Besma Khalfoun

Mohamed Maouche

Sonia Ben Mokhtar

Sara Bouchenak

MooD: MObility Data Privacy as Orphan Disease -Experimentation and Deployment Paper

Keywords: CCS Concepts, Security and privacy → Pseudonymity, anonymity and untraceability Mobility Data, User Re-identification, Location Privacy Protection Mechanism, User-Centric Protection, Data Privacy

With the increasing development of handheld devices, Location Based Services (LBSs) became very popular in facilitating users' daily life with a broad range of applications (e.g. traffic monitoring, geo-located search, geo-gaming). However, several studies have shown that the collected mobility data may reveal sensitive information about end-users such as their home and workplaces, their gender, political, religious or sexual preferences. To overcome these threats, many Location Privacy Protection Mechanisms (LPPMs) were proposed in the literature. While the existing LPPMs try to protect most of the users in mobility datasets, there is usually a subset of users who are not protected by any of the existing LPPMs. By analogy to medical research, there are orphan diseases, for which the medical community is still looking for a remedy. In this paper, we present MooD, a fine-grained multi-LPPM user-centric solution whose main objective is to find a treatment to mobile users' orphan disease by protecting them from re-identification attacks. Our experiments are conducted on four real world datasets. The results show that MooD outperforms its competitors, and the amount of user mobility data it is able to protect is in the range between 97.5% to 100% on the various datasets.

Introduction

Nowadays, the proliferation of mobile devices embedding GPS chips (e.g. smartphones, tablets, smartwatches) has significantly contributed to the development of geolocated services, also named Location Based Services (LBSs). These services are useful for users' daily life as they allow them to localize nearby friends, discover their environment and request for places whenever they like and wherever they are. The downside is that huge amounts of information regarding users' locations are being gathered and stored by third party services. These services or other entities that may have access to the collected data (e.g., accidentally or through an attack) may exploit it fraudulently in order to infer and reveal sensitive information about individuals (e.g., home address, workplace, religious beliefs, sexual preferences, political orientations, social relationships). The most common threats include: (1) re-identification attacks where an anonymous mobility trace is re-associated to its originating user based on previously recorded data [START_REF] Mulder | Identification via location-profiling in GSM networks[END_REF] [START_REF] Gambs | De-anonymization attack on geolocated data[END_REF] [33], (2) mobility prediction where users' next moves are anticipated [START_REF] Sadilek | Far Out: Predicting Long-Term Human Mobility[END_REF] [START_REF] Gambs | Next place prediction using mobility markov chains[END_REF] [3],

(3) extraction of user's Points of Interest (POI) (e.g., home, workplace, etc.) [START_REF] Zhou | Discovering personal gazetteers: an interactive clustering approach[END_REF] and (4) inference of social relationships (e.g., friends, coworkers, etc.) [START_REF] Bilogrevic | Inferring social ties in academic networks using short-range wireless communications[END_REF] [START_REF] Wang | Human mobility, social ties, and link prediction[END_REF].

To tackle these threats, many Location Privacy Protection Mechanisms (LPPMs) were proposed in the literature. LPPMs protect user location information by relying on a wide variety of techniques such as perturbation, generalization and fake data generation [START_REF] Gupta | An Exploration to Location Based Service and Its Privacy Preserving Techniques: A Survey[END_REF].

To evaluate the effectiveness of LPPMs, a variety of privacy metrics are usually used and the resilience against reidentification attacks is one of them. Considering a protected mobility trace (i.e., a raw trace to which a given LPPM is applied), a re-identification attack tries to link the protected mobility trace to its owner based on past unprotected mobility data that the attacker has access to. The more an LPPM is able to protect against re-identification attacks, the better. There exist a variety of re-identification attacks in the state-of-the-art literature that differ in the way they model and analyse user mobility (e.g., PIT-attack [START_REF] Gambs | De-anonymization attack on geolocated data[END_REF] uses Mobility Markov Chains and AP-attack [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF] uses heatmaps to model users' mobility). However, when LPPMs are evaluated against re-identification attacks the focus is generally put on the protection of the crowd, i.e., protecting the larger proportion of users possible, and little attention is given to users that remain unprotected. Considering a set of state-of-the-art attacks and LPPMs at the disposal of a data security expert aiming at the protection of a given dataset, the question that the latter may ask is: What should be done with mobility traces that are subject to re-identification despite the use of LPPMs?. A straightforward, and safe solution that the expert may adopt is to delete these vulnerable mobility traces from the protected dataset. However, this solution would engender the loss of large data portions. To assess this loss, we performed an experiment in which we applied three state-of-the-art LPPMs to protect four mobility datasets.

On the protected datasets, we ran three state-of-the-art re-identification attacks and we removed from the protected dataset, the traces that were re-identified by at least one of the attacks. The results of this experiment with Geo-I [START_REF] Andrés | Geo-indistinguishability: differential privacy for location-based systems[END_REF], TRL 18 and HMC [START_REF] Maouche | [END_REF] (described further in Section 4.1.2 and 5) show a data loss of 42% on average and that can reach 95% in the most vulnerable dataset. The detailed results of this experiment are presented in the problem illustration (Section 2.4).

In this paper, we present MooD (MObility Data Privacy as Orphan Disease), a user centric approach to enforce location privacy using multiple LPPMs aiming at the protection of orphan users, i.e, users that are not protected against re-identification attacks while using any of the existing LPPMs. The originality of MooD is that it combines off-the-shelf LPPMs and applies a fine-grained protection. The LPPMs' combination is realized with the application of various LPPMs on the same trace in the form of function composition, while the fine-grained protection implies the application of various LPPMs on contiguous sub-traces. MooD's mechanisms are driven by the resilience to state-ofthe-art re-identification attacks and the data utility metrics set by the data security expert.

We evaluate MooD by applying it to four real life mobility datasets and comparing its performance to the application of individual and hybrid LPPMs [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF]. The results of our experiments show that MooD is able to protect users' data in a range between 97.5% and 100% on the four datasets while the best competitor (HybridLPPM) protects users' data in a range between 64% and 95% on the same datasets.

The remainder of this paper is structured as follows. First, we present in Section 2 a background on user re-identification attacks and location privacy protection mechanisms and we illustrate the handled problem. Then, we describe the design principles of our system in section 3. Further, in section 4, we proceed to the experimental evaluation of our solution.

Finally, we present the related work and conclude in section 5 and 6 respectively.

Background and Problem Statement

In this section, we describe mobility traces, re-identification attacks and LPPMs (Section 2.1, 2.2 and 2.3, respectively). Then we present an experiment we did to illustrate our problem (Section 2.4).

Mobility Traces

A mobility trace is a sequence of spatio-temporal records r = (lat, lnд, t) associated to a given user, where lat and lnд correspond to the latitude and the longitude of GPS coordinates while t is a timestamp. To simplify mobility traces are timeseries (i.e.,T ∈ (R 2 × R + ) * ).

User Re-identification Attacks

POIs Mobility Markov Chains Heatmap

Original trace

Figure 1. Models of mobility profiles

A user re-identification attack aims at associating a protected mobility trace to its originating user based on users' past mobility. Two phases are necessary to run these attacks: a training phase and an attack phase. In the training phase, the attacker collects non-obfuscated mobility history of known users from several sources and builds users' mobility profiles. Several models have been used in the literature to characterize mobility profiles of users. The most common models include Points of Interests (POIs) (i.e., the set of meaningful places where users spent time), Mobility Markov Chain (MMC) where states are POIs and edges represent the probability transition between states or HeatMaps that aggregate user mobility over time across cells. Figure 1 illustrates the above three models. Then, in the attack phase, the attacker that receives an anonymous mobility trace, tries to re-associate it to the closest user profile among the learned ones.

More formally, considering an anonymous mobility trace T , a set of past mobility traces of known users H = {H 1 , H 2 , . . .} where H i ∈ (R 2 ×R + ) * and a set of users U , a re-identification attack A is defined in Equation 1.

A : (R 2 × R + ) * → U T → A(T , H) = u a (1)

Location Privacy Protection Mechanisms

In order to mitigate location privacy threats, Location Privacy Protection Mechanisms (LPPMs) have been introduced in the literature. LPPMs operate modifications on raw mobility data in order to offer end-users a set of privacy guarantees. More formally, a protection mechanism L is defined in Equation 2, it takes as input a mobility trace T and a set of parameters Υ and produces an obfuscated version of the mobility trace as an output.

L : (R 2 × R + ) * → (R 2 × R + ) * T → L(Υ,T ) = T ′ (2)
LPPMs differ in the way they alter the original mobility data and in the guarantees they offer to end-users. These guarantees can be theoretical (e.g., k-anonymity [START_REF] Sweeney | k-anonymity: A model for protecting privacy[END_REF], differential privacy [START_REF] Dwork | Differential privacy[END_REF]) or practical (e.g., the resilience to known attacks). Consider a data security expert that has to protect a given mobility dataset before its publication. The security expert has access to a set of LPPMs and a set of user re-identification attacks found in the literature. In order to assess the effectiveness of the LPPMs in front of the attacks, the expert may decide to run the re-identification attacks on the protected dataset and choose the LPPM that better protects her original dataset. We performed such an experiment on four real mobility datasets protected using three state-of-the-art LPPMs (i.e., Geo-I 4, TRL [START_REF] Huang | Search locations safely and accurately: A location privacy protection algorithm with accurate service[END_REF] and HMC [START_REF] Maouche | [END_REF]) and a hybrid solution proposed in [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF] on which we ran three state-ofthe-art attacks (i.e., POI-Attack [START_REF] Primault | Differentially private location privacy in practice[END_REF], PIT-Attack [START_REF] Gambs | De-anonymization attack on geolocated data[END_REF] and AP-Attack [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF] ). The details of the used LPPMs and attacks are presented in Section 4. The results of this experiment are depicted in Figure 2. These results show, on each dataset, the number of users for whom at least one of the attacks was able to disclose their identities. From these results, we can see that on all the datasets, there are several users, from 19% to 88% that are not protected in front of re-identification attacks despite the use of single LPPMs.

Problem Illustration

The question that a data security expert may ask in this situation is what should be done with these vulnerable portions of the respective datasets?. A safe answer would be to delete these parts of the datasets in order to prevent eventual user re-identifications that an attacker may perform on the published data. However, this may generate a massive data loss that ranges from 13% to 95% of the overall datasets, as depicted in Figure 3.

A closer look to the protected datasets shows that LPPMs perform differently from one user to another. Hence, a second step considered was to move to a user-centric approach where the hybridLPPM proposed in [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF], is applied to each user of the considered datasets. The latter selects an LPPM among a set of LPPMs that resists to re-identification attacks (if any) with the best utility metric, i.e, a spatial-temporal distortion is computed [START_REF] Maouche | [END_REF]. Column HybridLPPM of Figure 2 shows the ratio of non-protected users on the four datasets for which the best LPPM was chosen (i.e., an LPPM that protects against all the three considered attacks with the lowest spatio-temporal distortion). This result shows that despite the use of an hybrid LPPM for protecting mobility datasets, there is still a large portion of users that are vulnerable to re-identification attacks, i.e. 5% to 36%. Consequently, the generated data loss, as depicted in Figure 3 and that varies between 5% and 42% on the four datasets is still high.

The objective of this paper is thus to design a novel methodology that combines off-the-shelf LPPMs to protect a given mobility dataset in front of a set of user re-identification attacks while minimizing the eventual data loss. In this way, we protect the crowd as has been done in the literature and in addition provide other tools to protect orphan users.

MooD Design Principles

In this section, we present MooD (MObility Data Privacy as Orphan Disease), a system that aims at protecting users that are not protected against re-identification attacks when using a single LPPM. In the following, we start by describing

System Model

Let U = {U 1 , U 2 , ..., U N } be the set of users in the system. Each user is represented by two mobility traces, T u i the one she wants to share and H u i a past mobility trace used to control the risk of user re-identification.

Definition of a Composition of LPPMs:

A composition of p ∈ N protection mechanisms {L i 1 , L i 2 , . . . , L i p } a subset of all available LPPMs in L noted C p (L i k )
is the application of p LPPMs sequentially and gradually on a mobility trace. As described in Equation 3, it means that we start by applying the first LPPM L i 1 . The resulting data is used as an entry for the second LPPM L i 2 and so on. The order of the LPPMs is important since it is similar to a composition of functions 1 .

C p (L i k )(T ) = L i p • L i p-1 • . . . • L i 2 • L i 1 (T ) = L i p (L i p-1 (...L i 1 (T ))) (3)
From a set L of LPPMs, the set of all possible composition is noted

C with |C| = n i=1 n! (n-i)! where n = |L|
Definition of a Fine-Grained Protection : The fine-grained protection splits the mobility trace into multiple sub-traces and protects each sub-trace independently with different LPPMs (from L or C) as illustrated in figure 4. The objective of splitting traces is to separate descriminative mobility patterns. To this end, several techniques can be used, e.g., splitting traces according to time, distance or inter-POIs.

Definition of an Orphan User:

A user U is an orphan user with respect to a set of LPPMs L, a set of re-identification attack A and a background knowledge H, if she satisfies the property described:

∀L j ∈ L, ∃A k ∈ A, A k (L j (T U ), H) = U (4)
Definition of a Protected User with Single-LPPM: A user U is said to be protected by a single-LPPM if she satisfies the property: which states that there exists at least one LPPM in the set of considered LPPMs L that makes all the considered attacks in A fail at re-identifying the user.

∃L j ∈ L, ∀A k ∈ A, A k (L j (T U )) ̸ = U (5)
1 To simplify the notations we omit the parameters of each LPPM and past mobility used of each attack.

Definition of Protected User with Multi-LPPM:

A user U is said to be protected by multi-LPPM if she satisfies the property:

∃C j ∈ C, ∀A k ∈ A, A k (C j (T U )) ̸ = U (6)
Definition of Data Loss: we define the data loss over a dataset D = {T 1 ,T 2 , . . . ,T N }, with the set of LPPMs Λ against the set of re-identification attacks A as the ratio of data size (counted by records) of non-protected mobility traces in D.

In other words, it is the amount of data remaining after every non-protected mobility trace of the dataset has been erased to avoid user re-identification. As described in Equation 7(with |D| r computes the number of records in D).

data_loss(D, Λ, A) = |D N P | r |D| r D N P = {T ∈ D | ∀L ∈ Λ, ∃A ∈ A, A(L(T U )) = U } (7)

Overview of MooD

MooD is a fine-grained multi-LPPM user-centric approach. Its main objective is to protect the mobility trace of all users and in particular orphan users who are not protected by any single LPPM. The architecture of MooD is depicted in Figure 5 and its behaviour is described in Algorithm 1.

MooD takes as inputs: the mobility trace of a user, denoted T , a set of LPPMs denoted L of cardinality n, a set of user re-identification attacks denoted A of cardinality m and a utility metric M. It returns obfuscated mobility data as an entire mobility trace T ′ or as multiple sub-traces {T ′ 1 ,T ′ 2 , . . .}. It has three main components, the first component Multi-LPPM Composition Search aims at finding a multi-LPPM composition for orphan users, i.e. users who are not protected by a single LPPM against re-identification attacks. The second component Fine-Grained data protection manages mobility traces for which the first component was not able to find a protecting composition of LPPMs and uses fine-grained protection. In this case, the latter splits the original trace into a set of sub-traces and sends each one back to the first component as depicted in Figure 5. Finally, in the last component Best LPPM Selection, only the protected mobility trace (i.e. using single-LPPM or multi-LPPM protection) against all the attacks with the best utility value is retained.

Multi-LPPM Composition Search

The Multi-LPPM Composition Search is the main component in our system. It takes as input the mobility trace of a user T , the set of LPPMs L and the set of all considered re-identification attacks A. First (lines 4-12), we start by applying LPPMs independently to search if there exists an LPPM that can protect the mobility trace.

Then (lines 15-23), we apply all possible combinations of the considered LPPMs in an incremental and exhaustive If all re-identification attacks fail in re-associating the obfuscated mobility trace T ′ to its originating user, the privacy protection process is done and the user's mobility trace is protected by MooD. In this case, the Best LPPM Selection component chooses the best LPPM composition based on a utility metric (section 3.5). However, if at least one re-identification attack succeeds, it means that the user is still vulnerable. In this case, the mobility trace of the user is undertaken by the next component.

Fine-Grained Data Protection

The Fine-Grained Data Protection is a complementary component in our system (line [START_REF] Primault | Time Distortion Anonymization for the Publication of Mobility Data with High Utility[END_REF][START_REF] Sadilek | Far Out: Predicting Long-Term Human Mobility[END_REF][START_REF] Shankar | Privately querying location-based services with SybilQuery[END_REF][START_REF] Sweeney | k-anonymity: A model for protecting privacy[END_REF][START_REF] Wang | Human mobility, social ties, and link prediction[END_REF][START_REF] Wang | A de-anonymization attack on geo-located data considering spatio-temporal influences[END_REF][START_REF] Zheng | Geolife: A collaborative social networking service among user, location and trajectory[END_REF]. It is launched when the user's mobility trace is protected by neither a single LPPM nor a composition of LPPMs. The idea we adopt is to split the original trace into a set of sub-traces and try to protect each sub-trace separately. For that purpose, several techniques can be used or combined for splitting the original trace such as the fixed time slices where we split the trace after a fixed time duration (e.g. every hour) or the fixed distance slices (e.g. every 1 km). In our work, we opt for the fixed time slice. The assumption behind going towards fine-grained protection is that short mobility traces may contain less discriminative information than larger ones. Therefore, re-identification attacks which are based on profiling user mobility will be less successful at re-identifying users because the discriminative mobility patterns collected from the mobility trace of the user are separated. This way, a user can still participate in the published dataset or in the crowd-sensing campaign but only with multiple protected sub-traces that seem to come from different users. In practice, MooD cuts the trace in half according to time and recursively calls for MooD (line 32) with new user IDs (line 34). When the length of a mobility trace is shorter than δ , the protection process for this trace is stopped and the corresponding mobility records are erased from the published dataset or not sent to the crowdsensing server. The main role of the parameter δ is to stop the recursive split of traces. Moreover, in real use cases, the value of δ can be chosen according to the type of analysis the data will go through. For instance, for traffic congestion analysis (or count queries in general) there is no particular limit since the length of each sub-trace is not important to count the presence of users in particular places. But, if the application needs to study human mobility habits, a more reasonable value of δ is likely to be more than 24 hours.

Best LPPM Selection

It is important to protect data while maintaining high utility of the resulting trace. For that pupose, the Best LPPM Selection component was added to MOOD. Its main role is to choose T ′ , a protected version of a mobility trace with one among all the resilient LPPMs or multi-LPPMs against re-identification attacks, while retaining a high value of utility. To this end, a utility metric M is considered. Basically, a utility metric measures the distortion of obfuscated data Algorithm 1 MooD algorithm. for L j in L do ▷ Single-LPPM protection 5:

T ′ ← L j (T U ) 6: k ← 1 7: limit ← |A| 8:
while A k (T ′ ) ̸ = U and k ⩽ limit do 9:

k ← k + 1 10:
end while 11:

if k > limit then out ← out ∪ {T ′ } 12:
end for 13:

if out ̸ = ∅ then 14:

return {arg min

T ′ ∈out (ST D(T U ,T ′ ))[0]} 15:
else ▷ Composition of multi-LPPMs 16:

for C j in C -L do 17:

T ′ ← C j (T ) 18: k ← 1 19: while A k (T ′ ) ̸ = U & k ⩽ limit do 20: k ← k + 1 21:
end while 22:

if k > limit then out ← out ∪ {T ′ } 23:
end for

24:

end if

25:

if out ̸ = ∅ then 26:

return {arg max

T ′ ∈out (M(T U ,T ′ ))[0]} 27:
else if lenдth(T U ) ≥ δ then 28:

S ← Split_in_hal f (T U )

29:

▷ Fine-Grained protection end if 38: end function in comparison with the original data. The lower the distortion the better the quality of the resulting data. In our paper, we measured the utility using the Spatial-Temporal Distortion metric (STD) [START_REF] Maouche | [END_REF]. As defined in Equation 8, the spatiotemporal distortion ST D is the average distance between each record of T ′ and its temporal projection into T . The temporal projection of the record x = (lat x , lon x , t x ) in T ′ is the expected position r e in T at time t. Specifically, we search for r i = (lat i , lon i , t i ) and r i+1 = (lat i+1 , lon i+1 , t i+1 ) in T such as t i ≤ t x ≤ t i+1 , then we compute r e the interpolation with the ratio (t x -t i )/(t i+1 -t i ).

ST D(T ,T

′ ) = 1 |T ′ | x ∈T ′ d t empor al _pr oject ion (x,T ) (8)

Experimental Evaluation

In this section, we evaluate the effect of MooD on the protection against re-identification attacks. In Section 4.1, we present the experimental setup and the configuration of the considered LPPMs and attacks. To better understand the impact of the composition of LPPMs and the fine-grained protection in the protection of orphan users, we evaluate these parts separately. Specifically, we evaluate MooD's composition effect against single and multiple attacks in Sections 4.3 & 4.4. Then, for the remaining unprotected users, we analyze the effect of MooD's fine-grained protection in Section 4.5.

Experimental Setup

All the experiments were carried out in a computer running an Ubuntu 16.04 LTS OS with 5GB of RAM and 3 cores of 1.8Ghz each. The different considered LPPMs and attacks were taken from an open-source library [START_REF] Primault | ACCIO: How to Make Location Privacy Experimentation Open and Easy[END_REF] or the authors' own source code.

User Re-identification Attack Configuration

The three chosen re-identification attacks in this paper are: AP-attack, POI-attack, and PIT-attack described below.

POI-Attack is introduced in [START_REF] Primault | Differentially private location privacy in practice[END_REF] by Primault and others, where Points Of Interest (POIs for short) are used to represent the user's mobility profile. In the training phase, a clustering algorithm [START_REF] Zhou | Discovering personal gazetteers: an interactive clustering approach[END_REF] is run on raw mobility traces to extract POIs and build each user's mobility profile. After that, in the re-identification phase, when an adversary entity receives an anonymous mobility trace T ′ x , the attack builds its mobility profile. Then, it measures the similarity between the anonymous mobility profile and all the known mobility profiles previously built. The similarity is based on the geographical distance between POIs. Finally, only the mobility profile which minimizes the distance is selected. Gambs et al., where the Mobility Markov Chain (MMC) model is used to describe users' mobility behaviours. The states are POIs ordered by the number of records inside them and the edges represent the probability of transition between each pair of POIs. In the training phase, the MMC model of each individual is built based on the previously recorded mobility data. After that, in the re-identification phase, when the attacker has at his disposal an anonymous mobility trace, it constructs its MMC model and measures the distance between the latter and the background knowledge. Two information are considered: the geographical distance between POIs based on Euclidian distance and the weight of POIs. The weight of a POI is computed using the proportion of points contained inside a given POI. The authors of this article proposed many distance metrics to compare MMCs, the most effective one is stats-prox distance, a combination of two distances: the stationary distance and the proximity distance [START_REF] Gambs | De-anonymization attack on geolocated data[END_REF]. Finally, the MMC model which minimizes the stats-prox distance with the anonymous MMC is selected.

PIT-Attack is introduced in [16] by

AP-Attack is introduced in [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF] by Maouche and al, where the concept of heatmaps is used to describe the mobility user profile. To this end, a map is divided into several cells of equal size. The frequency of a visited cell is defined by the number of user's records inside the cell. In this way, it is easy to distinguish between extremely to poorly frequented regions by individuals. To measure the distance between an anonymous profile and the profile of known users, the Topsoe Divergence metric is used [START_REF] Dominik | A new metric for probability distributions[END_REF].

The attacks are parameterized as follows: AP-attack has a cell size parameter fixed at 800 meters which is the default value in [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF]. POI -attack and PIT -attack require a diameter of the clustering area to extract points of interest (POIs), and a duration of time spent at a POI. These values were respectively set to 200 meters and 1 hour as done in [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF].

LPPM Configuration

To evaluate MooD, we select three representative LPPMs:

(1) Geo-I [4], (2) Trilateration [START_REF] Huang | Search locations safely and accurately: A location privacy protection algorithm with accurate service[END_REF] (TRL) and ( 3) HMC [START_REF] Maouche | [END_REF]. Each LPPM belongs to a class of protection methods. We chose (1) Geo-I, which belongs to data perturbation based mechanisms. It obfuscates mobility traces by adding a laplacian noise to each record of the mobility trace. (2) TRL based mechanism is a different way to generate dummies in online services. It is based on trilateration: when a user launches an LSS (i.e. Location Searching Service) query, looking for a restaurant or a gas station, the algorithm chooses randomly 3 assisted locations l1, l2 and l3 in a range of r from the real location l of the user. The service provider looks for nearby places according to the three assisted locations and sends the result to the user. Finally, the user gets an accurate result by intersecting the result of the three sent locations using trilateration. (3) Heat Map Confusion (HMC) is a combination of data perturbation technique and dummies generation. In HMC, the mobility trace of each user is represented as a heatmap. Then, the algorithm alters the given heatmap by making it look similar to the one of another user. The objective of such an approach is to preserve a certain level of data utility and confuse an attacker that tries to re-identify users'mobility traces. Finally, HMC transforms back each obfuscated heatmap into a set of mobility traces.

Each LPPM has its own configuration parameters. These parameters have an impact on the balance between privacy and data utility. In these experiments, we chose medium values of parameters because the objective of our study is not to find the best configuration as previous works focused on ([9], [START_REF] Primault | Adaptive Location Privacy with ALP[END_REF]) but to show that it is possible with a reasonable configuration and a relevant combination of LPPMs to reach an adequate trade-off between privacy and utility. Specifically, Geo-I has ε as a privacy parameter, which tunes the amount of noise added to the mobility data, (the lower the epsilon the higher the protection). We have fixed the value of this parameter to 0, 01 which corresponds to a medium privacy level. TRL has a radius r from the real user's position where the fake locations are generated. The latter was set to 1 km. Finally, as HMC is based on heatmaps, the cell size of the heatmap is a parameter of this technique and it was set to 800 meters which concords with the used value in the original paper [START_REF] Maouche | [END_REF].

Moreover, we compared our solution to the HybridLPPM algorithm proposed in [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF] with slight variations. Briefly, we selected the aforementioned LPPMs with the same parameter values. Then, we ordered them according to the degree of data distortion they generate after obfuscation: (HMC → Geo-I → TRL). Finally, we opt for the LPPM which degrades the least the user's mobility data while protecting it, based on the defined order.

Mobility Datasets

In our experiments, we used four real mobility datasets with a summary depicted on table 1. These datasets are :

(1) MDC [START_REF] Laurila | The Mobile Data Challenge: Big Data for Mobile Computing Research[END_REF] that contains the mobility of users in the city of Geneva; (2) Privamov [START_REF] Boutet | Uniqueness Assessment of Human Mobility on Multi-Sensor Datasets[END_REF] that contains the mobility of users in the city of Lyon; (3) Cabspotting [START_REF] Piorkowski | CRAWDAD data set epfl/mobility[END_REF] that contains the mobility of cab drivers in the city of San Francisco and (4) Geolife [START_REF] Zheng | Geolife: A collaborative social networking service among user, location and trajectory[END_REF] that contains the mobility of users in the city of Beijing.

In our experiments, we considered the 30 most active successive days of each dataset. After that, we split the mobility trace of each user chronologically into a period of 15 days used as a training set (i.e. background knowledge) and the remaining 15 days used as a testing set. Only active users during those periods were considered.

In the experiments we conducted, a mobility trace that is still re-identified after the multi-LPPM composition search is split into sub-traces of 24 hours period before applying the recursive splitting algorithm presented previously. We choose chunks of 24 hours to simulate the scenario of a crowdsensing application where users send their data daily. Besides, we set the value of δ to 4 hours in MooD' algorithm. to a Single Re-identification Attack As a first step, we want to showcase the problem of orphan users when a single attack is used by the data analyst. We consider a set of state-of-the-art LPPMs (n = 3) and we select AP-attack as -the most powerful attack currently known in the literature -in order to evaluate the robustness of the generated obfuscated data against a re-identification attack. We compared the result of MooD with the existing LPPMs applied as single LPPMs on the four datasets.

The results depicted in Figure 6, show that in the MDC dataset, 96 out of 141 users are re-identified when no LPPM is applied, which means that 45 users are naturally insensitive to AP-attack. Additionally, 95, 79 and 14 users are re-identified while applying Geo-I, TRL, and HMC respectively. Whereas these numbers are lower (i.e 10 users) when HybridLPPM is used. All of those users are protected when using MooD. In the PrivaMov dataset, 32 out of 41 users are exposed to re-identification threat. 31, 26 and 9 users are reidentified when Geo-I, TRL and HMC are applied as a single LPPM respectively. Whereas in the case of HybridLPPM, only 4 users remain unprotected, Similarly, in the Geolife dataset, 32 out of 41 users identities are revealed when no LPPM is applied and AP-Attack is launched. Then 4 users are still non-protected by neither a single LPPM nor a HybridLPPM, whereas with MooD'composition of LPPMs, only one user is still vulnerable against AP-attack. Finally, in the Cabspotting, nearly half of the dataset is naturally protected against AP-Attack (242 out of 536), this is due to the homogeneity of cab drivers moving patterns. After applying a single LPPM, almost all the remaining unprotected users became protected except 4 users, for which the application of MooD with its multi-LPPM composition succeeds in protecting them.

Resilience of MooD's Multi-LPPM Composition

to Multiple Re-identification Attacks In this experiment, we use MooD with a stronger virtual attacker. It uses multiple re-identification attacks (m = 3) to assess whether the protected users are uncovered by at least one of the attacks. This is possible because MooD knows the ground truth about the real identity of the users. The corresponding results, as shown in Figure 7a, in the MDC dataset, 107 out of 141 users are re-identified when no LPPM is applied. This means that 34 users are naturally protected without the application of LPPMs. Thereafter, 107, 86 and 65 users are non-protected against at least one-attack among the considered ones when Geo-I, TRL and HMC are applied respectively. Then, 51 out of 141 users are still re-identified when HybridLPPM is applied to mobility traces. Whereas only 3 users remain non-protected with the Multi-LPPM combination Search of MooD. In the PrivaMov Dataset, as depicted in Figure 7b, 37 out of 41 users are vulnerable against re-identification attacks when no LPPM is used to protect data. Then, 36 users are re-identified when Geo-I mechanism is applied with medium privacy. The latter is not robust against re-identification attacks. The only way to make it resilient to the considered attacks is to increase its level of privacy (i.e. reduce the value of ϵ) at the expense of data quality. Moreover, 29 and 20 users are non-protected when TRL and HMC are applied, respectively. Whereas these numbers decrease to 10 users when the HybridLPPM is considered. Finally, only 3 users remain non-protected while the multi-LPPM composition in MooD is used. Similarly, in the Geolife dataset, as shown in Figure 7c, 32 users out of 41 users are unprotected against at least one among all the attacks. Then, the number of re-identified users decreases slightly to 28, 23 and 15 users when Geo-I, TRL and HMC are applied separately. Furthermore, the application of HybridLPPM generated 10 unprotected users and finally, only 2 users are still vulnerable against one or more re-identification attacks. Finally, in Cabspotting dataset, as illustrated in Figure7d, more than half of the whole users are re-identified in case of no LPPM. After that, when Geo-I, HMC, and TRL are applied as a Single LPPM, 263, 131 and 65 users are re-identified respectively. Then, the number of re-identified users declines to 27 users with HybridLPPM. Lastly, while considering the multi-LPPM composition of MooD, no users left unprotected. It means that we can protect the whole dataset from all the considered attacks.

Evaluation of Fine-Grained Data Protection

As few users remain vulnerable to re-identification attacks, we zoom on this category of users and apply the fine-grained data protection. We start by splitting their mobility traces into multiple sub-traces of 24 h period (as explained in section 3.4). Then, each sub-trace feeds MooD's multi-LPPM composition component in order to protect each sub-trace independently.

In the MDC Dataset, three users are not protected with the composition of LPPMs, denoted {A, B, C}. We split their mobility traces into 24 h sub-traces. Then, we apply MooD on the resulting sub-traces. Figure 8 shows that there are 68% of protected sub-traces with MooD and 32% of subtraces remain unprotected with the multi-LPPM composition. Therefore, we can see that user A became protected. User B almost protected (92% of his sub-traces are protected), whereas User C is still non-protected (only 11% of his subtraces are protected). Thus, the granularity of the considered traces has an impact on privacy protection. With the privamov dataset, three users were left non protected when only the multi-LPPM composition is used, denoted {D, E, F }. Similarly, we split their mobility traces into sub-traces of 24 h period. Then, we apply MooD's multi-LPPM composition on each sub-trace. The results show that 67% of the sub-traces of user D are protected with MooD, 43% of the sub-traces of user E are protected with MooD and 50% of the sub-traces of user F are protected by MooD too. Therefore, almost the sub-traces are partially protected. Finally, on the geolife dataset, only two users {G, H } were not protected by MooD's multi-LPPM composition. Then, after splitting their mobility traces, we obtain 4 sub-traces (i.e. 2 sub-traces for each user), the results show that only one sub-trace is protected by MooD.

Impact of MooD on Data Utility and Data Loss

It is important to evaluate the effectiveness of MooD in terms of data utility and data loss. In this paper, as discussed in Section 3.5, data utility is measured using the spatio-temporal distortion metric [START_REF] Maouche | [END_REF] (see Section 3.5) and the data loss is computed as defined in Section 3.1 After that, we compare MooD to state-of-the art LPPMs, previously described (see Section 4.1.2) by considering four different limits of the spatial-temporal distortion: low (i.e. < 500m), medium (i.e. < 1000m), high (i.e. < 5000m) and extremely high (i.e. ⩾ 5000m). Over all the datasets, as depicted in Figure 9, the result shows that for all the protected users (i.e. 754 users in the four datasets), 53.47% have a high utility using MooD (i.e. < 500m) compared its competitors, i.e. 38%, 12%, 45% and 49% with Geo-I, TRL, HMC and HybridLPPM, respectively. Moreover, with medium utility (i.e. < 1000m), MooD outperforms its competitors with a ratio of 78% as to Geo-I, TRL, HMC and HybridLPPM with 38%, 70%, 48% and 74%. This means that MooD can provide a good balance between privacy and data utility compared to its competitors. Depending on the degree of the distorted data, we can imagine several scenarios of data publishing and crowdsensing applications using our system. For instance, measuring the level of noise in a city when the distortion is low, like for instance [START_REF] Maisonneuve | NoiseTube: Measuring and mapping noise pollution with mobile phones[END_REF] where users participate with their mobile phones equipped with a GPS chip to measure the amount of noise in their vicinity. For medium distortion, our system can be used in an application that measures the level of pollution in a specific area. Finally, for high distortion, an application could be related to weather forecasting where the spatial precision of the protected data is not sensitive as in the previous scenarios.

In addition, we compared the data loss generated by MooD and the state of the art LPPMs. We found that a data loss between 14% and 95% is caused by the application of a single LPPM (i.e. Geo-I, TRL and HMC). Furthermore, when HybridLPPM is used the generated data loss is in a range between 5% and 42%. Whereas with MooD, a data loss between 0% and 2.5% is generated which is a negligible amount of data compared to its competitors.

Related Work

Several directions of investigation were taken by researchers to mitigate location privacy threats. Various Location Privacy Protection Mechanisms have been proposed [START_REF] Gupta | An Exploration to Location Based Service and Its Privacy Preserving Techniques: A Survey[END_REF], [START_REF] Bilogrevic | Predicting Users' Motivations behind Location Check-Ins and Utility Implications of Privacy Protection Mechanisms[END_REF], [START_REF] Shankar | Privately querying location-based services with SybilQuery[END_REF], [START_REF] Barak | Anonymizing mobility data using semantic cloaking[END_REF]. Some of them rely on formal privacy guarantees such as k-anonymity [START_REF] Sweeney | k-anonymity: A model for protecting privacy[END_REF] or differential privacy [START_REF] Dwork | Differential privacy[END_REF], some of them target sensitive information and try to hide them (e.g., POIs. . . ) [START_REF] Primault | Time Distortion Anonymization for the Publication of Mobility Data with High Utility[END_REF] and some of them aim at neutralizing specific attacks or preserving specific applications.

NeverWalkAlone [START_REF] Abul | Never Walk Alone: Uncertainty for Anonymity in Moving Objects Databases[END_REF] and its extension W4M (Wait for Me) [START_REF] Abul | Anonymization of moving objects databases by clustering and perturbation[END_REF] are examples of LPPMs which enforce k-anonymity. They guarantee that at each instant, there are at least k users walking inside a cylindrical volume. Another way of achieving k-anonymity is to generate fake data called dummies in order to make the real location of a target user unrecognized. For instance, Trilateration (TRL) [START_REF] Huang | Search locations safely and accurately: A location privacy protection algorithm with accurate service[END_REF] randomly chooses 3 assisted locations l1, l2 and l3 in a range of r from the real location l of the user and send them to the service provider instead of the real position l. The latter is mainly used in LSS services (Location searching services) where trilateration is used to get the exact distance between the user's location and the requested places from each assisted location, which makes this LPPM particularly suited for this type of applications. As for differential privacy, Geo-indistinguishability (Geo-I) introduced by Andres et al. in [START_REF] Andrés | Geo-indistinguishability: differential privacy for location-based systems[END_REF] applies it in the context of location privacy. It bounds the probability of two points to be reported positions of the same real position within a given radius r . Thus, a user can quantify the level of privacy according to their preferences using a privacy parameter ϵ (the lower the ϵ, the higher the privacy level). The authors suggested a way to achieve ϵ-Geo-I in practice by adding Laplacian spatial noise to each GPS coordinate. Additionally, the same authors proposed an extension of ϵ-Geo-I in [START_REF] Chatzikokolakis | Constructing elastic distinguishability metrics for location privacy[END_REF], where contextual information about users' environments are used to calibrate the amount of noise applied on mobility data. Moreover, HeatMap Confusion (HMC) [START_REF] Maouche | [END_REF], which uses a combination of data perturbation and dummies generation, is an LPPM that is designed to counter particular type of attacks, i.e. re-identification attacks. In the latter, the entire mobility of a user is represented in the form of a heatmap. Each user heatmap is altered so that it looks similar to the one of another user. The heatmap is finally transformed back to a mobility trace using traces of multiple users.

Furthermore, Some authors found that the application of the same LPPM on a whole dataset is not fair regarding the location privacy of users. Some may be overprotected, in the sense that the data utility is decreased further than it is needed and others may remain unprotected [START_REF] Maouche | AP-Attack: A Novel User Re-identification Attack On Mobility Datasets[END_REF]. This is why, some works proposed a user-centric approach where each individual is protected according to his mobility trace, his characteristics and his preferences in term of privacy and utility. For example, SmartMask [START_REF] Li | Privacy leakage of location sharing in mobile social networks: Attacks and defense[END_REF] is an example designed to automatically learn users' privacy preferences under different contexts (e.g. location semantic, frequency of visits, duration of visiting a location, time period). Once the privacy level is determined, different techniques ranging from simple operations of obfuscation to cloaking strategies are used depending on the required privacy level. LP-guardian is also a user-centric solution [START_REF] Fawaz | Location Privacy Protection for Smartphone Users[END_REF] implemented on Android users' smartphones where a decision tree is used to choose the adequate action to perform against different threats. These works are closed to MooD but it was not possible to compare with them because they require richer datasets and not only timestamped mobility traces.

Finally, another possible direction is to play on the configuration of LPPMs in order to protect the users' mobility data. Thus, instead of considering an LPPM with the same configuration, the idea is to tailor the LPPM configuration for each user according to his behavior over the time. To this end, some authors exploited optimization algorithms to find the best configuration for a given LPPM which ensure the tradeoff between privacy and data utility objectives. For instance, ALP (Adaptive Location Privacy) [START_REF] Primault | Adaptive Location Privacy with ALP[END_REF] a framework which enables an automatic configuration of the LPPM parameters using simulated annealing. Also, PULP [START_REF] Cerf | PULP: Achieving Privacy and Utility Trade-Off in User Mobility Data[END_REF] is another system which automatically configures LPPMs according to users' objectives in term of privacy and utility. MooD is complementary to those configuration frameworks. In other words, instead of setting LPPMs with a default configuration of parameters, we can integrate one of those framework to provide a tailored configuration for each LPPM or Multi-LPPM according to each user in our system.

Conclusion

In this paper, we presented MooD a user-centric fine-grained protection system based on the composition of multiple LPPMs. Its main objective is to protect the minority of orphan users who are not protected by any single LPPM and thus reducing the data loss in a published dataset or in a crowdsensing campaign. The experiments conducted on four real mobility datasets show that the proposed system is resilient to multiple re-identification attacks and can achieve a high level of privacy protection while maintaining a high utility level.

However, as MooD is based on brute force search for multi-LPPM composition, it is a time-consuming approach. That is why we aim in our future work at optimizing the search by exploring new heuristics and advanced ML techniques.

Furthermore, MooD can be extended by using state-ofthe-art LPPMs, attacks and utility metrics. As future work, since the amount of mobility data is continuously growing, the training set of the re-identification attacks can be periodically updated, in order to better feed our system and have a dynamic protection that evolves with the possible evolutions of the user behaviour. Another open direction is to test more sophisticated techniques for the fine-grained data protection component. For instance, a mobility trace can be split by inter-POIs or according to time gaps in mobility traces.

Figure 2 .Figure 3 .

 23 Figure 2. Ratio of non-protected users with state-of-the-art LPPMs and Hybrid LPPM on four real datasets

Figure 4 .

 4 Figure 4. Fine Grained Protection

Figure 5 .

 5 Figure 5. MooD Architecture

1 :

 1 function Mood(T U ,A,L,C,M,δ )

Figure 6 .

 6 Figure 6. Resilience to one attack -MooD vs. competitors

Figure 7 .

 7 Figure 7. Resilience to multiple attacks -MooD vs. competitors

Figure 8 .

 8 Figure 8. Fine-grained protection with MooD

Figure 9 .

 9 Figure 9. Utility of data protected with MooD vs. Competitors

Figure 10 .

 10 Figure 10. of Data Loss MooD vs. Competitors.

Table 1 .

 1 Description of datasets

	Name	Cabspotting	Geolife	MDC	PrivaMov
	# users	531	41	141	41
	location	San Francisco	Beijing Geneva	Lyon
	# records	11 179 014 1 468 989 904 282	948 965

Acknowledgments

This work benefited from the support of the French National Research Agency (ANR), through the SIBIL-Lab project (ANR-17-LCV2-0014), and the PRIMaTE project (ANR-17-CE25-0017).


domain: spi phys math info

text:
Julie Gauvrit-Ledogar

Arnault Tremolet

Loic Brevault

Sébastien Defoort

Franck Morel

Multidisciplinary Overall Aircraft Design and Optimization of Blended Wing Body Configurations

come

Multidisciplinary Overall Aircraft Design and Optimization of Blended Wing Body Configurations

J. Gauvrit-Ledogar 1 , A. Tremolet 2 , L. Brevault 3 , S. Defoort 4 and F. Morel 5 Onera, The French Aerospace Lab, France

The Blended Wing Body (BWB) configuration seems to be one of the most promising concepts to replace the current passenger transport aircrafts with substantial improvement of their performances and reduction of the air transport environmental footprint.

The typical features of the BWB configuration is that each subsystem, as propulsion, control surfaces, pressurized cabin, etc. is integrated to a wing shaped body. Thus, the design of such geometry imposes to consider, at the same level of the overall aircraft design, several disciplines such as aerodynamics, structure, propulsion, handling qualities, etc. Therefore, the use of multidisciplinary approaches is crucial in order to take into account the complex couplings between disciplines involved in its design and optimization.

Onera has developed a Multidisciplinary Design Analysis and Optimization (MDAO) process dedicated to BWB configurations throughout the internal research project CICAV. The first phase of the CICAV project is dedicated to the definition of the specifications and requirements of the expected multidisciplinary design and optimization process. Then, the geometric parameterization for BWB configurations is fully defined with the goal of being able to describe several BWB internal arrangements and overall airframe geometries. This approach led to the exhaustive definition of the process with the identification of the required disciplinary modules (type of models, internal processes, local design loops , etc.) and their attached variables (inputs, outputs). Those elements allow identifying the process data flow and system couplings.

Based on these specifications and data flow definition, the multidisciplinary design and optimization process is implemented, with the integration of disciplinary modules specifically developed or adapted for the BWB purpose. The CICAV process is composed of the following disciplinary modules:

 Geometry: overall airframe definition and internal pressurized part sizing,  Propulsion: engines performances definition,  Structure: primary structure sizing and weight and balance computation,  Aerodynamics: aerodynamic characteristics assessment,  Mission: performances assessment with regard to the specified mission,  Handling Qualities: handling qualities assessment and control solutions definition.

In the first part of the paper, the multidisciplinary design process will be detailed in addition with a description about the implemented disciplinary modules .

In the second part of the paper, using this MDAO process, a BWB configuration is designed with long-haul commercial transport mission specifications. They are based on the A350-1000 which entered in service in February 2018. In order to determine the most influential design variables among all the BWB parameters, a sensitivity analysis on the objective function and the constraints is carried out enabling to set the MDO prob lem to be solved. An MDO process is performed on the BWB concept with regard to performance objective under constraints (minimal performances, structural sizing rules, compliance with airport infrastructures, etc.). The performance objective is expressed as the minimization of the fuel weight for achieving its mission .

The final paper will describe the MDO process and the results of the BWB baseline design that fulfils the long-haul commercial transport mission.


M Bertrand-Andrieu

E Plasari

P Baron

METHODS FOR THE CHARACTERIZATION AND COMPARISON OF MIXING EFFICIENCY OF DIFFERENT CONFINED OPPOSING JET MIXING DEVICES

Keywords: Mixing efficiency, T-tube, Y-tube, Hartridge-Roughton mixing device, Micromixing test, Neutralization test

Methods for the characterization and comparison of mixing efficiency of different confined opposing jet

mixing devices.

INTRODUCTION

Many chemical reactions are fast relative to mixing so that conversion occurs before the reagent homogenisation is achieved. In such cases, concentration gradients affect considerably the final product properties. For precipitation systems, the particle size distribution is well known to depend on the supersaturation levels governed by the mixing process [START_REF] Doss | Experimental study on the choice of contacting fluid devices for controlling the precipitate quality. Application to the precipitation of BaCO3[END_REF]. When liquids are very viscous (polymer production, ceramic, glassware and food processing), mixing may influence the selectivity and rate of chemical reactions and the molecular weight distribution. Therefore, when reaction and mixing proceed simultaneously and not consecutively, the way of contacting reagents appears to be a crucial parameter in the control of the final product quality. Thus, a particular attention should be paid to the choice of the mixing device and information about mixing characteristics is of considerable interest for the reactor design. That is why, the work reported here describes two methods to characterize and compare mixing efficiency of confined opposing jet mixing devices, which are commonly used to contact rapidly and continuously two fluid streams. These methods have been applied to three high-intensity mixers of the same family: T-shaped tube, Y-shaped tube with a 90° angle and Hartridge-Roughton mixing device [START_REF] Hartridge | A method of measuring the velocity of very rapid chemical reactions[END_REF][START_REF] Roughton | Rates and Mechanisms of Reactions[END_REF] in which the jets enter tangentially into a circular chamber. These mixing devices are presented in Figure 1. The objective of this document is to provided rapid and easy to implement experimental methods avoiding long studies. Many studies on mixing efficiency are available in the literature for some of these devices [START_REF] Gray | Turbulent Radial Mixing in Pipes[END_REF][START_REF] Forney | Design of Tee Mixers for Non-Reactive and Reactive Flows[END_REF][START_REF] Cozewith | Computer Simulation of Tee Mixers for Nonreactive and Reactive Flows[END_REF][START_REF] Forney | Optimum Jet Mixing in a Tubular Reactor[END_REF][START_REF] Tosun | A Study of Micromixing in Tee Mixers[END_REF][START_REF] Wei | Application of CFD Modelling to Precipitation Systems[END_REF][START_REF] Pan | Experimental study of turbulent mixing in a tee mixer using PIV and PLIF[END_REF]. However, tests being performed in different size and geometry and under different operating conditions, it is not possible to point out the most effective system. That is why, in order to respond to this question, we have studied the mixing intensity in respective tubes of the same dimension, only the geometry of the impinging fluid streams being different as shown in Figure 1.

MIXING EFFICIENCY CHARACTERIZATION

Macromixing involves turbulence which rapidly decreases the segregation scale down to the Kolmogoroff velocity microscale (λ k ), and then the molecular diffusion process achieves the complete homogenisation. Micromixing in the three devices studied (Figure 1) is investigated using two chemical methods. The first one consists in a micromixing test based on the competing reactions which keep in memory the mixing efficiency through the product distribution. On the contrary, the second method is based on an acid-base neutralization reaction where the mixing efficiency is characterized using the reaction volume measured by visualization. Experiments are carried out under the same operating conditions; the fluid velocity in the mixing tube varies from 8 to 20 m s -1 , with a Reynolds number of the order from 15,000 to 40,000.

Micromixing test reaction

Among the several chemical tests of micromixing characterization available in the literature, we select the well known "iodide-iodate" method developed by Villermaux and co-workers [START_REF] Guichardon | Experimental comparison of the iodide-iodate and the diazo coupling micromixing test reactions in stirred reactors[END_REF], due to its flexibility and its ease of processing [START_REF] Guichardon | Characterisation of micromixing efficiency by the iodide-iodate reaction system. Part I: experimental procedure[END_REF].

Iodide-iodate method

The "iodide-iodate" method is based on a system of two parallel-competing reactions. The first one is a "quasi-instantaneous" neutralization and the second one is the classical Dushman's oxydo-reduction reaction. The whole reaction system may be written as follows: The test consists in contacting a strong acid (sulphuric acid) with a iodide, iodate and borate ion mixture. For a perfect mixing, the injected acid reacts instantaneously with borate ions according to the neutralization reaction infinitely faster than reaction (2). On the contrary, in the presence of a local acid excess, iodine is formed and the I 3 -concentration, measured by spectrophotometric absorption, allows to quantify the segregation intensity through a segregation index X s . X s varies between 0 for a perfect micromixing state and 1 for a total segregation one:

H 2 BO 3 -+ H + H 3 BO 3 (1) 5I -+ IO3 -+ 6H + 3I 2 + 3H 2 O (2) I -+ I 2 I 3 - (3)
        + = - - + - + ,0 3 IO ,0 3 BO 2 H ,0 H 3 I 2 I S n 3 n 2 n n n X ( 4
)
where n i is the mole number and subscript 0 represents the initial conditions. The experimental procedure described by the authors relates to a batch stirred tank in which a small acid volume is slowly injected. As our experimental conditions require to operate with equal volumes in continuous mode, we adapt the method by using a low acid concentration. In these conditions, acid aggregates are flooded in the iodide, iodate and borate mixture and can be supposed independent from each other. According to Baldyga and Bourne [START_REF] Baldyga | Simplification of micromixing calculations. Part 1: derivation and application of new model[END_REF], for a Schmidt number lower than 4000, micromixing process is supposed to be controlled by the engulfment step. Our conditions leading to a Schmidt number of about 1000, the experimental results are interpreted using the Incorporation Model [START_REF] Villermaux | A generalized mixing model for initial contacting of reactive fluids[END_REF] where the acid aggregates are assumed to gradually grow by engulfment of surrounding fluid. Considering an exponential incorporation function, the experimental segregation indexes can be associated with the characteristic micromixing time constant t m .

Experimental

Experiments are carried out in a specific apparatus developed by the Commissariat à l'Energie Atomique and the Chemical Engineering Science Laboratory at Nancy [15]. The operating principle is schematically shown in Figure 2 and a photo is given in Figure 3.

Neutralization tests

The devices are made of glass, so mixing characteristics can be investigated using a neutralization reaction between hydrochloric acid and sodium hydroxide solution in the presence of bromotymol blue as indicator. The initial H + concentration C A0 is taken 5 % higher than the initial OH -concentration C B0 in order to accomplish the neutralization of hydroxide ions. The yellow color corresponds to the total neutralization, so to a total homogenization at molecular scale of reacting fluids, whereas the blue one indicates a local concentration inhomogeneity.

Theory

Using the Incorporation Model in the case of instantaneous reactions, a simple relationship can be obtained between the decolourization time "t dec " and the micromixing time constant t m . According to the model, the basic aggregates are assumed to gradually incorporate the surrounding acid fluid and to grow as an exponential time function:

V B = V B0 exp         m t t (5)
At decolourization time t dec , the acid mole number incorporated is equal to the base mole number initially present in the basic aggregates, so:

( ) A0 B0 B0 iA C C V V dec t = (6)
where V iA is the acid volume incorporated and t dec is the mixing time defined as follows: u L t dec dec = [START_REF] Forney | Optimum Jet Mixing in a Tubular Reactor[END_REF] u being the flow velocity in the tube and L dec corresponding to the length necessary for the neutralization (the blue length).

Consequently, at decolorization time, the basic aggregate volume has grown as:

V B (t dec ) = V B0 + V iA (t dec ) =         + A0 B0 B0 C C V 1 (8)
From ( 5) and ( 8), we obtain:

t m =         + A0 B0 dec C C n t 1 l (9)
Knowing that C B0 /C A0 ≈ 1, we obtain the following relation between the decolourization time and micromixing time constant: Reagents, containing initially blue bromothymol in order to prevent the decolourization from the dilution effect, are supplied by pumps with a 25 mL.s -1 flow rate.

The decolourization time can be easily calculated from visual observations by measuring the tube length coloured in blue.

RESULTS AND DISCUSSION

For the iodide-iodate method, experimental runs show that the micromixing time is estimated with a 15% error, whereas the neutralization tests lead to an error estimation of about 20 % due to the experimental appraisal of the decolorization length. Table 1 compares micromixing times obtained by both methods, iodide-iodate test and acid-base neutralization, in the case of a fluid velocity in the central tube of the order of 8 m.s -1 . The micromixing time constant values are very close and lead to the same mixer classification. The use of the iodide/iodate method being much more complicated than the acid-base neutralization, we recommend the second method in all cases when the experimental conditions of fluid mixing visualization are fulfilled. For the iodide-iodate test, the segregation index X S and the micromixing time constant t m are determined for different reagent flow rates. Figure 5 presents a logarithmic plot of micromixing time constant (in ms) against flow rate (in L.h -1 ). This figure clearly shows that the Y-tube mixer has the lowest mixing efficiency, while the Hartridge-Roughton mixing device is much more efficient than the two other mixers. In addition, its geometry is simple and the mixer can be easily produced. For these reasons, between the confined opposing jets mixing devices studied in our work, we recommend to use the Hartridge-Roughton mixing device.

In the case of both T-tube and Hartridge-Roughton device, the micromixing time constant decreases with the flowrate according to the formula:

t m = K' Q -1.55 ( 11
)
This result is in good agreement with the Incorporation Model where:

ε ν K t m = (12)
Knowing that, in a smooth tube, the energy dissipation rate is proportional to u 3 , the micromixing time varies as Q -3/2 . The same result is obtained by Johnson and Prud'homme [START_REF] Johnson | Chemical processing and micromixing in confined impinging jets[END_REF] who have studied micromixing in confined impinging jets. On the contrary, data obtained for the Y-shapped tube lead to a lower slope value equal to 1.1. This is probably due to the influence of the Y-tube entry on the fluid velocity distribution in the upper part of the central tube giving a law of the energy dissipation rate against velocity with an exponent lower than 3.

CONCLUSION

The iodide-iodate method, based on the competing reactions which keep in memory the mixing progress through the product distribution, and the decolourization method, based on the measurement of the reaction volume, lead to micromixing time constant values very close to each other and can successfully characterize the mixing efficiency of rapid mixing devices. Both methods described here make it possible to compare mixing efficiency of the T-tube, Ytube and Hartridge-Roughton mixing device and to propose a mixer classification. Nevertheless, the second method is much simpler for use (simple experimental investigation, very simple treatment of experimental data), so we recommend it in all cases when the experimental conditions of fluid mixing visualization are fulfilled. The three mixers studied are characterized by very low segregation indexes with micromixing time constants of few milliseconds. Nevertheless, a sensible difference in mixing efficiency exists between them. The highest mixing efficiency is obtained for Hartridge-Roughton geometry. In addition, its geometry is very simple to be realized and used. For these reasons, we recommend as the first choice the Hartridge-Roughton mixing device. flow velocity (m.s -1 ) V B : basic aggregate volume (m 3 ) V iA : acid volume incorporated (m 3 ) Xs : segregation index (-) ν : kinematic viscosity (m 2 .s -1 ) ε :

NOMENCLATURE

local energy dissipation rate (W.kg -1 )

Figure 1 :

 1 Figure 1: Schematic presentation of high-intensity confined opposing jet mixing devices: a) T-tube, b) Y-tube (90° angle) and c) Hartridge-Roughton mixing chamber.

Figure 2 :Figure 3 : 3 - 1 [H 3

 23313 Figure 2: Schematic diagram of the experimental set-up for iodide-iodate tests.

  ExperimentalExperiments are performed continuously in transparent mixers made of glass and connected to 100 L feeding tanks, as shown in Figure4[START_REF] Bénet | Experimental study of a two-impinging-jet mixing device for application in precipitation processes[END_REF].

Figure 4 :

 4 Figure 4: Experimental set-up for neutralization tests.Pumps

5 Figure 5 :

 55 Figure 5: Flow rate influence on the micromixing time -Iodide-iodate method.

C

  A : acid concentration (mol.m -3 ) C B : base concentration (mol.m -3 ) K : constant (-) L dec : decolourization length (m) n i : mole number of element I Q :flowrate (m 3 .s -1 ) t dec : decolourization time (s) t m : micromixing time constant (s) u :

Table 1 .

 1 Micromixing time constant t m (in ms) determined by two methods (fluid velocities in the central tube of the order of 8 m.s -1 ).

	Mixer type	Iodide/iodate method	Neutralization method
		X s x10 3	t m (ms)	t dec (ms)	t m (ms)
	T-tube	1.8 ± 0.2	3.3 ± 0.4	2.0 ± 0.4	3.0 ± 0.6
	Y-tube	2.4 ± 0.2	4.9 ± 0.7	2.9 ± 0.6	4.3 ± 0.8
	Hartridge-Roughton mixing device	0.9 ± 0.1	1.7 ± 0.2	0.8 ± 0.2	1.2 ± 0.2