Sylvain Malacria
email: sylvain@malacria.fr

Gilles Bailly
email: gillesbailly1@gmail.com

Joel Harrison

Andy Cockburn

Carl Gutwin
email: gutwin@cs.usask.ca

Promoting Hotkey Use through Rehearsal with ExposeHK

Keywords: Hotkeys, Keyboard Shortcuts, Rehearsal, Menus, Command Selection, Novice Mode, Expert Mode ACM Classification H.5.2. Information Interfaces and Presentation: User Interfaces. -Graphical user interfaces (GUI)

⌘⎇2 ⌘⇧H ⌘W ⌘M ⌘← ⌘D ⌘T Figure 1. The user wants to open a new tab but is not sure of the hotkey. He visually locates the button in the toolbar (boxed on left), then presses the Command key ( ) to activate ExposeHK, which overlays toolbar items with available hotkeys (right). He completes the command by pressing T.

INTRODUCTION

Hotkeys, also called keyboard shortcuts or accelerators, offer a shortcut alternative to pointer-based selection of commands from toolbars and menus. Their efficiency stems from three mechanical advantages over pointing: first, in many tasks such as word-processing, the hands rest on the keyboard, so hotkeys eliminate the need to move the hand to a pointing device and back; second, they eliminate the need for a pointing round-trip from the workspace to the control widgets and back; and third, they allow a wide range of commands to be selected with a single key combination, thus removing the need to traverse a menu or tab hierarchy. A variety of theoretical models (e.g., KLM [START_REF] Card | The keystroke-level model for user performance time with interactive systems[END_REF]) and empirical studies (e.g, Odell et al. [START_REF] Odell | marking menus, and hotkeys: a comparison of one and two-handed command selection techniques[END_REF]) demonstrate that hotkeys improve user performance. Despite this potential, hotkeys are under-used: several studies have demonstrated that few users employ any form of shortcut interface [START_REF] Alexander | Understanding and Improving Navigation Within Electronic Documents[END_REF][START_REF] Bhavnani | The strategic use of complex computer systems[END_REF][START_REF] Carroll | Paradox of the active user[END_REF][START_REF] Kurtenbach | The design and evaluation of marking menus[END_REF][START_REF] Lane | The Hidden Costs of Graphical User Interfaces: The Failure to Make the Transition from Menus and Icon Tool Bars to Keyboard Shortcuts[END_REF]]. Carroll's 'paradox of the active user' [START_REF] Carroll | Paradox of the active user[END_REF] suggests that users are simply too engaged in their tasks to consider learning alternative strategies or methods, even if these methods may eventually improve performance. In addition, keyboard shortcuts require that users learn hotkeys beforehand, potentially resulting in errors due to incorrect hotkey/command memory associations.

The poor adoption of hotkeys and other high-performance interface techniques creates a substantial usability problem. While the performance difference between hotkeys and pointerbased commands may be small for some actions, it can be large when command activation involves hierarchical navigation (such as a menu-cascade) or when selecting widgets located far from the workspace. These small performance differences can compound into substantial effects when multiplied across thousands of daily repetitions. It is therefore important to find ways of helping users transition from the pointer to hotkeys.

Two recent studies show the state of the art in encouraging hotkey use. Grossman et al. [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF] and Krisler and Alterman [START_REF] Krisler | Training towards mastery: overcoming the active user paradox[END_REF] investigated the use of feedback (emphasising the hotkey after pointer selection) and cost (imposing additional steps to complete pointer selections) as mechanisms for encouraging adoption and use of hotkeys, with positive results.

However, these approaches have three substantial limitations. First, they use pointer-based selection as the starting point for hotkey presentation (i.e., the hotkey is only shown after mouse-based selection). Consequently, users reinforce pointing even while trying to learn a faster non-pointer method. Second, cost-based techniques work by penalising pointer selections, rather than by making hotkeys more attractive. For example, one of Grossman's successful techniques imposed a delay after pointer-based selection: the hotkey 'incentive' was turning users away from the old technique, rather than actually improving performance. Third, users are unable to exploit the spatial-location knowledge developed through prior pointer-based selection. Users must switch entirely to the new approach, which usually implies a temporary but substantial reduction in performance (a 'performance dip' [START_REF] Scarr | Dips and ceilings: understanding and supporting transitions to expertise in user interfaces[END_REF]) that is likely to deter hotkey use.

We have developed and evaluated a new method for encouraging and improving hotkey use -called ExposeHK (EHK)that addresses these issues. When activated with a modifier key (e.g., the Control key), EHK displays the hotkeys in the application's toolbar (see Fig. 1), menu, or ribbon. Importantly, EHK is compatible with existing toolbar and ribbon designs, and it can be readily adapted to menus. This work makes three main contributions. First, it describes design principles for promoting hotkey use. Second, it presents ExposeHK (EHK) -a system instantiating the principles with toolbar, menu and ribbon designs. Third, it presents empirical results showing that EHK promotes earlier and higher levels of hotkey use, that participants are faster with it, and that they strongly prefer EHK.

EXPOSEHK: DESIGN GOALS AND RELATED WORK

EHK uses a simple interaction mechanism to promote hotkey use. While a modifier key is held down, all hotkeys are concurrently displayed on top of their graphical controls. Selections are completed using the hotkey or by pointing.

We implemented and evaluated three forms of the technique for toolbars (ExposeHK T , see Fig. 1), menus (ExposeHK M , see Fig. 6), and ribbons (ExposeHK R , see Fig. 9), with details presented later. This section describes the design goals for EHK, as well as key associated prior work.

Design Goals

The ultimate objective of EHK is to improve the rate at which users attain expertise with interfaces, by promoting hotkey use. Figure 2, adapted from [START_REF] Scarr | Dips and ceilings: understanding and supporting transitions to expertise in user interfaces[END_REF], illustrates this idealised objective. It shows that switching to traditional shortcuts involves a temporary 'performance dip' that discourages their use. The dip occurs because users who are competent with pointer-based selection must pause, display the hotkey, learn it, and rehearse the key sequence. With EHK we aim instead to support a smooth and continual transition to expert performance. We have four goals to help EHK achieve this objective, as follows.

Goal 1: Enable hotkey browsing

In most contemporary interfaces hotkeys are not displayed until the user posts a menu item or dwells on a toolbar item (exceptions, such as Alt keys, are discussed with goal 4 below). Consequently, learning hotkeys involves moving the cursor to the point where a simple click would complete the selection -but then pausing, awaiting the shortcut feedback, and committing it to memory before proceeding (possibly by clicking rather than by using the shortcut). These actions can induce a performance dip (Fig. 2) that discourages hotkey use and traps the user in pointer-based 'beginner mode' [START_REF] Scarr | Dips and ceilings: understanding and supporting transitions to expertise in user interfaces[END_REF]. Any memory errors while learning hotkeys will further inhibit performance.

To avoid this trap, systems should allow users to browse hotkeys without requiring a pointing action. ExposeHK meets this goal by showing the hotkeys when a modifier key is pressed, as shown in Figures 1 and6. Users can therefore initiate their command actions using the same modality that they will ultimately use as experts. Novice users will still need to visually search for the target interface control, but once identified, they can press the EHK modifier key to display the hotkeys underlying the control, avoiding the need to move the hand to the mouse and point to the target. Furthermore, EHK does not require that users learn hotkeys beforehand, avoiding errors due to incorrect hotkey/command memory associations. By providing a single modality that removes the need to pre-learn the hotkeys we aim to minimise the magnitude and deterrent effect of the performance dip (Fig. 2).

Goal 2: Support physical rehearsal

In analysing factors influencing the development of expertise, Kurtenbach [START_REF] Kurtenbach | The design and evaluation of marking menus[END_REF] proposed the principle of rehearsal: 'guidance should be a physical rehearsal of the way an expert would issue a command'. He deployed this principle in marking menus, which allow novices to select items by moving the cursor into one segment of a visually displayed 'pie menu' [START_REF] Callahan | An empirical comparison of pie vs. linear menus[END_REF] (a cursor-centred circular arrangement of menu items). Experts select items using exactly the same physical action (a directional gesture), but without waiting for feedback.

The potential value of using the same physical action for novice and expert selections is supported by psychology literature on automaticity and the power law of practice (see [START_REF] Schmidt | Motor control and learning: A behavioral emphasis[END_REF] for a comprehensive review of motor control and learning). Automaticity [START_REF] Schneider | Controlled & automatic processing: behavior, theory, and biological mechanisms[END_REF] represents a high level of attainment in motor learning, allowing controls to be manipulated without substantial conscious deliberation. It is characterised by fast and parallel processing. The key determinant in the development of automatic performance is extreme repetition, although repetition alone is not sufficient for some tasks (e.g., Card et al. [START_REF] Card | The Psychology of Human-Computer Interaction[END_REF] studied one user repeating a text editing task 1100 times, without observing automaticity). These effects support Kurtenbach's principle of rehearsal, yet few shortcut interfaces (other than marking menus and their variants) exploit the principle.

Traditional hotkey methods require users to discover hotkeys using a non-hotkey modality (pointing), and consequently users rehearse pointing, not hotkey use. EHK, in contrast, allows users to discover and rehearse hotkeys using only the hotkey modality. Furthermore, EHK is compatible with traditional interfaces, whereas systems like marking menus require interface changes (i.e., non-traditional circular menu layouts).

Goal 3: Rapid hotkey identification for intermediate users

When users have an intermediate level of skill, they are likely to have partial knowledge of their interaction environment. For example, users may know the spatial vicinity of controls, even if not their exact location; or they may suspect that a particular hotkey sequence triggers a needed command, but be unwilling to execute it without confirmation. EHK leverages human spatial memory by ensuring that hotkeys are displayed at the spatial location of the underlying visual control, which reduces visual search time and allows rapid confirmation of hotkey bindings.

Goal 4: Stable commands in a flat hierarchy

A key reason for hotkeys' efficiency is that most hotkey interfaces use a single key combination to select a command, instead of a series of several point-and-click activities to traverse the command hierarchy. For example, the hotkey CTRL-B may replace two pointing actions for the 'Font' menu and 'Bold' item. Importantly, not all hotkey methods support hierarchy flattening. For example, Alt-Key navigation (part of the accessibility interface in Microsoft Office) displays hotkeys associated with successive levels of the interface hierarchy when the 'Alt' key is pressed, allowing users to traverse the interface. Theoretical and empirical results tend to show that selection time increases with the number of menu levels for experts [START_REF] Cockburn | A predictive model of human performance with scrolling and hierarchical lists[END_REF][START_REF] Scarr | Dips and ceilings: understanding and supporting transitions to expertise in user interfaces[END_REF]. In addition, it has been shown that it is difficult to chunk a multiple-keys sequence into one single cognitive unit when using Alt-Key navigation [START_REF] Miller | Categorization costs for hierarchical keyboard commands[END_REF].

ExposeHK's hotkey bindings are also stable across invocations (within an application), which allow users to learn and rapidly reproduce key sequences. While this may seem an obvious feature of hotkey interfaces, there are interesting accessibility interfaces that support some of EHK's characteristics, but violate this goal. In particular, the 'show numbers' [START_REF]Common commands in speech recognition[END_REF] interface in Windows 7 visually overlays each widget with a number that fades in and out (similar to EHK). Speech input then allows any widget to be selected by reading the number. While this is a powerful accessibility tool, it violates goal 4 because the activation numbers change across invocations.

Other related work

There is extensive literature on understanding and supporting expert performance with user interfaces. This includes work on user strategies (e.g., [START_REF] Bhavnani | The strategic use of complex computer systems[END_REF]), interface techniques that optimise expert performance (e.g., Flower Menus [START_REF] Bailly | Flower menus: a new type of marking menu with large menu breadth, within groups and efficient expert mode memorization[END_REF]), techniques supporting transitions from novice to expert performance (e.g., Blur [START_REF] Scarr | Dips and ceilings: understanding and supporting transitions to expertise in user interfaces[END_REF], Marking Menus [START_REF] Kurtenbach | Issues in combining marking and direct manipulation techniques[END_REF][START_REF] Kurtenbach | The design and evaluation of marking menus[END_REF], and Octopocus [START_REF] Bau | Octopocus: a dynamic guide for learning gesture-based command sets[END_REF]), understanding collaborative skill sharing [START_REF] Peres | Keyboard shortcut usage: The roles of social factors and computer experience[END_REF], and supporting community expertise [START_REF] Matejka | Communitycommands: command recommendations for software applications[END_REF].

Key prior work specifically on hotkeys includes empirical performance comparisons between shortcut techniques including hotkeys (e.g., [START_REF] Jorgensen | Using mouse and keyboard under time pressure: Preference, strategies and learning[END_REF][START_REF] Lane | The Hidden Costs of Graphical User Interfaces: The Failure to Make the Transition from Menus and Icon Tool Bars to Keyboard Shortcuts[END_REF][START_REF] Odell | marking menus, and hotkeys: a comparison of one and two-handed command selection techniques[END_REF][START_REF] Howes | The trouble with shortcuts[END_REF][START_REF] Appert | Using strokes as command shortcuts: cognitive benefits and toolkit support[END_REF]) and specialised hardware promoting hotkey use (e.g., a touch-sensitive keyboard that highlights on-screen widgets before a key is pressed [START_REF] Rekimoto | Presense: interaction techniques for finger sensing input devices[END_REF]). Finally, the two studies most closely related to our objectives concern the use of interaction cost as a disincentive for pointerbased selection [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF] and the use of feedback to help users learn hotkey bindings [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF][START_REF] Krisler | Training towards mastery: overcoming the active user paradox[END_REF]. As summarised in the introduction, we want to promote hotkeys without requiring pre-learning, without imposing an explicit cost on pointer-based techniques, and without the potential distraction of post-action feedback.

USER STUDIES RATIONALE

We conducted three studies to deploy and evaluate Ex-poseHK with traditional organizations of commands in graphical user interfaces: toolbars, menus, and ribbons. Studies 1 and 2, which respectively used toolbar and menu adaptations of ExposeHK, focus on goals 1 to 3, which concern promoting transitions to hotkey use. The primary measure of studies 1 and 2, therefore, is the proportion of commands completed using hotkeys -these studies answer the question, 'does Ex-poseHK promote earlier and increased hotkey use compare to other methods?' Study 3 then focuses on goal 4, examining the performance improvements that ExposeHK can provide when applied to the Microsoft Ribbon user interface, in comparison to existing methods.

STUDY 1: TOOLBARS (EXPOSEHK T )

The toolbar version of ExposeHK (ExposeHK T ), shown in Figure 1, overlays the hotkey associated with each toolbar item when a modifier key is pressed. Study 1 focuses on hotkey adoption with ExposeHK T compared with traditional tooltips and audio feedback. Traditional tooltips provide baseline comparison with a commercial standard, and audio feedback was used because Grossman et al. [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF] showed it to be an effective method for promoting hotkey use. The audio feedback condition used voice synthesis to read the hotkey binding when the pointer clicked the item. Participants in the study were free to complete selections by pointing to toolbar items or by invoking hotkeys.

The study was designed to answer several questions about ExposeHK T in comparison to traditional tooltips and audiosupplemented hotkey feedback: • does ExposeHK T result in earlier and higher levels of hotkey use? • how does hotkey use with the three interfaces (ExposeHK T , audio, tooltips) change with experience and frequency of item selection? • does ExposeHK T support faster command selection?

• are errors affected by interface or selection mechanism?

• how are the systems subjectively perceived?

Experimental method

The method was based on Grossman et al.'s [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF] hotkey study with some modifications, as described below.

Task and stimulus. Each task involved selecting a toolbar item in response to a voice-synthesised audible stimulus that read the name of one of the targets -Figure 3 shows a toolbar used in the study. Voice-synthesis was used to ease risks of confounds stemming from factors such as visual pop-out effects due to exact matches between the stimulus (e.g., a cat icon) and its representation in the interface.

The audio stimulus was produced, and task timing began, when the cursor was inside a 70×70 pixel box in the center of the screen and the space bar was pressed. The participant then selected the corresponding item, either by clicking on the target or by selecting the correct hotkey. As in Grossman et al.'s study, timing stopped when the user moved the cursor back to the box and pressed the spacebar, which simulates a pointing round-trip from the workspace to a control and back to the workspace. Completing one trial immediately initiated the next. All user events were logged, including mouse movement and incorrect selections.

Procedure. Participants completed tasks with all three interfaces: ExposeHK T , audio feedback, and tooltips. In the ExposeHK T condition, the hotkey binding replaced the corresponding toolbar icon when the control key was pressed. In the audio feedback condition, voice-synthesis read the hotkey binding when the user clicked on the item (i.e, after selection). In the tooltip condition, a tooltip showed the hotkey immediately when the cursor entered a toolbar item. Immediate display was used (rather than the traditional method of awaiting a dwell timeout) to maximise hotkey exposure and minimise the performance penalty for awaiting the tooltip.

Before using each interface participants received brief training (approximately 30 seconds; data discarded) in which they were prompted to select one item from a toolbar containing four items, first using the pointer, and then selecting the same item using a hotkey. During training, a single sentence was shown describing how to use the hotkeys: either 'Hover over the toolbar item to display the hotkey', 'Voice synthesis will read the name of the hotkey when you select the item', or 'Press the Control key to show the hotkeys'. The potential benefits of using hotkeys were not mentioned to the participants.

The toolbar used in the study consisted of 25 buttons, with a different set of buttons for each interface (e.g., Figure 3). Participants completed six blocks of trials with each interface. Each block consisted of 24 selections, comprising 12 different targets that were selected 8, 4, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1 times each, giving a near-Zipfian distribution (commonly exhibited with command selections, and also used by Grossman et al. [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF]). The same 12 targets with the same frequencies were repeated in each block. Targets within this distribution were controlled so that the target appearing 8 times was activated by holding the control key and pressing a hotkey in the left-hand side of the keyboard (Control plus one character among q,w,e,a,s,d,z,x,c), the target appearing 4 times was selected by a key in the right set (u,i,o,p,j,k,l,m), and a target selected twice was in the middle-keyboard (r,t,y,f,g,h,v,b,n). The remaining targets were evenly distributed across the left, middle, and right keyboard sides. Finally, the physical location of targets in the toolbar was controlled to balance the pointing distance for each target of a particular frequency across interface conditions.

Participants were instructed to complete selections as quickly and accurately as possible. To discourage 'racing through' the study irrespective of errors, each erroneous selection incurred a 3 second delay prior to initiating the next task. Once all blocks with an interface were complete, participants completed NASA-TLX worksheets [START_REF] Hart | Development of nasa-tlx (task load index): Results of empirical and theoretical research[END_REF] for the technique and gave comments. At the end of the experiment, which lasted approximately 30 minutes, participants ranked their preference for the interfaces and gave final comments.

Design.

The experiment used a 3×6×4 analysis of variance for within-subjects factors technique (ExposeHK T , audio, and tooltips), block (levels 1-6), and frequency (whether the item was selected 1, 2, 4, or 8 times in the block). Order of technique and the dataset used with the toolbar were counterbalanced across the participants using a Latin Square. The primary dependent measure was the proportion of trials completed using hotkeys. Additional dependent measures included selection time (with error trials removed) and error rate.

Although the within-subjects factor technique was counterbalanced, we anticipated the possibility of asymmetric skill transfer, with particular technique orders differently influencing performance in subsequent conditions (see [START_REF] Poulton | Unwanted asymmetrical transfer effects with balanced experimental designs[END_REF]). We therefore analysed factors order and technique, and found a significant interaction. The results analysis therefore reports between-subjects treatment of technique, discarding data from all but the first technique for each participant. For significant ANOVA effects, we include partial eta-squared (η 2 ) as a measure of effect size [START_REF] Richardson | Eta squared and partial eta squared as measures of effect size in educational research[END_REF].

Participants and Apparatus. 36 university staff and students participated, aged 20-45, 6 female. Experimental software, implemented in Java Swing, ran on Windows XP, using a 1680×1050 22" display, optical mouse, standard QWERTY keyboard, and earphones.

Results

The overall mean time for a correct item selection was 3.37s (σ 1.5), with a low overall error rate of 2.8%. Across all conditions, the mean time to select an item using a hotkey was 2.74s (σ 0.19), which was 35% faster than pointer-based selections (4.16s, σ 0.27). The following paragraphs describe analysis of the dependent measures. Subjective responses for all studies are reported after Study 3.

Proportion of hotkey use. Figure 4 (left) shows the proportion of command selections completed using hotkeys with the three techniques across blocks. With ExposeHK T , 94% of correct selections were completed using hotkeys, compared with 50% with audio and only 35% with tooltips (F 2,33 = 21.7, p < .001, η 2 = .57). As expected, hotkey use progressively increased across blocks (F 5,165 = 39.6, p < .001, η 2 = .54) and across all item frequencies (F 3,99 = 31.7, p < .001, η 2 = .49), with infrequent items having lower hotkey selection rates.

Importantly, there was a significant technique×block interaction (F 10,165 = 6.3, p < .001, η 2 = .27). Figure 4 (left)

shows that ExposeHK T users made an early and sustained switch to hotkeys, contrasting with other techniques' gradual increase. This suggests that ExposeHK T fulfills goal 1 (supporting hotkey browsing by novices), as over 81% of first block selections were completed using hotkeys.

Figure 4 (center) shows a significant technique×frequency interaction (F 6,99 = 9.2, p < .001, η 2 = .36). While hotkeys were consistently employed regardless of item frequency with ExposeHK T , low-frequency items were seldom selected using hotkeys with tooltip and audio conditions.

Finally, our study replicates Grossman's finding [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF] that audio feedback outperforms standard tooltips. Error rate. Tooltips, audio, and ExposeHK T had similar error rates (for both mouse and hotkey selection) of 2.6%, 3.3% and 2.7% respectively, showing no significant main effect (F 2,70 = 1.3, p = .28). There was no effect of block (p = 0.24) .

STUDY 2: MENUS (EXPOSEHK M )

Deploying ExposeHK with toolbars is simple because each icon has a unique spatial location, giving an unambiguous position for each hotkey when ExposeHK is activated. However, extending ExposeHK to the large command sets offered by menus raises design challenges because items can share the same display location. For example, Figure 5 (left) shows that the 'Safari' menu extends horizontally across 'File', 'Edit', 'View' and 'History' menus.

Characterising menu hotkeys

To understand how hotkeys are used in existing menus, and the degree of overlapping, we wrote a program using the Mac OS accessibility API to inspect the structure and location of menus in 30 mainstream Mac applications such as Microsoft Word and Adobe Photoshop. We calculated the degree of spatial overlapping between items with hotkeys using heatmap-style data similar to that shown in Figure 5 (right) for each application. The mean number of spatial collisions (two overlapping items) between hotkey items per application was substantial at 23.93 (σ 10.35), and 44.9 (σ 18.78) between a hotkey item and a normal item.

Adapting ExposeHK to menus

The primary design concept of ExposeHK M is similar to ExposeHK T -pressing a modifier key exposes all of the menu items with associated hotkeys overlaying items, as shown in Figure 6. Command selections can be completed by pressing the hotkey or by using the pointer. Second-level menu cascades are not displayed, so some degree of pointer-based selection is still necessary.

ExposeHK M modifies the visual layout of menus to remove spatial overloading. This is necessary to support hotkey browsing (goal 1) and to help intermediate users exploit their spatial memory (goal 3). With ExposeHK M , the width of the gap between top-level menu items is determined by the width of the longest item with a hotkey in each menu. If a longer item without a hotkey exists within the menu, the name is truncated until the cursor hovers over it.

An obvious consequence of this design is that the menubar width increases. Using data from our menu structure analysis, we calculated a mean menubar width of 1204 px for the 30 applications (using the default system font), ranging from 722 px to 1736 px. This raises interesting issues for deployment -ExposeHK M can be readily adapted to Mac OS X menus because they extend across the width of the primary screen; however, it would be more difficult to deploy in small windows where the menubar resides within the window. We return to issues of deployment in the discussion.

Although ExposeHK M is intended to promote hotkey use, it is compatible with pointer-based interaction and users can select items using the pointer if preferred. Doing so should be more efficient than traditional menus because it removes the requirement to first point to a menu to post it (pressing the modifier key posts all menus at once), thus replacing two pointing actions with a single one. Although this design risks giving an initial impression of visual clutter, studies suggest that similar methods of parallel presentation can improve pointer-based selection performance [START_REF] Scarr | Improving command selection with commandmaps[END_REF] and reduce visual search times because rapid eye saccades can replace comparatively slow pointer-based manipulation [START_REF] Hornof | Visual search and mouse-pointing in labeled versus unlabeled two-dimensional visual hierarchies[END_REF][START_REF] Quinn | The effects of menu parallelism on visual search and selection[END_REF]. Finally, users can still browse the menus and select the items using the pointer only as with a regular menubar if preferred.

Experimental method

Study 2 examined hotkey use with ExposeHK M in comparison to traditional menus supplemented with audio feedback (preference results are deferred until after Study 3). Audio feedback was used because it succeeded in promoting hotkey use in [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF] and in Study 1. The method was based on Study 1 (in turn based on [START_REF] Grossman | Strategies for accelerating on-line learning of hotkeys[END_REF]), with modifications described below.

Task and stimulus. Tasks involved selecting a menu item in response to an iconic target stimulus (e.g., a hat icon for the target 'Hat'). Iconic stimuli were used instead of text because pilot studies suggested that long and short word stimuli were easier to visually identify in the menu; iconic stimuli removed this confound: Figure 6 shows a menu and stimulus used in the study. The mechanism for presenting stimuli and completing selections was otherwise identical to Study 1. Procedure. All participants completed the tasks using ExposeHK M and audio feedback. When using ExposeHK M , all the menus concurrently appeared when the Control key was pressed (Fig. 6). With both interfaces selections could be completed by pointing or by using a hotkey. In the audio feedback condition voice-synthesis read the hotkey binding (e.g., 'Control-D') whenever a selection was made using the pointer. The hotkeys associated with target items all consisted of a single letter plus the Control key. The menus were populated using Grossman et al.'s dataset, consisting of 6 menu categories, each containing 12 items (Fig. 6).

Participants received brief training prior to using each interface, which involved selecting an item 4 or more times using the pointer and hotkey (data discarded). They then completed six blocks of trials, with each block consisting of 24 selections, using the same distribution as Study 1.

Design, Participants and Apparatus. The experiment was designed as a 2×6×4 repeated-measures design for withinsubjects factors technique (levels ExposeHK M and audio), block and frequency (as for Study 1). Order of Technique was counterbalanced. The target sets used in the menus were also counterbalanced. All participants from Study 1 proceeded immediately to Study 2 using the same apparatus.

We inspected the data for evidence of asymmetric skill transfer, and proceeded with within-subjects ANOVA having found none (between-subjects analysis does not substantively change the results of significance tests).

Results

Proportion of hotkey use. There were strong main effects for technique (F Regardless of technique, the mean hotkey selection time was 2.53s, which was less than half that of pointer selections (5.9s). Hotkey error rates (2.4%) were also lower than pointer selections (5.9%), which we attribute to the narrow height of menu items causing relatively frequent 'off by one' errors.

In summary, the results provide similar validation to that of Study 1. With ExposeHK M , participants chose to use hotkeys for nearly all commands almost immediately. In contrast, with audio feedback the transition to hotkeys was more gradual: hotkey use reached a lower maximum level, and hotkeys were comparatively rarely used with infrequent items.

STUDY 3: RIBBONS (EXPOSEHK R )

Microsoft's Office 2007 'fluent' user interface merges toolbar and menu designs, using a tabbed 'ribbon' to separate multiple toolbars. Adapting EHK to the ribbon is challenging because each of several tabs places different items in the same spatial location. Also, the ribbon supports an Alt-key method for navigating its ribbon that is superficially similar to EHK. This raises two questions: can EHK be adapted to the ribbon, and does it improve performance over the Alt-key technique?

The ribbon adaptation, called ExposeHK R , is visually similar to ExposeHK T , but it additionally allows users to move between tabbed toolbars using the scrollwheel (as does the current Microsoft Ribbon interface) or arrowkeys. To remain consistent with the Ribbon's tabbed subsets, ExposeHK R relaxes goal 1, which motivated the concurrent presentation of all items with toolbars and menus.

There are two key differences between Microsoft's Alt-key interface and ExposeHK R , both arising with respect to goal 4 (stable commands in a flat hierarchy). First, every selection with Alt-keys is necessarily hierarchical, involving a hotkey specification of the target tab and then the target item within the tab. Multi-level selections are necessary even when the correct target tab is pre-selected. With ExposeHK R , in contrast, hotkeys are globally available in a flat hierarchy. Furthermore, selecting a hotkey with ExposeHK R has the side effect of switching to the tab that contains the target item, which is intended to assist with browsing hotkeys when users make a series of selections within the same tab. Second, Alt-keys are unstable, with the same letter representing different meanings in different modes (e.g., in Microsoft Word 'H' is used for Home, Shading, Header, and more), whereas ExposeHK R 's commands are stable and mode-insensitive. These design differences have implications for the designer's choice of hotkey bindings, as discussed later.

Experimental method

Studies 1 and 2 focused on the proportion of hotkey use resulting from techniques that aim to promote them. In Study 3, the primary concern is the ultimate objective of hotkey interaction -improved performance -compared across three ribbon methods: ExposeHK R , mouse selection, and Alt-keys.

Task and stimulus. Each task involved selecting an item within a ribbon-like interface (Figure 8) in response to a text stimulus representing the target. The mechanism for presenting stimuli and handling errors was otherwise identical to Study 2. The key-bindings used with Alt-keys all used Alt, then a single keypress for each of two levels (tab, then item). The key-bindings for ExposeHK R all used Control then a single keypress.

Procedure. All participants completed the tasks using ExposeHK R , Alt Keys and pointer (mouse selection). With each condition they were required to complete selections using the primary interaction modality in order to get them to a performance maximum with that modality. Therefore, with ExposeHK R and Alt Keys they were required to use hotkeys and with pointer hotkeys were disabled. Before using each technique, participants received brief instruction and then completed eight random selections from a ribbon populated with a training set of items (data discarded). They were instructed to select targets as quickly and accurately as possible.

The ribbon used in the experiment consisted of 7 tabs with 18 items each. Participants completed 8 blocks of 12 selections with each interface. Each block comprised 2 selections of the same 6 targets, allowing participants to gain expertise across blocks. Half of the selections in each block involved switching to a different tab, allowing us to inspect the impact on performance of tab-switching with the different interfaces.

Design, Participants and Apparatus. Selection time data was analysed using a 3×8×2 analysis of variance for withinsubject factors technique (ExposeHK R , Alt Keys and pointer), block (levels 1-8), and tab switch (yes or no). Order of technique and the dataset used with each technique were counterbalanced across participants. 18 volunteers (aged 21-45, 1 female) participated. Experimental software, written in C#, ran on Windows 7 with a 1280×1024 22" display, optical mouse, and QWERTY keyboard.

Results

Figure 9 summarises the selection time results for the three techniques across block (left) and tab switch (right). Analysis of variance showed significant main effects for all factors: technique (F 2,34 = 34.5, p < .001, η 2 = .67), block (F 7,119 = 111.2, p < .001, η 2 = .87), and tab switch (F 1,17 = 282.5, p < .001, η 2 = .94).

The overall mean selection time with ExposeHK R (2.86 s, σ 1.6) was 8.6% faster than pointer selections (3.13 s, σ 0.97), and 36% faster than Alt Keys. However, Figure 9 (left) shows a significant technique×block interaction, with ExposeHK R slightly slower than pointer in the first two blocks, but substantially faster (30%) than pointer by the final block (posthoc Bonferroni, p < .05). Pairwise comparison of performance in the final block shows significant differences between all three interfaces. The early asymptote of pointer performance curve suggests that pointer selection rapidly reaches a relatively low performance ceiling.

SUBJECTIVE RESULTS (ALL STUDIES)

After each study participants completed NASA-TLX worksheets to assess subjective workload with each interface, they ranked the interfaces for overall preference, and they provided comments. In all cases, the participants' subjective responses strongly favoured EHK -66.7% ranked it first for overall preference in Study 1, with significant differences shown in bold (Friedman and Wilcoxon tests).

In studies 1 and 2, NASA-TLX measures showed that EHK had the lowest or equal-to-lowest workload measure in all categories. Several participants also commented that the audio feedback method was "annoying", and that they intentionally decided ignore its feedback. In study 3, EHK was assessed as resulting in lower physical demand, less frustration, and higher perceived success than pointing, but it had higher mental demand. We suspect that the low mental demand of pointing is a key factor in users failing to migrate to hotkeys, but we also suspect that once practiced, hotkeys require similar mental demand to pointing (e.g., using Control-C for copy no longer requires much thought for most users). We return to this issue in the discussion.

DISCUSSION

Design goals 1-3 address issues in promoting users' transition to using hotkeys: helping novices browse hotkeys (goal 1), using physical rehearsal (goal 2), and drawing on spatial memory to assist hotkey identification and confirmation for intermediate users (goal 3).

Studies 1 and 2 showed that toolbar and menu adaptations of EHK improved on the state-of-the-art systems for promoting hotkey use. Participants made an early, comprehensive, and sustained switch to hotkeys when using EHK, whereas standard tooltips and post-selection audio feedback resulted in slower hotkey adoption and lower levels of use. Participants, mostly university staff and students, were almost certainly aware of keyboard shortcuts as an interface mechanism, possibly increasing hotkey use for all conditions. Finally, participants also strongly preferred EHK to the other conditions tested (audio feedback and contemporary designs).

Design goal 4 addresses ultimate performance with hotkeys by advocating stable bindings that are globally applicable in a flat interface hierarchy. Study 3 therefore examined user performance with EHK when adapted to a contemporary 'ribbon' design of tabbed toolbars, comparing performance with standard pointer-based selection and with a commercial hierarchical 'Alt' Keys interface. Results showed that EHK quickly outperformed the pointer by up to 30% on selection time. EHK substantially outperformed the Alt keys interface throughout.

Together the studies suggest that user performance in command selection can be improved by incorporating EHK in standard toolbar, menu, and ribbon interfaces. With EHK novice users have a mechanism to browse hotkeys without using the pointer, and they can issue hotkey commands as a rehearsal of the expert mechanism. Intermediate users can draw on their spatial knowledge of commands to rapidly find hotkey bindings. Finally, the ultimate performance of experts is improved through stable bindings and flat hierarchies.

The following subsections discuss issues of deployment and identify promising areas for further work.

Discoverability and pointer compulsion

The studies show that when participants are aware of EHK they use it to their advantage and are enthusiastic about it. However, all three studies included explicit instruction and practice with EHK prior to experimental tasks, which raises questions of how it will be discovered and used in practice. We see two challenges for practical deployments, related to its discoverability and to the need to break users' inertia in continuing with pointer-based selections (or pointer compulsion).

Discoverability. Interactions such as EHK have no visual representation to aid their discovery until the user accidentally or deliberately presses its modifier-key trigger. Similar problems of weak affordances are present in many forms of interaction, such as touchscreens, where the number of taps, the number of fingers, the tap location, or press duration can be used to control different interactive effects, without any visual representation. In such cases designers often use techniques such as on-and off-line tutorials, 'tip of the day' utilities, and general marketing to promote discovery and awareness.

Social interactions around computing (e.g., over-the-shoulder observation) also play a major role is disseminating useful system capabilities [START_REF] Peres | Keyboard shortcut usage: The roles of social factors and computer experience[END_REF]. Consequently, useful facilities can become widely known even when their presentation is subtle or relatively cryptic.

Pointer compulsion. Studies 1 and 2 explicitly instructed users to make a series of pointer-based and hotkey-based selections with each interface prior to beginning experimental tasks. However, in pilot studies, some participants completed selections using the pointer despite clearly displayed instructions to use hotkeys, and they continued to do so until verbally instructed to use the hotkeys. Breaking this inertia of pointerbased interaction is challenging, but doing so is a primary objective of goals 1-3.

Regardless of these challenges to adoption, it is important to note that EHK is largely compatible with existing designs -it supplements their functionality without changing their basic behavior, allowing users to maintain existing interaction strategies without performance detriment, but also offering a higher performance ceiling if used.

In on-going work we are developing an application that will incorporate ExposeHK M into Mac OS X menus. This will allow us to gain insights into longitudinal use of EHK in realworld deployments.

Modifier keys and vocabulary

The hotkeys in our experiments used only the Control key as a modifier. However, some applications use multiple modifiers and modifier combinations to increase hotkey vocabulary (e.g. Control, Alt, and Control+Alt). Although we have not yet evaluated multiple modifiers, we suspect that the results will generalise to modifier key combinations. Importantly, design guidelines advocate using single modifier keys (like those evaluated) for important commands: for example, Apple recommends that developers "use the Command key as the main modifier key in a keyboard shortcut" [START_REF]Mac os x human interfaces guidelines[END_REF]. Furthermore, our analysis of how hotkeys are used in 30 mainstream applications showed that 93.4% (sd 12.7%) of commands use the Command key, suggesting that our method is representative of contemporary hotkey deployments.

When multiple modifiers are required, EHK could be further adapted to help users learn the modifier key bindings. For example, the display mechanism for exposing hotkeys could highlight the items accessed with the currently depressed modifier key (e.g., using a different color or opacity), while also showing all other hotkey bindings to assist users who are unsure of the required modifier for their target.

By advocating for stable hotkey bindings in a globally accessible flat hierarchy, goal 4 limits the number of commands accessible through a single hotkey character with each single modifier key to ≈ 45 (alphanumerical plus special characters).

In contrast, a two-level Alt hierarchy that uses a single character at each level gives access to up to t×45 (plus numbers and special characters) commands (where t is the number of top-level tabs). Pragmatically, though, we suspect that very few users know as many as 45 hotkeys in any existing system.

Adaptation to other interfaces

Several design solutions could be used to adapt EHK to menu and toolbar combinations. Most toolbar items are replicated in menus, so the simplest solution would be to allow the menus to occlude the toolbar. However, this would impair intermediate users' ability to use their spatial memory of items in the toolbar (opposing goal 3). Alternatively, different modifier keys, or different actions on the same modifier key, could be used to trigger toolbar and menu hotkey exposure: for example, a single Control key press might show ExposeHK T , and a second one ExposeHK M .

By displaying all of the available menu commands at once, ExposeHK M effectively turns the command-access interface into a CommandMap [START_REF] Scarr | Improving command selection with commandmaps[END_REF]. Scarr et al. demonstrated that pointer-based interaction with CommandMaps substantially outperforms ribbon and menu designs because it replaces two actions (each involving search, decision, and pointing) with a single one. Consequently, even when items within ExposeHK M have no associated hotkey, ExposeHK M should improve performance over traditional schemes.

CONCLUSION

Keyboard shortcuts such as hotkeys are widely deployed in current applications but they are known to be underused. We presented ExposeHK, a simple interactive technique that overlays hotkeys onto existing widgets when a modifier key is pressed. Its design promotes hotkey use and enhances efficiency through four goals: enable hotkey browsing; support physical rehearsal; support rapid hotkey identification; and support stable commands in a flat hierarchy. We presented three ExposeHK exemplars that work with the main methods for organising commands in graphical user interfaces: toolbars, menus, and tabbed 'ribbon' toolbars. Three studies, one with each of the designs, demonstrated that the adaptations succeed in promoting earlier and higher levels of hotkey use than other methods, that they improve user performance, and that they are subjectively preferred to alternatives.

  f o r m a n c e c u rv e fo r Ex pos eHK

Figure 2 .

 2 Figure2. Intended learning curve for ExposeHK, compared with modality switching (adapted from[START_REF] Scarr | Dips and ceilings: understanding and supporting transitions to expertise in user interfaces[END_REF]).

Figure 3 .

 3 Figure 3. Example of a toolbar used in the study (top), and with the ExposeHK T mode on (bottom)

Figure 4 .

 4 Figure 4. Results of Study 1. Left: % hotkey use by block; Center: % hotkey use by frequency; Right: mean time by block. Error bars ±1s.e.

Figure 5 .

 5 Figure 5. Left: The Safari menu would overlap with File, Edit, View and History menus. Right: heat map of Safari menus overlapping (red/dark means more overlap).

Figure 6 .

 6 Figure 6. Example menu and stimulus used in Study 2.

Figure 7 .

 7 Figure 7. Results of Study 2. Left: % hotkey use by block; Center: % hotkey use by frequency; Right: mean time by block.

Figure 8 .

 8 Figure 8. Example of a ribbon used in our experiment, with the ExposeHK R mode on.

Figure 9 (Figure 9 .

 99 Figure9(right) shows the significant technique×tab switch interaction (F 2,34 = 10.6, p < .001, η 2 = .67), which is best attributed to the contrast between the pointer and ExposeHK R being similarly affected by the need to switch tabs, while performance with Alt Keys was more consistent across the tab switch levels. This is explained by the Alt Key mechanism requiring users to carry out identical hierarchical actions regardless tab switch state, whereas pointer and ExposeHK R actions are different depending on the need to switch tabs (they need to carry out additional actions to click on the item or to view the hotkey). With experience, however, once hotkeys are well learned, ExposeHK R users do not need to switch tabs, which best explains the three-way significant technique×block×tab switch interaction (F 14,238 = 2.81, p < .001, η 2 = .14). 0

  Item selection time. Figure4(right) shows mean selection times with the different techniques across block. While there was no significant main effect of technique (F 2,33 = 1.09, p = .34), there was a significant technique×block interaction (F 10,165 = 1.99, p < .05, η 2 = .10), stemming from audio's slower selection times initial blocks. As expected, block (F 5,165 = 82.8, p < .001, η 2 = .71) and frequency (F 3,99 = 89.7, p < .001, η 2 = .73) showed significant effects. Finally, the mean time for pointer-based selections in the final block (for those who continued to use the mouse with any technique) was 3.53s, compared to 2.38s with hotkeys.

  1,35 = 45.2, p < .001, η 2 = .56), frequency (p < .001, η 2 = .51), and block (p < .001, η 2 = .64), as shown in Figure7(left and center). With ExposeHK M , 99% of selections were completed using hotkeys, ranging from 93% in block 1 to 100% in block 6, compared with 64% with audio, ranging from 37% in block 1 to 77% in block 6. The continuous high hotkey use with ExposeHK

M , compared to the gradual increase with audio caused a significant tech-nique×block interaction (F 5,95 = 20.3, p < .001, η 2 = .46). There was also a significant technique×frequency interaction (F 3,105 = 32.6, p < .001, η 2 = .48) caused by ExposeHK M 's consistently high hotkey use across frequencies, but only 42% hotkey use for infrequent targets with audio.

Item selection time and errors. Figure

7

(right) shows the mean selection time (errors removed) with the different techniques across block (including both pointer-based and hotkey-based selections). Mean selection times with ExposeHK M (2.78s σ 1.8) were faster than audio (3.16s σ 2.02): F 1,35 = 15.06, p < .001, η 2 = .30. As anticipated there were significant main effects of block, and frequency (p < .001), but technique did not interact with either.

Error rates were marginally lower with ExposeHK M (2.4%) than audio (3.0%): F 1,35 = 3.32, p = .08.

  1, 77.8% preferred it over audio in Study 2, and 88.9% ranked it first in Study 3. Mean responses are shown in Table


Guy Caignaert
email: guy.caignaert@ensam.eu

Olivier Coutier-Delgosha

Jean-Baptiste Leroux

Control of water air content during transient cavitation tests of inducers

Keywords:

The control of water air content is often necessary during transient cavitation tests of inducers. But no method is really defined or imposed to control it quantitatively, especially during tests where a continuous decrease of available NPSH at pump inlet is used in order to analyze, for example, the occurrence of instabilities.

The paper intends to show how a well-known in-duct hydro-acoustics intensimetry, using three pressure transducers can be used accurately for the instantaneous determination of waves celerity in ducts during such transient tests, with an appropriate treatment of the measured pressures. The instantaneous wave celerity can then be related to an instantaneous value of air content using a model.

An application to cavitation tests of an inducer at various speeds of rotation and a given non-dimensional flow rate is proposed, analyzed and discussed..

INTRODUCTION

Tests standards, such as ISO 3822-1 [1] for laboratory tests on noise emission from appliances and equipment used in water supply installations, often require a control of the quality of water, regarding especially its air content. The same type of attention has to be taken into account for cavitation tests of pumps or other hydraulic devices. During laboratory tests, the control of gas content in water can be mainly achieved by measuring dissolved oxygen with use of sensors. But these devices are difficult to use accurately because the information from the transducers can be influenced by parameters such as temperature and pressure of water. Such devices are also difficult to use during transient tests because of their limited time response. The present paper proposes to use a three-pressure transducers method in order to get a good control of waves celerity in ducts of constant cross-section. That method has been used efficiently with steady flows in ducts, with help of signal treatments in the low frequency range, especially for hydro (or aero) acoustics tests of pumps and fans ( [START_REF] Lavrentjev | Abom-Characterization of fluid machines as acoustic multi-port sources[END_REF], [START_REF] Lavrentjev | A measurement method for determining the source data of acoustic two-port sources[END_REF], [START_REF] Carta | Caignaert -Hydro acoustical characterization of centrifugal pumps-7 th international congress on sound and vibration[END_REF], [START_REF] Abo | Error analysis of the two microphones measurements in ducts with flow[END_REF], [START_REF] Caignaert | Charley-Caractérisation expérimentale du comportement hydroacoustique de turbomachines hydrauliques-La Houille blanche[END_REF], [START_REF] Caignaert | Charley -Sources of uncertainties for hydro acoustics measurements in ducts-INCE symposium[END_REF]). The results presented here show that such a method can be used rather accurately during transient operation of pumps, such as cavitation tests with continuously decreasing available Net Positive Suction Pressure.

During the tests with a continuously decreasing available NPSP, the measured pressure fluctuations in the ducts can also be used for a quite instantaneous characterization of pressure and flow rate fluctuations far upstream and downstream of the tested pump. The results are used as a complementary tool in order to analyze the various types of cavitation that occur within the pump, especially the occurrence of instabilities.

EXPERIMENTAL FACILITIES AND TESTS RESULTS

Figure 1 presents a scheme of the pump environment within the pump test-rig SESAME ( [START_REF] Coutier-Delgosha | Analysis of Cavitation Instabilities in a Four-Blade Inducer[END_REF] and [START_REF] Coutier Delgosha | Influence of the blade number on inducer cavitating behavior[END_REF]). That test-rig is a closed loop enabling: -Measurements of steady and unsteady characteristics of pump (flow rate, head, required NPSP) at various speeds of rotation (up to 6000 rpm) -Control of available NPSP at pump inlet by modifying the pressure in the upstream tank, with the possibility of varying that NPSP continuously Inlet pipe and outlet pipe have internal diameters respectively equal to 250 and 200 mm. -The pump speed of rotation is kept constant -No action is made on the valves used for the control of the flow rate in the loop, and the pump flow rate remains constant, as far as there is no blockage effect due to cavitation development. Figure 2 presents an example of such a transient test.

As it can be observed on that Figure 2, the transient evolution of pressure in inlet pipe (or Tau) is very slow, with duration of about 400 s, which allows for quasisteady interpretations of phenomena. The superposition of such results at three different pump speeds of rotation (4000, 5000 and 6000 rpm) and the same relative flow rate (same positions of control valves) is then presented in Figure 3. Some small differences can be observed, especially when flow rate and head coefficients begin their decrease due to the development of cavitation in the pump. One question was the potential influence of water gas content evolution at pump inlet and it was decided to try to get instantaneous values of waves celerity in the pipes during such tests, using the well-known "three transducers" method. That method was used for a long time in the lab for hydro-acoustics purposes ([4], [START_REF] Caignaert | Charley-Caractérisation expérimentale du comportement hydroacoustique de turbomachines hydrauliques-La Houille blanche[END_REF], [START_REF] Caignaert | Charley -Sources of uncertainties for hydro acoustics measurements in ducts-INCE symposium[END_REF]), but always during steady operating conditions, and one challenge was to adapt the method for transient conditions.

EXPERIMENTAL DETERMINATION OF WAVES CELERITY IN A DUCT OF CONSTANT CROSS-SECTION USING THREE PRESSURE TRANSDUCERS

The experimental determination of waves celerity in a duct of constant cross-section can be made using three pressure transducers, flush mounted on the wall of the duct, in three equidistant pipe cross-sections, as proposed in [START_REF] Carta | Caignaert -Hydro acoustical characterization of centrifugal pumps-7 th international congress on sound and vibration[END_REF], [START_REF] Caignaert | Charley-Caractérisation expérimentale du comportement hydroacoustique de turbomachines hydrauliques-La Houille blanche[END_REF], [START_REF] Caignaert | Charley -Sources of uncertainties for hydro acoustics measurements in ducts-INCE symposium[END_REF] and [START_REF]Guide acoustique des installations de pompage[END_REF]. The model refers to 1D propagation equations assuming no Mach number effect and no viscous effects ([8], [START_REF] Margolis | Measurements of the propagation of long-wavelength disturbances through turbulent flow in tubes[END_REF], [START_REF] Brennen | Hydrodynamics of Pumps[END_REF]). With that procedure, the waves celerity is experimentally defined, in the frequency domain, using transfer functions between transducers (1) and (0) and transducers ( 2) and (0), where transducer (0) is situated in the middle of transducers (1) and ( 2), according to the theoretical following equation:

kL H H p p p p cos ) (   0 2 0 1 2 1 (a)
With: H Transfer function L the distance between transducers (1) and (0) or ( 2) and (0) k the wave number equal to the ratio of waves celerity c over frequency f Figure 4 presents an example of the use of that method in a stainless steel pipe at the inlet of a radial flow pump operating in steady operating conditions. The figure presents the imaginary part (in red) and the real part (in blue) of the left part of equation (a) obtained from measurements; the green curve represents the "coskL" function that optimally approximates the real part of the experimental result. Such a result can be used to get a first appreciation on the quality of the experimental procedure as the result can be compared to estimation of the waves celerity obtained from the celerity in water with corrections due to the thickness of the pipe and the properties of its material. Coherence functions and observation of the experimental imaginary part of the left part of equation (a) can also be used as quality criterion. It can be noticed that boundary conditions directly influence the quality of the results. In such a method, the distance between transducers must also be chosen carefully according to the frequency range of interest. Useful indications about the experimental conditions can be found in references [START_REF] Lavrentjev | Abom-Characterization of fluid machines as acoustic multi-port sources[END_REF] to [START_REF]Guide acoustique des installations de pompage[END_REF]. In the present example, the transfer functions are experimentally obtained from cross spectra and auto spectra with a possibility of averaging these spectra over a more or less important number of measurements (50 for example in figure 4). function that optimally approximates the real part of experimental results. From that green curve, wave celerity of 1270 m/s is deduced.

RESULTS AT A GIVEN SPEED OF ROTATION

The method has been used during cavitation transient tests described in Figure 2. During these tests, the pump speed of rotation is equal to 4000 rpm. For the determination of waves velocities in both pipes, the signal is then divided in windows of 2 s. In every window, the method described in section 2 is used with an hypothesis of quasi-steady conditions within it. An average over 8 instantaneous spectra can be made. In every window, tests on coherences and imaginary parts are made in order to eliminate information at some frequencies as it appears on figure 5 where it can be observed that red points are used to fit a "coskL" law used to determine the celerity c. Figure 6 presents the results as time evolutions of these waves celerities during that test in respectively inlet and outlet pipes. As it can be observed, the celerity decreases much more at inlet, what can be probably be associated to an effect of an evolution of dissolved air within water. It can also be noticed that the sharp decrease of celerity at inlet appears nearly 80 s before the decrease in pump flow rate and head observed on Figure 2.

RESULTS FOR THREE SPEEDS OF INDUCER ROTATION

The measurements of pressure fluctuations in inlet and outlet pipes have been made for the three tests whose flow rate and pressure coefficients are presented in Figure 2. These results are characterized by similar flow velocity triangles at inducer inlet if Reynolds number effects are negligible. Figure 7 presents the evolutions of the waves celerity in inlet pipe with the nondimensional available NPSP. The results can appear relatively surprising as the various curves for the three speeds of rotation are not similar: the beginning of the decrease of inlet celerity appears here to be dependent of the speed of rotation with a tendency to appear at lower values of TAU for higher speeds of rotation. In fact, if these evolutions are drawn as function of available NPSP (Figure 8), the similarity appears much better: that means that the beginning of celerity decrease appears for a given value of available NPSP which probably indicates what can be called a test-rig signature for the beginning of gas content sharp increase. That interpretation of the results is confirmed in Figure 9 where each celerity value is transformed in a value of gas content (alpha) using the well-known Jakobsen model ( [START_REF] Shamsborhan | AbdelNour Experimental détermination of the speed of sound in cavitating flows[END_REF]). Results in the outlet pipe are of course of less interest regarding cavitation instabilities analysis, but they become useful for the hydro-acoustics characterization of the whole pump using transfer matrices that allow for a dynamic analysis of the whole installation. Evolutions of waves celerity in the outlet pipe are so presented in Figure 10. As already noticed, the variations of celerity are much smaller than in inlet pipe. The decrease that is observed is much important for the lower speed of rotation, which can be associated to the lower pump head for smaller speeds of rotation. The results can appear a little bit more "noisy" than at inlet, but it must be remembered that the transducers at inlet are probably more influenced by pump vibration in that zone.

Figure 10. Evolutions of celerity in outlet pipe with NPSP

CONCLUSION

The liquid gas content is known to have influence on the cavitation characteristics of a pump. But no method is really imposed in order to control it, especially during transient cavitation tests as the ones described in the present paper. The use of pressure transducers for hydro-acoustics characterization of pumps, turbines and systems has been developed for a long time. The challenge was here to look at the potential use of methods based upon the "three transducers method" during transient NPSP variations. Of course, the transient evolutions considered here remain slow enough so that quasi-steady approaches can be used.

In spite of the fact that the averaging of cross spectra and auto spectra is limited due to the time window duration, it has been demonstrated that the method is applicable for the analysis of such tests with a still good quality of the results and the potential use for the determination of void fraction using a model correlated to the experimental waves celerity measured all along the transient.

Figure 1 .

 1 Figure 1. Scheme of the pump test rig showing especially the pressure transducers locations in the inlet and outlet pipes

Figure 2 .Figure 3 .

 23 Figure 2. Non-dimensional NPSP (upper part), flow rate (middle) and pump head (lower part) during a typical transient cavitation test

Figure 4 .

 4 Figure 4. Real (in blue) and imaginary (in red) parts of left side of equation (a) in a stainless steel pipe (inlet diameter = 40 mm; wall thickness = mm) at inlet of a radial flow pump as functions of frequency (in abscissa). Green curve represents the "coskL"function that optimally approximates the real part of experimental results. From that green curve, wave celerity of 1270 m/s is deduced.

Figure 5 .

 5 Figure 5. Real (red points) and imaginary (green points) of the left side of equation (a). Evolutions with frequency (Hz, in abscissa) for one time window (duration 2 s) during a transient cavitation test of an inducer. Blue lines represent the "coskL" function fitted to red points and used for the determination of instantaneous waves celerities. Results in inlet pipe (figure on the left) and in outlet pipe (figure on the right)

Figure 6 .

 6 Figure 6. Waves celerity in inlet pipe (on the left) and outlet pipe (on the right) determined with a three-transducers method during a transient operation of an inducer operating at 4000 rpm with a continuously decreasing available NPSH.

Figure 7 .

 7 Figure 7. Evolutions of waves celerity in inducer inlet pipe in function of non-dimensional available NPSP for three different speeds of inducer rotation and the same relative flow rate

Figure 8 .Figure 9 .

 89 Figure 8. Evolutions of waves celerity in inducer inlet pipe in function of available NPSP for three different speeds of inducer rotation and the same relative flow rate

  volume of gas divided by the total volume (-) C propagation celerity of waves in a pipe (m/s) f frequency (Hz) g gravity acceleration (m/s 2 ) H transfer function (-) or pump head (m) K wave number = C/f L distance between two consecutive pressure transducers (m) N pump speed of rotation (rpm) NPSP Net Positive Suction Pressure (Pa) P, p pressure (Pa) PSI non-dimensional head coefficient = gH/(a 2 R 2 ) (-) Q pump mass flow rate (kg/s) QN reference pump mass flow rate (kg/s) proportional to N TAU non-dimensional NPSP = (NPSP/)/(a 2 R 2 ) (-)   pump angular speed of rotation (rad/s)  water density (kg/m 3 )


Hélène Le Bouder

Gaël Thomas

Edwin Bourget

Mariem Graa

Nora Cuppens

Jean-Louis Lanet

Theoretical security evaluation of the Human Semantic Authentication protocol

Keywords: PIN code, Human Semantic Authentication protocol, graphical password, shoulder surfing attack, dynamic password, authentication

Using a secret password or a PIN (Personal Identification Number) code is a common way to authenticate a user. Unfortunately this protection does not resist an attacker that can eavesdrop on the user (shoulder surfing attack). The Human Semantic Authentication (HSA) protocol proposes a solution against this attack. The main idea is to have concept passwords and to propose images that the user must correctly select in order to authenticate. A concept can be represented by different pictures, so one observation is not enough to retrieve the secret. In this paper, the security/efficiency trade-off in the HSA protocol is evaluated. A probabilistic approach is used. Under the assumption that the picture/concept database is known to the attacker, we show that HSA is barely more resistant to shoulder surfing attacks than a PIN code. More precisely we show that the probability to retrieve the secret concept password increases rapidly with the number of observations. Moreover the constraints on the size of the picture/concept database are very difficult to satisfy in practice.

Introduction

PIN (Personal Identification Number) codes or login/password pairs are common authentication methods. For instance, these methods are used in payment cards or SIM cards. Therefore, PIN and passwords are targets of choice for malicious adversaries. The security of PIN codes or passwords relies on them being kept secret. Many attacks exist to retrieve PIN codes or passwords with keyloggers, smudge marks on the screen etc. In the case where an attacker eavesdrops on the user's authentication, the security is broken. This kind of attacks are called shoulder surfing attacks.

Motivation and Contribution. To deter different types of attacks, most smartphones use new methods to authenticate users. For example graphical passwords require the user to memorise a graphical sequence and not a number sequence. The HSA protocol introduced in [START_REF] Zouinar | Evaluation ergonomique d'un système d'authentification graphique[END_REF][START_REF] Salembier | Experimental studies of a graphical authentication system based on semantic categorisation[END_REF], appears as an efficient countermeasure against many attacks, particularly shoulder surfing attacks. The main idea of the HSA protocol is to have a concept password. At each authentication, pictures are presented to the user. She has to select images that embody her concepts in order to validate her password. For example, the concept yellow could be represented with many different images, e.g. a lemon, a sun, an American taxi etc. The authors of HSA protocol are interested by human reactions and comprehension of this solution.

In this paper, the goal is to evaluate the security of this protocol. A statistical analysis of the HSA protocol against shoulder surfing attacks is presented. We show why this solution does not offer a stronger enough security with respect to the efficiency of the scheme.

Organization. The paper is organized as follows. The state of the art is described in section 2. The HSA protocol is presented in section 3. Statistical tools to evaluate the security of this protocol are given in section 4. The evaluation of this protocol is given in 5. Finally the conclusion is drawn in section 6.

State of the art 2.1 Authentication methods

The most common computer authentication method is the login/password pair. The vulnerability of this method is well-known, i.e. the difficulty of remembering passwords, and it resists poorly to shoulder surfing attacks. Alternative schemes are token-based and biometric-based authentication. Token-based authentication provides strong security. It requires that the user owns a token e.g a smart card. However, such a token needs to be unlocked by the user, often by requiring a PIN code. In such a case, the user needs to have the token and to know something. The biometric-based authentication is often classified in behavioural-based or physiological-based method. In the behavioural scheme, the user is authenticated thanks to the voice, the keystrokes and so on; and can be performed remotely. The physiological scheme analyses the face, fingerprinting, iris etc. The sensor can only be local and thus it requires the presence of the user. Its drawbacks are accuracy, (false positive, false negative) and the variability of the user's characteristics mainly related to its health.

Password schemes do not resist against shoulder surfing attack, but it has been demonstrated that many other attacks can cause damages with this scheme. Unfortunately, when using a screen keyboard it is possible to guess a cell phone PIN due to several side channels. The first obvious one is related with the smudge marks on the screen. Those smudge marks indicate the four PIN digits, so an attacker knows that the PIN is one of the 24 possible permutations of those digits. At Black Hat in [START_REF] Yue | My google glass sees your passwords! Proceedings of the Black Hat USA[END_REF], the authors have demonstrated a new attack using video footage (thanks to Google glasses), they claim to be able to automatically recognize 90 percent of PIN code up to nine feet from the target. The used side channel is the relative motion of the victims' fingers over the touchscreen, analysing shadow formation around the fingertip as it strikes the touch screen, and using computer vision techniques.

Modern smart phones use sensors that enable a wide range of interactions, but some of these sensors can be employed as a side channel to learn about user input. In [START_REF] Aviv | Practicality of accelerometer side channels on smartphones[END_REF], authors demonstrate that the accelerometer sensor can also be employed as a high-bandwidth side channel. Particularly, they use the accelerometer sensor to learn user tap and gesturebased input as required to unlock smart phones using a PIN/password or Android's graphical password pattern.

Side Channel, Key-logger and Observation Attacks

The security issue is probably the most important one, when accessing banking services using a smart phone. The user must be correctly authenticated using the touchscreen. Passwords and PIN code are highly sensitive assets and handling them over to third-party applications raises the following question: how a user can be sure that an application properly handles their assets? The recent discovery of passwordstealing applications and other vulnerabilities in Android demonstrates that users have reason to be concerned [START_REF] Felt | A survey of mobile malware in the wild[END_REF]. A trusted informationflow monitor such as TaintDroid [START_REF] Enck | Taintdroid: An information-flow tracking system for realtime privacy monitoring on smartphones[END_REF] can track the propagation of password data, but data must be tagged before it can be tracked. Unfortunately TaintDroid does not prevent data from leaking through covert channels such as a program's control flow or timing information.

The user can upload inadvertently a spyware application in its cell phone or this latter can be shipped with a pre installed key-logger [START_REF] Stavrou | All your sms and contacts belong to adups and others[END_REF]. There are a lot of programs for Android-based cell phones that are able to monitor the information sent or received by the phone. A key-logger is able to run completely in stealth mode. After it is installed it should not show up in the start-up icons or anywhere else on the phone that is being monitored. Other important features are also location tracking and remote control.

In [START_REF] Xu | Taplogger: Inferring user inputs on smartphone touchscreens using onboard motion sensors[END_REF] the authors describe a side channel that employs the gyroscopic orientation sensor to determine broadly where a user touches on a large keypad. They were able to infer PIN data while using the telephone keypad. Accelerometers have been used in [START_REF] Owusu | Accessory: Password inference using accelerometers on smartphones[END_REF] and [START_REF] Aviv | Practicality of accelerometer side channels on smartphones[END_REF] to infer sensitive data with an acceptable success rate.

The camera and microphone sensors are used in [START_REF] Simon | Pin skimmer: Inferring pins through the camera and microphone[END_REF] with the PIN skimmer application to retrieve the value of SIM PIN code. Every time the user touches the screen, their tool takes a photo of the user's eyes, with the front camera and saves the image along with its associated digit. The pairs (photo/digit) are sent to a server. The user photos are associated to each digit. These side channel attacks succeed because there is a direct mapping between the inferred position and the value to guess.

Randomized virtual keypads seem to be a promising solution to thwart such side channel attacks be-cause there are no more links between position and value. Unfortunately, there is still a possibility that an installed application with enough privilege can obtain a snapshot of the screen; thus the used keyboard and obtain the link between position and value. The difficulty resides only in luring the user while the application requires permission for screen shot. Another solution, a bit more complicated, requires acquiring root privileges. As a conclusion, to avoid side channel or key logging attacks, one can use graphical password schemes. But even this solution is still vulnerable to shoulder surfing attacks.

Graphical password

The graphical password mechanism requires from the user to memorize a sequence of graphical representations instead of an alphanumeric string. Human visual memory preserves the security of the system and improves usability. Several studies evaluate the usability of graphical authentication schemes and only a few studies have focuse on the security aspects [START_REF] Renaud | Are graphical authentication mechanisms as strong as passwords?[END_REF]. Graphical passwords are typically classified as recall-based, recognition-based, or cued recall-based.

Recall-based schemes

Users are either required to draw a shape from memory or repeat a sequence of actions. Examples of recall schemes are Draw-A-Secret (DAS) [START_REF] Jermyn | The design and analysis of graphical passwords[END_REF] and Pass-Go [START_REF] Tao | Pass-go: A proposal to improve the usability of graphical passwords[END_REF], as well as Android's Pattern Unlock.

A DAS password is a free-form picture drawn on an NxN grid. The grid is denoted by discrete rectangular coordinates (x,y) which are used to indicate the cells that are crossed by the user's drawn secret. In order for a drawn secret to be accepted in authentication, it needs to cross the same grid of cells while ensuring the breaks between the strokes occur in the same place. DAS does not rely on drawings from a semantic perspective but on the underlying grid sectors.

Pass-Go improves DAS's usability by encoding the grid intersection points rather than the grid cells. It overcomes the limitation of the DAS scheme, where strokes too close to adjacent cell edges could be incorrectly assigned to multiple cells.

Such pattern-based authentication mechanisms are vulnerable to attacks based on observations of smudges on the device touchscreen. Moreover, recall is a cognitively difficult task (same as a PIN code). Therefore, users tend to resort to coping strategies.

Recognition-based schemes

Users have to recognize a sequence of images or shapes, usually embedded in a grid of decoy images to detract attention of observers. It is the least cognitively demanding and particularly suitable for use with images.

Dhamija and Perrig [START_REF] Dhamija | Deja vu-a user study: Using images for authentication[END_REF] propose Déja Vu a recognition-based graphical authentication mechanism. Each image is abstract in nature and the collection is generated using a mathematical formula.

In fact, the output depends on an initial seed. The advantage relies on the fact that the actual images do not need to be stored, just the small initial seed.

A typical scheme is Passfaces [START_REF] Brostoff | Are passfaces more usable than passwords? a field trial investigation[END_REF] where a user selects a portfolio of faces from a database while creating a password. During authentication, a panel of candidate faces is presented for the user to select the face belonging to her portfolio. This process is repeated in several rounds, each round with a different panel. A successful login requires correct selection in each round.

Use Your Illusion (UYI) [START_REF] Hayashi | Use your illusion: secure authentication usable anywhere[END_REF] relies on the human ability to recognize a degraded version of a previously seen image. UYI utilizes an image process filter to eliminate most details in an image, while preserving some features such as colour and rough shapes.

Cued-recall-based schemes

Users have to select target points in an image or a sequence of images. The image serves as a cue to support memory recall. Ideally, cues are only helpful to the legitimate user but not to observers.

In [START_REF] Wiedenbeck | Passpoints: Design and longitudinal evaluation of a graphical password system[END_REF] the authors propose a mechanism called PassPoints. In PassPoints the user is expected to select five click points on an image. The sequence of click points is the authentication secret. The image can be selected from a library or provided by the user, the only requirement being that the image is complex enough to inspire users and protect the secret. In [START_REF] Suo | Graphical passwords: A survey[END_REF] the author propose a variant which is somewhat resistant to shoulder-surfing: Cued Click Points, where images are changed after each click; with the next image selected by a deterministic function. The next image displayed is based on the previous click point so users receive immediate implicit feedback as to where they are on the correct path when logging in.

Most graphical password schemes solve the problem of key-logging attacks but remain sensitive to shoulder surfing attacks or side channel attacks. Authentication protocol

Definition

In [START_REF] Salembier | Experimental studies of a graphical authentication system based on semantic categorisation[END_REF], the authors present the HSA protocol. They claim to be a mix between recall and cued-recall based schemes. For the authentication, the system proposes a sequence of a images set. The user selects the sequence of images that remind her its secret password. The originality of this scheme relies on the fact that the secret is not an image or a part of an image but a concept. In this paper, we suppose that the user selects an image and not a part of the image. Indeed, selecting a picture or a part of a picture is the same in the sense that a multi-parts picture could be reduced to multiple pictures in an equivalent whole pictures only scheme.

A Concept Password (CP) is a sequence of concepts, as a PIN code is a sequence of digits. On the screen, different pictures are presented to the user. Each picture contains several concepts. The user selects a sequence of pictures which contains her concept sequence in order to be authenticated.

This implies that the user must decode how the concept has been represented into the image. The authors of [START_REF] Salembier | Experimental studies of a graphical authentication system based on semantic categorisation[END_REF] claim that only a human can act as a good decoder. They give some examples. An image where the concepts yellow colour, tool, animal and food are the sequential elements of the CP. Any element of the CP can be instantiated with different pictures. For example, yellow can be a sun, a car, a wall. Any animal can either be an animal or a food and a bee can be an animal and the item yellow. Several concepts can be embedded into one image, an element can represent different concepts and a concept can be in different successive images. The main feature behind the HSA protocol is to obfuscate the secret elements through diversity and redundancy. The authors pay a lot of attention to the usability of the scheme leading to studies capturing different parameters as the time to recognition, the recognition ratio, etc. They claim a strong resistance against over the shoulder attacks performed either by human or by a machine. We investigate in section 4 and 5 the resistance of the HSA protocol from a mathematical point of view either for a human attacker or a machine based attacker.

Threat model

During the authentication process, HSA presents a challenge set to the user that contains both decoy con-cepts and CP embedded into a set of images. The user is required to choose all concept passwords to pass the authentication. A threat model in which the adversary performs a shoulder-surfing attack is assumed. A shoulder surfing attacker intends to capture the legitimate user's concept passwords through observing the user's selection with any technical recording device.

The attacker can use any device (a camera for example) to record all the images and all the attempts. As a consequence the entire set of images is known by the attacker. In the following, we suppose that the set of concepts is publicly known.

In summary the attacker can see the different pictures selected by the user. Is she able to retrieve the CP? If so, in how many observations? What are the limits of this identification scheme?

On the other hand, in this paper we want to keep a security as strong as the one offered by a PIN code. That means that the probability of selecting the good pictures by chance has to be the same as that of testing by chance PIN code.

Mathematical description

In this section, the objective of this paper is given, with a mathematical formalisation. Let be a Concept Password CP of size n (number of concepts the user has to memorize):

CP = c 1 , c 2 , ..., c n .
The set of all concepts is denoted D with a cardinal equal to D. The set of pictures in the database is denoted by P. At each authentication a subset of p pictures (taken from P) are presented to the user. Each picture can be mapped to a subset of D with only l concepts (each picture contains l concepts).

An attacker can have a divide an conquer approach and attack one concept at a time. So in the following, the attacker tries to find a single concept c i (e.g. the ith concept of the concept password) within a sequence of observed pictures. In this paper D j , denotes the set of l concepts included in the picture selected by the user at the j-th authentication for a given concept c.

Main questions.

In the rest of this paper, we want to know if an attacker can easily retrieve the concept password according to the number of concepts and its repartition. In other words, for a strong security implementation of HSA, we want to answer the following main questions:

1. How many concepts in total (D size of D)?

2. How many concepts in a picture (l)?

3. How many pictures should be presented to the user for one authentication (p)?

4 How to evaluate the number of concepts required ?

In this section various probability constraints are introduced in order to have an approximation for a good pair D and l. More precisely, this paragraph gives the tools to answer the questions 1 and 2.

Probability to select a good picture

The number of concepts by picture is fixed and noted l. Extreme values of l do no make sense. If l = 1 it is equivalent to a classic PIN. If l = D, all pictures contain all concepts: any sequence of pictures validates the CP. It is preferable to strike a better balance between these two extreme values.

Let be Q the probability of the event:

The attacker selects a picture associated to the concept c by chance.

Q = l D . (1)
This probability shows that a picture does not have to contain too many concepts.

To have the same security as a PIN or better, it means that

Q = l D 1 10
.

Thus, l the number of concepts by picture has to be:

l D 10 .

Probability to retrieve a concept

The attacker has a set of N observed pictures for the concept c, obtained from the shoulder surfing attack.

Let P (N) be the probability of the event: "the attacker has retrieved the concept c", with N observations. There are two cases:

1. The event A:

N j=1 D j = {c} and P (N) = 1 .
The attacker is sure that she has retrieved the good concept.

The event

A: c N j=1 D j ;
but the intersection is not equal to the singleton {c} so:

P (N) = 1 k , with k = # N j=1 D j .
Finally:

P (N) = l ∑ k=1 1 k • P # N j=1 D j = k . ( 2
)
As c is the common concept of all observations of the attacker, the following notations are introduced:

D * = D\{c} D * j = D j \{c} D * = D -1 l * = l -1 .
With these new notations, P (N) is a sum of P k (N) with the factor 1 k+1 ;

P (N) = l * ∑ k=0 1 k + 1 P k (N) ; (3)
with:

P k (N) = P # N j=1 D * j = k . ( 4
)

Estimation by recurrence

The goal of this part is to write the probability P (N + 1) with P (N).

The probability P k (N) defined in equation ( 4) is used.

If N = 2, the attacker can see only two observations, ∀k, P k (2) can be computed.

P k (2) = P # D * 2 D * 1 = k ; P k (2) = l * k • D * -l * l * -k D * l * .
This corresponds to a hypergeometric distribution. This distribution describes the probability of drawing k "successes" in l * draws, without replacement, from a population of D * objects that contains l * objects labelled "success". P k (2) can be seen as drawing l * concepts to form D * 2 , k of which should be taken from D * 1 (success).

Then, a recurrence relation can be defined:

P k (N + 1) = l * ∑ k =0 k k • D * -k l * -k D * l * • P k (N) .
(5) This is also a hypergeometric distribution : draw l * concepts to form D * N , k of which should be taken from The black + curve is the extreme case where D = l = 20; it means that a picture contains every concept. So it is impossible to retrieve the concept c and P = 1 D ; but this makes no sense from the HSA protocol point of view. Indeed, all pictures validate all concepts.

The blue curve represents the case with the same security as a PIN code for N = 0. More precisely:

D = 10 • l = 200.
There is a 1 10 chance to select a picture which contains the correct concept. Figure 1 shows that P > 0.9 after only N = 3 observations.

For all different values of D > l, P rapidly increases. Figure 3 is the same as Figure 2, but with P ≤ 0.5.

With D = 2000 and l = 200, with N = 4 observations, the probability P to retrieve the concept is bigger than 0.5.

Constraints

To avoid sieve attacks, all concepts have to be present on screen authentication. In order to not have some concept password more secure than others, each concept have to be contained in the same number of pictures on the same screen. Moreover, to keep the same security as a PIN code for N = 0 observation, each concept has to appear in 1 10 of the pictures at most . On the other hand, every picture has to contain the same number of concepts l in order to not introduce any new bias.

The estimation of l implies that a compromise is required. Indeed, the bigger the number of concepts l by picture, the better is P (N) the probability to retrieve a concept. On other hand, the smaller the number of concepts l by picture, the better is Q the probability to select a good picture by chance. There are ≈ 10 280 possible concept subsets.

• If l = 100 concepts by pictures, 1000 concepts are required to have a good security up to N = 2 observations. There are ≈ 10 140 possible concept subsets.

Security/efficiency trade-off

In the previous section, the human limits and the hardware limits have not been taken into account.

Store 10 140 pictures is impossible. Is it possible to have fewer pictures and keep the same security ? Studying how many pictures are enough is another subject of research for a future work. A solution would be to generate pictures on the fly. Another solution could be that pictures are stored on cloud, but that means that a connexion is required for authentication.

It is important that the HSA protocol can be used by real people. This protocol has to stay practical.

A human limit is for example the number of pictures which are printed on the screen. In [START_REF] Zouinar | Evaluation ergonomique d'un système d'authentification graphique[END_REF][START_REF] Salembier | Experimental studies of a graphical authentication system based on semantic categorisation[END_REF], the authors use only 4 concepts by pictures. One has to remark than 4 is very small.

Another problem is the capacity for a user to retrieve concepts in a picture. If a concept is obvious then the attacker can discover it very fast. For example a colour is a too obvious concept. On the other hand, concepts should not to be too abstract, since users must be able to retrieve them in a picture. Furthermore, according to the culture, abstract concepts can be seen differently. For example the concept wisdom could be represented by an elephant or an owl in different cultures.

Conclusion

The HSA protocol is better than a simple PIN code against shoulder surfing attacks. Unfortunately its improvement is minimal.

In [START_REF] Zouinar | Evaluation ergonomique d'un système d'authentification graphique[END_REF][START_REF] Salembier | Experimental studies of a graphical authentication system based on semantic categorisation[END_REF], the authors use only 4 concepts by pictures, so the security is broken for 2 observations. Indeed, in practice even if many concepts are used to generate the different pictures, this solution is not secure after 2 or 3 observations by the attacker. If l = 200 concepts by pictures, 2000 concepts are required to have a good security up to N = 3 observations and ≈ 10 280 pictures are possible. If l = 100 concepts by pictures, 1000 concepts are required to have a good security up to N = 2 observations and ≈ 10 140 pictures are possible. This represents many possible pictures with many concepts in each picture just to resist to only 2 or 3 observations. Moreover, human limits and hardware limits are not taken into account in this paper. But they represent important limitation in the implementation. Generating pictures on the fly would be an interesting solution, as it would solve many problems of HSA. An attacker won't be able to know the picture database since it does not exist and the device won't have to store all pictures. So she would need detect concepts in pictures. To our knowledge the best methods involve machine learning algorithms. That requires a characterisation step, with a numerous data samples.

Another question is how to generate a picture with 100 concepts such that a human is able to retrieve her concept in this picture?

In practice, it is often better to have no security at all and be fully aware of it rather than having a false feeling of protection relying on weak security. An HSA user is less alert than a standard PIN code user against shoulder surfing attacks. Since they feel protected against this kind of attacks, they are more careless in hiding their authentication. Yet security breaks down quickly (3 observations), so they should not relax their attention.

Figure 1 :

 1 Figure 1: Probability P according to N, for l = 20 and D = 20 in black +, D = 40 in red •, D = 100 in green * , D = 200 in blue , D = 400 in magenta ×.

Figure 1

 1 Figure 1 illustrates the probability according to different values of the number of observation N, for the number of concepts l by picture fixed to 20, and different values of the total number of concepts D.The black + curve is the extreme case where D = l = 20; it means that a picture contains every concept. So it is impossible to retrieve the concept

Figure 2 andFigure 2 :Figure 3 :

 223 Figure 2 and Figure 3 illustrate the shoulder surfing security for various values of l and D. The dashed lines are the line D = 10 • l. They represent Q = 1 10 , the probability to select a correct image by chance; for a PIN code, it is equal to 1 10 as explained in 4.1.

Figure 2

 2 Figure2gives the maximum value of N for which

Finally

  , we try to answer to the questions 1,2 and 3 of paragraph 3.3.1.• If l = 200 concepts per image, 2000 concepts are required to have a good security up to N = 3 observations. A picture is a random subset of l concepts in D concepts.