Nour El Madhoun
email: nour.el-madhoun@lip6.fr

Guy Pujolle
email: guy.pujolle@lip6.fr

Security Enhancements in EMV Protocol for NFC Mobile Payment

Keywords: Confidentiality, EMV, mutual authentication, NFC, NFC smartphone, payment, scyther, security

Today, by integrating Near Field Communication (NFC) technology in smartphones, bank cards and payment terminals, a purchase transaction can be executed immediately without any physical contact, without entering a PIN code or a signature. Europay Mastercard Visa (EMV) is the standard dedicated for securing contactless-NFC payment transactions. However, it does not ensure two main security proprieties: (1) the authentication of the payment terminal to the client's payment device, (2) the confidentiality of personal banking data. In this paper, we first of all detail EMV standard and its security vulnerabilities. Then, we propose a solution that enhances the EMV protocol by adding a new security layer aiming to solve EMV weaknesses. We formally check the correctness of the proposal using a security verification tool called Scyther.

I. INTRODUCTION

In several countries, NFC technology has been experimented for contactless payment systems by integrating it into smartphones, bank cards and payment terminals. Two types of NFC payment applications exist: [START_REF]EMV Books -Integrated Circuit Card Specifications for Payment Systems[END_REF] the micro payment which is destined for small amounts (maximum amount authorized -20 Euro in France) without entering a PIN code or a signature, [START_REF] Emms | Practical attack on contactless payment cards[END_REF] the macro payment which refers to the case when the amount is higher than the authorized limit. It is noted that in the second type, the payment transaction must be confirmed by composing a PIN code or a signature.

EMV is the security protocol implemented for both payment systems [START_REF]EMV Books -Integrated Circuit Card Specifications for Payment Systems[END_REF]: with contact (inserting the card into the terminal) and without contact (NFC). In [START_REF] Emms | Practical attack on contactless payment cards[END_REF] and [START_REF] Lifchitz | Hacking the nfc credit cards for fun and debit[END_REF], authors introduce security vulnerabilities in EMV protocol and show that they represent a much higher risk in the case of NFC payment compared to the classical payment. In this paper, we propose a new protocol that improves the security of EMV standard: we enhance the classical EMV exchanged messages and we add a new security layer allowing to overcome EMV vulnerabilities.

We specify that the proposal is intended to secure NFC mobile payment transactions between NFC smartphones and payment terminals. An NFC smartphone has three wireless connection interfaces: Wi-Fi, 4G and NFC, we consider that it is interesting for the proposal to benefit from using Wi-Fi or 4G to communicate with a trusted party, because the NFC interface can be used only for communication with the payment terminal. The correctness of the proposal is formally analyzed by a security tool called Scyther which describes formal proofs for security protocols. This paper is organized as follows. Section 2 studies EMV security standard and section 3 describes the proposed protocol solving EMV vulnerabilities. In section 4, we analyze the proposal with respect to informal analyzes whereas in section 5, we formally check the proposal using the Scyther security tool. Section 6 introduces related literature and the last section provides a brief conclusion.

II. EMV SECURITY STANDARD

EMV is the international standard destined for securing contact and contactless-NFC payment transactions. It has been launched by EMV Consortium (EMVCo). The actors involved to perform an EMV payment transaction (with or without contact) are [START_REF]EMV Books -Integrated Circuit Card Specifications for Payment Systems[END_REF]: • Client's payment device: a user may possess a contact bank card allowing to perform classical payments, or an NFC bank card or an NFC smartphone for NFC purchase transactions. • Issuing bank: it is the bank of the client's payment device. • Payment terminal: it is the merchant's device allowing to make classical and NFC purchases. • Acquiring bank: it is the bank of the payment terminal.

A. EMV Phases

Three EMV security phases are executed sequentially in the same manner for a contact or NFC payment operation [START_REF] Murdoch | Chip and pin is broken[END_REF]:

1) Card authentication: authenticates the client's payment device to the payment terminal in order to provide protection against counterfeit client payment devices. It also guarantees the integrity of banking information. 2) Cardholder verification: allows the verification of the PIN code or signature entered by the client in order to authenticate him to the payment terminal. It allows protection against lost and stolen client payment devices.

It is noted that this step is not executed in the case of NFC micro-payment. 3) Transaction authorization: confirms that the issuing bank authorizes the transaction to the payment terminal. According to EMV specifications [START_REF]EMV Books -Integrated Circuit Card Specifications for Payment Systems[END_REF], each EMV phase has two different implementations "online or offline" depending on Internet connection availability in payment terminals: • Online mode: it requires an Internet connection between: (1) the payment terminal and the acquiring bank, (2) the latter and the issuing bank. Transport Layer Security (TLS) protocol (see [START_REF] Dierks | The transport layer security (tls) protocol version 1[END_REF]) is used to secure these connections. The connection ( 2) is called inter-bank network and the issuing bank is responsible for the execution of EMV security procedures (see EMV phases II-A). For reasons of simplicity and visibility, we will not consider the inter-bank communication in this paper: we assume that the payment terminal communicates with the issuing bank directly and securely using TLS protocol. • Offline mode: the payment terminal is responsible for the execution of EMV security procedures. Once the Internet connection is available at the end of the day, the terminal confirms transactions to banks (acquiring and issuing).

B. EMV vulnerabilities

The studies [START_REF] Emms | Practical attack on contactless payment cards[END_REF] and [START_REF] Lifchitz | Hacking the nfc credit cards for fun and debit[END_REF] show two security vulnerabilities in the first phase of EMV protocol "Card authentication" in both modes (online/offline):

(a) The payment terminal is not authenticated to the client's payment device. (b) The banking data (Primary Account Number (PAN), expiration date) are exchanged in clear without encryption. In the online EMV card authentication phase, the revocation of banking data are well checked by the issuing bank. However, in the offline mode, the payment terminal cannot verify the validity of banking data because only the issuing bank has a list of revoked banking data [START_REF] Levi | The prevention of cheque and credit card fraud[END_REF]. We enumerate this vulnerability: (c). Fig- 1 and Fig- 2 respectively illustrate the online and offline EMV card authentication phases. We have designed these figures in general and clear diagrams in order to briefly and simply explain and demonstrate EMV vulnerabilities. For more details and clarifications, it is essential to consult EMV specifications in [START_REF]EMV Books -Integrated Circuit Card Specifications for Payment Systems[END_REF] and references [START_REF] Murdoch | Chip and pin is broken[END_REF] [START_REF] Bouzefrane | La norme emv[END_REF].

1) EMV Vulnerabilities in the online mode (Fig- 1): We can notice in red color that Banking Data are sent in clear: vulnerability (b). To illustrate vulnerability (a), we explain the content of each exchanged message:

• 2) EMV Vulnerabilities in the offline mode (Fig- 2): In this mode, we can also notice in red color vulnerability (b): Banking Data are sent in clear. In fact, there are three variants of the offline EMV card authentication phase: Static Data Authentication (SDA), Dynamic Data Authentication (DDA) and Combined Data Authentication (CDA). In this paper, we visualize the CDA variant (Fig- 2) because it is more prevalent. We will now detail the content of each exchanged message to show vulnerability (a):

• (1) C->P: C sends to P in clear text: i. Banking Data.

ii. {Hash(Banking Data)}sk(IB): is the static signature of the hash of Banking Data. It is generated by the secret key sk(IB) of IB and guarantees the integrity of banking data. iii. Certificate(IB): is the certificate of IB signed by the secret key of a certification authority CA, it will be used by P to obtain the public key of IB to verify {Hash(Banking Data)}sk(IB). iv. Certificate(C): is the certificate of C signed by sk(IB), it will be used by P to obtain the public key of C to verify the dynamic signature in the last step. 2), C generates a random number RandomC, signs using its secret key sk(C) the hash of 'RandomP, RandomC' and sends the message (3) to P. The latter verifies that the public key of C validates the dynamic signature {Hash(RandomP, RandomC)}sk(C). It finally confirms C authenticity. Consequently, we also conclude that there are no security steps provided in the offline EMV card authentication phase confirming the authentication of P to C: vulnerability (a). Indeed, we showed that P did not verify the revocation of Banking Data: vulnerability (c). Once the Internet connection is available, P contacts IB after having confirmed and executed the payment transaction. IB can then check the revocation of the Banking Data used for the transaction.

C. Discussions

At first, EMVCo has implemented EMV standard for contact payment while assuming that EMV vulnerabilities (section II-B) do not represent significant risks: because the contact communication takes place in a closed environment by inserting the card into the terminal, and under the responsibility of the customer who must normally insert his card into a trusted terminal (for example: in a known store). Then, EMVCo has also implemented EMV protocol for contactless-NFC payment and assumed that within a maximum NFC reading distance of 5-10 centimeters, it is difficult for an attacker to use an unauthenticated NFC reader to steal banking data from an NFC bank card [START_REF]EMV Books -Integrated Circuit Card Specifications for Payment Systems[END_REF] [START_REF] Madhoun | An online security protocol for nfc payment: Formally analyzed by the scyther tool[END_REF].

However, the NFC communication unfolds in an open environment using NFC radio waves and this represents a big risk. Authors in [START_REF] Emms | Practical attack on contactless payment cards[END_REF] and [START_REF] Lifchitz | Hacking the nfc credit cards for fun and debit[END_REF] confirm that the assumption of EMVCo in the case of NFC payment is very weak and show that: the distance of NFC reading can reach up to 1.50 meters if the NFC reader is equipped with a special antenna and an amplifier. Therefore, a skilled attacker in radio-electronics, can remotely steal banking data from a victim's NFC bank card even if the latter is in the bag. The sensitive banking data that can be retrieved are: PAN and expiration date. The visual cryptogram (Card Verification Value (CVV)/Card Verification Code (CVC)) and the cardholder's name are unrecoverable.

D. Risks

Firstly, if a malicious person obtains a revoked bank card, then he can use it to perform unauthorized transactions in the offline mode in an airplane for example [START_REF] Levi | The prevention of cheque and credit card fraud[END_REF]. Secondly, if an attacker manages to collect only the PAN and expiration date of an NFC bank card using an unauthenticated NFC reader, several risks are incurred [START_REF] Emms | Practical attack on contactless payment cards[END_REF] [3]: • Making fraudulent purchase transactions on the Internet without providing the CVV/CVC and the exact name. In fact, there are several websites do not request the CVV/CVC as: "www.amazon.com", "www.zappos.com", "www.cyberguys.com", etc. In addition, the name is not always verified by websites where it is highly possible to write a random name [START_REF] Madhoun | An online security protocol for nfc payment: Formally analyzed by the scyther tool[END_REF]. • User identification (through PAN) and tracking.

Hence, in Fig- 3 we were able, using an NFC smartphone (Samsung S5), and a free Android application to read banking data of an NFC bank card: PAN and expiration date. In the paper [START_REF] Madhoun | An online security protocol for nfc payment: Formally analyzed by the scyther tool[END_REF], we also proceeded in showing an example of how an attacker can harm a victim using his stolen bank data to make fraudulent purchase transactions on the Internet. A. Actors 1) Authentication Server (AS): it is a trusted entity able to authenticate payment terminals to NFC smartphones by performing security functions. Banks, payment terminals and NFC smartphones trust this server. We specify that AS: is connected to banks (acquiring/issuing) in real time, is available from any location at any time, stores a list of trusted certification authorities and contains a security application that enables verification of digital signatures and certificates.

2) NFC Smartphone (S): it includes a cryptographic unit allowing a secure storage for banking data. The client approaches S to P to make purchases (card emulation mode: simulates an NFC device as an NFC card). S is able to communicate securely with AS using Wi-Fi or 4G interface through an Android application. They authenticate each other and exchange a session key k(S,AS) (TLS protocol [START_REF] Dierks | The transport layer security (tls) protocol version 1[END_REF]). The proposed protocol allows to offload the verification procedure of P authenticity from S to AS in order to effectively use S resources (CPU, memory, etc.) Symmetric key of the current TLS session allows to protect information exchanged between S and AS k(P,IB)

Symmetric key of the current TLS session allows to protect information exchanged between P and IB Cryptogram-Key(S,IB)

Symmetric key stored in S during manufacturing by IB 3) Payment Terminal (P): it is used to perform contact and contactless-NFC payment transactions. It communicates securely using k(P,IB) (TLS protocol [START_REF] Dierks | The transport layer security (tls) protocol version 1[END_REF]) with IB (online mode). We assume that AB delivers to P at the opening of the bank account (merchant): pk(P)/sk(P), Cert(P) containing pk(P) and signed by sk(AB), Cert(AB) containing pk(AB) and signed by sk(CA).

4) Issuing Bank (IB): it is the bank of S and it communicates with P to authenticate S classically as in EMV card authentication phase in the online mode (see section II-B1).

B. Targeted Security Properties

The proposed protocol shall guarantee the security properties between S and P: • Mutual authentication: it is a strong agreement between S and P. S must authenticate P (overcoming vulnerability (a), section II-B1) and P must authenticate S. This agreement excludes potential replay and man-in-the-middle attacks where the attacker could usurp the identity of one of the two parties. • Non-repudiation of origin: S and P shall provide strong evidence for not being able to deny them in the future. • Confidentiality of banking data: the banking data must be sent in encrypted text (overcoming vulnerability (b)). • Integrity of banking data. • Validity of banking data.

We note that the: authenticity and non repudiation of S, integrity and validity of banking data are classically well ensured by the EMV standard (see section II-B1). Thus, the TLS protocol is assumed implemented in our proposal between S and AS, and between P and IB. Therefore, the mutual authentication between participants in TLS protocol is ensured by default. Also, all TLS messages are encrypted.

C. Protocol Description

We will now detail the exchanged messages of the proposal (see Fig- 4). For all abbreviations you can consult Tab-I.

(1) Authentication request for S: P->S The client presents S to P thanks to NFC radio waves. P sends in clear text to S: TD as in the online EMV card authentication phase (section II-B1), ReqS1, Cert(P), Cert(AB) and SignP. The latter is an electronic signature of the hash of 'P, S, TD, ReqS1' generated by sK(P). The Cert(P), Cert(AB) and SignP allow to confirm the authentication of P to S, ensure the integrity of 'P, S, TD, ReqS1' and guarantee that P cannot deny having sent SignP in the future (non-repudiation of origin). In the next step, S will send the received message (1) to AS to check P authenticity.

(2) Authentication request for P: S->AS

• We assume that S will not send the Authorization Request directly to P as in the online EMV card authentication phase (Fig- 1), but it will first of all confirm the authenticity of P by contacting AS. Therefore, after receiving (1), the Android application automatically starts in order to connect to AS through a secure communication channel TLS, using the Wi-Fi or 4G interface. Then, S sends to AS in encrypted text with k(S,AS): (1), a random number RS1 serves to prevent replay attacks and ReqP1. • Not valid, then it will not respond to P.

• Valid, then it prepares the Authorization Request as in the message (2) of the online EMV card authentication phase (Fig- 1). The Authorization Request contains • The Authorization Request received from S.

• ReqS2 whose aim is to request the authenticity of S once again insofar as P could not verify ARQC. IB starts by verifying received nonces TD, RS1, RAS1 and it will not respond to P if they are not valid. Alternatively:

• IB proceeds to authenticate S (respond to ReqS2) as in section II-B1: 1. It confirms that Banking Data are not revoked.

IV. INFORMAL ANALYZES

A. Results

The proposal in this work meets the security properties discussed in section III-B as follows: •Mutual authentication between S and P: in step (3), S confirms the authenticity of P thanks to Cert(P), Cert(AB) and SignP (overcoming vulnerability (a)). In step [START_REF] Levi | The prevention of cheque and credit card fraud[END_REF], P confirms the authenticity of S through ARQC. • Non-repudiation of origin: P and S cannot deny having respectively sent SignP and ARQC in the future.

• Confidentiality of Banking Data using pK(P) in step (4) (overcoming vulnerability (b)). • Integrity of Banking Data stored on S thanks to the cryptogram ARQC in step [START_REF] Levi | The prevention of cheque and credit card fraud[END_REF]. • Validity of Banking Data that are not revoked in step [START_REF] Dierks | The transport layer security (tls) protocol version 1[END_REF].

B. Examination of Possible Attacks

We will informally examine some attacks between P and S. The analyze of attacks on TLS protocol [START_REF] Dierks | The transport layer security (tls) protocol version 1[END_REF] between: 'S and AS', 'P and IB', is not the objective of this paper.

1) Malicious Payment Terminal (MP): which wants to pose as P to communicate with S. We assume that MP does not have a valid certificate and is not known by AS. Possible attacks:

(a) In step [START_REF]EMV Books -Integrated Circuit Card Specifications for Payment Systems[END_REF], MP sends to S principally: TDmp generated by itself, Cert(P), Cert(AB), and a signature SignMP generated by MP key. In step (3), AS rejects P authenticity because it could not verify SignMP with pK(P). (b) If MP replays the message (1), then this is can be detected thanks to TD validity. (c) MP cannot decipher the message (4) to obtain Banking Data because it does not have sk(P). 2) Malicious Smartphone (MS): which wants to pose as S to communicate with P. We assume that MS is not known by AS and IB. Possible attacks:

(a) In step ( 4)-( 5), MS sends P an Authorization RequestMS encrypted by pk(P) and mainly contains: TD, random numbers RMS1 and RASms1 instead of RS1 and RAS1 respectively, falsified Banking DataMS, an ARQCms generated by a specific key for MS instead of ARQC. In step [START_REF] Dierks | The transport layer security (tls) protocol version 1[END_REF], P sends to IB the Authorization RequestMS received from MS and without knowing that it is a malicious. However, IB rejects S in step (6) because: there is no good PAN to identify S and it could not verify ARQCms. (b) If MS replays the message (4), then this is can be detected by the validity of TD, RS1 and RAS1. (c) MS cannot decipher the message (4) to obtain Banking Data because it does not have sk(P).

V. FORMAL ANALYZES USING SCYTHER TOOL A. Overview

The verification of the correctness and soundness of a security protocol has proven to this day to be extremely difficult for humans. Hence, we verify the proposed protocol using a security verification tool called Scyther that has previously been successfully used in both research and teaching fields [START_REF] Cremers | The scyther tool: Verification, falsification, and analysis of security protocols[END_REF]. Scyther allows formal analyzes for security protocols by identifying potential attacks and vulnerabilities. Researchers in [START_REF] Cremers | Comparing state spaces in automatic protocol verification[END_REF] show the performance of Scyther compared to other security verification tools. Scyther analyzes protocols using specific Scyther claims (authentication, confidentiality, etc.) with an unbounded number of sessions and guaranteed termination. If it detects an attack corresponding to a mentioned claim, then it produces a graph describing this attack [START_REF] Cremers | The scyther tool: Verification, falsification, and analysis of security protocols[END_REF].

B. Scyther Claims Results

The Security Protocol Description Language (SPDL) is used to implement protocols in the Scyther tool [START_REF] Cremers | Operational semantics and verification of security protocols[END_REF]. Each actor is written as a role in this language. Due to the page limit, we show only the role for P in Fig- 5. The Scyther claims mentioned in the implementation of our proposal are: (1) Nisynch, Niagree, Alive, Weakagree for the mutual authentication and non-repudiation between S and P, (2) Secret for the confidentiality of Banking Data. Therefore, they refer to the targeted security properties presented in section III-B. As illustrated in Fig- 6, the protocol successfully guarantees all Scyther claims for P and S and no attacks are found. Indeed, there are no Scyther claims to verify the integrity and validity of Banking Data, but we can conclude that they are ensured thanks to the mutual authentication. We provide formal definitions taken from references [START_REF] Cremers | Operational semantics and verification of security protocols[END_REF] and [START_REF] Lowe | A hierarchy of authentication specifications[END_REF] for Nisynch, Niagree, Alive and Weakagree Scyther claims: 1) Non-injective synchronization (Nisynch): "ensures that messages are transmitted exactly as prescribed by the protocol. That is to say that whenever A (initiator) completes running the protocol with B (responder), and B has been running the protocol with A, then, all messages are received exactly as they were sent, in the exact order described by the protocol". This authentication form is strictly a stronger property than the other forms: Niagree, Alive and Weakagree.

2) Non-injective agreement (Niagree): "We say that a protocol guarantees to an initiator A non-injective agreement with a responder B on a set of data items ds (where ds is a set of free variables appearing in the protocol description) if, whenever A (acting as initiator) completes a run of the protocol, apparently with responder B, then B has previously been running the protocol, apparently with A, and B was acting as responder in his run, and the two agents agreed on the data values corresponding to all the variables in ds".

3) Aliveness (Alive): "We say that a protocol guarantees to an initiator A aliveness of an agent B if, whenever A (acting as initiator) completes a run of the protocol, apparently with responder B, then B has previously been running the protocol". 4) Weak agreement (Weakagree): "We say that a protocol guarantees to an initiator A weak agreement with another agent B if, whenever A (acting as initiator) completes a run of the protocol, apparently with responder B, then B has previously been running the protocol, apparently with A. Note that B may not necessarily have been acting as responder".

VI. RELATED LITERATURE

A mutual authentication protocol between NFC smartphones and payment terminals enabling to secure NFC payment transactions is proposed in [START_REF] Ceipidor | Kernees: A protocol for mutual authentication between nfc phones and pos terminals for secure payment transactions[END_REF]. The idea of this work is to use a single server that shares, in a static manner, secret symmetric keys with terminals and NFC smartphones. This idea remains difficult to design in a real and global environment. Hence, the proposal aims to resolve EMV security vulnerabilities: it guarantees mutual authentication and banking data confidentiality, but it does not ensure: banking data integrity (which is normally well assured by the original EMV protocol), origin non-repudiation and the validity of banking data that are not revoked. In fact, authors did not take into consideration the advantage of an NFC smartphone having both Wi-Fi and 4G interfaces that may be useful for direct communication with the server: the NFC smartphone connects firstly using NFC radio waves to the payment terminal, the latter then communicates with the server. In our previous studies [START_REF] Madhoun | An online security protocol for nfc payment: Formally analyzed by the scyther tool[END_REF] and [START_REF] Madhoun | A cloud-based secure authentication protocol for contactless-nfc payment[END_REF], we have designed security protocols for NFC payment systems based on asymmetric key cryptography and allowing to overcome EMV security weaknesses in EMV card authentication phase. They ensure: mutual authentication, non-repudiation, confidentiality and integrity of banking data. Thus, we have successfully analyzed the correctness of these proposals using Scyther.

The proposal [START_REF] Madhoun | An online security protocol for nfc payment: Formally analyzed by the scyther tool[END_REF] is destined to secure NFC payment operations between payment terminals and unconnected (without Wi-Fi or 4G) client payment devices: NFC bank cards. It is implemented in the online mode where the payment terminal communicates with an authentication server which is considered a representative of confidence and security of banks (issuing and acquiring). Thus, NFC bank cards trust the server and can communicate with it only via the payment terminal. The server is able to confirm the authenticity of NFC bank cards and payment terminals. This proposal ensures that banking data are not revoked.

The proposal [START_REF] Madhoun | A cloud-based secure authentication protocol for contactless-nfc payment[END_REF] is intended to secure NFC mobile payment transactions between NFC smartphones and payment terminals. It is executed in the offline mode where the payment terminal is not connected to the issuing bank and is responsible for the execution of the security procedure authenticating an NFC smartphone. The latter can interact (using Wi-Fi or 4G) through a secure channel (TLS) with a Cloud platform that offers security services such as: verifying the payment terminal authenticity. This proposal allows an efficient use of smartphone's resources (CPU, memory, etc.), because it enables offloading "the verification procedure of the payment terminal authenticity" from the NFC smartphone to the Cloud platform. However, it does not verify the revoking of banking data because it is executed in the offline mode.

The research work [START_REF] Madhoun | An online security protocol for nfc payment: Formally analyzed by the scyther tool[END_REF], [START_REF] Ceipidor | Kernees: A protocol for mutual authentication between nfc phones and pos terminals for secure payment transactions[END_REF] and [START_REF] Madhoun | A cloud-based secure authentication protocol for contactless-nfc payment[END_REF], are different from the classical EMV card authentication phase (online or offline): because they implement new security architectures by using new security elements for each actor as: multiple electronics certificates and signatures in [START_REF] Madhoun | An online security protocol for nfc payment: Formally analyzed by the scyther tool[END_REF] and [START_REF] Madhoun | A cloud-based secure authentication protocol for contactless-nfc payment[END_REF], symmetric keys in [START_REF] Ceipidor | Kernees: A protocol for mutual authentication between nfc phones and pos terminals for secure payment transactions[END_REF], etc. However, these large differences are too expensive although they theoretically participate in solving EMV vulnerabilities. We can say that these protocols require new implementations in a real environment and this can contribute to remove EMV standard. Our proposal in this paper aims to improve the security of EMV standard while maintaining the same basis of EMV messages and adding a new security layer.

VII. CONCLUSION

In this paper, we introduced a new protocol destined to secure NFC mobile payment transactions between NFC smartphones and payment terminals. It allows to solve EMV security weaknesses by enhancing the classical EMV exchanged messages and adding a new security layer. It ensures: mutual authentication and non-repudiation (compared to [START_REF] Ceipidor | Kernees: A protocol for mutual authentication between nfc phones and pos terminals for secure payment transactions[END_REF]), integrity (compared to [START_REF] Ceipidor | Kernees: A protocol for mutual authentication between nfc phones and pos terminals for secure payment transactions[END_REF]) and confidentiality of banking information, the validity of banking data that are not revoked (compared to [START_REF] Ceipidor | Kernees: A protocol for mutual authentication between nfc phones and pos terminals for secure payment transactions[END_REF] and [START_REF] Madhoun | A cloud-based secure authentication protocol for contactless-nfc payment[END_REF]). We have successfully analyzed the protocol correctness using the Scyther tool.

( 3 )( 1 )Fig. 2 .

 312 Fig. 2. EMV card authentication phase (Offline)

Fig. 3 .

 3 Fig. 3. Data of an NFC bank card read by an NFC smartphone III. PROPOSED PROTOCOL In this paper, we propose a new security protocol improving EMV standard by treating EMV security weaknesses. We have designed the proposal by adding a new security layer to the classical messages of the online EMV card authentication phase (see section II-B1). This proposal includes four actors (see Fig-4) presented in section III-A. It allows securing NFC mobile payment transactions between NFC smartphones and payment terminals. It is executed in the online mode, and we also focus on the advantage of using the 4G (or Wi-Fi) connection interface of an NFC smartphone to remotely communicate with an authentication server. Tab-I presents abbreviations simplifying future descriptions.

( 4 )( 6 )Fig. 4 .

 464 Fig. 4. The proposed NFC security protocol

2 .

 2 It uses the PAN to identify S in the data base and obtain the Cryptogram-Key(S,IB). 3. It calculates another ARQC1 from the received data 'S, P, AS, IB, TD, RS1, RAS1, Banking Data, Information, ConfirmP' and using the Cryptogram-Key(S,IB). Then, it compares ARQC with ARQC1. (6) Confirmation of S authenticity and authorization: IB->P IB sends to P in an encrypted text with k(P,IB): TD, RS1, RAS1, a random number RIB1 allows preventing replay attacks and: • Either a message ConfirmS if ARQC and ARQC1 are equal. This confirms: authenticity and authorization of S, non-repudiation for S, integrity of the message contained in ARQC and especially for Banking Data. • Or a message RejectS if ARQC and ARQC1 are not equal. RejectS indicates to P to finish the payment transaction with S.

Fig. 5 .

 5 Fig. 5. Role P in SPDL Language (Scyther)

Fig. 6 .

 6 Fig. 6. Formal results with Scyther

  are during the period of validity and are not revoked. 2. the CA issuing Certificate(IB) is a trusted certification authority. 3. the public key of CA validates the signature of Certificate(IB). 4. the public key of IB validates the signature of Certificate(C). 5. the public key of IB validates the static signature {Hash(Banking Data)}sk(IB). Then, it generates and sends to C a random number RandomP for dynamic signature.

• (2) P->C: P in the offline mode is able to execute security operations, so it verifies that: 1. Certificate(IB) and Certificate(C) • (3) C->P: after receiving (

TABLE I ABBREVIATIONS

 I

	Abbreviation	Description
	CA	Certification Authority
	IB	Issuing Bank
	AB	Acquiring Bank
	P	Payment Terminal
	S	NFC Smartphone
	AS	Authentication Server
	TD	Transaction Data generated by P (Unique)
	Cert(Y)	Certificate of Y (Y=P or AB or CA)
	pK(Y)	Public Key of Y (Y=P or AB or CA)
	sK(Y)	Secret Key of Y (Y=P or AB or CA)
	ReqYi	The i (i=1,2) authentication request for Y (Y=S or P)
	H(M)	One way hashing function of M = m1,m2..
	k(S,AS)


Philippe Vidal

World University rankings: use of quantitative indicators and results from student surveys

World University rankings display their results as league tables (ARWU, THE, QS) or as performance groups (U-Multirank). Although a priori the latter is more satisfactory, it does have serious limitations. Alternative propositions are explored.

A full description of the methodology can be found in: www.umultirank.org/cms/wp-content/uploads/2016/03/Rank-group-calculation-in-U- Multirank-2016.pdf. This method would make sense if all the data points plotted on a straight line, whatever its slope value. As seen in the following example, this situation is not what is observed when real data are used.

Introduction

One major criticism of league tables is that they tend to emphasise the differences in ranks. As an example, in the ARWU ranking, where Harvard university is the reference (global composite indicator =100), the ranked number 2 university has a score around 70, which makes a difference of 30. In contrast, the difference between universities ranked 50 and 51 is around 0.5 and between universities ranked 99 and 100 the difference is around 0.1. That is why all the league table rankings display the data, after the rank 100, by rank groups where the Higher Education Institutions (HEIs') are listed in alphabetic order (for ARWU,. In contrast, U-Multirank (UMR) and the CHE University-ranking on which it is based, display the HEI's results in the format of groups, where the HEIs' are also listed in alphabetic order. So, unlike ARWU etc. rankings, where the order is simply given by the rank of the HEIs' global composite indicators, the CHE-UMR group construction is based on a more complex methodology. A feature of CHE-UMR rankings is student satisfaction surveys. These, like other indicators are presented in the form of groups which are based on a rather complex methodology. The aim of this discussion is to demonstrate the flaws of those methodologies and to present alternative possibilities.

I. Interpretation of quantitative indicators

Using the distribution of indicator values, the UMR method produces a spread of points which are divided into 5 groups of uneven size. The principle is to plot the indicator values as y and the HEIs as x, and from this identify the x median value from which the corresponding y median is determined graphically. The guidelines for subdividing the values into groups is as follows:

Group A: where the indicator value is at least 25% above the median indicator. Group B: where the indicator value is between the median indicator and 25% above the median indicator Group C: where the indicator value is between the median indicator and 25% below the median indicator Group D: where the indicator value is at least 25% below the median indicator Group E: where the indicator value = 0

Exercise carried out on the real data

The UMR methodology described above (but where Group D is discarded) was applied to a set of data from about fifty French HEIs' (Fig. 1). The test is focused on eight indicators (Citation rate, External research income, etc.) each of which is divided into 4 categories as indicated by color differences in Fig. 1. The figure shows that there is a considerable size variation between the groups. For example, compare the size distribution of the groups Citation rate and External research income in Fig. 1. In addition, since in the majority of cases there are no obvious breaks in the data spread, the choice of divisions between adjacent categories becomes rather arbitrary, being based on a strict arithmetic exercise rather than clear differences. As a consequence, some HEIs' can either profit or be penalized depending on minor data differences. The most extreme example is the "Master graduation on time" category, in which the bulk of the dominating (green) group have indicator values close to 100% resulting in almost all of this HEIs' grouping being classified as B. Because of this, there are no HEIs' in group A.

Conclusions

Although the CHE national ranking scheme, which is based on 3 groups (Top group with 25% of HEIs', Medium with 50, and Bottom with 25) is a more satisfactory and fairer method than the 5 grouping of UMR, both grouping methodologies give the illusion of the existence of very different specific groups, each having their own characteristics. In fact the reverse is true since most of the data form a continuum. A minimal improvement of the methodology would be to create groups only when there is a minimum gap between the extreme values (10%, 20%, more?).

As an alternative it should be possible to show in graphic form the position of each HEI with respect to their position for each indicator. An example is shown in Fig. 2.

II. Interpretation of results from student surveys.

Student surveys are based on a series of questions where the student gives an opinion based on a Likert scale of 1 (best) to 6. Given that the student answers reflect their individual opinion rather than quantifiable measurement it is reasonable to ask how their answers can be presented and evaluated in a logical and rigorous way.

Ranking by groups: The CHE-UMR Method

An important aspect of the CHE-UMR evaluation of student satisfaction surveys is their use of groups to subdivide and grade student answers (see www.umultirank.org/cms/wp-content/uploads/2016/03/Rankgroup-calculation-in-U-Multirank-2016.pdf).

Faced with the problem that the spread of student answers within an individual HEI is generally substantially higher than the spread of other HEIs' average values, the authors of CHE-UMR solve the problem by assuming a real value for each HEI. From this they calculate the measurement error using conventional metrology methods, which attempts to estimate, based on a limited number of measurements, the error bar in which the real value (length, weight etc.) is located.

From this a confidence interval stated at the 95% confidence level is calculated. Its value is given by 2 /( √ n) (where  is the standard deviation and n is the number of measurements. The standard deviation should be actually multiplied by the Student-Fisher coefficient, which rapidly becomes very close to 2 for n> 10). It follows that dividing the standard deviation by √n produces an error bar that is unreasonably short. Clearly, this conventional technique, which minimizes the real scatter of the response values, is appealing since it produces groups more homogeneous in appearance, which in turn are easier to use in a ranking system. In brief, given that the answers of the students reflect the scatter of their opinions and that by definition there are no measurement errors, the use of a statistical evaluation approach is misleading and gives the user a false sense of reality.

The CHE-UMR methodology outlined above has two additional major drawbacks: 1) it is built on relative positioning and therefore the groups are created regardless of the degree of scattering in the distribution. When the data are highly variable, it is not too difficult to define classes but when data are rather homogeneous, grouping is more difficult to justify.

2) the method may not identify a top group when most of the answers are largely positive.

Alternative rankings

The problem posed by student surveys can be approached in other ways. For example:

a) Order by average: Penn State and Ohio universities http://studentaffairs.psu.edu/assessment/satisfaction.shtml This classification method has the great disadvantage of not considering the dispersion around the average value (Fig. 1). However the reports do display all the Likert scales data, which could be the basis for a better use (see below).

b) Order by positive responses: University of Geneva

Only the % of satisfactory answers higher than 80% is taken into account. Here again there is some arbitrariness in the division into classes above and below 80%. ). This presentation is easy to understand and does not suffer any of the flaws described above.

c) National

Student surveys: Conclusions

The methodology used in UMR is unsatisfactory because it uses a statistically invalid assumption and then minimizes the dispersion of the answers. The methodology requires creating groups which ignores the situation where there are no clear breaks in the data. The British methodology is clearer and the easiest to implement. It can be completed by reporting all the data (including average values, median, standard deviation) in a separate document.

General Conclusions

The use of formal groups by CHE-UMR when evaluating performance indicators for HEIs (including student satisfaction surveys) is not the most appropriate method when dealing with the matter. The danger is that it may present an erroneous picture of the real distribution of the data. One underlying question is that UMR and CHE rankings are basically based on relative, and not absolute, HEIs positioning.

Besides not being statistically pertinent, this, in turn tends to distort the resulting rankings since this can (1) create artificial boundaries within sets of rather homogeneous data, and (2) create quality scores which do not match reality.

  Figure 1: Data from a set of French HEIs'. The indicator values are reported as y. The letters A, B etc. correspond to the U-Multirank grouping methodology.

Figure 2 :

 2 Figure 2: Positioning (red dots) for 4 indicators (Bachelor graduation rate, Master graduation rate, Bachelors: graduating on time, Master: graduating on time) of Université Catherine de Parthenay (fictitious) Department of Psychology regarding the other Departments of Psychology (from democeres.obs-ost.fr).

Survey of Student Engagement: USA http

  ://nsse.indiana.edu Here the approach is to use quartiles. The raw data are presented on box plots and further evaluated using comparisons of average values with (1) the overall average (2) the best 10% (3) 50% better. This is an interesting exercise but not easy to use.

d)

Order by % of positive responses: United Kingdom

	http://unistats.direct.gov.uk
	Based on annual National Student Surveys, this method uses the % contributed by the top two
	groups of the Likert scale (i.e. groups 1+2

Acknowledgements

The author thanks Ghislaine Filliatreau and Robert W. Nesbitt for their helpful comments, and Marie-Laure Taillibert for her appreciable technical help.

Philippe Vidal, philippe.vidal@obs-ost.fr and phvidal@orange.fr


Bernard Yannou
email: bernard.yannou@ecp.fr

Supporting need seeker innovation: the Radical Innovation Design methodology

Keywords: front end of innovation, innovation process, innovation methodology, user pains, usage situations

Driven by a utilitarian perspective, the question of useful innovation and creating essential values is set. Such innovation should lead to cover or alleviate significant pains which are not satisfactorily covered by existing solutions. Radical Innovation Design (RID) is a structured methodology for exploring the front end of useful innovation in need seeker mode. In this paper, the fundaments of RID are presented for the first time and illustrated on the search for radical innovations for a handitennis wheelchair of a champion. The most original part of RID stands in the problem setting stage which starts with re-expressing the ideal need to set the issue playground -for usefully thinking in the box -in which two worlds are populated: the world of problems or pain points and the world of usage scenarios. The determination of value buckets has been automated by matrix representations of dependencies between problems, usage scenarios and existing solutions. A subset of opportunistic value buckets are further addressed in the problem solving stage for focused ideation, to ensure performing "blue ocean" innovations, i.e. in not yet explored usage and problem situations.

EXPLORING THE FRONT END OF USEFUL INNOVATION

According to Jeremy [START_REF] Bentham | An Introduction to the Principles of Morals and Legislation[END_REF], the British philosopher of the 18 th and 19 th centuries, maximizing the overall well-being of sentient beings is equivalent to minimizing their pains and thus creating values for them (2009). Inspired by this statement and in the context of designing a product for a market, it is not trivial to determine which useful design solution is adequate to cover or alleviate existing pains of some market segments which are not satisfactorily covered by existing solutions. The utilitarianism theory [START_REF] Bentham | An Introduction to the Principles of Morals and Legislation[END_REF] defines "usefulness" of a solution as its ability to improve the well-being of humans and to diminish their pains in different situations. There is no accurate definition of a useful solution. From the author's viewpoint it is something related to essential needs or essentials values as those described in the lowest layouts of Maslow pyramidlike eating, drinking, health...or at a higher level but linked with a significant sufferinglike mood disorder such as depression or bipolarity, loneliness, difficulty of living in society -. The notion of essential value has also been defined in the context of Bottom of Pyramid (BoP) by [START_REF] Prahalad | The Fortune at the Bottom of the Pyramid[END_REF][START_REF] Ohtonen | Is your company a Need Seeker? http://thenextten[END_REF] who tries to reconcile the billions people living in extreme poverty with the delivering of essential products and services. But even, in developed countries, essential needs are numerous and badly or partially addressed. For directly addressing them, companies or designers should better adopt the so-called Need Seeker innovation strategy first introduced by Boston Consulting Group. Indeed, Boston Consulting Group has stipulated that firms follow at least one of three innovation strategies: Need Seeker, Market Reader, Technology Driver, depending on the focus put on the customer, the market or the technology. Booz and Company (see [START_REF] Ohtonen | Is your company a Need Seeker? http://thenextten[END_REF]) defines them as follow: 

Need Seekers, such as Apple (US), Dyson (UK) and Oxylane (France), make a point of engaging customers directly to generate new ideas. They develop new products and services based on superior end-user understanding.



Market Readers, such as Hyundai, Caterpillar and Loréal, use a variety of means to generate ideas by closely monitoring their markets, customers, and competitors, focusing largely on creating value through incremental innovations.



Technology Drivers, such as Google and Bosch, depend heavily on their internal technological capabilities to develop new products and services. After a recent Booz and Company study (see [START_REF] Ohtonen | Is your company a Need Seeker? http://thenextten[END_REF]), following a Need Seekers strategy offers the greatest potential for superior performance in the long term. These companies are effective at both the ideation and conversion stages of innovation and they consistently outperform financially. Being predominantly Need Seeker is not easy; it can be made by two ways:  Using lead-users (see [START_REF] Hippel | The age of the consumer-innovator[END_REF], their insightful refreshing ideas and dreams and their testimonies on usage and pain points. This is the case of Oxylane company in Francesport equipment and outdoor-.



Having a visionary leader like Steve Jobs (Apple) or James Dyson (Dyson), the company growth and the number of product references being limited by the imagination and control power of a single brain. There is thus a need for a methodology investigating growth territories or strategic value niches for generating disruptive innovations beyond immediate customer expectations and in a cooperative and multidisciplinary manner and a secure way. After [START_REF] Motte | The specificities of radical innovation[END_REF], it can be done thanks to an adapted organization and special methodologies and processes. In terms of organization, [START_REF] Millier | Marketing The Unknown: Developing Market Strategies For Technical Innovations[END_REF] insists on the necessity to manage antagonism and balance between exploration and exploitation of new idea territories. [START_REF] Christensen | The Innovator's Solution: Creating and Sustaining Successful Growth[END_REF][START_REF] Christensen | The Innovator's Dilemma: The Revolutionary Book That Will Change the Way You Do Business[END_REF] say with different words that for succeeding disruptive innovations, companies must not put too much emphasis on customers' current needs, and work on how to adopt new technologies or business models that will meet customers' unstated or future needs. In terms of methodology, [START_REF] Christensen | The Innovator's Solution: Creating and Sustaining Successful Growth[END_REF][START_REF] Christensen | The Innovator's Dilemma: The Revolutionary Book That Will Change the Way You Do Business[END_REF] proposes the jobs-to-bedone concept and defines it as "a framework which is a tool for evaluating the circumstances that arise in customers' lives. Customers rarely make buying decisions around what the "average" customer in their category may dobut they often buy things because they find themselves with a problem that they need to solve. With an understanding of the "job" for which customers find themselves "hiring" a product or service, companies can more accurately develop and market products well-tailored to what customers are already trying to do." For this and other works on innovations, Clayton Christensen has been designated as the most influential management thinker in Yannou B., (2015) [START_REF] Wang | A Usage Coverage-Based Approach for Assessing Product Family Design[END_REF] may cover in a dominant way a number of usage scenarios characteristics of the targeted user/consumer group. Proceeding that way, they show that innovative designs may be proved to be dominant -i.e. ranked first because performing better-on a subspace of usage situations; these designs are then naturally in a "blue ocean" (after [START_REF] Kim | Blue ocean strategy -How to create uncontested market space and make the competition irrelevant[END_REF]) which is almost a guarantee of success when launching an innovative offer.

INTRODUCING THE RADICAL INNOVATION DESIGN METHODOLOGY

The author has been influenced by a number of previously mentioned ideas and approaches. Radical Innovation Design (RID) methodology is a structured process for exploring the front end of innovation in need seeker mode. RID has been successfully applied on about 30 innovation projects since 5 years along with 20 companies. In this paper, the fundaments of RID methodology are presented for the first time and illustrated on the search for radical innovations for a handitennis wheelchair of a champion. This example has been chosen since it is not subject to non disclosure agreement. Albert Einstein said "If I had an hour to solve a problem and my life depended on the solution, I would spend the first 55 minutes determining the proper question to ask, for once I know the proper question, I could solve the problem in less than five minutes." Following that maxim, The author (Yannou et al., 2013a) structured the RID process in two macro stages of problem setting (see Figure 1) and problem solving (see Figure 2). Radical Innovation Design® is a methodology because it is based on 1) structuring principles 2) a stage-and-gate process (see also [START_REF] Cooper | A process model for industrial new product development[END_REF][START_REF] Cooper | Stage-gate system: A new tool for managing new products[END_REF][START_REF] Cooper | Winning at new products: accelerating the process from idea to launch[END_REF]) very detailed in the early problem setting like Cooper suggested in (1988), 3) a list of 9 expected templated deliverables along the process, 4) two computerized tools such as the DSM-Value-Bucket tool described in the present paper and the UIPC-monitor tool (Yannou et al., 2015a), 5) already several successes in company contexts since after 30 RID innovation projects with about 20 companies, several innovations are being to be launched on the market. The goal of RID methodology is to maximize the potential value creation inside a legitimate design perimeter called ideal need. RID is a systematic exploration/exploitation process of value creation opportunities through a series of stages making the inventory of usage situations (or scenarios) and pain points (or problems) users may live. RID uses at the same time 3 perspectives:  The perspective of an economist: design is considered as a probabilistic theory of value creation, 

The perspective of an industrial designer: design starts with the know-how for observing userstheir usages, pain points, needs…-and inventing new usages, 

The perspective of a design engineer: knowing how to measure utilities to create, gather evidences and bring serious proofs of concept using the most adequate technologies. The author in (Yannou et al., 2013a) showed that the more the design team completes the successive RID deliverables, especially in problem setting, the most likely the innovation outcome is to be successfully launched on the market. To that aim, it is proposed to monitor innovation process with four proofs to consolidate along it: Utility, Innovation, Profitability and Concept, this is the UIPC model described in (Yannou et al., 2015a;Yannou et al., 2013c). The problem setting starts with the reframing of the initial idea submitted by the innovation project initiator into an ideal need. Let us start with the example of need seeker innovation on the wheelchair of a handitennis champion. It has been the actual innovation project initiated by a 22 year old handicapped female student who is nearly ranked 30 th in the world championship ranking and who wants to win in Rio-2016 Paralympic Games. She came with the initial idea of "to lighten at most her handitennis wheelchair". Such a goal would have led to a carbon fiber high tech wheelchair. Making lighter the wheelchair is not an objective in itself; it has been reframed into the following ideal need: "to be performing on every tennis point in every game situation." This ideal need is a "box perimeter" inside which investigation must be pursued at its extreme limit. Contrarily to most of people about creativity, the author do not believe that "thinking outside the box" is the must, but it is more efficient to "thinking inside the box, providing the box is large enough and well defined." Continuing with RID process, two worlds are investigated concurrently within the ideal need perimeter (see Figure 1): 

The world of problems. It consists in inventorying, quantifying and causally ordering the miscellaneous pain points, counter-performances, dissatisfactions, needs, that users may experiment.



The world of situations. It consists in inventorying, qualifying and sizing the usage situations that users live and in which problems occur with more or less intensity. ) other (problems x usage-situations) currently covered by existing situations but that consumers consider as "must have", c) these previous choices being compatible between them and with the present offer portfolio and customer segmentation of the company (represented by "business logics" in Figure 1).

BUILDING AND COVERING THE CAUSAL GRAPH OF PROBLEMS AND THE USAGE SCENARIOS SPACE FOR THE HANDITENNIS WHEELCHAIR

The determination of value buckets has been partly automated by a matrix representation of dependencies between problems, usage situations and existing solutions and by a computational mechanism leading to the DSM-Value-Bucket tool (see also (Yannou et al., 2015b)). This approach and tool may be affiliated to Dependency Structure Modelling approaches [START_REF] Eppinger | Design Structure Matrix Methods and Applications[END_REF].

In Figure 3, the causal graph is represented as causal paths leading to point loss problem and it is further graphically covered by four existing solutions. Here, some modelling techniques of causal graph representations are borrowed from the system dynamics practice (see for instance [START_REF] Schaffernicht | Causality and diagrams for system dynamics[END_REF]). For simplicity, 4 problems out of 16 are retained, namely: time loss (moving), injury of the racquet hand, loss of ball power and extended tiredness during the match.

In Figure 4, a graphical tessellation of typical usage situations during a match is represented. Proximity of two usage situations means a high probability of time precedence (or in other cases, proximity of user types). For simplicity, 4 usage scenarios out of 8 are retained, namely: serve, shot in move, ball receiving and start moving to hit ball. Practically, a pre-screening of problems is made and a first version of the causal graph of problems sketched. Next, the list of typical usage situations is established and for each usage situation an observation protocol is designed and followed to get a deep understanding of the pains/problems possibly occurring in this usage situation, for measuring them (frequency, repeatability, importance, consequences) and carrying out a root cause analysis. It goes far beyond the classical personas method storyboarding usage situations with weak rationale of the situation representativity and no measurements of pain points. For instance, here, the serve situation has been carefully studied: gestures have been recorded and analyzed, ball speed has been measured as well as serve accuracy, ability to serve aces, double faults rate. In addition, it has been observed that a back and forth translation as well as a rotational twist of the wheelchair occurred during the serve. It is obviously due to the translational freedom of the four wheels and the rotational freedom of the two caster wheels. An additional investigation in root causes led to experiment the gains to block the four wheels during serve (+30% in ball speed) or to only block the rotation of caster wheels (+20% in ball speed).

THE DSM VALUE BUCKET ALGORITHM

The determination of value buckets has been automated by matrix representations of dependencies between problems, usage scenarios and existing solutions (see also (Yannou et al., 2015b)). Three matrices A, B and C are built along the problem setting stage of a RID process described in previous sections. The first matrix A (see Figure 5) expresses which problems occur during usage scenarios, the second matrix B how much existing solutions cover problems and the third matrix C how much existing solutions are useful in usage situations. Combining these three matrices results in a matrix E of value buckets as being the combinations of important problems occurring during characteristic usage situations and for which few existing solutions are useful or efficient. Matrix A is named the "Ideal performances matrix" and links problems (columns) and usage scenarios (rows) with an intensity scale from 0 to 5 for expressing how much (or often) a problem occurs in a usage scenario. The meaning of the intensity scale is {0=null; 1=weak; 2=moderate; 3=average; 4=important; 5=very important}. For instance (see Figure 5, matrix A):  The racket hand injury mainly occurs when the player starts moving, pushing with her hand to propel the wheelchair, grasping the racket and the hand rim at the same time.



There is an important power loss during serve due to an uncontrolled twist of the wheelchair. Matrix B is the "(solutions X problems) matrix" and expresses the relevance of an existing solution for a given problem with the same qualitative scale from null (0) to very important (5). For instance (see Figure 5, matrix B): 

The ergonomic hand rim is very relevant for avoiding racket hand injury.



The ergonomic hand rim also partly avoids time loss.  Both the back posture system and the manual lever are good for relieving the generalized tiredness. Matrix C is the "(usages X solutions" matrix" and expresses the relevance of an existing solution in a given usage scenario with the same qualitative scale from null (0) to very important (5). For instance (see Figure 5, matrix C): 

The manual lever is very efficient during start moving situation and moderately during shot in move.



The back posture system is efficient during the serve situation. At this stage, an "Intrinsic Value Buckets matrix" D is computed as the subtraction between the "Ideal performances matrix" A expressing importance of problems to solve in usage situations and the matrix multiplication C x B expressing the average relevance of existing solutions in (usage, problem) cases. Of course, this difference is normalized to get each number at both sides of the subtraction comprised between 0 and 1. Moreover, one introduces a "bucket filter" BF, a real number comprised between 0 and 1 and being 0.5 by default, to eliminate the least important (usage, problem) cases, following formula (1). Yannou B., (2015) 'Supporting need seeker innovation: The Radical Innovation Design methodology', Proceedings of ICED:

International Conference on Engineering Design, Milano, Italy, July 27-31

ICED15 IVB ij = Max (0, A ij Max kl (A kl ) -2 × 𝐵𝐹 × CB ij Max kl (CB kl ) ) (1)
Finally, the importance of problems (relatively to the ideal need) and the size of usage scenarios are assessed, again through the 0 to 5 intensity scale (see Figure 5, size and importance introduced in the surroundings of matrix D). The rationale for weighing problem importance and usage size must be captured. The RID framework encourages keeping the traceability of exploration/exploitation and decision making. For instance, the logic for justifying the problem importance may be:  Ball power loss and time loss moving should be importantly improved in the champion play.  Tiredness and hand injury are second order issues for the champion play. The rationale for justifying the size of usage scenarios may be the scenario frequency (comparing the number of times serving and shooting in move) and of its importance for winning a point (80% of serves in handitennis are winning points). A last "Normalized value buckets matrix" E is computed to augment intrinsic value buckets with importance of problems and size of usage scenarios, following formula [START_REF] Yannou | Set-based design by simulation of usage scenario coverage[END_REF].

NVB ij = IVB ij × size i × importance j ( 2
)
Figure 5. The DSM Value Bucket data streaming and computation mechanics (refer to Figure 1)

Two important value buckets are revealed for the handitennis wheelchair project; their matrix coordinates are (1,2) and (3,2) (see Figure 5). The designer team is asked to verbally interpret them and they come up with these natural justifications:

 Value bucket #1 (1,2):
The loss of power during serve is partly due to the (observed) wheelchair twist.



Value bucket #2 [START_REF] Kim | Blue ocean strategy -How to create uncontested market space and make the competition irrelevant[END_REF][START_REF] Yannou | Set-based design by simulation of usage scenario coverage[END_REF]: The champion player is late on the position for receiving the ball, and consequently she returns the ball with power loss; this is due to her right hand grasping the tennis racket and at the same time moving the wheel.

VALIDATION AND DISCUSSION

For briefly illustrating the relevance of such fine interpretations of revealed value buckets, the readers are invited to look at the two-stage ideation process starting from the value buckets in Figure 6 and at the fruitful outcomes of this ideation process in Figure 7 (comments of these outcomes are out of the scope of this paper). The DSM value bucket tool (see also (Yannou et al., 2015b)) opens the way of automating the radical usage-driven innovations along with a systematic investigation and representation of problems or pain points and usage scenarios. RID methodology may be somewhat compared to known innovative design methodologies like TRIZ, QFD or axiomatic design and design thinking. Compared to TRIZ, RID uses a causal graph for representing the problem structure whereas comparable substance-fields representations in TRIZ (see [START_REF] Savransky | Engineering of creativity -Introduction to TRIZ Methodology of Inventive Problem Solving[END_REF]) are used for representing imperfect solutions. In the same manner QFD and axiomatic design may be used to represent the propagation of the voice of the customer into the product components and design parameters, but little is done to characterize the problem opportunities especially in the light of what the other existing solutions use to efficiently perform or "cover". Finally, RID demonstrates that it exists other ways than the design thinking prototype-and-learn experimental loop, being a more rational manner to investigate need-seeker problems.

CONCLUSIONS

The most original part of RID methodology stands in the problem setting stage which starts with reexpressing the ideal need to set the issue playgroundfor usefully thinking in the box -in which two worlds are addressed: the world of problems or pain points and the world of situations or usage scenarios. The two spacesproblems and usage scenarios -are populated with real world situations. For this purpose, some modelling techniques as causal graph representations and persona method are used. Then, a first "ideal performances matrix" of the DSM-value-bucket tool (see also (Yannou et

)) allows to cross problems with usage scenarios to express in which usage situations people are subject to pains. Next, existing design solutionscommercial solutions or patents -are identified and their coverage of the two spaces is modelled. Here the DSM-value-bucket tool proposes to represent the coverage effectiveness and efficiency of both problems and usage scenarios by two appropriate matrices: the Solution-Problem matrix and the Usage-Solution matrix. Multiplying both matrices allow to come up with the likelihood for the existing solutions to satisfactorily answer to one problem arising during one usage scenario. Subtracting this matrix with the "ideal performances matrix" results in a final "value buckets" matrix highlighting which problem is worthy to be addressed in an innovation project. The last step of the RID problem setting stage is to select a subset of opportunistic value buckets to further address in the problem solving stage, so as to ensure to perform radical innovation on "blue ocean"i.e

. not yet exploredusage and problem situations.

The author has proposed a method for structuring and automating the discovery of value buckets during the front end of need seeker innovations. The interest of need seeker innovations have been revealed by people like [START_REF] Christensen | The Innovator's Solution: Creating and Sustaining Successful Growth[END_REF][START_REF] Christensen | The Innovator's Dilemma: The Revolutionary Book That Will Change the Way You Do Business[END_REF] and [START_REF] Ulwick | What Customers Want: Using Outcome-Driven Innovation to Create Breakthrough Products and Services[END_REF] but no one before had implemented these ideas in a design engineering process. The DSM Value Bucket tool was designed two years ago and has already been applied successfully to 14 innovation projects with 10 private companies, plus the "handitennis wheelchair project" presented in this paper. Future works will validate the relevance of the most rated resulting value buckets to the light of launching disruptive products after opinion of lead users.

The RID methodology has been applied along years in many different situations (see Table 1), providing the followed process has been to investigate worlds of users/pains/usage-situations: in companies of different sizes (very small, SMEs or world size companies), in different industrial sectors, in different business situations (BtoB, BtoC, BtoBtoC...), in product or service situations and even when the challenge was to find essential values to create in technology push contexts (despite the apparent contradiction with RID fundaments). In addition, a similar algorithm, but more sophisticated, for improving the well-being of humans and diminishing their pains in different situations, has been applied following the utilitarianism theory perspective. Indeed, the different deadly falls scenarios of the elderly people have been investigated (see [START_REF] Bekhradi | Simulating global utility of design solutions to elderly falls by building relevant usage segmentation[END_REF]) to ensure that new designed products and services are likely to bring essential health, social and economic values. Starting from a disparate literature on elderly falls' issue, the author has first built a usage scenarios spaceby Bayesian-like approaches -. Next, the usefulness and the coverage ability of three design solutions have been evaluated by simulationusing expert rules -over a tessellation of usage segments. In addition, a simulator has been developed to assess the

Figure 1 .

 1 Figure 1. The problem setting macro-stage of Radical Innovation Design® methodology

Figure 2 .

 2 Figure 2. The problem solving macro-stage of Radical Innovation Design® methodologyDefining the real world consists in building a causal graph (of problems) and a usage scenarios space of characteristic usage situations (see Figure1). Next, as existing solutions may partly cover problems in usage situations, a covered causality graph and a covered usage scenario spaces are derived from the careful analysis of the conditions (usage scenarios) and effectiveness/efficiency of service delivery (problems/pain points more or less relieved). Next, in the final targeting stage of problem setting, a list of weighed value buckets are derived as being the combinations of important problems occurring during very characteristic (frequent) usage situations and for which few existing solutions exist or are really effective/efficient. From this list of value buckets, a perimeter of ambition is defined by the

Figure 3 .Figure 4 .

 34 Figure 3.The covered causality graph for the handitennis wheelchair issue (see Figure1)

Figure 6 .Figure 7 .

 67 Figure 6. The two-stage ideation process starting from the value buckets included in the perimeter of ambition (refer to Figure 2)

  'Supporting need seeker innovation: The Radical Innovation Design methodology', Proceedings of ICED:

	International Conference on Engineering Design, Milano, Italy, July 27-31
	the world (see The Washington Post paper (McGregor, 2013)). Ulwick (Ulwick, 2005) has extended it
	in a principle of design-outcomes segmentation instead of a conventional a priori customer
	segmentation.
	Inspired by these ideas, Yannou et al (2009) and He et al (2012) have adapted this user-centered
	perspective to model the market demand model in a design engineering platform through the
	representation of usage contexts. It has been called the Usage Context Based Design (UCBD). Next,
	Yannou et al (2013b) have proposed the Design by Usage Coverage Simulation principle for
	evaluating with coverage indicators how much a new product or product family
	ICED15

  al.,Yannou B., (2015) 'Supporting need seeker innovation: The Radical Innovation Design methodology', Proceedings of ICED:International Conference on Engineering Design, Milano, Italy, July 27-31

Table 1 .

 1 Diversity of successful applications of RID methodology in (essential) need seeker mode for 5 companies in 2014

	Company	Size	Sector	Business	Innovation	Product or
					model	service
					Market pull
		SME	Automotive	BtoB	(Techno	Service
			marketing	BtoC	push)
		SME	Robotics	BtoB	Techno push	Product
		Very small	Healthcare and handicap	BtoB BtoC	Market pull	Product
		World	E-healthcare	BtoB BtoC	Market pull push) (Techno	Service
		World	Automotive	BtoBtoC	Market pull	Product

potential of non or poorly-covered usage segments to deliver insightful information in order to truly be a need seeker in the front-end of innovation. The Radical Innovation Design process has consequently also been followed here, which tends to show that this reasoning process for usefully innovate is maybe general.