starting mesh. (a) Transonic case and (b) subsonic case. [Colour figure can be viewed at wileyonlinelibrary.com]

Figure 11

 11 Figure 11 depicts the starting regular mesh with N i D N j D 65 and N k D 33 (139,425 nodes). A structured O-O mesh has been used where the index i runs clockwise along the wing section from the trailing edge along the pressure side and back to the trailing edge along the suction side (green planes at i min and i D 40 in Figure 11(b)), the index j goes from the wing surface to

Figure 9 .Figure 10 .

 910 Figure 9. Comparison of the -criterion for the mono-block transonic case mesh adaptation. (a) Step 0: starting mesh, (b) step 1, (c) step 2, (d) step 3, (e) step 4, (f) step 5: final mesh. [Colour figure can be viewed at wileyonlinelibrary.com]

Figure 12 .

 12 Figure 12. Convergence of C D for the regular and adapted meshes in the transonic 3D flow condition about the M6 wing.

Figure 13 .

 13 Figure 13. Index vectors for the mesh interpolation of the starting base mesh (black line) and of the C D -based adapted mono-block mesh (red line). Please note the uniform distribution in i and k while the exponential distribution in j for the starting base mesh. (a) i -Mesh plane, (b) j -mesh plane, and (c) k-mesh plane.

Table I .

 I Verification with an OAT15A. Err. rel. % OE 10 1 Err. rel. % OE 10 2 Err. rel. %

		Rotation	Camber		Thickness
	Method OE 10 3 FD 9.6	-	3.5	-	3.4	-
	AdjParam ( N AdjParam ( lin T ) T ) AdjMesh ( lin T )	8.178 9.142 9.142	14:8 4:8 4:8	2.568 2.981 2.981	26:6 14:8 14:8	2.458 2.916 2.932	27:7 14:2 13:8

Table II .

 II Transonic case.

		Block	N i	N j	N BL	N TOT	C D	C L
	Experiment	-	-	-	-	-	0.0127	0.743
	Base (finest)	-	801 801	80	641,601 0.01200 0.744
	Mono-block	-	221 179	77	39,559	0.01213 0.738
		1(frozen) 401	47	40
	Multi-block	2	210	71	-	39,437	0.01235 0.743
		3	142	40	-
	Comparison of C

D and C L values obtained from the standard base refinement (finest grid) and from the C D -based adapted mono-block and multi-block meshes. The number of nodes in i and j directions is shown as well as the number of nodes in the BL and the total mesh size, N TOT . The experimental values from Cook et al.

[START_REF] Cook | Aerofoil RAE 2822 -pressure distributions, boundary layer and wake measurements[END_REF]

are equally reported.

Table III .

 III Subsonic detached case.Comparison of C D and C L values obtained from the standard base refinement (finest grid) and from the C D -based adapted mono-block and multi-block meshes. The number of nodes in i and j directions is shown as well as the number of nodes in the BL and the total mesh size, N TOT .

		Block	N i	N j	N BL	N TOT	C D	C L
	Base (finest)	-	801 801	80	641,601 0.02987 1.295
	Mono-block	-	163 179	71	29,177	0.02986 1.290
		1(frozen) 401	59	40
	Multi-block	2	178	80	-	45,027	0.03018 1.293
		3	132	54	-

Table IV .

 IV 3D ONERA M6 wing case.Comparison of C D and C L values obtained from the standard base refinement (finest grid) and from the C D -based adapted mono-block mesh. The number of nodes in i and j directions is shown as well as the number of nodes in the BL and the total mesh size, N TOT . The limiting values from the Richardson method are equally given.

		N i	N j	N k	N BL	N TOT	C D	C L
	Richardson	-	-	-	-	-	0.01870 0.274
	Base (finest) 321 321 161	64	16:59 10 6 0.01877 0.275
	Mono-block 109 131	57	34	0:813 10 6 0.01915 0.268

‡ In literature, the term non-conforming is also used to refer to non-conventional mesh types. In this paper, the term non-matching is preferred in order to strengthen the point on the type of non-conforming mesh used.

ACKNOWLEDGEMENTS

The authors express their gratitude to A. Dumont for the verification computations presented in this paper. The authors are greatly thankful to J.C. Vassberg and A. Jameson for the hierarchy of NACA0012 O-meshes made available for the co-workers of D. Destarac.

This research is fully supported by the Marie-Curie ITN-ANADE funded through the European Union FP7 under grant agreement N:289428.