Olivier Herscovici-Schiller

Jean-François Sauvage

Laurent M Mugnier

Kjetil Dohlen

Arthur Vigan

Coronagraphic phase diversity through residual turbulence: performance study and experimental validation

Keywords: instrumentation, high angular resolution -instrumentation, adaptive optics -techniques, high angular resolution -techniques, image processing -turbulence -methods, data analysis

Quasi-static aberrations in coronagraphic systems are the ultimate limitation to the capabilities of exoplanet imagers both ground-based and space-based. These aberrations -which can be due to various causes such as optics alignment or moving optical parts during the observing sequence -create light residuals called speckles in the focal plane that might be mistaken for a planets. For ground-based instruments, the presence of residual turbulent wavefront errors due to partial adaptive optics correction causes an additional difficulty to the challenge of measuring aberrations in the presence of a coronagraph. In this paper, we present an extension of COFFEE, the coronagraphic phase diversity, to the estimation of quasi-static aberrations in the presence of adaptive optics-corrected residual turbulence. We perform realistic numerical simulations to assess the performance that can be expected on an instrument of the current generation. We perform the first experimental validation in the laboratory which demonstrates that quasi-static aberrations can be corrected during the observations by means of coronagraphic phase diversity.

INTRODUCTION

Imaging exoplanets is a challenging task. Current groundbased exoplanet imagers such as SPHERE or GPI reach contrast levels of 10 -6 in H-band at 0.5 arc second separations [START_REF] Beuzit | Ground-based and airborne instrumentation for astronomy II[END_REF]Macintosh et al. 2008). Such high contrast imaging is enabled by the use of coronagraphs, devices which reject the on-axis starlight but let out-of-axis light from disks or planets pass through. However, any optical aberration in the instrument causes light to leak through the coronagraph, which results in speckles appearing in the focal plane of the telescope. These speckles constitute the ultimate contrast limit for exoplanet imagers.

Since the quasi-static aberrations evolve slowly during the night [START_REF] Martinez | [END_REF](Martinez et al. , 2013)), the full contrast capacity of exoplanet imagers can be reached only if a correction is applied during the night. A few methods have been developed to measure the quasi-static aberrations [START_REF] N'diaye | Modern Technologies in Space-and Groundbased Telescopes and Instrumentation II[END_REF]Galicher et al. 2008). However, none of them is currently adapted to being used during the observations of a ground-based instrument, although some tests are currently taking place [START_REF] Vigan | ternational Society for Optics and Photonics[END_REF]. Our goal is to present the adequacy of the coronagraphic phase diversity, COF-FEE, to the measurement of quasi-static phase aberrations in the presence of adaptive-optics-corrected residual turbulence. We start with the adaptation of the algorithm. We continue with a performance assessment consisting in numerical studies of the sensitivity of the method to various sources of perturbation. We finish with the description of a laboratory validation of the coronagraphic phase diversity in the presence of residual turbulence on the MITHiC bench at laboratoire d'astrophysique de Marseille.

FORMALISM OF THE CORONAGRAPHIC PHASE DIVERSITY IN THE PRESENCE OF RESIDUAL ADAPTIVE-OPTICS-CORRECTED TURBULENCE

In this section, we recall the formalism of coronagraphic phase diversity and we present its adaptation to the presence of adaptive-optics-corrected turbulence.

2.1 COFFEE, the coronagraphic phase diversity COFFEE, the coronagraphic phase diversity, is a postcoronagraphic wavefront sensor [START_REF] Sauvage | [END_REF]Paul et al. 2013a). As its name suggests, it is a flavour of the phase diversity (Gonsalves 1982;[START_REF] Mugnier | Advances in Imaging and Electron Physics[END_REF] method. The principle is to use information encoded in images produced by the scientific instrument to retrieve the aberrations of the instrument. Unfortunately, more than only one image is needed to do so. In phase diversity, two (or more) images are used. One is called the focused image. The other one, called the diversity image, is taken while a known aberration, called the diversity phase, is voluntarily introduced in the system. In the context of coronagraphic phase diversity for ground-based instruments, the diversity phase can be easily introduced by the deformable mirror of the adaptive optics system. From a mathematical point of view, COFFEE is a maximum a posteriori estimator with non-homogeneous Gaussian noise assumption. The principle is to find the upstream phase aberration φ up and the downstream phase aberration φ down that minimise the cost function J :

J (φ) = k, x,y i(k, x, y) -m(φ up , φ down , k, x, y) 2 2σ 2 (k, x, y)
+R(φ up )+R(φ down ).

(1)

In the first term of the right hand sign, i is an experimental image produced by the detector. Its counterpart m is a numerical model of the image, which takes into account the sought quasi-static aberrations φ up and φ down . The indexes of the sum are x and y, which are the coordinates of the pixels in images, and k, which is there to distinguish between the focal image and the diversity image. The denominator σ 2 is the variance of the noise level of pixel x, y in the image i(k). This first term is a noise-weighted distance between the experimental data and the output of a model. The second term of the right hand sign, R, is a regularisation term, often taken as

R(φ) = 1 2σ 2 ∇φ x,y ∇φ 2 (x, y), ( 2
)
where ∇φ is the spatial gradient of φ. This second term represents prior knowledge of the statistics of the aberrations. More precisely, this terms penalises the phase spatial gradients, which smooths the reconstructed phase and attenuates the noise propagation in the wavefront. This avoids unrealistic very high spatial frequencies to appear in the reconstructed wavefront. If the images are not narrow-band, the impact of spectral width is negligible for ∆ λ/λ < 15% (Meynadier et al. 1999). If the image is broad-band, then the numerical model of the image must be calculated for several wavelengths [START_REF] Seldin | Imaging technology and telescopes[END_REF]. This will increase the computation cost of the numerical model in proportion to the width of the spectral band. However, the calculations at different wavelengths can absolutely be done in parallel, so the increase in the number of computations will not result in an increase in the duration of the computation if a multiplecore-computer can be used.

Implementation: taking turbulence into account

The numerical implementation of COFFEE in a turbulencefree case is described in Paul et al. (2013a) and Paul et al. (2013b). The expression of m in COFFEE is

m(φ, k, x, y) = f k × [h det h c (φ + φ k )] (x, y) + b k , (3)
where f k the incoming flux, h det is the response of the detector, is the convolution operator, h c is the point spread function of the coronagraphic instrument, φ is the static aberration that we seek to retrieve, φ k is zero for the focused image and is the diversity phase in the diversity image, and b k is a constant background.

In order to take the effect of atmospheric turbulence into account, the model of data formation m must reckon the impact of turbulence. In order to do so, we developed an analytic expression for coronagraphic imaging through turbulence (Herscovici-Schiller et al. 2017) to use as the point spread function of the instrument. The optical impulse response of the coronagraphic instrument in the presence of (residual) turbulence is noted h lec -the index stands for "long exposure coronagraphic". We still note h c the impulse response of the coronagraphic instrument without turbulence. By analogy with the atmospheric transfer function [START_REF] Roddier | [END_REF] as described by Herscovici-Schiller et al. (2017), we note h a (D φ ) the atmospheric point spread function, defined as

h a (D φ ) = F -1 exp - 1 2 D φ , (4)
where D φ is the phase structure function of the (residual) atmospheric turbulence. If the turbulence is supposed to be stationary and ergodic, then, for an exposure time much larger than the characteristic time of turbulence,

h lec (α; φ up , φ down , D φ ) = ∬ h a α ; D φ × h c α; φ up + 2πα • Id, φ down dα , ( 5
)
where α is a two-dimensional angular position in the focal plane, φ up is the static aberration upstream of the coronagraph, φ down is the static aberration downstream of the coronagraph, and Id is the identity function of R 2 . In order to use this forward model into COFFEE, one needs to compute it efficiently, and to compute its gradients.

The numeric model of the instrument is computed by performing a discrete sum to approximate the integral, using the same Fourier optics model for h c as in Paul et al. (2013a), as long as an estimate of D φ is available, for example using one of the methods described in [START_REF] Sauvage | [END_REF] or [START_REF] Véran | [END_REF]. If the point spread function is sampled on N × N pixels, a natural choice is to calculate the numeric point spread function as

h lec (α; φ up , φ down , D φ ) = (6) N /2 α x =-N /2 N /2 α y =-N /2 h a α ; D φ × h c α; φ up + 2πα • Id, φ down .

A physical approximation that reduces computing costs

The resulting cost of calculation is then N 2 times the cost of calculating h c . This cost can be considerably alleviated if the coronagraph is a Lyot-type coronagraph such as Lyot's opaque mask or Roddier's phase mask coronagraphs. Indeed, for those coronagraphs consisting of small phase or amplitude features strictly located in the vicinity of the stellar image, the influence of the focal mask on the point spread function is essentially negligible when there is a strong upstream tip-tilt. Let us define a central square region of side M in the focal plane of the coronagraphic mask. If the light beam is centred outside of this central square, the coronagraph is supposed to have no influence on the beam. Then, the previous equation can be split into two regions:

h lec (α; φ up , φ down , D φ ) = (7)
N /2

α x =-N /2 α x [-M/2, M/2] N /2 α y =-N /2 α y [-M/2, M/2] h a α ; D φ × h c α; φ up + 2πα • Id, φ down + M/2 α x =-M/2 M/2 α y =-M/2 h a α ; D φ × h c α; φ up + 2πα • Id, φ down .
Since the double sum on the first line exists only for strong tip-tilts, the value of h c in it is very close to the value of a non-coronagraphic point spread function, denoted h:

h lec (α; φ up , φ down , D φ ) ≈ (8) N /2 α x =-N /2 α x [-M/2, M/2] N /2 α y =-N /2 α y [-M/2, M/2] h a α ; D φ × h α; φ up + 2πα • Id, φ down + M/2 α x =-M/2 M/2 α y =-M/2 h a α ; D φ × h c α; φ up + 2πα • Id, φ down .
Now, we can give a convolutive structure to the first double sum. Let us define h 0 a as

h 0 a (α ) = 0 if α ∈ [-M/2, M/2] × [-M/2, M/2] h a (α ) otherwise. (9)
Then, Equation ( 8) can be re-written as :

h lec (α; φ up , φ down , D φ ) = (10) N /2 α x =-N /2 N /2 α y =-N /2 h 0 a α ; D φ × h α; φ up + 2πα • Id, φ down + M/2 α x =-M/2 M/2 α y =-M/2 h a α ; D φ × h c α; φ up + 2πα • Id, φ down ,
h lec (α; φ up , φ down , D φ ) = h 0 a (D φ ) h φ up , φ down (α) (11) + M/2 α x =-M/2 M/2 α y =-M/2 h a α ; D φ × h c α; φ up + 2πα • Id, φ down .
Since the cost of calculating the convolution product is negligible in comparison with the cost of calculating the double sum, the total cost of the calculation has diminished from N 2 times the cost of calculating h c to M 2 times the cost of calculating h c . An important point is then to determine which is the quality of the approximation as a function of the side of the exact calculation zone, M. Figure 1 presents the energy in the difference between the field calculated without approximation and the field calculated using Equation (11). Various sizes M, varying from 1 to 41, are considered. The coronagraph that is considered here is a Lyot coronagraph of radius 2λ/D. The root mean square of the upstream aberration is 100 nm at a wave-length λ = 1, 589 nm, and the phase structure function is representative of SPHERE's SAXO adaptive optics system. The normalisation factor is taken such that the coronagraphic point spread function without any aberration, without turbulence, has a total energy of 1. The sampling factor is chosen to satisfy exactly the Shannon-Nyquist condition, that is to say that a numeric field of M pixels corresponds to an optic angular size of Mλ/2D.

There are two regimes of loss of precision due to the approximation. In the first regime, the approximation is crude because the size M is insufficient, and the error decreases greatly with any increase in M. In the second regime, where M > 10, the exact calculation is performed on a zone of extension 5λ/D. Beyond this zone, the error committed by approximating a tilted coronagraphic point spread function by a non-coronagraphic one becomes negligible. Indeed, even if there is a Lyot (or Roddier & Roddier) coronagraph, a light beam tilted by more than 5λ/2D will essentially not be modified by the coronagraph. Consequently, in the second regime, the approximation error is very low, and decreases more slowly.

In conclusion, for coronagraphs such as the Lyot coron-agraph or the Roddier & Roddier coronagraph, and in particular the popular APLC, the cost of a long-exposure coronagraphic image simulation can be about a hundredfold the cost of a short-exposure coronagraphic image. In practice, the simulation of a 1024 × 1024-pixel long-exposure coronagraphic image results in a calculation time of less than five seconds on a single core of an office computer equipped with a 2.6 GHz Intel processor. In principle, the approximation could be adapted to a four-quadrant phase mask coronagraph, where the convolutive approximation could be done far from the transitions.

Calculating the gradients

The COFFEE criterion given by Equation ( 1) can be separated into two parts. The gradient of the regularisation part, R, is easier to calculate, for the inclusion of turbulence into the model does not change it. As can be found in Paul ( 2014)

∂R ∂φ (φ) = - 1 σ 2 ∇φ ∆φ for R(φ) = 1 2σ 2 ∇φ x,y ∇φ 2 (x, y). (12)
Let us define D as the other part of the criterion, that is, the distance between the model m and the data i :

D = k, x,y i(k, x, y) -m(φ up , φ down , k, x, y) 2 2σ 2 (k, x, y) . ( 13
)
Then, using the complete expression of m, D is

D = k, x,y i(k, x, y) -f k × h det h lec (φ up + φ k , φ down ) (x, y) -b k 2 2σ 2 (k, x, y) , (14)
where

h lec (α; φ up , φ down , D φ ) = (15) N /2 α x =-N /2 N /2 α y =-N /2 h a α ; D φ × h c α; φ up + 2πα • Id, φ down .
The gradient of D with respect to φ can be calculated using the long-exposure coronagraphic point spread function as an intermediate variable :

∂D ∂φ = l m ∂D ∂h lec (l, m) ∂h lec (l, m) ∂φ . ( 16
)
By using the analytic expression for h lec , this gradient is also

∂D ∂φ = l m ∂D ∂h lec (l, m) (17) × ∂ ∂φ N /2 α x =-N /2 N /2 α y =-N /2 h a α ; D φ × h c l, m; φ up + 2πα • Id, φ down .
Now, a rearrangement of the summation operators leads to

∂D ∂φ = N /2 α x =-N /2 N /2 α y =-N /2 h a α ; D φ (18) × l m ∂D ∂h lec (l, m) × ∂ ∂φ h c l, m; φ up + 2πα • Id, φ down .
One can note that the second line of this last expression is the gradient of the non-regularised criterion in the absence of turbulence, whose expression is given in the appendix of Paul et al. (2013a). Consequently, the structure of the calculation of this gradient is similar to the calculation of the point spread function itself. Thus, its calculation can also benefit from the acceleration described in the previous subsection.

Now that the formalism and implementation of coronagraphic phase diversity in the presence of turbulence are described, let us move on to a numerical study of the robustness of the method.

NUMERICAL STUDY OF THE ROBUSTNESS OF THE METHOD

In this section, we perform numerical simulations to study the impact on the quality of the COFFEE reconstruction of various discrepancies between the model m and the actual imaging process leading to i. A simulation result when there is no discrepancy is presented in Herscovici-Schiller et al. (2017). We consider successive discrepancies in order to obtain a realistic simulation of the performance that can be expected of the technique on a real instrument.

Parameters of the simulations

In all this section, the phase aberrations are expressed at a wavelength λ = 1.589 nm. The simulation is purely monochromatic, the wavelength being λ = 1.589 nm.. The input parameters of the simulations include a phase structure function D φ that is representative of turbulence at Paranal after correction by SPHERE's adaptive optics SAXO. The upstream phase aberration, φ up , has a root mean square of 50 nm, with an energy spectral density that follows a f -2 statistics. This upstream phase aberration is what we wish to estimate thanks to COFFEE in the simulations. The downstream phase aberration, φ down , has a root mean square of 20 nm, with the same energy spectral density as the upstream aberration. The coronagraph is an unapodized Lyot coronagraph, with a ratio of 95 % between the diameter of the entrance pupil and the diameter of the Lyot stop. There are no amplitude aberrations in the system. The total flux of the source is taken at 10 9 photons, and the root mean square of the electronic noise of the detector is one electron per pixel. The diversity phase is supposed to be perfectly known. It is taken as a pure defocus, with root mean square 125 nm. The images in the focal plane have 128 × 128 pixels. The value of the sampling is chosen as 2, so the Shannon-Nyquist condition is respected, and the estimated phases are sampled over 64 × 64 pixels.

Sensitivity to an error on the phase structure function

The analytic model that we use in the reconstruction algorithm requires the knowledge of the phase structure function of the post-adaptive optics residuals.

During operations, the statistics of the adaptive opticscorrected turbulence can be estimated using several techniques [START_REF] Véran | [END_REF][START_REF] Sauvage | [END_REF]. A first family is telemetry techniques that give access to such data as the seeing or the wind speed. Those data can then be used jointly with the parameters of the adaptive optics system in a numeric simulation whose output is the phase structure function D φ . A second family of techniques is to use such real-time measurements of the adaptive optics system as residual slopes and command voltages. Since this section is concerned with performing simulations, we used the first option to produce the phase structure function.

Whether one or the other technique is chosen, the phase structure function will not be perfectly known in practice. In this subsection, we test how an error on the parameter D φ impacts the quality of the reconstruction. We generate data using the parameters detailed in the previous subsections. We then perform COFFEE reconstructions using different phase structure functions, which are obtained by multiplying the "true" phase structure function D φ by a factor 1p. For the sake of legibility, a reconstruction performed using (1p)× D φ as phase structure function is called a reconstruction with a error of magnitude p on D φ . This corresponds to a reconstruction where the seeing is underestimated, but with a correct knowledge of the wind velocity and the magnitude of the source. Indeed, D φ translates the phase residual statistics after the AO system, and this residual behaves in direct relation with the Fried parameter r 0 [START_REF] Rigaut | Adaptive Optical System Technologies[END_REF]Fétick et al. 2018), as the adaptive optics loop acts mainly as a filter. A more detailed analysis should also indicate the impact of a wind difference (hence only impacting the on-axis residuals), or a boiling effect, or mis-registration evolution, or the impact of additionnal dead actuators; here we perform a principle demonstration taking only r 0 , which is the main contributor to the final correction error of the adaptive optics loop, hence producing a scaling on D φ .

Figure 2 displays the root mean square error between the estimated upstream phase, φ up , and the true upstream phase, φ up as a function on the error on D φ , for five different values of the error p. The error evolves in the same way for p < 0.. On SAXO, the adaptive optics of SPHERE, one can expect an error ranging from 5% to 15%. Consequently, one can expect an error of one to three nanometres on the part of the aberrations that can be corrected by the deformable mirror. Thus, COFFEE is expected be a good candidate to measure and correct the quasi-static aberrations several times per night, using on-sky measurements.

Sensitivity to the noise level

The incoming photonic flux has a critical impact on the noise level in the images. In this subsection, we study the impact of the photonic flux on the estimation quality of φ up . We perform this study with a 10 % error level on D φ , for we do not have proof that the various causes of estimation errors are independent. When the light flux increases, the noise decreases, so we expect the quality of the estimation to increase. This expectation is confirmed by the results shown on Fig. 3. It shows that the estimation error decreases with an increase in the flux. Moreover, it shows that the quality of the estimation is much less sensitive to an increase in the incoming light flux at around one million incoming photons in the pupil.

We can explain the order of magnitude of this critical point in a simple manner. The coronagraph blocks about 90% of the incoming 10 6 photons. About 10 5 reach the 128 × 128 = 16, 384 pixels of the detector, which amounts to an average of about 6 photons per pixel. Since the electronic noise is one electron per pixel, we deduce that the effect of an increase in the total flux is reduced if the average flux per pixel is such that the signal to noise ratio is higher than 5, which is easily reachable in a reasonable amount of time for a H magnitude of nine to twelve.

Let us consider the case of an observation by the Very Large Telescope of a star of magnitude 15 in the visible. The photonic flux on the detector without a coronagraph is about 2 × 10 5 photons per second in H-band. Since the data that we aim to use are typically exposures of a several hundred seconds, the resulting number of photons is in the range of 10 7 , which is quite enough to avoid the estimation to be limited by the noise level.

Sensitivity to the presence of a planet in the data

The data formation model that we use in COFFEE relies on the light propagation from a point source. However, for practical on-sky implementations, COFFEE must be able to estimate aberrations while observing planets. Here, we present COFFEE estimates performed on simulated images where there is a planet. We chose realistic parameters: we kept a 10% error level on D φ , and an incoming light flux of 10 6 photons in the pupil. The position of the planet is at an angle 3.5λ/D from the star. We simulated planets with flux ratios of 10 -3 , 10 -4 , and 10 -5 between the star and the planet, so that we could test the various impacts that various planet fluxes could have on the estimation error.

Figure 4 presents COFFEE estimates with no planet in the data, and with planets whose fluxes are 10 -5 , 10 -4 , and 10 -3 with respect to the star.

In the case where the flux ratio is 10 -5 , the phase estimation is almost unperturbed by the planet: the root mean square of the difference between the reconstruction with a planet and the reconstruction without planet is only 0.35 nm. This difference is mainly due to the fact that the realisations of the noise in the data are different.

In the case where the flux ratio is 10 -3 , the phase estimation is strongly perturbed by the planet. In that case, the root mean square of the difference between the reconstruction with a planet and the reconstruction without planet is 6.0 nm. The error is mainly a sinusoidal structure whose image through the data formation model generates a strong speckle that looks like a planet.

In the intermediate where the flux ratio is 10 -4 , the phase estimation is slightly perturbed by the planet. In that case, the root mean square of the difference between the reconstruction with a planet and the reconstruction without planet is 0.5 nm.

These results show that COFFEE may or may not mistake a planet in the data for a speckle, depending on its light flux. This influence of the light flux of the planet can be explained by comparing it with the regularisation level. If the flux of the planet is high, the associated noise in the pixels that image it is low, and the planet then has an important impact on the criterion, leading to a sinusoidal estimation for φ up . On the opposite, if the flux of the planet is low, the associated noise in the pixels that image it is high, and the planed then has a low impact in the criterion, so the regularisation will prevent the emergence of an artefact. This is especially obvious if one compares Figs 5 and6.

We conclude that, for a planet whose light flux compared to its star is less than 10 -4 , its presence in the data will account for an estimation error of root mean square less than half a nanometre in the SPHERE-like case of a fifty-nanometre upstream aberration. If, however, a planet of flux higher than 10 -4 happened to be in the field, then it would be clearly visible in the raw data (compare Figs 5 and6). In that case, one could choose to ignore a small region about the planet in the COFFEE input data. The alternative is to implement a model of the planet as a source point in the COFFEE algorithm. Even in the presence of an imperfect knowledge of the phase structure function, and with a limited exposure time, the expected error root mean square of the estimation error is of the order of a nanometre in the adaptive optics-corrected zone, for a 50-nanometres root mean square phase aberration. With this encouraging simulation result in mind, we proceed to the laboratory validation.

LABORATORY VALIDATION OF THE CORONAGRAPHIC PHASE DIVERSITY IN THE PRESENCE OF RESIDUAL TURBULENCE

Strategy of validation

Aim

The aim of our experiment was to use the coronagraphic phase diversity to estimate a static phase aberration upstream of a coronagraph by using post-coronagraphic images as input data. The experiment was performed in a controlled environment, the MITHiC testbed.

The MITHiC testbed

MITHiC is the Marseille Imaging Testbed for High Contrast imaging. It has been developed at the laboratoire d'astrophysique de Marseille (LAM) for almost ten years N' [START_REF] N'diaye | Modern Technologies in Space-and Groundbased Telescopes and Instrumentation II[END_REF]. It is schematically described on Fig. 7. The light source is a super-luminescent diode. It emits light in a narrow spectral band centred around λ = 677 nm. In all our data processing, it is considered as a monochromatic light source. The light undergoes linear polarisation, and injected on the bench through an entrance pupil.

It is propagated in a second pupil plane, where it passes through a rotating transparent phase screen. On this screen are engraved random path differences whose statistics is that of atmospheric turbulence corrected by SAXO, the adaptive optics system of the SPHERE instrument. The scale of these path differences is such that the 45-nm-RMS phase shift that they create at the working wavelength of 677 nm is the same as the 100-nm-RMS phase shift created by the SAXOcorrected atmospheric turbulence at 1,600 nm, which is a typical observational wavelength for SPHERE. The phase screen used on MITHIC to produce the wavefront errors (both the residual turbulence, or dedicated static patterns) have been specified by LAM and realized by SILIOS company on a pixel map interface. LAM has provided exactly the phase map (pixel by pixel depth graduated in nanometers) to be engraved on the phase screen. The realization of SILIOS has been checked at LAM with a high-resolution ZYGO interferometer after delivery, and they are correct at a nanometric level, which guarantees that the statistic, as well as the power law and RMS across the aperture are the expected ones.

In a third pupil plane, the light meets the surface of a spatial light modulator. The presence of this element is the reason why the light is polarised in the first place. The spatial light modulator is used as a high resolution deformable mirror.

The light is then split into two paths using a beam splitter. The auxiliary path, or ZELDA path [START_REF] N'diaye | Modern Technologies in Space-and Groundbased Telescopes and Instrumentation II[END_REF], can be used to perform ZELDA experiments, or to use a HASO wavefront sensor as a calibration reference, which is what we did. The main path, which is the one of interest for us here, comprises a Roddier & Roddier focal plane mask, and a Lyot stop in the next pupil plane.

Finally, the light reaches a focal plane camera. This focal plane can be turned into a pupil plane by introducing a movable lens in the light beam.

Validation strategy

Our goal was to validate aberration estimation using coronagraphic phase diversity in the presence of residual adaptive optics-corrected turbulence. The plainest strategy imaginable would have been to introduce a known pupil-plane phase aberration upstream of the coronagraph, take focused and diversity images, process them with COFFEE, and compare the output of COFFEE to the known aberration. However, this plain strategy would have needed that the optical testbed be absolutely perfect, that is to say that the introduced aberration be perfectly known. Since aberrations always exist on the bench, and COFFEE is an absolute wavefront sensor, this was not feasible. So we proceeded in two times, using a differential estimation strategy, as for example in Herscovici-Schiller et al. (2018).

First, we did not introduce any aberration. Let us call φ 0 up the static aberration on the bench. We took a focused image and a diversity image, which we collectively denote by i 0 . We used i 0 as an input in COFFEE, the output being our estimate of the static aberration on the bench, φ 0 up . Then, we used the spatial light modulator to introduce a known aberration, φ F up . This did not suppress the aberration φ 0 up on the bench, so the resulting total aberration on the bench was φ 0 up +φ F up . We took a focused image and a diversity image, which we collectively denote by i 1 . We used i 1 as an input in COFFEE, the output being our estimate of the total aberration on the bench, φ 0 up + φ F up . The last step is to compute the difference φ 0 up + φ F up -φ 0 up , which we use as the estimate φ F up of φ F up . This validation strategy is described symbolically on Fig. 8.

Calibration of the parameters of the optical model

Since COFFEE relies on a model of image formation, some calibrations are necessary to perform an estimation. We detail these calibrations here.

Sampling on the detector

To determine the sampling on the detector, we took a noncoronagraphic image whose size is 1, 000 × 1, 000 pixels. The modulus of its Fourier transform is the modulation transfer function. This modulation transfer function, whose circular average is shown on Fig. 9, goes to zero at spatial frequency pixel number 107. Consequently, the sampling factor s f on the detector is

s f = 1000 107 ± 1 = 9.43 ± 0.1. (19)
In order to shorten calculation times, the data used as input to COFFEE were under-sampled by a factor 4. The resulting sampling being higher than 2, the Shannon-Nyquist condition is satisfied, so there is no loss of information in the reconstruction.

Lyot ratio

The Lyot ratio is defined as the ratio between the diameter of the entrance pupil and the diameter of the Lyot stop. It is a necessary parameter for the direct model. In order to determine it, we introduced the Lyot stop -but not the Roddier & Roddier focal mask -on the bench. Then, just as for the determination of the sampling on the detector, we took an image and examined the cut of the corresponding modulation transfer function. It is located between pixels 99 and 100. Since the Lyot ratio is proportionnal to the ratio of the cut frequencies, the Lyot ratio is r L = 99.5 ± 0.5 107 ± 1 = 0.93 ± 0.01.

(20)

Detector noise

The only information on the electronic noise of the camera given by the manufacturer is that its root mean square is less than 5 electrons per pixels Photometrics (2014). A previous calibration had found a root mean square value of one electron per pixel. We calculated the root mean square of a stack of 4000 images taken in complete darkness, which yielded a root mean square of 1.6 electrons per pixel. We use this value σ det as the detector noise in the denominator in Equation 1. The exact formula for the denominator is σ 2 = σ 2 photon + σ 2 det , where σ 2 photon is directly estimated from the images (Mugnier et al. 2004).

Phase structure function

A key parameter of the direct model in the presence of turbulence is the phase structure function of the post-adaptive optics turbulence. In order to estimate it in our case, we took the specification file of the rotating phase screen, and calculated a variance over as many distinct realisation as there were non-overlapping disks in the adaptive-optics corrected turbulence path difference strip on the phase screen. The absolute value of the corresponding atmospheric point spread function (defined by Eq. 4), F exp -D φ /2 , is displayed on Fig. 10. The correction limit of the adaptive optics at a radius of 20 λ/D is clearly visible.

Uncertainty on the introduced diversity

The diversity phase was introduced by the spatial light modulator. Since any error on the diversity phase impacts the quality of the estimation, it is important to check the exactness of the introduced diversity. In order to do so, we first introduced a command for a 200 nm defocus on the spatial light modulator. We measured the defocus that was effectively introduced thanks to an Imagine Optic HASO wavefront sensor. The HASO measurement, displayed on Fig. 11, shows that the introduced phase diversity is really a pure defocus. When projected on the first thirty-two Zernike polynomials, the HASO measurement is of a 196 nm root mean square aberration, 195 nm of whose are concentrated in the defocus. This shows that the spatial light modulator produces phase is close to that which it is commanded to produce. static aberrations compensation could be performed on an instrument such as SPHERE at least once per hour.

CONCLUSIONS

We have presented coronagraphic phase diversity through turbulence as a post-coronagraphic wavefront sensor adapted to high-precision wavefront measurement in the presence of adaptive optics-corrected turbulence. We have performed realistic simulations which show that the estimation error when used on a high-contrast system such as SPHERE should not exceed a few nanometres, whereas the quasi-static aberration of SPHERE is about 50 nanometres. Finally, we have performed a laboratory demonstration of the validity of the technique, reconstructing a highfrequency aberration with a precision of about two nanometres through a coronagraph and turbulence. Our team's next step in to perform a measurement and correction of quasistatic aberrations on SPHERE, thanks to data collection by A. Vigan and M. N'Diaye. Since we demonstrated coronagraphic phase diversity in the presence of residual adaptiveoptics-corrected turbulence, since there are no intrinsic chromatic limitations with COFFEE, and since the execution time of the program allows it to be executed several time during the night, we hope to soon prove that it is efficient on-sky.

Figure 1 .

 1 Figure 1. Evolution of the quality of the point spread function calculation as a function of the size of the zone where the influence of a Lyot coronagraph is taken into account

Figure 2 .

 2 Figure 2. Estimation error as a function of the error on the knowledge of D φ . The total error is separated as an error in the zone that is corrected by the deformable mirror and the uncorrected zone.

Figure 3 .

 3 Figure 3. Root mean square of the estimation error of the upstream phase as a function of the incoming light flux (in photons).The estimation is performed with a 10 % error on the phase structure function.

Figure 4 .

 4 Figure 4. Top, from left to right: COFFEE estimate without a planet, COFFEE estimate with a planet of flux 10 -5 relative to the star, COFFEE estimate with a planet of flux 10 -4 relative to the star, and COFFEE estimate with a planet of flux 10 -3 relative to the star. Bottom: difference between top and COFFEE estimate without a planet.

Figure 5 .

 5 Figure 5. Left: focused image taken as a COFFEE input with the presence of a planet. The planet is at a third of the adaptive optics correction radius, below the star. The flux of the planet is 10 -3 times the flux of the star. Middle: direct model corresponding to the COFFEE reconstruction. Right: difference between direct model corresponding to the COFFEE reconstruction (middle) and direct model corresponding to the true aberration; the impact of the planet on the estimation quality is clearly visible.

Figure 6 .

 6 Figure 6. Same as Fig. 5, except this time the flux of the planet is 10 -5 times the flux of the star. Contrarily to Fig. 5, the planet is invisible in the data, and it has no impact on the estimation quality.

Figure 7 .

 7 Figure 7. Schematical representation of MITHiC, reproduced from Leboulleux (2018). Courtesy Lucie Leboulleux.

Figure 8 .

 8 Figure 8. Strategy for the experimental validation of coronagraphic phase diversity in the presence of residual turbulence.

Figure 9 .

 9 Figure 9. Circular average of the modulation transfer function of MITHiC

Figure 17

 17 Figure 17. φ F up , the 13-nm root mean square estimate of the introduced 11-nm root mean square F-shape aberration.

© 2019 The Authors

MNRAS 000, 1-12 (2019)

ACKNOWLEDGEMENTS

The PhD work of O. Herscovici-Schiller was co-funded by CNES and ONERA. We thank J.-M. Le Duigou for his support. This work received funding from the E.U. under FP7 Grant Agreement No. 312430 OPTICON, from the CNRS (Défi Imag'In), and from ONERA in the framework of the VASCO research project. We thank Raphaël Galicher for helpful criticism of a first draft of this paper. We thank the reviewer for their careful review and constructive comments, which helped us to improve this article.

Another important matter is the linearity of the response of the spatial light modulator. We tested the amplitude of the defocus, as measured by the HASO, for various commands. Figure 12 shows the excellent linearity of the response, with a linear correlation coefficient of 0.994. Consequently, for a defocus diversity whose root mean square is 75 nanometres, the error on the diversity should have an impact of less than a nanometre on the estimation [START_REF] Blanc | [END_REF].

Estimation of the reference wavefront

Data

We aligned the coronagraph on the bench, activated the turbulence simulator, and turned on the light source. The spatial light modulator is sent a flat command. The resulting phase aberration is denoted by φ 0 up on Fig. 8. A stack of 400 images is saved. Each exposure lasts 0.035 s, with a wait of 0.020 s between exposures. After that, the light source is turned off, and a stack of 400 images is saved in the same condition. The first stack (the data stack) is then averaged; the median of each pixel of the second stack (the background stack) is calculated; and then the background is subtracted from the data sum average. The resulting data is then under- sampled by a factor 4 for the sake of calculation speed, and constitutes the data i 0 foc that will be input into COFFEE. Then the whole procedure is repeated, this time with the spatial light modulator being sent a 75 nm defocus. The resulting data, i 0 div , joins i 0 foc to constitute i 0 , the complete COFFEE input for the reconstruction. This input is displayed on the bottom part of Fig. 13.

Reconstruction

We perform an estimation of φ 0 up using i 0 as input data, along with the model of the bench calibrated in the previous section. The estimate φ 0 up of the reference wavefront φ 0 up is shown on Fig. 14. Its root mean square is 24 nm. The spatial light modulator is now sent a F-shape command. The corresponding pupil image (taken when no coronagraph was in place) is displayed on Fig. 15. The root mean square of this command is 11 nm.

The resulting phase aberration is denoted by φ F up on Fig. 8. Just like before, a stack of 400 images is saved. Each exposure lasts 0.035 s, with a wait of 0.020 s between exposures. After that, the light source is turned off, and a stack of 400 images is saved in the same condition. The first stack (the data stack) is then averaged; the median of each pixel of the second stack (the background stack) is calculated; and Figure 16. Estimated high-frequency aberration phase, φ F up then the background is subtracted from the data sum average. The resulting data is then under-sampled by a factor 4 for the sake of calculation speed, and constitutes the data i 1 foc that will be input into COFFEE.

Then the whole procedure is repeated, this time with the spatial light modulator being sent a 75 nm defocus on top of the F-shape aberration. The resulting data, i 1 div , joins i 1 foc to constitute i 1 , the complete COFFEE input for the reconstruction. This input is displayed on the top part of Fig. 13.

Reconstruction

We perform an estimation of φ 0 up + φ F up using i 1 as input data, along with the model of the bench calibrated in the previous section.The estimate φ 0 up + φ F up of the high-frequency wavefront φ 0 up + φ F up is shown on Fig. 16. Its root mean square is 28 nm.

Differential reconstruction

The difference between φ 0 up + φ F up and φ 0 up is our estimate φ F up of the introduced F-shape aberration, φ F up . It is displayed on Fig. 17. The estimate has a root mean square of 13 nanometres, whereas the introduced aberration has a root mean square of 11 nanometres. We conclude that we are able to reconstruct a high-frequency aberration of about 10 nanometres with a 2 nanometres accuracy, using the scientific camera of a coronagraphic system in the presence of turbulence.

The total computing time necessary for the reconstruction of the aberration is about two hours and a half on a single core of an office computer equipped with a 2.6 GHz Intel processor, running a COFFEE program written in Interactive Data Language, without much optimisation. Therefore, using a modern computer running an optimised code, quasi-This paper has been typeset from a T E X/L A T E X file prepared by the author.


Louis Cianciullo
email: louis.cianciullo@jcu.edu.au

Hossein Ghodosi
email: hossein.ghodosi@jcu.edu.au

Efficient Information Theoretic Multi-Party Computation from Oblivious Linear Evaluation

Keywords:

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Oblivious polynomial evaluation (OPE) was first introduced by Naor and Pinkas [START_REF] Naor | Oblivious Transfer and Polynomial Evaluation[END_REF] in 1999. An OPE protocol consists of two participants, a sender, S who holds a polynomial f (x) and a receiver, R who has a value α. OPE allows R to learn f (α) without having S learn α and also keeping f (x) private. A more formal definition, originally given in [START_REF] Chang | Oblivious polynomial evaluation and oblivious neural learning[END_REF] is presented below: Definition 1. [START_REF] Chang | Oblivious polynomial evaluation and oblivious neural learning[END_REF] An OPE protocol is composed of two parties, S who has a polynomial f (x) over a finite field F and R who has an input value α ∈ F. Correctness is achieved if, at the end of the protocol, R learns f (α). Security is guaranteed if the following two conditions are met after the protocol has been executed:

1. S cannot reduce his uncertainty of α. 2. R does not learn any information relating to f (x), other than f (α).

In this article we focus on a special case of OPE, wherein f (x) is of degree at most one, known as oblivious linear evaluation (OLE). Specifically, we utilise OLE for the purpose of performing multiplication in multi-party computation (MPC).

MPC allows a set of n mutually distrustful participants to compute any given function across their private inputs, without revealing any information relating to their private inputs. We focus on the threshold setting, where an MPC protocol is considered secure if a set of t or less participants, where t < n, cannot gain any information relating to another participant's private input, other than what the output of the protocol gives them. More formally: Definition 2. A (t, n) threshold MPC protocol allows a set of n participants, P 1 , • • • , P n with respective private inputs, x 1 , • • • , x n to compute a given function,

f (x 1 , • • • , x n ).
Privacy is maintained if, after completion of the protocol, an adversary controlling any subset of up to t participants (t < n), cannot learn more information (about other participant's private inputs) than what could be derived from each participant's individual, private input and the output of the protocol.

Traditionally, the adversary is classified as either passive or malicious. Participants under control of a passive adversary may share information with one another but do not deviate from the MPC protocol. Participants under control of a malicious adversary also share information but may act arbitrarily, i.e. they do not necessarily follow the protocol. Another aspect of the adversary considered in an MPC protocol is the resources it has at its command. Specifically, an unconditionally (information theoretic) secure MPC protocol is secure against a computationally unbounded adversary. Whilst a conditionally (computationally) secure MPC protocol is secure against a computationally bounded adversary.

In this article we focus on information theoretic (t, n) threshold MPC secure against a passive adversary. We show the construction of an efficient MPC scheme based on OLE. In the next section we give some background and motivation on this topic, following this we then discuss our contribution in depth.

Background

MPC is an extremely powerful tool that can be used to solve practically any given problem involving a set of distrustful parties. In classical, unconditionally secure protocols [START_REF] Ben-Or | Completeness Theorems for Noncryptographic Fault-tolerant Distributed Computation[END_REF][START_REF] Chaum | Multiparty Unconditionally Secure Protocols[END_REF][START_REF] Rabin | Verifiable Secret Sharing and Multiparty Protocols with Honest Majority[END_REF] each participant, P i (i = 1, • • • n) shares their private input, x i by utilising Shamir's secret sharing scheme [START_REF] Shamir | How to share a secret[END_REF] to distribute shares to all participants. To compute a given function, f (x 1 , • • • x n ), participants need simply perform all computations on the shares of each input value. For instance, if a participant wants to compute a share relating to the sum of two distributed input values he simply adds his two corresponding shares together. At the end of the protocol, a set of t + 1 or more participants then pool their information to reconstruct the output.

Due to the homomorphic nature of Shamir's scheme [START_REF] Benaloh | Secret sharing homomorphisms: Keeping shares of a secret secret (extended abstract)[END_REF] participants can easily compute any linear operation by privately computing on their shares. However, since the inception of MPC [START_REF] Goldreich | How to play any mental game[END_REF] the largest limiting factor has been the high amount of resources required to compute a multiplication. Perhaps the most widely known and efficient method of computing a multiplication in an MPC protocol is known as Beaver's method (A.K.A Beaver's triples) [START_REF] Beaver | Efficient Multiparty Protocols Using Circuit Randomization[END_REF]. For completeness we review this protocol below.

Beaver's Method Beaver's method [START_REF] Beaver | Efficient Multiparty Protocols Using Circuit Randomization[END_REF] for computing a multiplication in MPC relies on some pre-shared information known as a triple. Specifically, a triple is composed of three values, a, b and c where a • b = c and a, b, c ∈ F q such that q > n and q is a prime number. Each participant has a share of these triples, such that participant Suppose we have participants P i with input x i and P j with input x j for i, j = 1, • • • , n and i = j. To compute shares of the multiplication γ = x i • x j we first have both P i and P j distribute shares of their private values among the other participants, where P k gets x i k relating to x i and x j k relating to x j . To compute a share, γ k relating to the product γ, a set of at least t + 1 participants execute the following steps:

P k (k = 1, • • • , n) receives
1. Each participant, P k , computes z k = x i k -a k and v k = x j k -b k , where z k is a share of the value z = x i -a and v k is a share of v = x j -b. 2.
A set of at least t + 1 participants broadcast their shares, z k and v k amongst themselves. 3. Participants publicly reconstruct the values of z and v using the shares z k and v k , respectively. 4. P k computes his share of γ as γ k = zv + zb k + va k + c k . 5. t + 1 or more participants can reconstruct γ = x i • x j by pooling their shares.

In order to construct z and v a set of t+1 participants is required to cooperate. If all participants in this set wish to compute these values (and consequently, the multiplication) then each participant must both receive and send t messages. Since each message would consist of 2 elements from the field F q (i.e. z k and v k ) the communication complexity of this protocol can be given as O(qt 2 ).

Many recent MPC protocols utilise a resource intensive computationally secure offline phase to compute these multiplication triples. The actual MPC is then carried out in a faster information theoretic online phase. For our purposes, we focus solely on the information theoretic online phase. It suffices to assume that participants gain the shares of the triples via an external party known as an initialiser, who (after computing and distributing the shares of the triples) does not take part in the actual MPC protocol. In the next section we review the OLE based two-party protocol given by Döttling et al. [START_REF] Döttling | Tinyole: Efficient actively secure two-party computation from oblivious linear function evaluation[END_REF].

TinyOLE Recently Döttling et al. [START_REF] Döttling | Tinyole: Efficient actively secure two-party computation from oblivious linear function evaluation[END_REF] proposed a two-party protocol (n = 2) in which the two participants, P 1 and P 2 use OLE to compute shares to a multiplication. Specifically, they use OLE to compute multiplication triples in an offline phase. Their scheme utilises a simple additive secret sharing scheme wherein a given value, a (for example), is represented as a = a 1 + a 2 , across a finite field F; where P 2 has the share a 2 and P 1 gets a 1 . Addition in their scheme consists of simply adding shares together. Multiplication is achieved by utilising OLE in a black-box fashion.

To compute a multiplication of two distributed (and not necessarily known) values, a and b, they rely on the fact that:

ab = a 1 b 1 + a 1 b 2 + a 2 b 1 + a 2 b 2 .
To compute the "troublesome" terms of the form c = a 1 b 2 they utilise a black-box OLE. Essentially, P 1 acts as a sender and submits the polynomial f (x) = a 1 x-c 1 where c 1 is a randomly chosen value. The second participant, P 2 acts as receiver and submits α = b 2 . Both participants send their values to a black-box OLE, with

P 2 receiving back f (α) = a 1 b 2 -c 1 . If we set c 2 = f (α) then each participant now holds a share of c as c = c 1 + c 2 .
To compute shares to the entire multiplication it is easy to see that at least 2 OLEs are needed.

Döttling et al. specifically use this method in a computationally secure offline phase to compute random multiplication triples, where the values of a and b are not actually known to either participant. Our proposed scheme differs to theirs in that we wish to utilise OLE in an information theoretic, online phase to compute the multiplication of known input values for a given MPC function.

Our Contribution

In this section we summarise our proposed MPC scheme which utilises OLE to compute shares to a given multiplication. In contrast to the methods discussed above our protocol obtains the following desirable properties:

1. Unlike Beaver's scheme [START_REF] Beaver | Efficient Multiparty Protocols Using Circuit Randomization[END_REF] our proposed protocol only requires communication between two participants to compute a given share to a multiplication i.e. a participant may compute his share without the assistance of t other participants. We achieve this result by having one designated participant who acts as a sender in an OLE. The other participants need simply privately compute an OLE with this sender participant to compute a share to a multiplication. As a result of this, the communication complexity of our protocol is O(qt), which is more efficient than Beaver's (at O(qt 2 )) by a multiplicative factor of t. 2. We do not rely on a black-box method of OLE and instead provide a specific construction. Our OLE multiplication scheme is based on the information theoretic protocol given in [START_REF] Hanaoka | Information Theoretically Secure Oblivious Polynomial Evaluation: Model, Bounds, and Constructions[END_REF][START_REF] Tonicelli | Information-theoretically secure oblivious polynomial evaluation in the commodity-based model[END_REF]. This scheme, like Beaver's scheme, relies on some precomputed information which can be produced via an offline phase or an initialiser. Since we wish to focus solely on the information theoretic OLEbased MPC scheme itself we will assume that the information is provided via an initialiser.

3. Our scheme only utilises one OLE per participant to compute a multiplication. In a two party protocol we would only need one OLE. So, for an individual participant to compute his share (in either a multi-party or twoparty protocol) the complexity cost is just O(q). Using Beaver's scheme, this would be O(qt). 4. Lastly, unlike the TinyOLE scheme [START_REF] Döttling | Tinyole: Efficient actively secure two-party computation from oblivious linear function evaluation[END_REF], our scheme is scalable, in that it extends to the multi-party case with n participants. In fact, computing n shares (one for each participant) to a single multiplication requires only n -1 OLEs, one for each individual participant to compute his share. We note that utilising all n participants is not actually necessary. We only really require a set of t + 1 participants, enough to compute the output of a given multiplication at the end of the protocol.

Outline

The rest of the paper is organised as follows. In section 2 we go over some of the sub protocols and tools used in our proposed MPC protocol. Section 3 gives a high level overview of our protocol as well as a model for security. The actual construction for our protocol is given in section 4, along with an evaluation and proof of correctness and security.

Preliminaries

In this section we review Shamir's secret sharing scheme [START_REF] Shamir | How to share a secret[END_REF] and the the information theoretic OPE originally given by Hanaoka et al. in [START_REF] Hanaoka | Information Theoretically Secure Oblivious Polynomial Evaluation: Model, Bounds, and Constructions[END_REF]. Both of these protocols are fundamental building blocks of our proposed MPC protocol.

Shamir's Secret Sharing Scheme

Like all MPC schemes our proposed protocol utilises secret sharing to ensure privacy. In a secret sharing scheme a set of n participants are each privately sent a share of a given secret. An authorised subset of these participants can pool their shares to recover the secret, whilst an unauthorised subset should get no information. We note that our proposed OLE-based MPC scheme can potentially work with any linear secret sharing scheme. However, in order to show a specific implementation we will demonstrate our proposed protocol using Shamir's secret sharing scheme [START_REF] Shamir | How to share a secret[END_REF]. Shamir's scheme is a (t, n) threshold scheme, meaning that an authorised subset is any set of t + 1 or more participants where t < n. This scheme operates over a finite field F q where q > n and q is a prime number. To demonstrate, suppose we have participant P i (i = 1, • • • , n) who wishes to distribute his input value, x i among the other participants. P i computes a random polynomial, g(x) of degree at most t and sets g(0) = x i . He then privately sends to each participant,

P k (k = 1, • • • n) the share x i k = g(k)
. A set of t + 1 or more participants can reconstruct x i by performing Lagrange interpolation across their shares to compute g(x).

Information Theoretic OPE

Hanoka et al. [START_REF] Hanaoka | Information Theoretically Secure Oblivious Polynomial Evaluation: Model, Bounds, and Constructions[END_REF] introduced an unconditionally secure OPE protocol that utilises some pre-distributed information to achieve information theoretic security. Our proposed OLE-based MPC protocol utilises a modified variant of their OPE protocol to compute a multiplication. Therefore, for completeness, we display their full protocol in figure 1.

In the initial, setup phase of their protocol a third party, known as an initialiser assigns some random information to both R and S. Following this the initialiser takes no further part in the protocol and R and S utilise the assigned information to compute an OPE in the computation phase of the protocol.

Input: R has a value α and S the polynomial f (x) of degree at most t. Output: R obtains f (α) and S gets nothing.

Setup The initialiser privately sends:

1. A random polynomial, S(x), of degree at most t to S.

(x) = f (l + x) + S(x). 3. R computes f (α) = V (d) -g.

Model

This section presents a high level overview of our protocol and a set of criteria for evaluating the security of our scheme. We use the traditional setting of MPC protocols. That is, each party P j (1 ≤ j ≤ n) distributes its private input, x j amongst all participants, using a Shamir (t, n) threshold scheme. Linear functions can be computed by each participant privately. In order to perform multiplication, however, we must utilise OLE.

Overview

Suppose we have a set of n participants who wish to compute shares to the value γ = x i • x j , where x i and x j are the respective private input values of participants P i and P j , for 1 ≤ i, j ≤ n and i = j. Further suppose, that P j utilises the polynomial f j (x) to share x j among all participants (via Shamir's secret sharing scheme), such that a given participant

P k (k = 1, • • • , n) receives the share x j k = f j (k) of x j .
A simple method for computing shares of γ is to have each participant, P k , simply send his share, x j k , to P i who can then send back the value γ k = x i x j k . Due to the homomorphic nature of Shamir's secret sharing scheme the value γ k is a share corresponding to the polynomial Γ (x) = x i f j (x) with free term x i • x j . The obvious problem with this simple protocol is that neither P i 's nor P j 's privacy is maintained.

To keep P i 's input, x i , private we can have P i introduce a random, private masking polynomial, h i (x), of degree at most t, with free term h i (0) = 0. Now, when he receives a given share, x j k , we require P i to send back γ k = x i x j k +h i (k). Each P k now holds shares to the polynomial Γ (x) = x i f j (x)+h i (x). Intrinsically we can see that, due to Shamir's secret sharing scheme, the protocol is now tprivate with respect to P i , as a set of t participants with t shares cannot compute any information relating to the effectively random polynomial Γ (x). It remains to ensure the privacy of P j .

Surprisingly, ensuring that P j 's privacy is maintained is actually quite simple. Rather than having each P k simply hand his share to P i we instead have P k and P i utilise an OLE protocol, where P k acts as the receiver and P i as the sender. First P i computes two polynomials, f i (x) = x i •x and h i (x) (the masking polynomial, as before). Each P k (1 ≤ k ≤ n) then acts as the receiver and executes an OPE protocol with P i (who acts as the sender) to privately evaluate P i 's polynomial, f i (x) at the point x j k , as before P i adds the masking polynomial to his computation.

Fig. 2. Overview of the protocol

Since the OLE protocol does not allow P i to learn the evaluation point then the protocol can now be considered t-private for both P i and P j . Specifically, P i 's privacy is maintained via the masking polynomial and P j 's privacy is maintained via Shamir's secret sharing scheme and the OLE protocol. An overview of this is given in figure 2. Note that P i will also use his share from x j and compute his own share of γ = x i • x j (of course, there is no need to perform OLE, as he plays the role of the sender and receiver at the same time).

Security and Correctness

In order to prove the security and correctness of our proposed scheme we will evaluate it against the following criteria specified below:

1. Correctness -Upon completion of the protocol each participant, P k holds a share, γ k of the polynomial Γ (x), of degree at most t with free term Γ (0) = x i • x j . 2. Privacy -A set of t or less participants, not including either P i or P j , cannot reduce their uncertainty of x i or x j . 3. Privacy with respect to P i -A set of t or less participants, including P j , cannot reduce their uncertainty of x i . 4. Privacy with respect to P j -A set of t or less participants, including P i , cannot reduce their uncertainty of x j .

We note that the last three criterion presented here simply encapsulate the notion of privacy given in definition 2.

Proposed OLE-Based MPC Protocol

Similar to the OPE protocol given in figure 1, our proposed multiplication protocol consists of two phases:

1. The Setup Phase: Where the initialiser privately sends some (essentially random) information to each participant involved in the protocol. 2. The Computation Phase: Where participants are able to compute shares to the multiplication.

Where our scheme differs, however, is in the addition of a masking polynomial (h i (x)) and the limiting of the receivers polynomial to a degree no greater than 1 (OLE).

As per section 3.1 suppose we have a set of n participants P 1 , • • • , P n , with respective private inputs x 1 , • • • , x n , who wish to compute shares of the value γ = x i × x j where i, j ∈ [1, n] and i = j. Participant P j first privately distributes shares for x j amongst all participants, using the polynomial f j (x), such that P k (1 ≤ k ≤ n) gets the share x j k = f j (k). To compute a share γ k , of γ each P k cooperates with P i to execute our modified OLE protocol, with P k essentially acting as the receiver and P i acting as the sender for each P k . Note that all computations are performed in the field F q where q is a prime number such that q > n. The full protocol is given in Figure 3.

In order to compute a share P k and P i exchange exactly 3 field elements (l and V (x)). This gives a communication complexity of O(q). Therefore, the overall communication complexity, required for each of the n participants to compute his share can be given as O(qn). However, since the protocol is based on Shamir's (t, n) secret sharing scheme [START_REF] Shamir | How to share a secret[END_REF] we actually only require t + 1 participants to ensure the output can be constructed. This gives a communication complexity of O(qt).

Computation

Pi privately computes:

-A masking polynomial, hi(x) of degree at most t with fi(0) = 0.

-The multiplication polynomial, fi(x) = xi • x.

Each P k then privately executes the following steps with Pi:

1. P k sends the value l k = xj k -d k to Pi. 2.
Pi then computes and sends to P k the polynomial V k (x) which is computed as:

V k (x) = hi(k) + fi(x + l k ) + Si k (x)
3. P k computes his share of γ as

γ k = V k (d k ) -g k .
Fig. 3. An information theoretic, OLE-based multiplication protocol for MPC

Evaluation

In this section we evaluate the proposed protocol against the set of security criteria given in section 3.2. We note that all four of these criterion evaluate the specific multiplication protocol and not the actual MPC itself. That is, we evaluate the multiplication protocol only and assume that participants have not yet reconstructed the actual output of the MPC.

Correctness At the end of our protocol each participant, P k , will now have a share of the polynomial: Γ (x) = h i (x) + x i f j (x). Since the free term of h i (x) is equal to zero, we can say that Γ (0) = x i f j (0). Now, f j (x) has the free term x j and both h i (x) and f j (x) are of degree at most t. As a result of this we can conclude that correctness is achieved, as each P k has a share to a polynomial, Γ (x), of degree at most t, with free term equal to x i • x j .

Privacy Theorem 1. A set of t participants, not including P i or P j , cannot compute any information relating to x i or x j .

In order to prove this we must first show that the modified OLE protocol is secure. Following this, we need to prove that a set of t shares relating to the multiplication reveals no information.

Proof. Suppose that a given participant, P k executes the multiplication protocol with P i . After sending l k to P i he receivers the polynomial

V k (x) = h i (k)+f i (x+ l k ) + S i k (x) which we can simplify as V k (x) = v k + z k x. Let S i k (x) = κ k + ω k x
and recall that f i (x) = x i • x, then we can rewrite the equation as

V (x) = h i (k) + x i l k + κ k (x i + ω k )
x. This gives P k the following information:

v k = h i (k) + x i l k + κ k z k = x i + ω k
Since the values ω k and κ k (as well as the coefficients of h i (x)) are chosen at random, P k cannot gain any information from the above equations. The next step in the protocol is for

P k to compute γ k = V (d k ) -g k , which can be written as γ k = h i (k) + x i x ij .
Individually, this gives no information to P k as he does not know the value of either h i (k) or x i , it remains to be seen if a coalition of participants can compute any information. Without loss of generality suppose that the first set of t participants, P 1 , • • • , P t pool their information together. Let h i (x) = m 1 x + m 2 x 2 + • • • + m t x t , then the coalition can compute the following system:

γ 1 = x i • x i1 + m 1 + m 2 + • • • + m t γ 2 = x i • x i2 + 2m 1 + 4m 2 + • • • + 2 t m t . . . γ t = x i • x it + tm 1 + t 2 m 2 + • • • + t t m t
Due to the perfectness of of Shamir's secret sharing scheme [START_REF] Corniaux | An entropy-based demonstration of the security of Shamir's secret sharing scheme[END_REF][START_REF] Shamir | How to share a secret[END_REF] the above system does not reveal any information to the participants as they effectively have a set of t shares relating to a degree t polynomial. This becomes even more evident when we take into account that x i k = f j (k) meaning that each P k has a share of the polynomial Γ = x i f j (x) + h i (x).

The end result being that a coalition of t participants cannot reduce their uncertainty of x i . The same is also true for x j , as collectively the coalition only has t shares of f j (x).

Privacy with respect to P i Theorem 2. A set of t participants, including P j , cannot compute any information relating to x i .

Proof. The proof of this is similar to the proof of theorem 1 along with some extra information. Namely, we now assume that the coalition of participants has the values of both f j (x) and, consequently x j . The first, obvious ramification of this is that the coalition now know the shares of every other participant relating to x j . This actually gives them no advantage, in regards to the OLE, as they do not know (and cannot compute) the values given to the other participants by the initialiser (namely d k and g k ). We therefore only need to prove that knowing f j (x) reveals no information relating to x i .

As before, at the end of the protocol each participant has a share to the polynomial Γ (x) = x i f j (x) h i (x). It is easy to see that if the coalition can compute Γ (x) or even h i (x) then they can easily compute x i . However, the coalition do not hold direct shares to h i (x), so even knowing h i (0) = 0 gives them nothing. Furthermore, to compute any information relating to Γ (x) would require the coalition to compute a solution to the system given in the proof of theorem 1.

Computing a solution to this system is analogous to solving a system of equations composed of t + 1 unknowns (x i and the coefficients of h i (x)) and t equations. We can therefore conclude that a set of participants, including P j cannot reduce their uncertainty of x i .

Privacy with respect to P j Theorem 3. A set of t participants, including P i , cannot compute any information relating to x j .

Proof. In the proof of theorem 1 it was shown that the modified OLE is secure, therefore to prove the above theorem we need to show that a coalition of t participants, including P i , with t shares relating to Γ (x) = x i f j (x) + h i (x) and t shares of f j (x) cannot compute any information relating to x j . First, let f j (x) = x j + W 1 x + • • • + W t x t and assume, as before, that a coalition composed of the first t participants (which includes P i ) pool their knowledge. They can construct the following system from their shares of Γ (x):

γ 1 = x i • (x j + W 1 + • • • + W t ) + h i (1)
γ 2 = x i • (x j + 2W 1 + • • • + 2 t W t ) + h i (2)
. . .

γ t = x i • (x j + tW 1 + • • • + t t W t ) + h i (t)
From the shares of f j (x) we get:

x j1 = x j + W 1 + • • • + W t x j2 = x j + 2W 1 + • • • + 2 t W t . . . x jt = x j + tW 1 + • • • + t t W t
It is easy to see that the two systems are actually linearly dependent. Since the values of x i and h i (x) are known to the coalition, this results in a system composed of t + 1 unknowns (the coefficients of f j (x)) and only t linearly independent equations. The net result of this is that each value of x j is, from the point of view of the coalition, equally likely. Meaning that they cannot compute any information relating to x j .

  the shares a k , b k and c k relating to (respectively) a, b and c.

  2. A random value, d and the value g = S(d) to R. Computation 1. R sends the value l = α -d to S. 2. S then computes and sends to R the polynomial V

Fig. 1 .

 1 Fig.1. Information Theoretic OPE[START_REF] Hanaoka | Information Theoretically Secure Oblivious Polynomial Evaluation: Model, Bounds, and Constructions[END_REF][START_REF] Tonicelli | Information-theoretically secure oblivious polynomial evaluation in the commodity-based model[END_REF]

Input:

  Pi has xi and P k has the share xj k , of xj. Output: P k obtains the share γ k , of Γ (x) where Γ (0) = xi • xj. Setup The initialiser privately sends: 1. A set of n -1 random polynomials, Si k (x), of degree at most 1 to Pi where k = 1, • • • , n and k = i. 2. A random value, d k and the value g k = Si k (d k ) to every participant P k .

This research is supported by an Australian Government Research Training Program (RTP) Scholarship.


Amandine Jambert

Blockchain and the GDPR: a data protection authority point of view

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

As more and more solutions rely on blockchain for processing personal data, questions regarding how to assure compliance to GDPR rose. The French Data protection authority, the CNIL, received numerous requests from both the public and the private sector regarding blockchain projects and GDPR [1]. She thus addressed the matter in November 2018 through a publication on its website [START_REF]Solutions for a responsible use of the blockchain in the context of personal data[END_REF].

The objective of this talk was to give the main key points of the GDPR, to underline how they can apply in the blockchain context and finally to show how we hope for cryptographic techniques to solve part of the problems.

How do the GDPR and blockchain interact?

When a blockchain contains personal data, such as public keys of individuals or personal data stored "within" a transaction, the GDPR may be applicable as it implies the processing of personal data. The second criteria for applicability will be whether the processing is performed by controllers or processors established in the EU or aiming eat EU residents. Thus, the GDPR is applicable to processing on blockchain in a wide array of cases.

Furthermore, some classical blockchain properties, especially transparency (i.e.all participants can view all data recorded) and irreversibility (i.e. once data is recorded, it cannot be altered or removed), may have impacts on individual rights (namely, the right to privacy and the right to personal data protection) which calls for a specific analysis.

In consequence, the CNIL suggests the following initial analysis and recommendations to stakeholders who wish to use blockchain when carrying out personal data processing.

We consider in this short paper only the cases of processing on the blockchain using the payload to store personal data and the cases of smart contract using personal data.

2 Which points require particular attention?

Blockchains are a technology, not a processing in itself. Thus the first point of attention will be to determine a clearly defined purpose for the processing using the blockchain and to clarify the responsibilities of the actors involved. Regarding the responsibilities, the work carried out by the CNIL has revealed that, in many cases, the person1 deciding to register data on a blockchain can be considered as a data controller given that the participant determines the purpose and means of data processing. The miners, or validators, of transactions including personal data on a blockchain would be, at best, processors. For public blockchains, the CNIL is currently conducting an in-depth reflection on the matter and promotes the development of solutions to address contractual relations between participants/data controllers and miners.

The second point can be summed up as the minimization of risks for data subjects when their data are planned to be used in a processing carried out on a blockchain. In some cases, these technologies are likely to raise issues regarding the GDPR or to put unnecessary high risks on individuals. Therefore, it is necessary to balance, from an early stage, the needs of using a blockchain rather than another technology with the objectives and characteristics of each processing. In addition to questioning the use of a blockchain, the data controller must also question which type of blockchain should be used and how it will be used to limit the risks on individuals.

The third point of attention concerns the exercise of rights. Some of them can be exercised effectively such as the right of access and the right to portability. Others, like the right to erasure, the right to rectification and the right to object to processing, are not straightforward. In those cases, the CNIL acknowledges the existence of technological solutions that should be evaluated.

Finally, while not covered here, actors need to be as cautious as possible regarding the implementation of obligations concerning sub-contracting an the rules governing international transfers of personal data, in particular for public blockchains.

What are the technical solutions considered?

We can define the data manipulated on a blockchain as two categories: the identifiers (i.e. the public keys of participants) and the payload which is used in numerous processing on blockchain.

The architecture of most blockchain needs the identifier to be visible to function, thus the CNIL considers that those data can not be further minimized and that their retention period will be in line with the blockchain life.

On the contrary, the payload format is chosen by participants independently to the blockchain architecture. The Privacy by Design principle (Article 25 of the GDPR) requires the data controller to choose the format with the least impact on individuals' rights and freedoms.

As the more protective format, the CNIL considers that personal data should be registered on the blockchain preferably as a commitment. If this is not possible, one may use a hash of the data generated using a keyed-hash function, or, at least, a ciphertext.

The common feature underlying some of these solutions is to store any data in cleartext outside of the blockchain (such as, for example, on the data controller's information system) and to store on the blockchain only a proof of existence of the data (e.g. commitment , hash generated from a keyed hash function, etc.).

In a general manner, it is important to avoid storing personal data in cleartext on the blockchain. Nevertheless, if no other solution is applicable, and when justified by its purpose, a DPIA can be carried out to evaluate whether the risk of storing the information either as a simple hash or in cleartext would be acceptable. If the conclusion are that risks on data subject are minimal then it can be envisaged.

Note that the choice of the most protective solutions allows the controller to answer to most of the questions regarding the exercise of data subject rights. In particular, when using a perfectly hiding commitment scheme, the deletion of the witness and the value committed (both stored out of the chain) is sufficient to render the commitment anonymous in such a way that it can no longer be considered personal data? This solution thus allows a data controller to both respects any pertinent data retention period and respect any request of erasure.

The GDPR does not apply to processing of personal data by a natural person acting in the course of a purely personal or household activity.


Thulani Mashiane

Elmarie Kritzinger

Cybersecurity Behaviour: A Conceptual Taxonomy

Keywords: Cybersecurity behaviour, Classification, Taxonomy, Cybersecurity

User cybersecurity behaviour is a concern for organisations as well as home users. This is because cyber-criminals have made a shift from targeting security systems to targeting the users of the systems. As a result, an increasing number of studies have been conducted in efforts to understand user cybersecurity behaviour. The advantage in understanding user behaviour is that researchers and security practitioners can apply this knowledge and begin to change behaviour to benefit cybersecurity. Different studies have categorised similar cybersecurity behaviours, however the naming conventions differ across studies. This brings out the first contribution of the paper, unified terminology for the cybersecurity behaviour. Secondly, most studies were conducted in an organisational setting. User behaviour in other environments is yet to be identified and categorised. The second contribution of this study is the identification and categorisation of home user cybersecurity behaviour. The identification and classification of more cybersecurity behaviour is aimed to have a positive impact in the creation of strategic interventions to change and maintain good cybersecurity behaviour.

Introduction

To decrease the number of cyber incidents, it is key that users, especially user behaviours, are understood to understand how to change user behaviour. An initial step is the identification and classification of user cybersecurity behaviour.

Cybersecurity Behaviour (CSB)

Human behaviour refers to an individual's actions, reactions, mannerisms and conduct within different environments [START_REF] Scheflen | How behavior means[END_REF]. Cybersecurity behaviour (CSB) is therefore defined, by the current research, as an individual's actions, reactions, mannerisms, and general conduct in the cyber domain. The goal of studying user CSB is to promote good CSB while decreasing malicious or bad CSB.

Cybersecurity Behaviour Context

Researchers [START_REF] Liang | Understanding security behaviors in personal computer usage: A threat avoidance perspective[END_REF][START_REF] Kruger | An assessment of the role of cultural factors in information security awareness[END_REF] have noted that users act differently in different settings. But, the categorisation of CSB has been focused mainly on behaviour in organisations. Numerous targets of cybersecurity attacks fall outside the context of the organisation [START_REF] Bjrnhaug | Internet of Things-Cybersecurity at Home[END_REF]. Therefore, a gap exists in literature, where other cybersecurity contexts have been left out. The importance of including different contexts is the ability to accurately categories CSB.

Cybersecurity Behaviour Taxonomy

To understand a system, it is necessary to understand the components that make up that system. A taxonomy is a tool used to classify components in a domain. Making use of a taxonomy allows for the structural organisation of concepts that make up the system. CSB have been expressed in the form of taxonomies. More recently, Bitton et al. presented a taxonomy for mobile cybersecurity awareness [START_REF] Bitton | Taxonomy of mobile users'security awareness[END_REF]. The current study builds on previously published taxonomies in the classification of users' CSB.

The remainder of the paper is presented as follows. Section 2 presents a literature review and Section 3 presents the proposed conceptual taxonomy. The conclusion and future work is presented in Section 4.

Literature Review

The following section presents literature that focuses on user CSB in the workplace as well as at home.

Cybersecurity Behaviour

Context is made up of the circumstances surrounding a behaviour. Context has an influence on behaviour [START_REF] Acquisti | Privacy and human behavior in the age of information[END_REF]. An example related to CSB is: social engineering attacks may be more effective at certain times of the year, such as the festive season. In this section, the CSB in the work and home context are discussed.

Cybersecurity Behaviour at Work The CSB of employees is mostly governed by policies and regulations. Employees are held accountable for misconduct or not adhering to the organisational rules [START_REF] Kritzinger | Cyber security for home users: A new way of protection through awareness enforcement[END_REF][START_REF] Safa | Information security policy compliance model in organizations[END_REF]. Furthermore, ICT departments assist users in adhering to policy by sending reminders about software updates, information on new threats, information best practices, and blocking dangerous or inappropriate sites [START_REF] Stanton | Analysis of end user security behaviors[END_REF].

Blythe strived to understand CSB in an organisational setting [START_REF] Blythe | Cyber security in the workplace: Understanding and promoting behaviour change[END_REF]. In an organisational setting, cybersecurity is usually evaluated as a function of compliance [START_REF] Bulgurcu | Information security policy compliance: an empirical study of rationality-based beliefs and information security awareness[END_REF]. In an organisation, bad CSB is seen as noncompliance to the set policies. Blythe contended that behaviour is more entailed than this. The study argued that the evaluation of compliance is limited in that it tests a small scope of policies and procedures. Among other behavioural determinants, the behaviour is a function of interior and exterior influences. Interior influences include selfmotivation or drive, similar to intentions mentioned in [START_REF] Stanton | Analysis of end user security behaviors[END_REF], while exterior influences are features such as the environment [START_REF] Blythe | Cyber security in the workplace: Understanding and promoting behaviour change[END_REF].

To categorise CSB in organisations, a six-element taxonomy was developed by Stanton et al. The dependent variables used to group the behaviours were 1) the amount of expertise required to carry out the behaviour, and 2) the intention towards the organisation when carrying out the behaviour. The six categories of the taxonomy where: intentional destruction, dangerous tinkering, aware assurance, detrimental misuse, nave mistakes, and basic hygiene [START_REF] Stanton | Analysis of end user security behaviors[END_REF].

Intentional destruction, detrimental misuse, dangerous tinkering, and nave mistakes are examples of bad CSB and aware assurance and basic hygiene are examples of good CSB. To visualise the taxonomy, the categories of the taxonomy were put on a two-dimensional plane. On the x-axis, the intention of the user is plotted; intentions range from malicious to unintentional. On the y-axis, the user expertise ranging from expert to novice are plotted (see Fig. 1.). Guo observed the disparities in the conclusions of information systems behaviour research. The different, often contradicting results were hypothesised to be due to methodological issues or the ill definition of information system's behaviour. The study realised the need for more clear definitions of information systems behaviours. Through the review and synthesis of previous studies, a conceptual framework was designed which incorporates four categorisations of organisational behaviour: security assurance behaviour, security compliant behaviour, security risk-taking behaviour, and security damaging behaviour [START_REF] Guo | Security-related behavior in using information systems in the workplace: A review and synthesis[END_REF]. Chu, Chau, and So developed a typo-logical theory for information security deviant behaviour in an organisational setting [START_REF] Chu | Developing a Typological Theory Using a Quantitative Approach: A Case of Information Security Deviant Behavior[END_REF]. The result of the study categorised cybersecurity into four categories: Misuse of information systems resources, Information security carelessness, System protection deviance and Access control deviance.

In terms of CSB at work, Fig. 2 presents a graph with the cybersecurity categories taken from the studies presented in Section 2. The categories are plotted on the same graph that was used in the research by Stanton et al. [START_REF] Stanton | Analysis of end user security behaviors[END_REF]. The graph shows most of the categories identified require some level of cybersecurity expertise. This implies that users in organisations, generally, have the expertise in cybersecurity. An inference can be made that CSB in organisations is not hindered by the lack of cybersecurity expertise.

The next important observation is that a majority of the security behaviour categories are not intended on malicious or benevolent behaviour. This neutral attitude towards cybersecurity is a risk because users, then show no interest in improving or applying their skills.

Currently, through the graph in Fig. 2, it is not clear what the intentional difference between Security Risk taking behaviour and Security Compliance behaviour is. It is therefore a need that a clear distinction in intentions is derived. This distinction must also be represented, though the graph.

Cybersecurity Behaviour at Home Home users are individuals of different ages that make use of computers or mobile devices that connect to the Internet. In the home context, users are typically solely responsible for managing their CSB. It is assumed that cybersecurity knowledge, awareness and skills are much lower for home users, as they are not exposed to training programs [START_REF] Anderson | Practicing safe computing: a multimedia empirical examination of home computer user security behavioral intentions[END_REF]. This assumption was later proven false by [START_REF] Edwards | Examining the security awareness, information privacy, and the security behaviors of home computer users[END_REF] where it was found that home users do have cybersecurity knowledge and skills. The knowledge may be gained from other environments such as work, but the behaviour at home is different [START_REF] Kritzinger | Cyber security for home users: A new way of protection through awareness enforcement[END_REF][START_REF] Talib | An analysis of information security awareness within home and work environments[END_REF].

Lastly, there are home users that do follow cybersecurity principals at home. Cybercitizens is a term found in the study by Catherine et al. Cybercitizens describe home users that are proactive in being cybersecurity aware and applying cybersecurity skills in their environments [START_REF] Anderson | Practicing safe computing: a multimedia empirical examination of home computer user security behavioral intentions[END_REF]. The study focuses on the intentions of cybercitizens and presents interventions to encourage more users to become cybercitizens. The type of behaviours that a cybercitizen exhibits are installing and updating antivirus software, be cautious of emails as well as email attachments, and lastly choosing strong and easy to remember passwords [START_REF] Anderson | Practicing safe computing: a multimedia empirical examination of home computer user security behavioral intentions[END_REF].

Proposed Conceptual Cybersecurity Behaviour Taxonomies

The proposed CSB taxonomy addresses the two points: 1) Ambiguity in cybersecurity intentions, and 2) Completeness in the introducing of context as an independent variable when categorising CSB.

Updated Work Cybersecurity Behaviour Taxonomy

The current section proposes an updates CSB taxonomy for the work environment. The contribution in this section is the division of behaviour intentions into four categories. Fig 3 presents the CSBs at work with the derived intentions. This new graph offers the advantage of clearly showing the intentions associated with the categories of behaviours. headings should be numbered. Lower level headings remain unnumbered; they are formatted as run-in headings.

Intentions Intentions are plans for performing a behaviour. The literature on CSB intentions can be divided into intentional and unintentional CSB [START_REF] Safa | Human aspects of information security in organisations[END_REF].

Intentional Cybersecurity Behaviour Intentional CSB refers to instances where the user purposefully wants to harm systems or disregard cybersecurity principals. Opposite to this, users can purposefully uphold or/and promote cybersecurity principals. Intentional Good (IG) Cybersecurity Behaviour There exist instances where the user purposefully upholds cybersecurity principles [START_REF] Stanton | Analysis of end user security behaviors[END_REF]. This category is adopted from Stanton et al. where aware assurance and basic hygiene are collapsed into intentional good CSB. An example of users performing intentional good CSB are users that create good passwords to protect information belonging to them or an organisation. Literature has developed terms such as good cybersecurity hygiene and conscious care behaviour to describe this category of users [START_REF] Stanton | Analysis of end user security behaviors[END_REF][START_REF] Safa | Information security conscious care behaviour formation in organizations[END_REF].

Unintentional Cybersecurity Behaviour Unintentional CSB refers to instances where the user does not intend on disregarding nor upholding cybersecurity principals. In these instances, good or bad CSB is a by-product of other actions or intentions.

Unintentional Bad (UB) Cybersecurity Behaviour Behaviours categorised as unintentional bad CSB are those where the user does not intend to cause malicious harm or purposefully disregard cybersecurity principals. Ifinedo referred to these behaviours as counterproductive computer security behaviours [START_REF] Ifinedo | Effects of Organizational Citizenship Behavior and Social Cognitive Factors on Employees'Non-Malicious Counterproductive Computer Security Behaviors: An Empirical Analysis[END_REF], while Stanton et al. referred to it as dangerous tinkering and nave mistakes [START_REF] Stanton | Analysis of end user security behaviors[END_REF] and Chu et al. refers to it as information security deviant behaviour [START_REF] Chu | Developing a Typological Theory Using a Quantitative Approach: A Case of Information Security Deviant Behavior[END_REF]. An example of unintentional bad CSB is a user that writes their password down or recycles their password [START_REF] Nthala | If Its Urgent or It Is Stopping Me from Doing Something, Then I Might Just Go Straight at It: A Study into Home Data Security Decisions[END_REF].

Unintentional Good (UG) Cybersecurity Behaviour Behaviours categorised as unintentional good CSB are behaviours where users preserve cybersecurity because of other intentions or actions. The study by Virginia Tech found that even though users complied with password change policies, the users still felt that cybersecurity is an obstacle. In this case, the intention of the behaviour is to comply, and it is not to practice good CSB [START_REF] Tech | When users resist: how to change management and user resistance to password security[END_REF]. Unintentional good CSB is not ideal, because for a behaviour to be repeated the user must be intentional in repeating as well as sustaining the behaviour.

Home Cybersecurity behaviour Taxonomy

Categories captured in Fig. 3's graph focus on CSB that occur at work. In the interest of completeness, the next section of the study aims to categorise CSBs of home users. To do so, different CSBs were extracted from literate. These behaviours were plotted on a similar graph as used in Fig. 4. However, the y-axis had to be adjusted. According to the literature presented, home users do have cybersecurity knowledge and skills. In the home environment the application of these knowledge and skills is more distinguishing of the behaviours as opposed to having the knowledge and skills. Therefore, the y-axis is divided into None or Limited Knowledge and Skills, Knowledge and Skills but No Implementation and finally, Knowledge and Skills with Implementation. In the Knowledge and Skills with no Implementation there are three behaviour categories, namely Disrupting, Unconcerned and Knowledge Gaining. Disrupting behaviours are intentional bad CSBs. The behaviours under this category show neglecting of cybersecurity principals through the reckless actions such as downloading torrents from peer-to-peer networks. The category Unconcerned describes careless CSBs. However, the intention of these behaviours in not to intentionally cause harm. Knowledge gaining CSB is intentionally good behaviour. However, without applying the knowledge and skills these behaviours have little use in maintaining cybersecurity.

In the No or Limited Knowledge row there are two behaviour categories, namely Cognitive Laziness and Convenience. These terms were taken from [START_REF] Rughini | Nothing ventured, nothing gained. Profiles of online activity, cyber-crime exposure, and security measures of end-users in European Union[END_REF]. Cognitive Laziness is unintentional bad CSB. This category of behaviours describes behaviour that is done mindlessly without consideration of any cybersecurity. Finally, the Convenience category describes unintentional good CSB. These behaviours are done only if the cybersecurity related task is convenient.

Conclusion

The aim of the paper was to provide a clear representation and visualisation of CSB. The study reviewed literature on CSB in the workplace. The literature was consolidated and represented on one graph. Previous research had represented user intentions of CSB on an ordinal scale ranging from malicious to benevolent. The current study improved on this measurement by dividing intentions into smaller units of measurement. The result was four categories to describe user CSB intentions. The second half of the paper focused on home user CSB. Eight categories of home user CSB were presented. The categories were obtained by plotting home user CSB found in literature against knowledge and skill implementation and user intentions. The information in this study contributes to the understanding of user CSB and can be used by researchers and practitioners of cybersecurity. This research aids in specifying the question from How to change CSB? to How to change CSB of home users who exhibit Cognitive Laziness behaviour. Future work will need to conduct an experiment to verify the conclusions found in this study. Future work will also need to address the influences of CSBs.

Fig. 1 .

 1 Fig.1. End User Security Behaviours[START_REF] Stanton | Analysis of end user security behaviors[END_REF]

Fig. 2 .

 2 Fig. 2. Cybersecurity Behaviour in Organisations [9, 17, 18].

Fig. 3 .

 3 Fig. 3. Work CS Behaviour with Segmented Intentions adapted from [9, 17, 18].

Fig. 4 .

 4 Fig. 4. Home Users'Cybersecurity Behaviour Categories