Valdemar Vicente
email: valdemarneto@usp.br

Graciano Neto

Everton Cavalcante
email: everton@dimap.ufrn.br

Jamal El Hachem
email: jamal.elhachem@univ-pau.fr

Daniel Soares Santos
email: danielss@usp.br

On the Interplay of Business Process Modeling and Missions in Systems-of-Information Systems

Systems-of-Information Systems (SoIS) are a class of systems-of-systems (SoS) in which constituents are information systems and exhibit a strong business-oriented nature. Existing mission notations and approaches for specifying missions in SoIS have not been able to cope with particular characteristics of this class of systems, including the sequence and interdependence among activities, roles definition, and the dynamics of constituents to freely join or leave a SoIS. In this context, we claim that Business Processes Modeling (BPM) techniques and models could complement such approaches, offering support for requirements specification and an additional viewpoint for architectural specification of SoIS. This position paper outlines a discussion on the potential of BPM to complement mission specification modeling notations, as well as it presents some research directions and challenges for modeling missions in SoIS.

I. INTRODUCTION

Systems-of-Information Systems (SoIS) are a class of systems-of-systems (SoS) in which constituents are strictly software-intensive information systems [START_REF] Carlsson | On the nature, function and composition of technological systems[END_REF], [START_REF] Breschi | Sectoral innovation systems: technological regimes, schumpeterian dynamics, and spatial boundaries[END_REF], [START_REF] Saleh | Information Systems: Towards a System of Information Systems[END_REF], [START_REF] Majd | On the Move to Meaningful Internet Systems[END_REF], [START_REF] Neto | Systems-ofsystems: Challenges for information systems research in the next 10 years[END_REF]. Both SoS and SoIS are concerned with the accomplishment of missions. In the SoS context, missions can be viewed as a set of goals to be accomplished by (i) performing tasks based on capabilities of constituent systems, i.e., what they can do to perform such tasks, and (ii) interactions among constituent systems leading to emergent behaviors. Individual missions are realized by constituent systems themselves whereas global missions of an SoS are accomplished through emergent behaviors. [START_REF] Silva | On the characterization of missions of systems-of-systems[END_REF], [START_REF] Silva | A mission-oriented tool for system-of-systems modeling[END_REF].

As SoS, SoIS are often formed by constituent systems that are managed and operated by independent organizations [START_REF] Maier | Architecting principles for systems-of-systems[END_REF]. These constituents in a SoS can cooperate to accomplish interorganizational missions. Considering the current industrial practices, it is not uncommon the emergence of temporary alliances of companies to achieve specific and temporary goals within the context of a project [START_REF] Frame | New tools to support collaboration and virtual organizations[END_REF]. In this sense, SoIS can support inter-organization business processes, making this class of systems to have a strong business-oriented nature. This raises the need of establishing representation and management strategies to support concepts such as sequence of activities and interdependence between roles and goals [START_REF] Neto | Systems-ofsystems: Challenges for information systems research in the next 10 years[END_REF], [START_REF] Lana | Systems-of-systems development: Initiatives, trends, and challenges[END_REF].

We have noticed that current SoIS engineering approaches and notations do not support modeling missions in the SoIS domain. Existing notations such as SysML1 and UML2 activity diagrams require adaptations (profiles) to represent cooperating constituent systems since they do not have native support to model these missions. And mKAOS approach do not hold the notion of inter-dependent activities [START_REF] Silva | A mission-oriented tool for system-of-systems modeling[END_REF]. For SoIS, a notation for specifying missions should encompass (i) a business-oriented nature, (ii) the concept of process with a sequence of inter-dependent activities, and (iii) flexibility for adaptations due to the business dynamics. In this paper, we claim that business process notations and mission modeling languages can interplay to leverage missions modeling in SoIS.

The remainder of this paper is organized as follows. Section II introduces research directions and challenges. Finally, Section III contains some concluding remarks.

II. RESEARCH DIRECTIONS AND CHALLENGES

We glimpse that BPM has potential to complement mission specification. We hereby outline some challenges for missionmodeling based on business processes in the context of SoIS.

Emerging requirements and flexible business-oriented missions. BPM has been commonly used to represent interorganizational/collaborative business processes in industry. The main challenge would be how to use it to represent a business process when participating organizations can join or leave the SoIS mission at runtime. Moreover, it is necessary to consider new requirements arising from emergent behaviors discovered in SoIS or potential business innovations due to new arrangements of existing capabilities [START_REF] Lana | Systems-of-systems development: Initiatives, trends, and challenges[END_REF]. New missions can be designed based on business processes, and current business processes must be flexible to fit those requirements.

Relationship between mission modeling and BPM. The interplay between mission modeling and BPM in SoIS can be properly realized when mapping mission concepts to BPM notations. For instance, Business Process Execution Language (BPEL) is a service orchestration language commonly associated with BPM in the context of Service-Oriented Architecture (SOA), providing strategies for service discovery and architectural self-adaptation [START_REF] Pant | Business process driven SOA using BPMN and BPEL: From business process modeling to orchestration and service oriented architecture[END_REF]. Therefore, BPM models associated with mKAOS mission models can be mapped, via model transformation, to BPEL models with self-adapting characteristics. This approach can be especially useful for an SoIS that adopts SOA as its underlying platform, in which a centralized entity (directed SoIS) orchestrates constituents.

Goal granularity and matching. Goal-based approaches often decompose missions into sub-goals. However, identifying potential constituents that could join an SoIS to increase its capabilities or improve the provided services provided may rise a problem of goal granularity and matching. BPM approaches and tools need to be drawn to automatically define an optimal granularity of sub-goals. Strategies based on ontology and semantic representation can also be established to automate the discovery of constituents with the capabilities needed to solve a sub-goal.

Reuse and/or adaptation of BPM tools to SoIS. In a previous work, we have presented Sinfonia, a collaborative approach based on a software component for modeling and executing business processes in a model-based information system application framework [START_REF] De Oliveira | A Component for Business Processes Management in Information Systems[END_REF]. This tool supports the execution of flexible business processes, i.e., those that can have their flow changed at runtime. As flexibility is a key concern in business process management [START_REF] Kaes | Flexibility Requirements in Real-World Process Scenarios and Prototypical Realization in the Care Domain[END_REF], this type of approach could be extended and adapted to cover SoIS needs and associated to mission modeling in SoIS.

Handling conflicts. In the SoIS context, conflicts among goals may arise for a variety of reasons, such as: (i) the existence of a broader range of stakeholders including both stakeholders of constituents and the stakeholders of the overall SoIS, each one with different interests in the SoIS; (ii) conflicts in the relationship between constituents and the SoIS due to their managerial independence; (iii) conflicts arisen from interactions among constituents due to their operational independence; and (iv) the fact that a given constituent might simultaneously belong to more than one SoIS. Therefore, it is necessary to provide strategies and solutions to tackle these different scenarios that may result in conflicting goals and to assess the impact of such conflicts in the operation of the SoIS and its constituents.

III. FINAL REMARKS

In this paper, we argued the potential of BPM to complement mission specification in the context of SoIS. Due to the predominant business-oriented nature of this particular type of SoS, specific notations are required to capture the characteristics exhibited by SoIS. BPM can be useful in this effort since: (i) it is possible to adopt well-established tools supporting BPM to allow for SoIS mission modeling, simulation, automation, and monitoring; (ii) BPM models bring the possibility of converting them to the BPEL format, thereby allowing for processing and compilation; (iii) a BPM metamodel is available, thus allowing for model transformations to other models, including code generation; and (iv) there are well-established notations, which reduce learning curve and can facilitate mission modeling in SoIS.

Missions are a concept from SoS domain while business processes come from the Information Systems domain. Both business processes and SoIS do not exhibit the notions of missions yet. As business processes represent a key concern for the Information Systems domain [START_REF] Shafer | The power of business models[END_REF] and missions are a key concern for SoS [START_REF] Silva | Bridging missions and architecture in software-intensive systems-of-systems[END_REF], it is of paramount important to fit these concepts in SoIS research.

http://www.omg.org/spec/SysML/1.4/

http://www.uml.org/


Vanea Chiprianov
email: vanea.chiprianov@univ-pau.fr

Laurent Gallon

Khouloud Salameh

Manuel Munier

Richard Chbeir

Jamal El Hachem

To- Wards

Towards Security Software Engineering the Smart Grid as a System of Systems

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

The Smart Grid (SG) is an enhancement of the 20 th century power grid [START_REF] Fang | Smart grid -the new and improved power grid: A survey[END_REF]. While traditional power grids generally carry power from central generators to customers, the SG uses twoway flows of electricity and information to create an automated and distributed energy delivery network. While the information flow enables capabilites like self-monitoring, self-healing and energy efficiency, such a heavy dependence on ICT surrenders the SG to vulnerabilities associated with ICT.

This increases the risk of compromising reliable and secure power system operation, which is the ultimate objective of the SG. Therefore, cyber security is regarded as one of the biggest challenges in the SG [START_REF]Nist framework and roadmap for smart grid interoperability standards[END_REF]. Attacks on the current power grid and similar systems have raised a strong awareness about the possible severe consequences these may have in the SG, from customer information leakage to a cascade of failures, such as massive blackout. For example, the North American Equipment Council reported the effects of a slammer worm on the power utilities [START_REF]Sql slammer worm lessons learned for consideration by the electricity sector[END_REF]; Stuxnet has shown how a stealthy attack targeting both hardware and software is possible [START_REF] Kushner | The real story of stuxnet[END_REF].

Some of these new security challenges raise from the big number of composing elements of the SG, their interactions and the new capabilities these interactions generate. All these indicate that the SG is a System of System (SoS). In what follows, we present the main characteristics of the SG and analyze it as an SoS, in Section II. We then identify, analyze and classify security challenges and solutions in the SG, according to the specific characteristics of SoS, in Section III. To address them, we introduce a vision/framework/roadmap based on principles of Software Engineering, in Section IV.

II. THE SMART GRID AS AN SOS

We introduce the main components of the SG, the specific characteristics of SoS and analyze how the SG is an SoS.

A. The Smart Grid

An SG is a modernized electrical grid that uses ICT to gather and act on information in an automated fashion, to improve the efficiency, reliability, economics, and sustainability of the production and distribution of electricity. To realize these advantages, SG architectures have been proposed, e.g. [START_REF] Ancillotti | The role of communication systems in smart grids: Architectures, technical solutions and research challenges[END_REF]. Based on the GridWise architecture [START_REF] Chassin | Decentralized coordination through digital technology, dynamic pricing, and customer-driven control: The gridwise testbed demonstration project[END_REF] and the description presented in [START_REF] Fang | Smart grid -the new and improved power grid: A survey[END_REF], we define our vision of the SG (cf. Figure 1).

A closer look at the SG functioning leads us to define four basic systems, namely: i) Smart Infrastructure System, ii) Smart Information System, iii) Smart Management System, and iv) Smart Protection System. The key success of the SG lies on maintaining a seamless interaction and data exchange between its CSs. We detail each in the following.

1) Smart Infrastructure System: Its focus lies in the energy system, consisting of the following subsystems: a) Power Generation subsystem: due to the support of two flows of electricity, new power generation paradigms are enabled. They comprise: i) Distributed Energy Resources: include small scale power generation like solar panels, combined heat and power or cogeneration systems, wind turbines, micro turbines, backup generators and energy storage. Storage elements can be deployed every where in the SG: power generation, transmission, distribution, and customers (e.g. electric vehicle batteries). They can be seen as a distributed storage system, which helps balance energy consumption and production. The storage system is critical for the SG, and must be highly secured.

ii) Virtual Power Plants: an aggregation of customers (e.g. residential, commercial, industrial, etc.) under one type of Pricing, Demand Response or Distributed Energy Resource program. Their distributed generators may have a total capacity comparable to that of a conventional plant.

iii) Grid-to-Vehicle and Vehicle-to-Grid: electric vehicles with energy stored in batteries could perform a variety of services while connected to the power grid. In Grid-to-Vehicle, vehicles need to be charged after the batteries deplete. The charging operation leads to a significant new load on the existing distribution grids. In Vehicle-to-Grid, vehicles provide a new way to store and supply electric power. The two concepts are related. For example, vehicles can be used to provide power to help balance loads by "peak shaving" (sending power back to the grid when demand is high) but also "valley filling" (charging when demand is low). b) Transmission subsystem: responsible for moving the power over long distances to substations. The generated electric power is stepped up to a higher voltage for transmission. Upon arrival at a substation, the power is stepped down from the transmission level voltage to a distribution level voltage. c) Distribution subsystem: upon arrival at the service location, the power is stepped down again from the distribution voltage to the required service voltage(s).

2) Smart Information System: In this system, the information exchanged between the SG components can be found. This information is processed by several subsystems: a) Smart Metering subsystem: a smart meter is usually an electrical meter that records consumption in intervals of an hour or less and sends that information at least daily back to the utility for monitoring and billing. It has also the ability to disconnect and reconnect remotely and control the user appliances and devices in order to manage loads and demands. b) Communication subsystem: is responsible for communication connectivity and information transmission among systems, devices, and applications. It will leverage existing wireless and wired communication technologies. The Supervisory Control and Data Acquisition (SCADA) system is a power operation monitoring system across the management, transmission, and distribution domains. c) Reasoning subsystem: after receiving the data extracted from smart meters, the role of this subsystem is essential in translating it semantically, providing a shared understanding of the information exchanged in the SG domain and allowing its CSs to reason and act autonomously.

3) Smart Management System: Uses information extracted from the Smart Information System to provide advanced management and control services and functionalities using: a) Energy Market subsystem: negotiates the energy price between the consumers and the producers with the goal of reaching the optimal balance in energy production and consumption at any given point in time.

b) Energy Optimization subsystem: applies optimization techniques, to maximize the utility function of each SG CS. c) Mobility subsystem: bearing in mind the mobility of SG components (e.g. electric vehicles), this subsystem handles their operations even during their displacements.

4) Smart Protection System: Transversal to the other systems, provides grid reliability analysis, failure protection, and security and privacy protection services. The Security and Privacy part will form the focus of what follows in this paper.

The SG is a complex system, with significant differences in terms of new components, new interactions and capabilities, when compared to the traditional power grid. To analyze this complexity, we use concepts related to Systems of Systems.

B. Systems of Systems

Systems of Systems (SoSs) [START_REF] Jamshidi | System of systems engineering -new challenges for the 21st century[END_REF] are large and complex systems, composed of several independent, concurrent and distributed Constituent Systems (CSs), although numerous definitions for SoS have been advanced (e.g. cf. [START_REF] Gorod | System of Systems Management: A Network Management Approach[END_REF]). SoSs have been identified [START_REF] Klein | A Systematic Review of System-of-systems Architecture Research[END_REF] in defence and national security, earth observation systems, space systems, modelling and simulation, sensor network, healthcare, electric power grid, business information system, transportation system and astronomy.

Several characteristics that differentiate SoSs from monolithic systems have been identified. For example, it is well accepted that SoSs are characterised by the fact that the CSs are independent from an operational and managerial point of view, that the SoS does not appear fully formed, but rather its development is evolutionary, with functions and purposes added, removed, and modified with experience, by the fact that the functions and purposes of the SoS do not reside in the CSs, but rather emerge from the entire SoS, and finally by the large geographic extent of the CSs [START_REF] Maier | Architecting principles for systems-of-systems[END_REF]. Other sets of characteristics of SoS, partially overlapping, have been identified, e.g. [START_REF] Boardman | System of systems -the meaning of OF[END_REF]: autonomy, belonging, connectivity, diversity, emergence.

Using the management criterion, SoS have been categorized into [START_REF] Maier | Architecting principles for systems-of-systems[END_REF]: (1) Directed: CSs operate subordinated to the central managed purpose; (2) Collaborative: CSs voluntarily collaborate to fulfill the agreed central purposes; (3) Acknowledge: there are recognized objectives, a designated manager, and resources for the SoS; (4) Virtual: lack of a central management authority and a centrally agreed purpose for the SoS.

C. The Smart Grid as an SoS

A study [START_REF] Pérez | Large-scale smart grids as system of systems[END_REF] analyses the SG according to the five criteria that differentiate SoSs from monolithic systems: (i) Operational and managerial independence: the SG is constituted from systems such as solar, wind plants, swarms of electric vehicles, which operate on their own and have different owners and managers. (ii) Evolutionary development: different energy generating systems can be dynamically aggregated/removed to/from the power grid. (iii) Emergent behaviour: producers, providers and consumers coordinate in order to balance supply and demand. (iv) Geographic distribution: the energy generation, storage, and consumption should be realized as near as possible to the physical location of consumption/generation in order to achieve greater efficiency of the system. This requires a shift from current centralized energy infrastructures towards more distributed ones. The study concludes that the SG is a Collaborative/Acknowledge SoS that integrates other SoSs, which have operational and managerial independence.

III. SECURITY CHALLENGES TO THE SG AS AN SOS

Traditionally, security deals with confidentiality, integrity and availability [START_REF] Avizienis | Basic concepts and taxonomy of dependable and secure computing[END_REF]. Related to these, the high-level SG security objectives identified by [START_REF]Guidelines for smart grid cyber security[END_REF] are: i) Availability: ensuring timely and reliable access to information. Its loss means the disruption of access to information, which may further undermine power delivery. ii) Integrity: guarding against improper information modification or destruction. It is essential to ensure non-repudiation and authenticity. Its loss may induce incorrect decisions regarding power management. iii) Confidentiality: preserving autorisations on information access. It is necessary for the protection of proprietary information and personal privacy. In the SG, availability is more important than integrity, which is more important than confidentiality [START_REF] Liu | Cyber security and privacy issues in smart grids[END_REF], [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. In what follows we analyse challenges to assuring these security objectives, challenges raised by the characteristics that differentiate the SG SoS from monolithic systems.

A. Operational independence challenges a) Identification, authentication and access control: The SG infrastructure incorporates millions of electronic devices and users. Identification and authentication is the key process of verifying the identity of a device or user as a prerequisite for granting access to resources in the SG information system. To meet these requirements, every node (cf. Availability objective) in the SG must have at least basic cryptographic functions, such as symmetric and asymmetric cryptographic primitives, to perform data encryption and authentication [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. A review on how encryption, authentication, and access control can be added to current communications is presented in [START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF].

b) Device security issues: Each of the key components of the SG may have its specific vulnerabilities [START_REF]Guidelines for smart grid cyber security[END_REF]. For the smart meter: customer tariff varies on individuals, and thus, breaches of the metering database may lead to alternate bills; functions like remote (dis)connect and outage reporting may be used by unwarranted third parties. Possible solutions may include: ensuring the integrity of meter data; detecting unauthorized changes on meter; authorizing all accesses to/from smart meter networks. Electric vehicles can be charged at different locations, thus inaccurate billing or unwarranted service will disrupt operations of the market. Possible solutions include establishing electric vehicle standards. For SCADA [START_REF] Liu | Cyber security and privacy issues in smart grids[END_REF]: intercepting, tampering, or forging distribution control commands or access logs; synchronizing time-tagged data in wide areas; improper models for decision making; inconsistent agreement on load control; false forecasts. Possible solutions may include: ensuring commands and log files are accurate and secure; using a common time reference (GPS time-stamped) for time synchronization; using multi-layer intrusion detection.

B. Managerial independence challenges

c) Accountability: It means that the system is recordable and traceable. Even if a security issue appears, the accountability mechanism determines who is responsible for it, be it a user or an organisation managing a part of the SG. This is especially important because the SG involves different organizations, each with its own business objectives and regulatory requirements depending on the country in which it is based and in which it operates. This part of security concerns both the energy and the information. All records can be used as evidence in future judgment. Under such a circumstance, no one can deny their actions, not even the administrators or other users with high privileges. Together with some suitable punishments or laws, this will prevent many attacks [START_REF] Liu | Cyber security and privacy issues in smart grids[END_REF]. Additionnaly, it can be used to determine the cause or extent of damage from an attack or failure, in digital forensics.

C. Evolutionary development challenges

d) Backwards compatibility: Compatibility problems could emerge while integrating legacy devices (of the traditional power network) into the SG, which may cause the system to fail or malfunction [START_REF]Guidelines for smart grid cyber security[END_REF].

e) Secure and efficient communication protocols: Differing from conventional networks (e.g. Internet), message delivery requires both time-criticality (from legacy power grid) and security in the SG, in particular in Distribution and Transmission Grids. Tradeoffs are required to balance communication efficiency and information security in the design of communications protocols and architectures for the SG [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. Therefore, the impacts of security protections need to be minimized and their timing made predictable [START_REF] Liu | Cyber security and privacy issues in smart grids[END_REF].

f) Co-design of control and security: Industrial control normally does not do too much about security. Recently, some attention has been dedicated to it. Co-design of control and security in the SG will be interesting in the future [START_REF] Liu | Cyber security and privacy issues in smart grids[END_REF].

D. Emergent behaviour challenges

g) Hidden vulnerabilities due to interdependencies: Ensuring the management objectives of the Smart Management System (e.g. energy efficiency) involves interactions between several CSs of the SG SoS. This makes these objectives exposed to chains which include vulnerabilities specific to each CS, and which could be exploited when the CSs interact to realize a management objective. Possible solutions include continuous (real-time) monitoring to identify them [START_REF] Bari | Challenges in the smart grid applications: An overview[END_REF]. In this way, attacks can be detected in time and appropriate actions can be taken quickly through a rapid restoration plan.

E. Geographic distribution challenges h) Attack detection:

The SG features a relatively open communication network over large geographical areas. Accordingly, it is almost impossible to ensure every part or node in the SG to be invulnerable to network attacks. Therefore, the communication network needs to consistently perform profiling, testing and comparison to monitor network traffic status such as to detect and identify abnormal incidents due to attacks [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. Types of attacks targeting:

1) Availability: The most important type of attack is Denial of Service (DoS) -the attempt to delay, block or corrupt the communication in the SG. It can appear at all layers: physical -channel jamming, MAC -ARP spoofing, network and transport -traffic and buffer flooding and application; for a literature review of these attacks in the SG, consult e.g. [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. In the SG, a DoS attacker does not need to completely shut down network access by using some extreme means (e.g. all-time jamming) but instead it may launch weaker versions of attacks to intentionally delay the transmission of a timecritical message to violate its timing requirements. Therefore, the goals of DoS attacks in the SG include not only disrupting the resource access but also violating the timing requirements of critical message exchange. To model the impact of DoS attacks in Distribution and Transmission Grids, messageoriented metrics, which not only characterize the end-to-end message delay but also reflect the delay constraints, should be properly defined. Assessing the risk of large DoS attacks is reviewed in [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF], which concludes that it is quite difficult for Probabilistic Risk Assessment to estimate the probability of potential large-scale DoS attacks against the Smart Grid, as there is no historic data for profiling; also graph and security metric assessments are not able to demonstrate to what extent a DoS attack would undermine the power system with respect to time-critical messages; therefore accurate risk assessment such attacks remains a challenging issue.

2) Integrity: Attacks aim at deliberately and illegally modifying or disrupting data exchange in the SG. They occur generally at the application layer. The target can be customers' information (e.g. pricing information and account balance) or status values of power systems (e.g. voltage readings and device running status). The false data injection attacks against power grids, discovered and designed in [START_REF] Liu | False data injection attacks against state estimation in electric power grids[END_REF], have drawn increasing attention. Research on false data injection attacks has become an active and challenging field in SG security. This research is classified e.g. in [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF] into attacks against: DC SCADA and AC SCADA, impacting the state estimation, and against the electric market, with potential financial loses.

3) Confidentiality: Attacks intend to acquire unauthorized information from network resources in the SG. The attackers eavesdrop on communication channels to acquire information such as a customer's account number, personal profiles of customers which can be used to detect whether people use specific facilities. Such abuses may allow a malicious person to know whether or not you are at home, know your working hours, or if you are away on vacation. The thief could then visit your home without fear of being caught! These attacks have low impact on the functionality of the SG, but very high on customer privacy [START_REF] Fang | Smart grid -the new and improved power grid: A survey[END_REF], and social concerns have received more and more attention in recent years. Examples include wiretappers and traffic analyzers [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. These issues may be addressed [START_REF] Liu | Cyber security and privacy issues in smart grids[END_REF] by anonymous communication technologies. However, to effectively implement these anonymisation mechanisms, it is first necessary to have clearly identified the information to be protected, the inferences to be avoided, and computations to perform on such anonymised data. Moreover, these technologies may cause overhead or delay issues. In addition, network traffic camouflage techniques could be considered to hide critical entities (e.g. database, control center) in the grid.

IV. ROADMAP/VISION/FRAMEWORK FOR SECURITY SOFTWARE ENGINEERING THE SMART GRID AS AN SOS

Having identified and analysed security challenges specific to the SoS nature of the SG, we have also seen that addressing them involves a multitude of solutions. How could these solutions be integrated into a more complete framework? One such vision could be similar to the one described in [START_REF] Fang | Smart grid -the new and improved power grid: A survey[END_REF] for management applications and services. This proposes the "Smart Grid Store", an integrated platform in which many management applications and services are available online. Users can choose their expected services and download them. Of course, verifications of interoperability and compatibility are necessary as well. A similar integrated platform can be envisioned for security solutions. To build such a platform, principles of Software Engineering could be used.

Software Engineering deals with systematic methods, lifecycle processes and tools for defining software. As the SG is a cyber-physical system [START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF], Software Engineering is useful at addressing especially the cyber/software security challenges, and the impacts of physical security challenges on the cyber part, but it will be limited when addressing challenges specific to the physical nature of the SG.

A. Life-cycle Management

The main challenge for managing the life-cycle of the SG is taking into account the legacy system of the traditional power grid. If we consider the traditional power grid as the first iteration, and the SG as the second iteration, we may consider that an iterative, spiral development process describes the life-cycle of the SG SoS. Such a spiral process begins with considering the requirements of the new iteration, developing an architecture to fulfill them, implementing it in code, verifying the code and releasing the new iteration.

B. Requirements

The requirements of the second iteration in developing the SG need to both integrate the characteristics of the legacy power grid, and fulfill the expectations for the new SG. Examples of legacy characteristics that influence security include high restrictions on transmission delay and failures; e.g. delay constraints for messages for substantion communication in IEC 61850, range from 3 ms to 500 ms. This is directly related to the backwards compatibility and co-design challenges.

In the requirements phase, risk management is usually performed. Security-related risks are part of SG risk identification and mitigation. In this work we focus not on the management of risks inherent to the industrial activity itself, but on risks regarding the security of information. These include new security risks resulting from new capabilities composed from interacting CSs, as well as any residual security risk of CSs [START_REF] Dahmann | Security engineering in a system of systems environment[END_REF]. How to identify and mitigate risks associated with endto-end flow of information and control in the SG, without, if possible, focusing on risks internal to individual systems? While there are standards for risk management of standalone systems [START_REF]International Organization for Standardization (ISO)[END_REF], there are not for SoS. To what extent do they apply to the SG SoS? In the same way it is necessary to take into account the operational independence of CSs in the design of the security of the SG SoS -the framework should enable the cooperation of various Information Security Management Systems for overall risk management.

For example, [START_REF] Zafar | System security requirements analysis:a smart grid case study[END_REF] applied SQUARE to identify security requirements for the SG. They concluded that, from an SoS perspective, it is necessary to increase the method's support for dealing with and resolution of conflicts between requirements. These conflicts could be caused by the fact that requirements come from different stakeholders, or by impacts between security and functional and other non-functional requirements.

C. Architecture

Any architecture of the SG will have to first describe the legacy power grid and then allow for modelling the mechanisms that implement the expectations of the new SG. The same applies for the security architecture. Features of the SG, such as heterogeneous devices and network architecture and delay constraints on different time scales, make it impractical to uniformly deploy strong security approaches all over the SG. Consequently, the SG requires fine-grained security solutions designed for distinct network applications [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. How to choose between them, how to use them together? Tradeoff analysis of security mechanisms is necessary.

A key architectural tool in this respect may be the use of predictive modelling and simulation to compare architectural alternatives, "what-if" scenarios [START_REF] Eusgeld | System-of-systems approach for interdependent critical infrastructures[END_REF]. Alternative architectures would need to be carefully considered and modelled to ensure the SG is not compromised or undesirable emergent behaviours result, or the security requirements are not met. A review of simulation challenges, techniques, and future trends in the SG is performed in [START_REF] Li | Simulation of the smart grid communications: Challenges, techniques, and future trends[END_REF]. Among simulation techniques, event-based has been considered as particularly well suited due to its enabling loose couplings [START_REF] Chiprianov | Towards modelling and analysing non-functional properties of systems of systems[END_REF].

D. Implementation

If the architecture is described using Model-driven languages and tools, this will enable readily code generation. However, specific issues will persist. One such issue is related to information management (in the Smart Information Subsystem of the Smart Infrastructure System).Information analysis, integration, and optimization in the SG will need Big Data approaches, as exemplified by [START_REF] Tannahill | System of systems and big data analytics bridging the gap[END_REF].

E. Verification

As CSs of the SG will be defined by different organisations, this implies that certification and quality processes will be different. Still, common standards need to be agreed upon. Additionally, using simulation for creating descriptive architectures is useful for verifying them as well.

F. Release

The SG release process is triggered every time some aspect of the SG (including individual CSs) evolves. Operational and managerial independence properties mean that synchronisation between the CSs and their managing organisations may not be possible when updates are deployed. Special care needs to be taken, therefore, at each release to detect undesired emergent behaviour, so monitoring becomes essential. In some cases, evolution may impact the conformance to requirements. At runtime, it is important to ensure that the required levels of requirements (security, but also performance, etc.) are achieved. If not, re-engineering is required.

V. RELATED WORK

To identify works related to security challenges to the SG as an SoS, we performed a Systematic Literature Review (SLR) [START_REF] Kitchenham | Systematic literature reviews in software engineering a systematic literature review[END_REF] For this, we searched the databases of Scopus, ACM Digital Library, IEEE Xplore Digital Library and SpringerLink, in title, abstract and keywords, using the search string: (challenge OR issue) AND security AND ("smart electrical grid" OR "smart power grid" OR "intelligent grid" OR intelligrid OR futuregrid OR intergrid OR intragrid) AND ("system of system" OR "system-of-system" OR "system of systems" OR "systemof-systems"). We included only papers in English, from the Computer Science domain, published all years. We excluded conference reviews. From the results, we excluded papers after reading their titles and abstracts, and deciding they are not sufficiently related to the research question. After reading these papers, we found among their references new studies pertinent for our research which were therefore added. The papers we finally retained are presented next in this section.

A clear disscussion and review of security issues in the SG and possible solutions to them, well structured around the three high-level objectives of availability, integrity and confidentialy, is presented in [START_REF] Wang | Survey cyber security in the smart grid: Survey and challenges[END_REF]. Another catalogue of challenges and possible solutions is furnished in [START_REF] Liu | Cyber security and privacy issues in smart grids[END_REF]. A review of attacks and risks in the SG, analyzing the coupling between the power control applications and the cyber system is presented in [START_REF] Sridhar | Cyber physical system security for the electric power grid[END_REF]. Some security challenges in the SG and approaches to address them are presented in [START_REF] Bari | Challenges in the smart grid applications: An overview[END_REF]. While these reviews consider the SG as a complex system, and even mention SoS, they do not analyse the security challenges for the SG by considering the specific characteristics that differentiate the SG as an SoS from monolithic systems, as we do.

[22] applies SQUARE to identify security requirements of the SG and analyses them from an SoS perspective. [START_REF] Lakshminarayanan | Applying model based systems engineering approach to smart grid software systems security requirements[END_REF] applies Model Based Engineering to capturing security requirements of the SG analyzed from an SoS perspective. A risk analysis of the SG as an SoS [START_REF] Chen | Risk analysis of gps-dependent critical infrastructure system of systems[END_REF] focuses on the increased dependence on GPS and the spoofing threaths this engenders for the SG. All these works focus on security requirements of the SG, while we address al phases of the life-cycle. Some works focus on the security architecture of the SG. Challenges with respect to authentication and authorization of SG applications are discussed in [START_REF] Lakshminarayanan | Authentication and authorization for smart grid application interfaces[END_REF], which proposes a reference architecture based on Service Oriented Architecture (SOA). However, this is limited to authentication and autorisation, and the SG is analyzed as an SoS just to identify loosely conected interfaces which supports the use of SOA. An SG simulation of a wireless ecosystem architecture, using OMNeT++, studied DoS attacks [START_REF] Pitas | Emerging communication technologies and security challenges in a smart grid wireless ecosystem[END_REF]. However, specific challenges due to the SoS nature are not highlighted. Another simulation prototype, based on a testbed using customisable hardware and available software, is used in [START_REF] Min | Design and analysis of security attacks against critical smart grid infrastructures[END_REF] to investigate mitigations to a blackout attack targetting the SG as an integrated system, an interconnected SoS.

A mathematical modelling of the SG as two complex interdependent networks: power and communication, interconnected by edges, enables analysis of random and selective attacks, which shows that the SG disintegrates faster for targeted attacks compared to random attacks [START_REF] Ruj | Analyzing cascading failures in smart grids under random and targeted attacks[END_REF].

The results of the SLR we performed show the number of works addressing the security of the SG as an SoS is quite reduced, but has increased recently, especially in 2014. However, most of them focus only on one phase of the development life-cycle of a security solution. Moreover, they focus on requirements and architecture phases, using (mathematical) modeling and simulation, but they do not address implementation, verification or release phases. This may be explained at least partially by the physical nature of the SG, which is costly to emulate, especially in an academic context, and suggests collaborations with industry would be highly desirable to have access to more realistic conditions.

VI. CONCLUSION

In this paper we discussed how specific characteristics of the SG SoS (operational and managerial independence; evolutionary development; emergent behaviour; and geographic distribution) raise challenges for security engineering. To address these vulnerabilities, we proposed a framework based on Software Engineering principles. This framework indicates directions which could be taken, based especially on modelling, simulation and code generation techniques.

Fig. 1 .

 1 Fig. 1. Smart Grid framework.


Carlos Aldana

Arnaud Isch

Yves Coquet

Ary Bruand

Keywords: water density, * g: gravity acceleration, * ρ b : bulk density

come

Measurement of hydraulic properties of soils and rocks using an unconventional triaxial system coupled to the multistep outflow method

) K s (cm.j-1)

ABSTRACT

Understanding the transport properties of the vadose zone is a cornerstone in the preservation of aquifers and water resources. In this experimental study, an unconventional triaxial system based on the multistep outflow method is used to measure the hydraulic properties of soils and rocks at different degrees of saturation. Some of the main features of the set-up is the accuracy in the outflow measurement (1 mm3) and the possibility to apply an overburden pressure to simulate field conditions throughout the experiment. Saturated measurement is followed by the unsaturated experiment, both running on the same sample, which improves the consistency of the measured properties. Estimation of the volume change of the samples throughout the experiment is also performed. After several runs, the measurement system has been proved effective. The saturated condition is ensured by an algorithm integrated in the software which further improves the automation of the applied protocol. Hydraulic properties were obtained from a saturated state down to a one bar matric suction. The pressure translation technique helped avoid the presence of air bubbles in the system thus improving outflow measurements.

MATERIALS AND METHODS

RESULTS AND DISCUSSIONS

1. SAMPLING

TRIAXIAL SYSTEM ASSEMBLY 3. PROTOCOLS

CONCLUSION

On the whole, data from the presented unconven�onal triaxial system is consistent with the characteris�cs of the tested materials. The system has proved high versa�lity in both saturated and unsaturated experiments which have been carried out with the same lab equipment. Samples with different nature and hardness were successfully tested. Field condi�ons were simulated which is not possible when using a conven�onal setup (Temp cell). The working pressure of the pressure-volume controllers and the accuracy of measurements allow to easily reach high pressure gradients for those samples having low hydraulic conduc�vity, which cannot be obtained with a gravity-driven conven�onal set-up.

Carlos Aldana, Arnaud Isch, Yves Coquet, Ary Bruand

We gratefully acknowledge the financial support provided to the PIVOTS project by « La Région Centre -Val de Loire» and the European Regional Development Fund. -The problem of air di usion was overcome with the pressure translation technique. No correction was needed for the cumulative outow unlike other laboratory conventional set-ups.

-The accuracy of the controllers helped improve the measurement of hydraulic properties since their resolution is 1 mm This feature along with their working pressure range allowed to measure low conductivity values for some rocks.

-No tensiometers in the set-up was available which decrease tting of matric suction at the begining of each pressure step.

IMPORTANT FEATURES RELATED TO K(θ) EXPERIMENT

-K was measured for all samples with h ranging from -10 to -900 cmH O.

-K(θ) curves display caracteristic shapes according to their textures. However, values seem to be lower than those found in the literature probably because consolidation has been applied during the experiments.

-The technique has shown versatility with a wide range of samples being tested.

-The protocol allows to combine the saturated experiment with the unsaturated one, all in a single experimental setup, thus improving the consistency of measured properties.

-

  mass of water stored in the sample *ΣVi=cummulative outflow volume of water at ti *Mds= mass of the dry sample Indirect measurement of sample deformation was possible. However, local strain transducers could be used for direct measurement.

.69E-04 Measurement of Hydraulic Proper�es of Soils and Rocks using an Unconven�onal Triaxial System based on the Mul�step Ou�low Method. Ins�tut des Sciences de la Terre d'Orléans (ISTO), UMR 7327 -CNRS/Université d'Orléans/BRGM, 1A rue de la Férollerie 45071 Orléans Cedex 2

	Sample A	Limestone	16.15	300	2.14	1.20E+00
	Sample B	Soil	0.75	10	1.30	2.81E-03
	Sample C	Weathered limestone	4.50	70	1,61	8.98E-03
	Sample D	Sand deposit	3.75	58	1.89	8.62E-02
	Sample E	Soil	1.55	20	1.36	5.71E-03
	Sample G	Weathered limestone	1.15	15	1.55	2.36E-02
	Sample H	Sand deposit	4.10	64	1.75	5.02E-02
	Sample I (rep A)	Limestone	16.15	300	2.14	2.00E-01
	Sample J	Limestone	7.50	124	2.00	1

(1)

(3) (4)

(5) (4)


Eric Laporte
email: eric.laporte@univ-mlv.fr-christian.leclere@univ-mlv.fr

Christian Leclère

Maria Carmelita

P Dias

Éric Laporte

Maria Carmelita Dias
email: mcdias@let.puc-rio.br

Very strict selectional restrictions: a comparison between Portuguese and French

come

Introduction

We discuss the characteristics and behaviour of two parallel classes of verbs in two Romance languages, French and Portuguese. Examples of these verbs are Port. abater [gado] and Fr. abattre [bétail], both meaning 'slaughter [cattle]'.

Such collocations are intermediate cases between verbal idioms and largely free verb phrases. Precise knowledge of these verbs would aid recognition of verb senses in texts and therefore be useful for natural language processing. The objective of this study is to compare the importance of these classes of verbs within the respective lexicon of both languages, and in particular to investigate corresponding pairs such as abater [gado]/abattre [bétail].

Related work

The distributional restrictions attached to word combinations show a continuum ranging from relatively free combinations between meaningful words (e.g. mount a hill) to the unique combinations observed between the elements of idioms (e.g. mount the guard). A distributionally frozen idiom such as mount the guard can be seen as an extreme case of selectional restriction in which only the guard can fill one of the slots of the verb [START_REF] Guillet | Représentation des distributions dans un lexique-grammaire[END_REF]. In the intermediate case, the set of nouns that can fill a slot is reduced to a semantically homogeneous set of few nouns. For example, the verb mount in mount a show has a precise meaning observed only with play, opera and a few other nouns denoting spectacles. A list of phrases corresponding to this situation, called 32R3, had actually been produced for French [START_REF] Boons | La structure des phrases simples en français. 2. Classes de constructions transitives[END_REF], and was extended later by the LADL 1 to a list of 1003 verbs 2 .

When a verb selects a small set of nouns as its possible complement, this set can sometimes be characterized as the set of the hyponyms of a noun. For example, all the complements of Port. abater [avião, helicóptero] 'bring down [plane, helicopter]' are probably aeronave 'aircraft' and its hyponyms. Thus, our research is also indirectly connected with ontologies [START_REF] Gruber | A translation approach to portable ontologies[END_REF] and the semantic classification of nouns [START_REF] Gross | Synonymie, polysémie et classes d'objets[END_REF].

Comparison between French and Portuguese

We borrowed the definition of French class 32R3 from [START_REF] Leclère | Organization of the Lexicon-Grammar of French verbs[END_REF] and transferred it to Brazilian Portuguese 3 . Verbs in this class share some important features: e.g. they take only one essential complement and do not admit a sentential object or subject. These criteria define the classes as highly residual ones, i.e. they select verbs with few other interesting properties 4 . We made a cross-lingual comparison between samples of the French and Portuguese classes. Our starting point was the list of French verbs [START_REF] Boons | La structure des phrases simples en français. 2. Classes de constructions transitives[END_REF] beginning with a, in its updated version, and their translation into Portuguese. We then looked up all the verbs starting with a in an important Portuguese dictionary [START_REF] Houaiss | Dicionário Eletrônico da Língua Portuguesa[END_REF] and satisfying the definition, and translated the Portuguese verbs into French. This process produced a list of 74 Portuguese candidates and 75 French candidates to be included in the class. These lists include the entries in a that are members of the class in one of the languages, and their translation into the other, if they exist 5 . However, collocations and other word combinations are language-dependent phenomena: even if a member of the class in one language has a translation into the other, this translation is not 1 Laboratoire d'automatique documentaire et linguistique, Université Paris 7, 1968-2000. 2 This list is available on the web at http://infolingu.univ-mlv.fr/english: follow Linguistic Data, Lexicon-Grammar, View. 3 When a verb has several senses, we considered each of them as a separate lexical entry, e.g. Port. abater [avião] 'bring down [plane]' was considered distinct from abater [gado] 'slaughter [cattle]'. 4 However, the phenomenon of very strict selection also occurs with other verbs, e.g. intransitive or ditransitive verbs, and is worth a systematic study. 5 Fr. aplatir [balle], a technical term of rugby, has no translation in Brazilian Portuguese. necessarily a member of the class in the other language. For example, Fr. aplanir [difficulté] can be translated into Port. amainar [dificuldade], but Port. amainar can be used with much more various complements than Fr. aplanir (with this abstract meaning). Other verbs are only translated by syntactically different constructions6 . Thus, among a total of 74 pairs (French and Portuguese verbs of the sample and their translation), 47 % are pairs of members of this class in both languages (see table ).

The sets of nouns selected

The verbs in class 32R3 and in its Portuguese counterpart select small sets of nouns. These sets of nouns are by definition semantically homogeneous. For example, the complements of Port. abater [avião] 'bring down [plane]' are aeronave, avião, helicóptero and others. Some of these sets of nouns are even sets of synonyms: for example, Port. amortecer [impacto] takes such complements as choque, colisão, impacto... How can these sets of nouns be represented in a formal grammar? The conclusions of [START_REF] Guillet | Représentation des distributions dans un lexique-grammaire[END_REF] about French can be extended to Portuguese. Some of the sets of nouns in question can be specified through the choice of canonical representatives, e.g. aeronave for the complements of abater

[avião], i.e. these sets consist of the canonical representative and all its hyponyms. For example, the set of hyponyms of aeronave is the set of nouns N for which the sentence N é um aeronave 'N is an aircraft' is true for the common sense7 . However, in some cases, the only suitable canonical representative would be a whole phrase including elements of definition. For example, the comple-

Conclusion

The class of verbs we discussed are quite frequent in Portuguese and French, and probably also in other languages. Therefore, their study is useful for a number of computer applications both monolingual and bilingual. We showed that the behaviour of these combinations in Portuguese and in French are quite similar, but that the combinations themselves are mirrored by equivalent ones in roughly half the cases. The sets of nouns selected by this type of verbs are interesting subjects of study themselves, but their representation by canonical representative is bound to be only an approximation in a large number of cases.

Table -

 - Verbs with very strict selectional restrictions in French and Portuguese (excerpt)

				PORTUGUESE
	VERB	COMPLEMENT VERB	COMPLEMENT
	abattre	avion...	abater	avião...
	abattre	bétail...	abater	gado...
	abjurer	foi...	abjurar	fé...
	abolir	loi...	abolir	lei...
	abroger	loi...	ab-rogar	lei...
	boucler	ceinture...	afivelar	cinto...

We found that 62 % of the 74 Portuguese verbs, and 85 % of the 75 French verbs could be included into the class. This difference tends to indicate that though it is present in both languages, the phenomenon could affect more entries in French than in Brazilian Portuguese.

  ments of Fr. abattre[bétail] 'slaughter[cattle]' denote domestic animals bred for certain purposes, but no French noun means this: bétail 'cattle', which excludes poultry, is two narrow, and animal domestique 'domestic animal', which includes pets, is too general. In other cases, it is difficult to find even a periphrasis that adequately defines the set of nouns. This is the case of Fr. applaudir[spectacle, discours] and Port. aplaudir[espetáculo, discurso] 'applause[show, speech]', though the meaning of the verb is the same for a show and for a speech.

Examples: without complement (Port. abortar [feto]/Fr. avorter), with a prepositional object (Fr. amender [loi]/Port. fazer uma emenda em [lei]), or with two verbs (Port. adernar [embarcação]/Fr. faire gîter [embarcation]).

This set certainly includes avião and helicóptero, but relevant questions are: does the set of hyponyms include all the complements of abater[avião]? do all the complements of abater[avião] belong to the set of hyponyms? If the answer to both questions is yes, aeronave becomes a good choice to define this lexical entry of abater.

This work has been partially supported by the CNRS.