Christophe Vernay
email: cvernay@solais.fr

Ana Maria Realpe

Daniel De Gabaï

Sébastien Pitaval

Innovative Simulation Tools For An Exhaustive And Synthetic Characterization Of The Solar Glare Occurrences For The Design And The Administrative Instruction Of Large-Scale Photovoltaic Plants

Keywords: photovoltaic, glare, safety, simulation, characterization

come

INTRODUCTION

Photovoltaic (PV) is challenged to play a major role in the energy transition that must be conducted in the coming decade, through the development of large-scale PV plants, mostly ground-mounted, whose individual power now reaches hundreds of megawatt peak (MWp). As an illustration, Fig. 1 The emergence of large-scale PV plants inevitably generates disturbances with the local environment, among which the sun reflection on the PV panels, also known as solar glare, whose consequences may vary from loss of visual comfort (e.g. residents) to the endangering of people in the case of transportation (e.g. airplanes, trains, cars). Besides maintaining good neighborly relations on the long term and preventing any legal action, PV developers shall consider the glare problematics early in the development process in order to successfully pass the administrative instruction, i.e. the building permit issuing process. Some high-level guidelines are already applicable depending on the country or the state. As an example, in Belmont, Massachusetts, a section of the law states that rooftop PV panels shall be placed and arranged such that glare shall not be directed onto adjacent buildings or properties [START_REF] Colton | Assessing rooftop solar PV glare in dense urban residential neighborhoods: determining whether and how much of a problem[END_REF]; other national laws indicate, for the same rooftop PV panels, a maximum time of exposure per day and per year. On the opposite side, complex policies were established by some aviation administrations for the construction of PV systems close to airports: the Federal Aviation Administration (FAA) in the United States or the Direction Générale de l'Aviation Civile (DGAC) in France, as detailed hereafter.

The FAA's opinion regarding the building of a specific PV generator is based on the assessment of the potential ocular hazard analyzed over the entire calendar year and defined as a function of the retinal irradiance and the subtended angle (size/distance) of the glare source [START_REF] Aylward | Interim policy, FAA review of solar energy system projects on federally obligated airports[END_REF]. Fig. 2 below defines three regions for the impact characterization: potential for permanent eye damage (retinal burn), potential for temporary afterimage (flash blindness), and low potential for temporary after-image [START_REF] Ho | Methodology to Assess Potential Glint and Glare Hazards From Concentrating Solar Power Plants: Analytical Models and Experimental Validation[END_REF]. All potentials for glare in the airport traffic control tower (ATCT) cab is prohibited while only the low potentials for after-image are accepted regarding the final approach paths. In 2010, the French DGAC issued some rules for the impact characterization over control tower, the final approach path and the rolling of each runway, mostly based on the angle of view, i.e. the angle between the trajectory and the potential reflected ray, and the associated luminance ([4], [START_REF]Gêne visuelle liée aux panneaux solaires implantés à proximité d'aérodromes[END_REF]). The latter, expressed in candela per square meter (cd.m -2 ), measures the luminous intensity per unit area of light travelling in a given direction; solar disk is about 16.10 8 cd.m -2 at noon and 6.10 5 cd.m -2 at sunrise [6]. Impacts over control tower are acceptable only when they are in the back of the air controller, whatever luminance is. Regarding the final approach and the rolling, Fig. 3 below describes three protection areas defined for each approach, namely A (around airport), B (around touchdown) and C (around runway): depending on the location of the PV project with respect to these three zones, the acceptance thresholds for the angle of view and the luminance vary (respectively ±30° or ±90° and 10 4 or 2.10 4 cd.m-2). Finally, the DGAC systematically delivers a positive opinion to any project that implements glare-free PV panels, i.e. PV panels certifying a maximum luminance level of 10 4 cd.m -2 for PV project in zone A or 2.10 4 cd.m -2 for zone B.

Though quite different in the impact characterization, both the FAA and DGAC requirements are relevant references for the aviation administration outside the United States and France, but also for other administrative authorities that newly face PV projects close to sensible areas: networks of railways and motorways regarding security issues but also municipalities regarding urban constraints (e.g. covisibility with historic monuments or neighbors). Considering the wide range of applications and targeted audience, the recent works carried out by SOLAÏS aim at proposing some innovative and generic simulation tools in order to address the glare problematic as part of the PV project development. The results are presented in this paper through a case study of a 1-axis tracking PV project close to a French airport, thus subject to the DGAC's requirements. Section 2 introduces the case study then presents the proposed modelling of the glare source (i.e. the PV panels) and the critical elements (e.g. final approach). Section 3 finally presents the identification and characterization of the glare impacts through a synthetic and visual approach for a better understanding of the results.

PROPOSED MODELLING

Introducing the case study

The case study considered in this paper was carried out by SOLAÏS in 2016 and consists in a groundmounted PV plant using 1-axis tracking solution. It is located in Bretagne Region, south-west part of France, on the lands of the Bretagne Atlantique airport (also called Guiscriff -Scaër) whose main information is presented in Table I. The 55-hectare footprint corresponds to the targeted cadastral parcels; it is divided into two areas, respectively 17 and 28 ha, located on both sides of the runway, as depicted in Fig. 4. Considering the surface and the current state of PV panel efficiency, more than 40 MWp could be theoretically installed. A glare study must be conducted for the building permit examination in order to prove that the PV plant fulfils the DGAC's requirements.

PV plant mesh

A first challenge consists in defining a fine mesh of the PV plant in order to identify accurately the critical zones of the layout for which remediation should be potentially considered. For that purpose, the layout is firstly delimited by Jordan polygons, either concave or convex, which are defined as closed and simple, i.e. without intersection except the first and last points. An iterative process is then run in order to split each Jordan polygon into triangular facets whose maximum side length (L MAX ) can be changed down to ten meters. Fig. 5 below depicts the meshing for the case study using only two Jordan polygons (one per PV area), depending on L MAX value. It has to be noted that the size of the mesh, through L MAX , doesn't have any influence on the overall results of the analysis because the latter only considers the intersection between a trajectory and a reflected ray for a given triangular facet as presented later in section 3. However, decreasing the mesh size allows refining the location of prohibited areas while increasing the computation time. This is all the more important when the PV plant layout intersects the protection areas defined by the French DGAC, cf. Fig. 6 for the QFU 20 approach.

PV panel modelling

The baseline considered in this study consists in classical crystalline PV cells encapsulated into a glass layer that protects them from the environment while allowing light energy to pass through. The disadvantage of this rigid outer layer is that part of the sun rays are reflected, thus generating glare, depending on the angle of incidence (AOI), i.e. the angle between the sun direction and the normal of the PV panel. The simplest approach to estimate the loss was developed in [START_REF] Souka | Determination of the optimum orientations for the double exposure flatplate collector and its reflections[END_REF] and later adopted by the American Society of Heating, Refrigeration and Air Conditioning (ASHRAE, [START_REF]Methods for Testing to Determine the Thermal Performance of Solar Collectors[END_REF]) through the incident angle modifier (IAM) and the ASHRAE modelling defined by Eq. 1 and illustrated in Fig. 7. These profiles highlight the fact that PV panels behave as simple mirror for low incidences. In the present study case, the PV panels are mounted on a one-axis tracking system whose kinematic profile aims at maximizing the incident energy throughout the day. The rotation axis is horizontal and oriented northsouth. A backtracking algorithm is implemented so as to remove the mutual shading, from one row to another one, at the sunrise and sunset. The tool allows processing the kinematic provided by any tracker manufacturer. However, in the early stage of a PV project development where manufacturer hasn't been selected yet, SOLAÏS proposes a generic tracking model depending on the "dihedral solar angle" defined as the dihedral angle between:  The PV panel plane when the rotation angle is null;  The plane containing the rotation axis and the sun direction.

Working with the dihedral solar angle allows working on a single profile, whatever the day is. Three different modes can then be considered, as depicted in Fig. 8: 1 Backtracking mode at sunrise and sunset to minimize the mutual shading; 2 Underperforming tracking due to the constraint on rotation angle; 3 Perfect 1-axis tracking around solar noon. 3 CHARACTERIZING THE GLARE A glare impact occurs when an incident sun ray, reflected on the surface of the PV panel, enters a user's visual field. A user can be either static (e.g. air controller, residents) or dynamic (e.g. pilot, train driver) and its localization is defined in the tool by using at least one segment; curved trajectories are then approximated using many segments. The impact identification consists in determining for each triplet {triangular facet, segment, sun position} the potential intersection between the segment and the infinite triangular prism derived from the reflection of the incident sun ray on the PV panels located in the triangular facet, as depicted in Fig. 9. The results for the specific case of the final approach coming from the north (i.e. QFU 20) are presented in two synthetic views. Fig. 10 first presents the geographical identification of the critical facets (in orange) for which at least one glare impact has been found. This 2D view provides useful information about the location of the critical areas for which glare has been identified (about 30 % of the total area). Regarding the development process, it allows PV developer balancing different tradeoffs: abandoning the critical areas versus accepting another PV panel configuration with lower performance. Then, a second chart characterizes the identified impacts throughout the year using true solar time (TST) on x-axis and day in the year on y-axis (Fig. 11); symmetric black curves corresponds with sunrise/sunset while topography may appear if present. The available physical quantities are the angle between the reflected ray and the user's visual field, the luminance of the reflected ray, the sun elevation, the angle between the reflected ray and the sun, the distance between the user (e.g. the pilot) and some critical locations (e.g. touchdown, railway crossing), etc. For this specific simulation, Fig. 11 show that a pilot approaching on QFU 20 is impacted by glare early in the morning (precise hour are available), during 2 to 34 minutes, between end of October and mid-February (accurate date are available), with an angle between user's field of view and reflected ray higher than 68°. Finally, because the glare analysis is issued for people who may not have the adequate technical background (e.g. municipal councilor, administrative authority), another effort was made on the visual synthesis through the 3D envelop of the reflected rays embedded into Google Earth, as depicted in Fig. 12. This envelop, only applicable to fix structures, is defined by the direction of the reflected rays throughout the day for both summer and winter solstices; any trajectory that intersects this envelope is geometrically impacted by glare.

CONCLUSION

The tools proposed in these works are based on SOLAÏS' large experience regarding the glare studies requested since 2010 by the French aviation administration (DGAC) to the PV project developer. The latter now benefits from visual and synthetic results which are valuable for both the design and the administrative instruction of the project (building permit issuing process) and which ease the reading and the understanding of such a complex topic. The latest version of the tools finally intends to be as generic and adaptive as possible in order to address other national policies and other risk assessment (e.g. PV plants close to railways and motorways) while minimizing the study costs for the developers.

  Photovoltaic (PV) is challenged to play a major role in the energy transition that must be conducted in the coming decade, through the development of large-scale PV plants, mostly ground-mounted, whose individual power now reaches hundreds of megawatt peak (MWp). As an illustration, Fig.1issued from PVresources.com, depicts the ranking of the 121 PV plants commissioned between 2010 and 2015 around the world, with an individual capacity exceeding 50 MWp. In 2010, only 6 plants were commissioned, with an average power of 73 MWp and a maximum of 97 MWp; their number reached 35 in 2015 with an average power of 151 MWp and a maximum of 575 MWp in California. On that period, Europe recorded 25 power plants with a maximum of 300 MWp in France.

Figure 1 :

 1 Figure 1: Breakdown of the 121 PV plants commissioned between 2010 and 2015 around the world, with an individual capacity exceeding 50 MWp.

Figure 2 :

 2 Figure 2: Impact of different retinal irradiances as a function of subtended source angle for short-term exposures.

Figure 3 :

 3 Figure 3: Definition of the three geographical zones A, B and C as per DGAC's requirements depending on the airport threshold (beginning/end of runway) and the touchdown point. The distances are different for a helicopter final approach and take off area (FATO) but the definition remains the same.

Figure 4 :

 4 Figure 4: Superimposing the footprint of the groundbased PV plant (yellow) with the satellite image; thresholds (THR) and touchdowns are highlighted.

Figure 5 :

 5 Figure 5: Meshing of the PV plant using two Jordan polygons depending on the maximum side length (L MAX ) of the triangular facets; runway is highlighted in purple.

Figure 6 :

 6 Figure 6: Location of the PV plant within the protection areas (A, B and C) as defined by the French DGAC.

Figure 7 :

 7 Figure 7: IAM profile of glass-protected PV panels based on ASHRAE modelling (b0=0.04) and measurements of a specific PV panel performed by Sandia National Laboratories.

Figure 8 :

 8 Figure 8: Daily kinematic profile of the 1-axis trackers depending on the dihedral solar angle, highlighting three different modes: backtracking (1), maximum rotation angle (2) and perfect 1-axis tracking (3); applicable whatever the day in the year.Table II below presents the input parameters considered in the model where the PV panel thickness is used to slightly delay the rotation of the PV panels at the sunrise (symmetric for the sunset).

Table II:

  Input parameters for the tracking system of the case

Figure 9 :

 9 Figure 9: Intersection between a segment and the infinite triangular prism derived from the reflection of the incident sun ray on the PV panels located in the triangular facet.

Figure 10 :

 10 Figure 10: Geographical identification of the critical facets.

Figure 11 :

 11 Figure 11: Characterization of the identified impacts through available physical quantities, here the angle between the reflected ray and the user's visual field is analyzed.

Figure 12 :

 12 Figure 12: 3D envelop of the reflected rays embedded into Google Earth; applicable to fix structures only.

Table I :

 I Information about Bretagne Atlantique airport

	ICAO code	LFES
	Latitude	48° 3'4.96" N
	Longitude	3°39'55.74" W
	Landing strip	Paved, 1500 x 30 m
	1 st magnitude orientation	24°	(QFU 02)
	2 nd magnitude orientation	204°	(QFU 20)


A Bernot
email: alix.bernot@irt-saintexupery.com

G Trémouille

Optimisation and adaptation of an existing aeronautic motor to an HVDC network

Keywords: BLDC motor, non-overlapping winding, single layer concentrated winding, aeronautic motor, HVDC network

This paper presents the evolution of an airliner fan BLDC motor to adapt it to an HVDC electrical network. The guiding principle of the design is to increase reliability. A nonoverlapping teeth winding is introduced to separate the motor phases in order to limit winding failures and especially partial discharges. The machine is also optimised using spoke-type magnets flux concentration rotor, in order to reduce total mass. The new machine is compared to the existing one with a finite elements method analysis.

Introduction

The evolution towards the more electric aircraft is expected to increase the airliner's systems power density, reliability and efficiency, and to reduce maintenance [START_REF] Foch | Overview of MEA architectures and key technologies[END_REF]. Hydraulic and pneumatic systems, such as flight actuation (until recently hydraulic systems), cabin pressurization and de-icing (until recently warm air bleed systems), are eventually to be replaced by electrical systems. For instance, unlike a Skydrol pipe, an electrical wire does not leak, and there is no need of regularly changing the fluid, limiting the maintenance operations. On the A380, the introduction of 24 electricallypowered flight actuators alongside 16 hydraulic actuators has enabled a 500kg total mass gain on the aircraft, even if a single electrical actuator is heavier than a hydraulic one.

However, the total on-board power increases steadily (more than 1MVA in the Boeing 787, first bleedless airliner, compared with 300kVA on board the Airbus A340). In order to achieve mass gains at the system level, the aircraft electrical network is evolving. Since the A380, the electrical generators are directly coupled to the reactor, without a mechanical gearbox, leading to a 360 to 800Hz variable frequency. This has led to the replacement of networksupplied AC induction machines by electronic-supplied permanent magnets BLDC machines. The electrical network voltage has doubled in the A350, from 115V to 230V, in order to reduce the copper wire masses. The manufacturers are now planning to replace the 230V three-phase electrical network by a 540V HVDC network, in order to remove the rectifier stages of the equipments, which now mainly use power electronics inverters with DC buses.

The studied motor is an existing airliner fan motor, powered by an inverter with a 270V DC bus, rectified from a 400Hz 115Vac three-phase network. It is a surface permanent magnet BLDC six-pole motor, with a six-step control power electronics. The advantage of BLDC six-step control is that there is no need for RTCA DO-178 software code to be certified, which is a costly process in the aircraft industry. The motor rated operating point is 7Nm at 15krpm. The operating point is permanent, with little speed variation, and the motor must operate at thermal equilibrium. The fan motor is naturally cooled by the forced airflow generated by the fan.

This study is the adaptation of this motor to a DC bus voltage of 540V, which can either come from an HVDC network, or be rectified from a 400Hz 230V three-phase network. The driving design guidelines for the new motor are the improvement of reliability and mass, which are two major issues for aircraft motors. The new motor will be compared to the existing one.

Main failure modes

The aftersales main fault sources causing motor returns are, sorted by frequency:

-IGBT fault in the inverter -Bearing fault -Winding fault, short-circuit -Winding fault, open-circuit

The first fault source, the IGBT fault, is typically due to high currents in the switch. It can occur with voltage-driven BLDC motor such as this one, with significant current ripples. In order to minimise this issue, the motor control strategy is to minimise the current ripple, instead of maximising the torque/current ratio.

The second fault source is the bearing fault. This can be due to unbalanced radial forces on the shaft. In order to minimise this issue, the motor will have to be somehow symmetric, in order to compensate the radial forces.

The third fault source is a winding short-circuit fault, either turn-to-turn, phase-to-phase or phase-to-mass. It can be due to mechanically damaged wire insulation during assembly, or simply to discharges caused by the high voltages. The rise of the DC bus voltage due to the aircraft electrical network evolution increases steadily the second problem, with the appearance of partial discharges in the copper insulation. This issue is developed in detail in the next paragraph.

The fourth fault source is an open-circuit fault, which can be for instance a soldered joint breakup. This leads us to minimise the number of joints in the winding.

Partial discharges

The voltage rise generates higher constraints on the winding insulation. One problem is the appearance of small discharges inside small gas bubbles in the copper insulations, called partial discharges. These partial discharges cannot appear at the voltages generated by a 270Vdc inverter, since the voltages remain below Paschen's law thresholds [START_REF] Kaufhold | Electrical stress and failure mechanism of the winding insulation in PWM-inverter-fed low-voltage induction motors[END_REF][START_REF] Stone | Adjustable speed drive surges: how they affect motor stator windings[END_REF].

However, with voltages generated by a 540Vdc inverter, these partial discharges may appear. This effect is worsened by the pressure drop at higher altitudes: the pressure can decrease down to 200hPa at 12,000m (40,000 feet). It is also worsened by the voltage rise and fall speeds, which increase with the progressive introduction of wide-bandgap semiconductors, such as silicon carbide and gallium nitride. With commutation times as low as 10ns and dV/dt up to 50kV/s, these new materials allow power electronics inverter with better efficiencies, but introduce here new challenges in the motor design.

The partial discharges slowly damage the insulation, reducing the motor life expectancy [START_REF] Kaufhold | Electrical stress and failure mechanism of the winding insulation in PWM-inverter-fed low-voltage induction motors[END_REF][START_REF] Stone | Adjustable speed drive surges: how they affect motor stator windings[END_REF]. The lifespan of an airliner is 40 years, with 4,000 flight hours per year (11 hours per day), demanding electric machines lifetimes of 160,000 hours. The new motor design will then have to reduce the partial discharges in order to increase the motor's lifespan.

The partial discharges appear mainly between two different phases, because there is the higher electrical constraint (with sometimes double the transistor's dV/dt and the maximum voltage of the inverter between the two phases in certain commutation configurations). They can even also appear between two turns of the same wire when the voltage time travel of the voltage wave through the copper wire is too slow compared with the inverter commutation time. The insulation between two turns of the same coil is generally limited, with only the copper wire enamel and a very thin layer of resin, favouring these discharges risks.

On the other hand, the copper to iron insulation is generally good with the usual techniques, combining insulating paper, wire enamel and resin, with little partial discharges risks.

Hence the main regions of the electric motor where these partial discharges are [START_REF] Kaufhold | Electrical stress and failure mechanism of the winding insulation in PWM-inverter-fed low-voltage induction motors[END_REF][START_REF] Stone | Adjustable speed drive surges: how they affect motor stator windings[END_REF], by decreasing order of probability:

-Inside the end windings, between two phases -Inside a slot, between two phases -Between two conductors of the same coil

In case of distributed windings, there is, most of the time, an overlap between the phases in the end windings. This is particularly at risk and is the most likely place of partial discharges.

The second place of partial discharges is when two phases share the same slot. Even with insulating paper separating them, the high voltage difference and dV/dt may lead to partial discharges between the phases.

The third place is between the first and the last turn of the same coil. The voltage rise time of 50kV/s achieved with SiC transistors can lead to an uneven rise of the electrical field near the copper wire, with up to 80% of the voltage located in the first turn at some point [START_REF] Kaufhold | Electrical stress and failure mechanism of the winding insulation in PWM-inverter-fed low-voltage induction motors[END_REF][START_REF] Stone | Adjustable speed drive surges: how they affect motor stator windings[END_REF]. This may lead to partial discharges between the first and the last turn of the same coil if they are located next to each other.

Single layer concentrated winding

In order to minimise winding electrical stress and remove the partial discharges preferred places, we choose a single layer concentrated winding. It is a non-overlapping winding with one tooth out of two wound, according to figure 1.

Figure 1: single layer concentrated winding [START_REF] Meier | Permanent-Magnet Synchronous Machine with Non-Overlapping Concentrated Windings for Low-Speed Direct-Drive Applications[END_REF] This winding naturally limits partial discharges. The end windings never overlap between different phases, removing the first preferred place of partial discharges. There is only one phase in each slot, removing the second preferred place of partial discharges. Moreover, the winding is progressive, with the same number of turns of a phase on every sixth tooth, naturally keeping the first turn away from the last and limiting the third preferred place of partial discharges.

Furthermore, there are some other advantages with this type of winding [START_REF] Meier | Permanent-Magnet Synchronous Machine with Non-Overlapping Concentrated Windings for Low-Speed Direct-Drive Applications[END_REF][START_REF] Ishak | Comparative Study of Permanent Magnet Brushless Motors with all Teeth and alternative teeth Windings[END_REF][START_REF] Ishak | Permanent-Magnet Brushless Machines With Unequal Tooth Widths and Similar Slot and Pole Numbers[END_REF]. The end windings are shorter, leading to a lower resistance. A higher slot fill factor (>0.4) is easier to achieve, also lowering the resistance and the copper losses, improving the efficiency. The back-EMF is more easily rendered trapezoidal, which is more favourable for six-step control, leading to lower current and torque ripples. It is also easier to manufacture, with a smaller number of winding strings to insert, and a much easier inserting process. Since the copper wire is wound around the teeth, it is easier to insert a wire turn around a single tooth with a bigger slot than in a smaller slot separated by several small teeth; there is also no need of carefully counting the right number of small slots separating each wire strand.

There are however some drawbacks to this technique. The magnetomotive force has a higher harmonics content, which increase the iron losses, the mechanical vibrations and the acoustic noise.

5 Chosen architecture: 12/8 spoke-type interior permanent magnet

Number of slots

The motor has three phases, so the number of stator slots has to be a multiple of 6 (each phase needs at least two slots, on every side of a slot). This number has to be kept low in order to minimise the pole number, for a smaller frequency (less iron losses) and an easier control (less precision needed on Hall effect sensors angular positioning). In order to keep lower constraints on the bearings (second failure source), we choose a symmetric machine, so we need at least 12 slots. When a current flows in the first phase, the rotor will undergo a higher radial force under the first phase teeth. With two teeth wound for the first phase, each diametrically opposite to the other, the radial forces on the rotor will be compensated by the symmetry. The Figure 2 is a finite elements method simulation of the radial force on the edge of the rotor for the chosen machine with three different currents in the different phases (the force varies between 0 in blue and 1.1N/m in red.

We see clearly the necessity of the symmetry to balance the radial forces, and thus limit the efforts on the bearing.

Figure 2: Radial forces on the rotor edge

Rotor architecture and number of poles

The existing machine is a surface permanent magnet machine with a retaining sleeve. The thickness of the sleeve is double the thickness of the mechanical airgap, leading to a high magnetic airgap. The retaining sleeve is compulsory in an aircraft surface-PM motor for safety reasons. We choose embedded permanent magnets in order to remove the retaining sleeve, minimise the equivalent magnetic airgap and increase the flux and the torque density.

Flux concentration rotors allow a higher magnetic flux density in the airgap and so higher torque densities [START_REF] Hendershot | Design of Brushless Permanent-Magnet Machines[END_REF]. In order to minimise the number of permanent magnets at the rotor, we choose a spoke-type permanent magnet rotor architecture, which has only one magnet per pole and has maximum flux concentration effect. The other frequent option is V-shape permanent magnets rotors, but with twice more permanent magnets, and a smaller flux concentration. The chosen rotor can be seen on Figure 3.

The number of poles is then determined by the number of magnets in the rotor. In order to have a balanced three-phase machine, the possible pole numbers with 12 slots are 4, 8 and 10 (with 2 or 6 poles the flux variations in the coil would be zero because of rotor/stator symmetry). The associated winding factors are 0.5, 0.866 and 0.966 [START_REF] Meier | Permanent-Magnet Synchronous Machine with Non-Overlapping Concentrated Windings for Low-Speed Direct-Drive Applications[END_REF]. The existing motor has 6 poles. We choose an 8-pole rotor in order to have a good winding factor to have a higher torque, to minimise the mass. The chosen rotor is represented on Figure 3. The magnets are represented in dark or light blue depending on their magnetisation orientation, and the three stator phases are coloured in yellow, green and red. The big round hole in the center is the non-magnetic shaft.

Figure 3: 12slots/8pole chosen motor architecture

Machine design

The design presented here is a pre-design, prior to a proper optimisation process. A few singular steps of this pre-design and some choices made are highlighted and explained. The aim of this study is to assess the feasibility, the advantages and drawbacks of the chosen architecture. If the design is considered valid, a proper optimisation will be done, and then a prototype built to validate the performances and especially measure the partial discharges in the winding.

Magnetic pre-design

The major design parameters of the existing machines are kept: length (58mm), outer diameter (130mm), airgap diameter (90mm). The stator (NO20 0.2mm Fe-Si sheet stack) and rotor material (M400-50A 0.5mm Fe-Si sheet stack) are kept. The current density is kept constant, since the cooling will be identical (air-forced cooling generated by the fan itself): 9A/mm². The main design tool is the finite elements method simulation, Ansys Maxwell software is used. The design strategy begins with a magnetic design, adjusting the airgap length (0.6mm), the magnet length (18mm) and width (5mm), the yoke width (10mm) and the duct thickness (1mm) to have an acceptable magnetic flux density distribution in the iron without current, with a maximum of 1.3T. The duct thickness is determined by a mechanical calculation. The magnetic flux density without current is represented on Figureௗ4.

Figure 4: no-current magnetic flux density

Airgap and slot adjustement

The machine back electromotive force is then simulated with a single turn winding, to adjust the back-EMF shape. The effect of the pole shoe width on the back-EMF is simulated on Figure 5 below. This figure highlights that the longer the pole shoe, the longer the plateau phase of the back-EMF trapezoidal shape, which is better for 6-step control. However, with too long pole shoes, the winding insertion is too complicated during the manufacturing process. We choose here to have a slot opening that is half the slot width, 24° (angle), in order to keep enough space for winding insertion.

In order to improve the back-EMF shape, we choose to modify to increase the airgap length above the pole shoe edges. The rotor outer edge remains a circle, but the pole shoe edges are brought away from the rotor, as can be seen on Figure 6. The result of the simulation of the impact of this modification on the back-EMF shape is presented on Figure 7 below: taking away the pole shoes from the rotor improves the flatness of the plateau phase of the back-EMF. The teeth width and slot width are adjusted to get a good compromise between copper losses and magnetic flux density (iron losses); the same width of 14mm is chosen. All the dimensions will later be optimized before the prototype is built.

Winding design

With the measurement of the single-turn back-EMF, the winding can now be adjusted. Each tooth is wound with 20 coil turns. The chosen slot fill factor is 0.5, the slot area is 176mm², so the copper wire is 4.4mm². The estimated phase resistance is 36mȍ (19mȍ in the existing motor). Aircraft machines are manually wound, so to ease the winding and insertion process for the worker the machine will be actually wound with seven 0.8mm wires in parallel. The smaller wires are indeed much easier to manipulate than the bigger wires.

7 Simulation results

Nominal speed

The motor is powered with a 540V dc bus IGBT inverter. The control mode is six-step voltage switching with no current regulation. The actual motor will include at least a current limitation by chopping for safety reasons. The simulation is done at fixed speed at nominal point (15krpm), and the control angle is chosen to minimise the current ripple (to limit the first failure mode, IGBT fault). The figures 8 to 10 show the simulated back-EMF, torque, and currents. The back-EMF shape is trapezoidal, but the plateau phase width is only 60°, smaller than the optimal 120° required. This element can be improved in the final optimisation. Its maximum value is 240V, twice the maximum value of the existing motor, because the DC bus voltage has doubled. The existing motor has a quasi-sine back-EMF. The torque ripple increases to 18%, due to the use of concentrated winding, which remains acceptable. The current ripple is 15%, and its root mean square 29A. The total copper losses are 90W, compared with 148W in the existing machine. The airgap magnetic flux density is higher thanks to flux concentration and the absence of magnet retaining band, so less current is required to produce the rated torque, leading to lower copper losses.

The no-load torque of the new design is ±0.8Nm, four times higher than in the existing motor. This is due to the concentrated winding architecture, which has a naturally higher no-load torque.

The iron losses of the existing machine are 0,5kW. The iron losses of the new design, simulated with the Bertotti technique, are 0,8kW. This increase is due to the higher pole number, which has been chosen in order to balance the radial The motor efficiency at nominal point will then decrease from 93% to 91%. The thermal equilibrium of the new motor will have to be checked. A comparison with the 4-pole machine performances will be done in a further study, in order to assess the best motor parameters.

Slow speed

The BLDC six-step control mode can be tricky to implement for high speed machines, especially when the inductances are high. LȦI can indeed not be neglected compared with the electromotive force at higher speeds [START_REF] Hendershot | Design of Brushless Permanent-Magnet Machines[END_REF]. The double layer concentrated winding is a high inductance design, so the compatibility with fixed control angle six-step control at every speed has to be checked. The simulated motor inductance was 1mH, ten times higher than the inductance of the existing motor (100H). We have simulated the motor at 300rpm (fixed speed) with a lower voltage of 12Vdc (representing current limitation) and the same control angle: the current and torque results are presented on Figures 11 and12.

Figure 11: simulated torque at 300rpm

Figure 12: simulated currents at 300rpm

The current shape at small speed is good, there is no control issue. We can see that the demagnetization following phase commutation is shorter than at nominal speed, because of the smaller LȦ. The 300rpm simulated average torque is 6,7Nm, the torque ripple 28%, the current effective value 23A and the current ripple 22%. The machine control is less optimal than at nominal speed, but the difference is acceptable. LȦI at nominal speed is 66V and the electromotive force is 240V at high speed, so it is logical that the optimal control angle shift between low and high speed will be small. This allows the usage of the high speed optimal control angle at all speeds.

Conclusions

The adaptation of an existing airliner fan motor to an HVDC electrical network has lead us to choose a single layer concentrated winding, in order to reduce the electrical constraints in the winding and the partial discharges issues. A flux concentration 8-pole rotor has been chosen, in order to maximize torque output. The BLDC motor is powered by a six-step inverter.

The newly designed motor has a higher torque and lower copper losses, but higher iron losses and torque ripple, because of the concentrated winding architecture. The efficiency is lower, so the thermal equilibrium of the new machine will have to be checked. The six-step BLDC control mode has also been validated at low speeds.

The new motor simulations point that the performances of the new architecture are interesting and worth continuing the investigation. Further works include a comparison with a four-pole motor and a proper optimisation process to tune the geometrical dimensions. A prototype will then be built to validate the new machine.

Figure 5 :

 5 Figure 5: back-EMF shape depending on the pole shoe length

Figure 6 :

 6 Figure 6: pole shoes taken away from the rotor

Figure 7 :

 7 Figure 7: back-EMF shape depending on the pole shoe edge additional distance to the rotor

Figure 8 :

 8 Figure 8: back-EMF at nominal speed for the new design


Ruben Rios

David Nuñez
email: dnunez@lcc.uma.es

Javier Lopez

Query Privacy in Sensing-as-a-Service Platforms

The Internet of Things (IoT) promises to revolutionize the way we interact with the physical world. Even though this paradigm is still far from being completely realized, there already exist Sensing-as-a-Service (S 2 aaS) platforms that allow users to query for IoT data. While this model offers tremendous benefits, it also entails increasingly challenging privacy issues. In this paper, we concentrate on the protection of user privacy when querying sensing devices through a semi-trusted S 2 aaS platform. In particular, we build on techniques inspired by proxy reencryption and k-anonymity to tackle two intertwined problems, namely query privacy and query confidentiality. The feasibility of our solution is validated both analytically and empirically.

Introduction

The interconnection of computational and sensing devices to the Internet is expected to transform every single aspect of our lives. This novel paradigm, already known as the Internet of Things (IoT) [START_REF] Gubbi | Internet of Things (IoT): A vision, architectural elements, and future directions[END_REF], brings about a whole set of innovative services and Sensing-as-a-Service (S 2 aaS) [START_REF] Sheng | Sensing as a service: Challenges, solutions and future directions[END_REF][START_REF] Tu | Sensors as a Service on the Internet of Things[END_REF] platforms play a fundamental role as they allow querying IoT devices. In this model, the sensing devices deployed by companies, administrations or citizens can be queried through a sensing server, which acts as gateway, as shown in Fig. 1. This model is already a reality and there are some companies, like Amazon (cf., AWS IoT platform [START_REF]How the AWS IoT Platform Works[END_REF]), which are offering the infrastructure necessary for delivering these sort of services. While this model offers great opportunities to both industry and citizens, it also poses serious privacy risks. In particular, there is the possibility of exposing user interests to honest-but-curious sensing servers since they act as intermediaries for the sensing devices. Therefore, it is paramount to provide the users of these platforms with mechanisms that allow them to remain unlinkable from the sensing devices they are interested in querying. This is precisely the main objective of this paper, to provide a solution to query privacy in Sensing-as-a-Service scenarios where the access to the readings of sensing devices is managed by a semi-honest sensing server, which may be interested in profiling the users of the platform.

One may think that such a solution can be achieved with traditional public key cryptography but there are some notable limitations to this approach. First, the user needs to be aware of the public key of every single sensing device, which raises evident usability and scalability issues. Moreover, it is necessary for the user to check the status of the public keys, such as whether or not they have been revoked. Moreover, if a query is intended for multiple (or all) sensing nodes, the user has to query the sensors individually. This not only implies more energy and bandwidth waste but it is also highly advisable to hide these issues from the user, so as to facilitate the development and adoption of S 2 aaS platforms.

The main contribution of this paper is the QPSP (Query Privacy for Sensing Platforms) protocol. The proposed protocol is based on proxy re-encryption and k-anonymity techniques to provide both query confidentiality (i.e., hiding the query itself and the sensed data) and query privacy (i.e., hiding the nodes replying to the queries) in semi-trusted S 2 aaS platforms. The proposed scheme is, to the best of our knowledge, the first solution to exploit these notions to protect query privacy issues in sensing scenarios. This rest of this paper is organized as follows. Section 2 analyzes previous papers describing query privacy solutions in related domains. Next, in Section 3 we provide a detailed description of the problem addressed by the QPSP protocol and identify some general assumptions that are applicable to the rest of the paper. The various phases of the QPSP protocol are described in Section 4 and its privacy guarantees are analyzed in Section 5. In addition, we experimentally evaluate the feasibility of our solution with current sensing devices in Section 6. Finally, Section 7 presents the conclusions of the paper and outlines some potential lines of future research.

Related Work

Most of the research in query privacy has been done in the area of Wireless Sensor Networks. Although this problem can be trivially solved by making all sensor nodes reply to every query, it also imposes severe energy requirements on the sensor nodes. Consequently, some authors have striven to find the right balance between privacy protection and energy consumption. The authors in [START_REF] Di | Location privacy and resilience in wireless sensor networks querying[END_REF] propose reducing the amount of traffic generated by using data-aggregation. This solution is only suitable for a particular type of query. A more general approach is presented in [START_REF] Carbunar | Query privacy in wireless sensor networks[END_REF], where the authors propose transmitting bogus queries to the network to hide the destination of real queries. Instead of sending bogus queries, the authors in [START_REF] De Cristofaro | Privacy-Preserving Querying in Sensor Networks[END_REF] propose hiding the recipient of the queries by sending them on a particular path of nodes that contains the actual destination. Unfortunately, the user needs to define the path, which is impractical for large-scale sensor networks.

A completely different approach is to unlink the original data source from the current location of the data, which is mostly achieved by having two types of nodes: sensing and storage nodes. The authors in [START_REF] Dimitriou | Privacy preservation schemes for querying wireless sensor networks[END_REF] propose having several data replicas so that user queries are forwarded to a number of random points with the hope that the query arrives at some of them. PriSecTopK [START_REF] Liao | Privacy-preserving and secure top-k query in twotier wireless sensor network[END_REF] concentrates on enabling top-k querying with the help of order-preserving encryption. A major limitation of this scheme is the need for shared secrets between the user and each sensing node. In addition, some papers [START_REF] Chen | Privacy-and integrity-preserving range queries in sensor networks[END_REF][START_REF] Zhang | Achieving efficient and secure range query in two-tiered wireless sensor networks[END_REF] have considered the problem of privacy-preserving range queries. Basically, the idea behind these schemes is to transform data and queries into special codes that can be processed by storage nodes without leaking information in the case they are compromised. All these solutions restrict the user to a particular type of query.

Finally, some effort has been made to protect query privacy in urban sensing scenarios. The approach followed in [START_REF] Cristofaro | Adversaries and countermeasures in privacyenhanced urban sensing systems[END_REF] is again based on data replication and storage devices. Their scheme is complemented with bogus replies to hide the data sources. A noteworthy difference with respect to our work is the adversarial model, which is an external attacker located at the edge of the network.

Problem Definition

This section deals with the definition of the problem. First, we present a general description of the system and then we illustrate the capabilities of the adversarial model. This section introduces the main assumptions applicable to the rest of the paper.

System Model

The system we are aiming for is composed of a substantial number of sensing devices which can be queried through a sensing server. Without loss of generality, we assume that the sensing devices are organized into clusters, where one node acts as the head or leader of each cluster. However, it is also reasonable to assume a more general model where the sensing server provides access to several sensing networks, like the one depicted in Fig. 2, which is a typical configuration in fullyfledged IoT scenarios. Note that the secure selection of cluster heads is beyond the scope of this paper and the interested reader is referred to [START_REF] Schaffer | Secure and reliable clustering in wireless sensor networks: A critical survey[END_REF] for a survey.

Moreover, there are at least n > 1 cluster heads in the sensing network. The cluster heads are considered to be able to communicate with one another and also with the sensing server. In the more general model, the cluster heads of each of the sensing networks are also necessarily interconnected. In either case, the communication with other cluster heads can be done directly through the Internet or by using the routing information available to them after the execution of a secure clustering protocol. The routing information also allows the cluster heads to determine how to reach any sensing device in the network.

Finally, we focus on a scenario where the readings of the sensing devices are publicly available to anyone willing to access them. This is, for example, the case of a Smart City [START_REF] Cocchia | Smart and Digital City: A Systematic Literature Review[END_REF]. Another important assumption is that the sensing devices, including the cluster heads, are owned and managed by an entity (e.g., the city council) other than the one that governs the access to the readings of the devices, namely the sensing server (e.g., Amazon). Moreover, the two entities are considered not to collude against the users.

Adversarial Model

The adversarial model considered in this paper is semi-honest (or honest-butcurious), which means that the adversary is assumed to follow the protocol but may try to benefit from a privileged role in the system to obtain information beyond what is permitted. More precisely, the adversary is interested in learning information about the interests of a particular user based on the queries he/she issues and the nodes responding to them.

We assume that the sensing server is a semi-honest adversary which has the following capabilities:

-Content analysis: inspects any packet it receives in order to retrieve sensitive information. The analysis is not limited to the payload of the packets but may also include the packet headers. Thus, the adversary may learn the query contents, the sensed data and the identities of the parties involved in the communication. -Statistical analysis: analyzes the features of the communication flow including the distribution of messages, the time at which messages are delivered or received, the transmission rate, and so on. The goal of this type of attack is to discover patterns in the transmissions in order to infer sensitive information.

The hearing range of the adversary is also an important aspect to consider when dealing with traffic analysis attacks. Typically, a semi-honest adversary is internal and limits its actions to the traffic addressed to it or traversing it. Nonetheless, in this paper we assume a more powerful adversary, which is allowed to extend its hearing range to the sensing network. The attacker is allowed to collude with external entities located in the vicinity of the sensing devices.

Moreover, we consider that a semi-honest sensing server can try to cheat by slightly modifying its behavior as long as it does not deviate from the protocol specification. For example, the adversary can craft random numbers at will instead of using a pseudo-random number generator for that purpose. The adversary can benefit from vague protocol specifications or randomly defined operations.

Query Privacy for Sensing Platforms Protocol

This section provides a detailed description of the QPSP protocol. First, we present a brief overview of the protocol and then continue with the explanation of each of the phases involved in it . Prior to that, we introduce some cryptographic background.

Overview

The QPSP protocol consists of three phases: initialization, query, and response. During the initialization a global public key, denoted by pk P , is generated by the cluster heads in a distributed way. This global public key corresponds to the sensing network as a whole and no single entity controls the corresponding decryption key in order to reduce the possibility of key compromise. This phase also deals with the generation of the corresponding re-encryption keys.

The global public key pk P is used to encrypt the queries sent to the sensing server, which transforms them using techniques from proxy re-encryption into new, encrypted queries that can be decrypted by the cluster heads only. This is done using special keys called re-encryption keys. During this process, the content of the query remains unaltered and cannot be obtained by the sensing server. Once the query has been decrypted by a cluster head, it is forwarded to the appropriate sensing device without disclosing its identity to the gateway.

The response phase is simpler. The confidentiality of the response is secured from the user end by incorporating a fresh key into the query to be used to encrypt the content of the response. From an abstract point of view, the communications are basically a two-message exchange between a user and a sensing device but some traffic obfuscation mechanisms are introduced to prevent leaking information.

Preliminaries

This section introduces some cryptographic notions that will be used during the definition of the QPSP protocol. Due to space limitations we do not go into details.

Bilinear pairings Let G 1 , G 2 and G T be cyclic groups of prime order q. A bilinear pairing is a map e : G 1 ×G 2 → G T satisfying the properties of bilinearity, non-degeneracy, and computability (see [START_REF] Sabır | Still wrong use of pairings in cryptography[END_REF] for more details). Depending on the characteristics of the groups involved, there are essentially three types of pairings, namely Type-1, Type-2 and Type-3. In this paper we use Type-3 pairings as they achieve the best trade-off between security and efficiency [START_REF] Steven | Pairings for cryptographers[END_REF].

Proxy Re-Encryption From a high-level viewpoint, proxy re-encryption is a type of public-key encryption that enables a proxy to transform ciphertexts under Alice's public key into ciphertexts decryptable by Bob's secret key. In order to do this, the proxy is given a re-encryption key, generated by Alice, which makes this process possible. There are multiple proxy re-encryption proposals in the literature, the most prominent are those of Blaze et al. [START_REF] Blaze | Divertible protocols and atomic proxy cryptography[END_REF] and Ateniese et al. [START_REF] Ateniese | Improved proxy re-encryption schemes with applications to secure distributed storage[END_REF].

Initialization phase

In this phase, the sensing platform sets up the necessary public parameters and cryptographic keys. As mentioned, we describe a distributed key generation procedure, principally performed by the cluster heads. Finally, we also present a key validation procedure in order to guarantee the correctness and validity of the key generation process.

Setup Let e : G 1 × G 2 → G T be a Type-3 pairing, and g and h generators of G 1 and G 2 , respectively. Let Z be the result of computing e(g, h). The public parameters of the system are the elements of the tuple (e, g, h, Z).

Key Generation

The main goal of this procedure is to create the global public key for the sensor domain, denoted by pk P , with no associated private key. In parallel, it is also necessary to create re-encryption keys that enable the transformation of ciphertexts between the global public key and the cluster heads' public key.

First, each cluster head CH i generates a key pair (pk i , sk i ) = (h xi , x i ), where x i is sampled uniformly at random from Z q . The cluster heads distribute their public keys among the rest, so we can assume that after this step, the cluster heads knows each others' public key. Next, each cluster head independently generates a temporal secret value p i sampled uniformly at random from Z q , and computes the values u i = Z pi and v ij = (pk j ) pi = h pixi , for all j ∈ {1, ..., N }. Finally, it sends (u i , {v ij }) to the sensing server for aggregation.

Once the sensing server has received the inputs from all the cluster heads, it computes the global public key and corresponding re-encryption keys as follows:

pk P = N i=1 u i = N i=1 Z pi = Z p1+...+pN = Z p (1)
rk P →i = N j=1 v ij = N j=1 h xipj = h xi(p1+...+pN ) = h xip (2)
Note that this procedure guarantees that the secret p = p 1 + ... + p N (which is the private key associated with the global public key) is never computed explicitly and that it cannot be recovered efficiently, by the Discrete Logarithm hardness assumption.

Key Validation

Given that the sensing server aggregates the inputs from all the cluster heads in order to create the global public key and the associated reencryption keys, it is possible (although not sensible) that it misbehaves during the aggregation process, for example, by discarding the input and publishing an alternative global public key for which it controls the corresponding decryption key. Recall that the goal of the distributed key generation process is to create a global public key with no associated private key.

In Appendix A.1 we describe a procedure for key validation, in which the cluster heads interact with each other and the sensing server. The existence of such a procedure acts as a deterrent to possible misbehavior from the sensing server, since it represents an efficient mechanism to detect any deviation from the agreed key generation process. Therefore, we can assume that the sensing server does not misbehave during key generation.

Query phase

This phase comprises the first direction of the communication, which is from user to cluster head, via the sensing server (as shown in Fig. 3). It comprises two messages: the first between user and sensing server, and the second between sensing server and the cluster head.

Message 1 (Encryption)

The first message of the protocol is constructed on the user side, and is delivered to the sensing server. The idea is that the user encrypts the query with the global public key pk P , and the encrypted query is later re-encrypted to a cluster head of the sensing platform.

User Sensing server

Cluster head The encryption scheme1 we propose is based on Ateniese et al.'s proxy reencryption scheme [START_REF] Ateniese | Improved proxy re-encryption schemes with applications to secure distributed storage[END_REF], which is proven IND-CPA secure. Let us suppose that the input to be encrypted is represented by an element m ∈ G T . The user samples random r ∈ Z q and produces the ciphertext CT = (CT 1 , CT 2 ) as follows:

M1 Random key K m ← Q K M1 ← EncP (m) M2 M2 ← ReEnci(M1) m ← Deci(M2) Parse Q and K from m Get response R for query Q M3 ← SymEnc K (R) M3 M4 R ← SymDec K (M4)
Enc P (m) = (g r , m • (pk P ) r ) = (g r , m • Z pr )
An important point when it comes to defining the actual protocol messages is that the initiator (i.e., the user) does not need to own any kind of key (either symmetric or asymmetric) to query the responder (i.e., a sensing device); that is, the initiator is unauthenticated. To the contrary, the responder has a public key, in this case, a global public key for the sensing platform. Therefore, the initiator can use this public key as a means to set up a secure channel for the response, by encrypting a fresh random key K with the public key of the sensing platform (as with the query Q). This is reminiscent of the one-pass key transport technique described in [START_REF] Alfred J Menezes | Handbook of applied cryptography[END_REF]Section 12.5.1]. Therefore, the first message of the protocol, which is named M 1 and generated by the user, is basically the encryption of the query Q and a fresh random key K to be used for securing the response, as shown in Fig. 3.

Message 2 (Re-encryption) Message M 1 is received by the sensing server, which transforms it into a ciphertext, decryptable by one of the cluster heads. Since, in principle, the encrypted query does not convey any metadata, the sensing server simply chooses some arbitrary cluster head (either at random or following some network delivery criteria). Therefore, the server is basically a blind gateway between the users and the sensing network.

Let us suppose that the sensing server chooses cluster head CH i then, the corresponding re-encryption key is rk P →i = h xip . The sensing server transforms the original ciphertext CT into a new ciphertext CT ′ intended for CH i as follows:

ReEnc i (CT ) = (e(CT 1 , rk P →i ), CT 2 ) = (Z prxi , m • Z pr )
The final message M 2 is simply the re-encrypted ciphertext.

Response phase

This phase includes the decryption and delivery of the query to the actual recipient as well as the response to the user.

Message 3 (Decryption) The cluster head CH i receives message M 2 , containing ciphertext CT ′ = (CT ′ 1 , CT ′ 2 ) and decrypts it using its own secret key as follows:

Dec i (CT ′ ) = CT ′ 2 • (CT ′ 1 ) -1/ski = m • Z pr • (Z prxi ) -1/xi = m
The resulting output m is parsed as the original query Q and a response key K. Next, the cluster must deliver m to the actual destination but as this process is subject to traffic analysis we propose a transmission mechanism inspired by the notion of k-anonymity.

All cluster heads use a deterministic mapping function to choose k destinations. This function is such that it receives one identifier as input and always returns the set of k identifiers, which include the original one. Therefore, CH i can either forward the actual query (encrypted under a shared key) to the k sensing devices output by the mapping function or simply send bogus queries to the k -1 cover destinations. In either case, the cluster heads must share secrets to encrypt the message and thus prevent content analysis attacks.

After reaching the k sensing devices, all of them must behave in the same way. As a result, devices receiving a (cover) query must reply to it, possibly with bogus or synthetic data. Finally, the results collected by the corresponding cluster heads are relayed to the cluster head who originally received the query, which filters out cover messages and selects the true response R. Finally, the cluster head encrypts it using the key K to produce message M 3 ; alternatively, the sensing device itself can encrypt the response, provided the cluster head sends the key K together with the query. Finally, message M 3 is delivered to the sensing server, which simply forwards it to the user. Message 4 (Delivery of response) The user receives message M 4 from the sensing server, and decrypts it using the key K in order to retrieve the response to his original query.

The analysis presented in this section concentrates on the two security properties the QPSP protocol aims to protect, namely query confidentiality and query privacy.

Query Confidentiality

The encryption scheme we use for protecting queries from the user to the cluster heads is essentially a restricted version of Ateniese et al.'s proxy re-encryption scheme [START_REF] Ateniese | Improved proxy re-encryption schemes with applications to secure distributed storage[END_REF], adapted to a Type-3 pairing setting. This encryption scheme satisfies the security notion of indistinguishability against chosen-plaintext attacks (IND-CPA), under the External Diffie-Hellman assumption (XDH) [START_REF] Ateniese | Untraceable rfid tags via insubvertible encryption[END_REF]. For reasons of space, we omit the full security proof, but the rough idea is as follows.

Assuming that there is an adversary B that wins the IND-CPA security game, it is possible to construct an algorithm A that uses B to solve the XDH problem (which is essentially the DDH problem in G 1 but in a pairing setting). Adversary A receives a DDH tuple (g, g a , g b , g c ) ∈ G 4 1 , and is asked to decide whether c = a • b. In order to decide, it simulates the environment for the adversary B by taking element g a for generating the global public key pk * P = e(g a , h) = Z a , and elements g b and g c for generating the challenge ciphertext CT * = (g b , m δ • e(g c , h)) = (g b , m δ • Z c ). It can be seen that when c = a • b, the challenge ciphertext is a valid encryption of m δ under pk * P , and B guesses δ correctly with non-negligible advantage. When the guess is correct, adversary A outputs c = a•b, which solves the DDH problem in G 1 with the non-negligible advantage. To the contrary, when c is random, B does not have any advantage in guessing δ, and hence, neither does A. Overall, it can be seen that A still solves the XDH problem with non-negligible advantage.

Query Privacy

We have just shown that the sensing server cannot obtain information from content analysis but may still perform statistical analysis. Next we show that even when the sensing server does not strictly follow the protocol specification, it learns nothing.

First, let us assume a single protocol run. After a single query, the sensing server may learn, with the help of external colluders, that the user has queried one of the k nodes responding to the query. Note that if k is sufficiently large, query privacy is ensured as long as the mapping function has been designed taking into account the properties of l-diversity and t-closeness [START_REF] Li | t-closeness: Privacy beyond k-anonymity and l-diversity[END_REF]. In the case that the mapping does not respect these notions, the attacker may not know which particular device replied to the query but still learn that the user is interested in, for instance, radiation levels. We assume that this is dependent on the scenario and thus beyond the scope of this paper.

Let us now assume that the user is repeatedly issuing queries. If the queries are addressed to different sensing devices, the analysis is similar to the single execution case. However, if the user is regularly querying a particular device and the sensing server is aware of this, the adversary is incapable of determining which of the elements in the anonymity set is the actual recipient. Even if the sensing server tries to cheat by choosing the cluster heads at will, it is still unable to reduce the size of the anonymity set because all cluster heads use the same mapping function.

The sensing server's last resort is to craft its own queries and submit them to the sensing network. This is possible since we are considering a public sensing network. However, there is no incentive for it to do so since the only thing the attacker will learn is the mapping function for a particular node, which is not secret, and the data sensed by the node. These data are not sensitive since they are obtained from a query issued by the sensing server and not by a particular user. Thus, the interests of the user are not revealed.

Finally, recall that the sensing server and the sensing devices are supposed not to collaborate. This is because the former knows the identity of the user and the latter is aware of the nodes of interest to the user. To reduce the risk of privacy exposure, the identity of the user can be further protected with the help of an anonymity network, such as Crowds or Tor.

Experimental Evaluation

In order to experimentally evaluate the overhead of the cryptographic operations in our proposal, we implemented a proof of concept in C using the Apache Milagro Crypto Library [START_REF]Apache Milagro Crypto Library[END_REF]. Since we defined the cryptographic scheme over a Type-3 pairing setting, it was necessary to use an elliptic curve that supports this. We selected a 256-bit Barreto-Naehrig (BN) curve, which is suitable for said pairings and offers a good trade-off with respect to security and performance [START_REF] Diego F Aranha | The realm of the pairings[END_REF].

We used three different execution platforms, in order to simulate the characteristics of the entities involved in the potential use cases. For the user and sensing server, we used a laptop with an Intel Core 2 Duo processor @ 2.66 GHz and 8 GB of RAM. For the cluster heads, we performed our tests in two different platforms: a Raspberry Pi Gen 1 Model B (SoC Broadcom BCM2835, 32-bit, single core, 700Mhz, 512 MB), and an Intel Galileo Gen 1 (SoC Intel Quark X1000 32-bit, single core, single-thread, P54C/i586 400Mhz, 256 MB). Table 1 shows the results of our experiments, categorized by the type of operation, entity and execution platform. Both encryption and re-encryption of queries are tested on a PC-like platform, while decryption is done in a sensorlike device. Experiments were executed 100 times and the average value was taken. It can be seen that the results are of the order of 10 ms in the user-and server-side, while they range between 46 and 122 ms on the side of the cluster head, depending on the execution platform. Further optimizations include the pre-computation of pairings for re-encryption, given that re-encryption keys are fixed arguments to pairings. In this regard there are several techniques, such as [START_REF] Costello | Fixed argument pairings[END_REF] which reports a speed-up around 30%. It is also possible to study different curves in order to find the more efficient ones on the side of the cluster head, that is, curves that minimize the cost associated with exponentiations on G T .

Conclusions

This paper has presented the QPSP protocol. The proposed solution prevents users from being profiled by semi-trusted Sensing-as-a-Service platforms. This is achieved with the help of proxy re-encryption primitives and traffic obfuscation at the sensing network. More precisely, the user sends queries to the platform encrypted with a global public key generated by a set of cluster heads, the query is then re-encrypted by the sensing server and forwarded to one of the cluster heads, which is responsible for transmitting the query to the final destination using a privacy-preserving routing protocol.

The proposed solution is intended for Sensing-as-a-Service platforms where the data collected by the sensing devices are public and therefore anyone can query the network. We are planning to extend our solution to a scenario where the access needs to be both authenticated and respectful of privacy. Moreover, we are exploring network management issues such as the revocation of nodes and how to deal with the addition of new cluster heads once the network has been deployed.

Fig. 1 .

 1 Fig. 1. Sensing-as-a-Service Platform

Fig. 2 .

 2 Fig. 2. General System Model

Fig. 3 .

 3 Fig. 3. Main part of the QPSP protocol

Table 1 .

 1 Performance of the cryptographic operations for different execution platforms

	Entity	Platform	Operation Cost (ms)
	User	Laptop	Encryption	7.58
	Sensing server	Laptop	Re-Encryption	11.55
	Cluster head Raspberry Pi Decryption	46.20
	Cluster head Intel Galileo Decryption	122.20

In practice, the proposed scheme would be used to encrypt a fresh random key, which in turn will be used to encrypt the actual message with a symmetric encryption algorithm, following a hybrid encryption approach. For simplicity in the description, we will obviate this.

In the proxy re-encryption literature, knowledge of a re-encryption key and the corresponding recipient's private key can be used in some cases to derive the original private key. This is known as a "collusion attack"[START_REF] Ateniese | Improved proxy re-encryption schemes with applications to secure distributed storage[END_REF].

Acknowledgements

This paper has been partially supported by the Junta de Andalucía through the project FISICCO (P11-TIC-07223) and the Spanish Ministry of Economy and Competitiveness through the PERSIST (TIN2013-41739-R) and SMOG (TIN2016-79095-C2-1-R) projects.

Appendix A

A.1 Key Validation Procedure

The validation process has to check three requirements: (i) that the global public key is the result of aggregating the inputs from all the cluster heads, (ii) the reencryption keys are also generated by aggregation, and (iii) the re-encryption keys are correctly associated with the global public key (i.e., they allow the transformation of ciphertexts from the global public key to the cluster heads' keys).

Validation requirement (i) can be checked simply by engaging all the cluster heads in an incremental ring-style protocol, where each of them receives an intermediate value and multiplies it by its input u i for the public key; hence, at the end of the protocol, the global public key (which we assume is published by the system and known by all the cluster heads) should be obtained. As long as no cluster head is corrupted, this requirement can be correctly checked.

Validation requirements (ii) and (iii) involve re-encryption keys. A complication here is that, although the global public key is, indeed, public, re-encryption keys may not be (and possible should not be) public 2 . However, it is possible for each cluster head to challenge the service provider and to test if the response corresponds to a valid re-encryption key as follows. Each cluster head CH i computes a random challenge value g k , and sends it to the sensing server, which responds with the value e(g k , rk P →i ). Now the cluster head checks whether the following equation holds: e(g k , rk P →i ) = (pk P ) xik It can be seen that, given rk P →i = h xip and pk P = Z p , the correct response from the service provider will be Z xikp , which is indeed equal to (pk P ) xik . Therefore, each cluster head can independently check requirements (ii) and (iii) and report to the others in the case there is a problem. Since, the correctness of the global public key has been checked before, and this public key is used during the validation of the re-encryption keys, it can be safely accepted that all the keys are correct.