Bertrand Beaufils
email: bertrand.beaufils@sysnav.fr

Frédéric Chazal
email: frederic.chazal@inria.fr

Marc Grelet
email: ‡marc.grelet@sysnav.fr

Bertrand Michel
email: §bertrand.michel@ec-nantes.fr

Bertrand Michel Robust

Robust pedestrian trajectory reconstruction from inertial sensor

In this paper, a strides detection algorithm combined with a technique inspired by Zero Velocity Update (ZUPT) is proposed using inertial sensors worn on the ankle. This innovative approach based on a sensors alignment and machine learning can detect both normal walking strides and atypical strides such as small steps, side steps and backward walking that existing methods struggle to detect. As a consequence, the trajectory reconstruction achieves better performances in daily life contexts for example, where a lot of these kinds of strides are performed in narrow areas such as in a house. It is also robust in critical situations, when for example the wearer is sitting and moving the ankle or bicycling, while most algorithms in the literature would wrongly detect strides and produce error in the trajectory reconstruction by generating movements.

Our algorithm is evaluated on more than 7800 strides from seven different subjects performing several activities. We validated the trajectory reconstruction during motion capture sessions by analyzing the stride length. Finally, we tested the algorithm in a challenging situation by plotting the computed trajectory on the building map of an 5 hours and 30 minutes office worker recording.

Robust pedestrian trajectory reconstruction from inertial sensor

Bertrand Beaufils * , Frédéric Chazal † , Marc Grelet ‡ and Bertrand Michel §

I. INTRODUCTION

The emergence of Global Navigation Satellite System (GNSS) receivers in the 2000s has changed the perception of navigation. While they are commonly used in outdoor environments they fail to produce accurate localization due to poor reception in many situations, for example in tunnels, indoor parking, in the forest, inside buildings etc. Instead, bodymounted inertial measurement units (IMUs) can be used to record the movements of pedestrians, providing an estimate of their motion relative to a known origin. Unlike infrastructuredependent localization systems such as map matching, Wi-Fi [START_REF] Chen | Signal strength based indoor geolocation[END_REF], Radio Frequency Identification [START_REF] Renaudin | Uwb and mems based indoor navigation[END_REF] or ultra-wideband [START_REF]Hybrid localization using uwb and inertial sensors[END_REF], body-mounted IMUs are lightweight and can be rapidly and easily deployed.

In this context, Sysnav has developed WATA systems (Wearable Ankle Trajectory Analyzer) based on magneto-inertial sensors [START_REF] Dorveaux | Magneto-inertial navigation: principles and application to an indoor pedometer[END_REF], [START_REF] Chesneau | Motion estimation of a rigid body with an ekf using magneto-inertial measurements[END_REF], to enable trajectory reconstruction. Here we consider an ankle worn device for dead reckoning. The strategy which consists in the integration of the linear acceleration and angular velocity data from the unit may rapidly cumulate large errors due to IMUs drifts. To overcome this issue, we use a technique inspired by Zero Velocity Update (ZUPT) [START_REF] Abdulrahim | Understanding the performance of zero velocity updates in mems-based pedestrian navigation[END_REF]- [START_REF] Bamberg | Gait analysis using a shoe-integrated wireless sensor system[END_REF], which is an effective method to limit the accumulation of errors. It consists in correcting the speed drift by estimating the speed of the ankle when the foot is on the ground during the walk and then integrates the data only between two ZUPTs. Several studies [START_REF] Susi | Motion mode recognition and step detection algorithms for mobile phone users[END_REF], [START_REF] Florentino-Liano | Human activity recognition using inertial sensors with invariance to sensor orientation[END_REF], propose to detect pedestrian movements and classify activities (such as walking, stairs climbing, running...) from inertial data. These approaches do not work well outside a controlled environment [START_REF] Ghose | Human activity recognition from smart-phone sensor data using a multi-class ensemble learning in home monitoring[END_REF]. Moreover these methods based on sliding windows do not allow to detect individual strides. A few methods of stance detection have been proposed in the literature by tuning thresholds to determine the start and the end of the strides [START_REF] Castaneda | An improved shoe-mounted inertial navigation system[END_REF]- [START_REF] Norrdine | Step detection for zuptaided inertial pedestrian navigation system using foot-mounted permanent magnet[END_REF]. Sysnav first developed a similar approach based on the swing detection and a combination of criteria on the inertial data to determine the ZUPT instant (accelerations close to one g and small values of the angular velocity). These methods show good results for classical gait but they tend to fail for atypical strides such as stairs and small steps. In order to give an illustration of these limits, we ask a wearer to climb the stairs and get in a small corridor where he performs small steps before going back. We plot in Figure 1 the computed trajectory by the Sysnav algorithm. It illustrates that during the atypical strides in the corridor, no stride is detected as the trajectory stays on the same point for dozens of seconds. In the end, the error is about two meters.

Other approaches use machine learning techniques on the frequency characteristics of the signals [START_REF] Moder | Smartphone-based indoor positioning utilizing motion recognitiont[END_REF], [START_REF] Cho | Mems based pedestrian navigation system[END_REF]. These methods show good results when it is known that the pedestrian is walking but fail in a lot of real life situations. Indeed, several foot movements in sitting position and bicycling for example are wrongly detected as strides.

In this work we describe our step detector which is based on a innovative technique to compute a sensors alignment for inertial data that enables a extraction of intervals that may correspond to strides. The selection among them is performed by a classifier built with the Gradient Boosting Tree algorithm. The same approach can also be applied to recognize the activity of the performed step. Activity recognition can be a valuable information in many situations, for example in medical context, but we focus here on trajectory reconstruction.

II. TERRESTRIAL REFERENCE FRAME COMPUTATION

The system should be worn at the ankle as illustrated in Figure 2. In this default placement, the sensors record the inertial data in the reference frame defined by the Z axis aligned with the leg and the X axis aligned with the foot. However we observed that the device may be worn upside down and may turn around the ankle during the recording. The machine learning approach in this algorithm requires the 3-D inertial data to be in the same reference frame definition. In a previous work [START_REF] Beaufils | Stride detection for pedestrian trajectory reconstruction: a machine learning approach based on geometric patterns[END_REF] we described a method that aligns the sensors based on geometric patterns of the angular velocity data. In this paper we present a more robust technique that has the particularity of removing the gravity from the acceleration data and compute a terrestrial reference frame. Indeed, the accelerometer in the device records the linear acceleration (Γ) that is equal to the gravity added to the acceleration of the WATA system (Γ Ankle ). The main idea lies in the fact that in an inertial reference frame, the integration of Γ Ankle is equal to the difference of the ankle speed (a few meters per second for a pedestrian) that is small compared to the integration of the gravity. At any time t in [0, t f inal ], the device records the acceleration and angular velocity data (respectively Γ Bt (t) and Ω Bt (t) in R 3 ) in the body reference frame of the system B t . With a no integration error of the angular velocity, R t solution of Equation 1 the following would be the rotation matrix between B t and B 0 .

dRt dt = -Rt Skew(Ω B t (t)), (1)
with R 0 = I 3 and the Skew operator defined for all vector n in R 3 , n = (n x , n y , n z ) T :

Skew(n) =   0 -nz ny nz 0 -nx -ny nx 0   .
In practice, due to gyrometer imperfections (bias, non linearities, noise...), the product of the computed rotation matrix R t and B t only approximates B 0 . We note Bt 0 the resulting reference frame. We can now express for all t the inertial data in the reference frame Bt 0 as follows:

Γ Bt 0 (t) = Rt Γ B t (t), Ω Bt 0 (t) = Rt Ω B t (t). (2)
Let Γ Ankle Bt (t) be the acceleration of the WATA system without the gravity g Bt : Γ Bt (t) = Γ Ankle Bt (t) + g Bt . Then the mean of the recorded acceleration projected in Bt 0 , on an interval ∆T , is given by:

1 ∆T t+∆T t Γ Bu 0 (u)du = 1 ∆T t+∆T t (Γ Ankle Bu 0 (u) + g Bu 0 )du.
We assume that for a ∆T small enough, the reference frame Bu 0 is constant for all u in [t, t + ∆T ]: ∀u ∈ [t, t + ∆T ], Bu 0 = Bt 0 . Namely, we consider that during a small period, the integration of the angular velocity produces no error. As a result, g Bu 0 is a constant g Bt 0 on this interval, we have:

1 ∆T t+∆T t Γ Bu 0 (u)du = 1 ∆T t+∆T t Γ Bt 0 (u)du = 1 ∆T t+∆T t (Γ Ankle Bt 0 (u) + g Bt 0 )du = 1 ∆T t+∆T t Γ Ankle Bt 0 (u)du + g Bt 0 .
Let V Ankle Bt 0 (u) be the speed of the ankle in the reference frame Bt 0 for all u in [t, t + ∆T ]. From the equation above we can write:

1 ∆T t+∆T t Γ Bt 0 (u)du = V Ankle Bt 0 (t + ∆T ) -V Ankle Bt 0 (t) ∆T + g B 0 .
For a sufficiently long duration of integration ∆T , we assume that the speed difference of the ankle, between t + ∆T and t, divided by ∆T is small compared to the gravity:

V Ankle Bt 0 (t + ∆T ) -V Ankle Bt 0 (t) ∆T g Bt 0 . (3)
Thus, we can deduce the following equation:

1 ∆T t+∆T t Γ Bu 0 (u)du ≈ g Bt 0 . ( 4
)
The assumption in Equation 3 is valid for large ∆T value. However, this approach requires to compute the mean of the acceleration in an inertial reference frame. Due to the integration drift with time, if ∆T is too large we have no guarantee that Bu 0 equals Bt 0 for all u in [t + ∆T ]. In practice, we found a compromise by setting ∆T = 15s.

Thanks to Equation 4 we can identify the gravity in the body reference frame at t = 0: g B0 0 = g B0 . If the angular velocity integration did not produce any error, for all t > 0 g Bt 0 would be equals to g B0 . In practice we observe that g Bt 0 changes with time. This variation is due to the integration drift. For all t > 0 we can correct it by computing the rotation matrix R g t that aligns g Bt 0 over time. We introduce the vector a as follows:

a = lim dt→0 g Bt 0 /||g Bt 0 || × g Bt+dt 0 /||g Bt+dt 0 || dt .
Then the rotation matrix R g t is the solution of the following equation:

dR g t dt = -R g t Skew(a) (5)
Then we can project the inertial data in the initial body reference frame for all t > 0:

Γ B 0 (t) = R g t Γ Bt 0 (t) = R g t Rt Γ B t (t), Ω B 0 (t) = R g t Ω Bt 0 (t) = R g t Rt Ω B t (t). (6)
We now define a terrestrial reference frame B terr by considering the vector -

g B 0
||g B 0 || as the new Z terr axis and choosing arbitrarily X terr and Y terr axes in order to build an orthonormal basis. We note R terr the rotation matrix between B terr and B 0 . The inertial data projected in the terrestrial reference frame are given by the following for all t:

Γ B terr (t) = R terr Γ B 0 (t), Ω B terr (t) = R terr Ω B 0 (t). (7)
We have now access to the acceleration of the ankle for all t by removing the gravity (≈ 9, 81m/s) from the Z terr axis:

Γ Ankle B terr (t) = Γ B terr (t) -   0 0 9, 81   . (8)
The advantage of the attitude filter is the efficiency of its computation. This characteristic is necessary as we use Γ Ankle B terr to compute a pseudo-speed that is one of the main features in our step detector. Indeed, due to the complexity of our application framework, it is difficult to describe a stride detector with only inertial models. In Section III, the computation of a pseudo-speed is introduced. It allows to extract a family of candidate intervals that may correspond to strides.

III. PSEUDO-SPEED COMPUTATION

A. Integration of the ankle acceleration

In previous Section II, we described the projection of the inertial data recorded by the device into a terrestrial reference frame B terr . In this procedure, the gravity is removed from the acceleration that can be integrated to compute the pseudospeed of the ankle during the recording with an unknown initial condition. The first step of our algorithm is to detect phases of inactivity where we assume the ankle velocity as null. Let {(t 0 1 , t 1 1 ), . . . , (t 0 i , t 1 i ), . . . , (t 0 n , t 1 n )} the n detected couples of inactivity instants with the ankle in motion in between. We can integrate Γ Ankle B terr between t 0 i and t 1 i chronologically and in the reverse time direction to compute what we call respectively forward speed (V f or ) and backward speed (V back ). We introduce here their general expression between two instants a and b with a < b:

       V f or a,b (t) = t-a 0 Γ Ankle B terr (a + u)du + V f or a,b (a), V back a,b (t) = b-t 0 Γ Ankle B terr (b -u)du + V back a,b (b). (9)
In particular, the instants t 0 i and t 1 i are defined as moments where the ankle is motionless so we assume V f or i

(t 0 i ) = 0 and V back i (t 1 i ) = 0.
As a result we have:

         V f or t 0 i ,t 1 i (t) = t-t 0 i 0 Γ Ankle B terr (t 0 i + u)du, V back t 0 i ,t 1 i (t) = t 1 i -t 0 Γ Ankle B terr (t 1 i -u)du. (10)
Since the integration drift cumulates errors with time, we make the assumption that for all t in [a, b], the more t is close to b the more V f a,b produces errors and on the opposite the more t is close to a the more V b a,b produces errors. That is why we compute the pseudo-speed V a,b as weighted mean between a and b:

V a,b (t) = V f or a,b (t) b -t b -a + V back a,b (t) t -a b -a . ( 11
)
We note t 0 the first index of inactivity detected and t n+1 the last one. For all t < t 0 we can only compute the backward speed as we do not know the inital condition for t = 0:

V b 0,t 0 (t) = t 0 -t 0 Γ Ankle B terr (t 0 -u)du. ( 12
)
On the contrary for all t > t n+1 we can only compute the forward speed between t n+1 and t f inal because we do not have any information on the speed of the ankle at the end of the recording:

V f tn+1,t f inal (t) = t-tn+1 0 Γ Ankle B terr (t n+1 + u)du. (13)
We can now define the pseudo-speed V during all the recording, namely for all t in [0, t f inal ]:

V (t) =              V back 0,t 0 (t) if t < t 0 , V t 0 i ,t 1 i (t) if t 0 i < t < t 1 i , ∀i ∈ 1, n , V f or t n+1 ,t f inal (t) if t n+1 < t, 0 otherwise. (14)

B. Pseudo-speed visualization

A group of people of various ages and heights, have practiced several activities (walking, running, stairs, side steps, small steps...) wearing the WATA system with infrared markers during motion capture (MOCAP) sessions under video control. The cameras record the position of the device with high precision in a terrestrial reference frame defined at the beginning of the motion trial. Regarding the minimum of altitude and the video, we can detect when the foot is on the ground in the recording. Figure 3 illustrates a pattern in the inertial data that can be used to detect the beginning and the end of the strides during a walking phase. The contact of the foot with the ground is visible with a peak in the acceleration and a combination of conditions on the acceleration (one direction is close to one g, the two others are close to zero) and angular velocity (local minima, swing phase identification etc.) seems indeed to be sufficient criteria and presented good results in [START_REF] Beaufils | Stride detection for pedestrian trajectory reconstruction: a machine learning approach based on geometric patterns[END_REF]. Nevertheless this method has shown its limits in situations of atypical movements such as fast sides stepping and rapid descent of stairs. Figure 4 exhibits the problem as it is hard to detect when a stride occurs from the inertial data. On the contrary we can see in both Figure 3 and Figure 4 that the norm of V (Equation 14) is a good feature to solve this issue. The beginning and the end of a stride are defined by local minima around a maximum. However by following this procedure based on V norm criteria, many intervals are wrongly extracted when the wearer is moving its ankle but not walking. The goal is now to select among these intervals which ones are true strides. We adopt a statistical learning approach to answer this problem.

IV. ALGORITHM

A. Preprocessing and database

The first step of the algorithm is to project the inertial data in the terrestrial frame presented in Section II. Then we compute the pseudo-speed V described in Section III and defined in Equation 14. We saw in previous Section III that a combination of criteria on the norm of the computed speed allows to detect the start and the end of the stride. We set wide threshold values in order to detect all types of strides (small steps, running, stairs etc.). However many intervals are wrongly selected when the wearer is moving its ankle during daily activities other than walking (bicycling, sitting in a car etc.) and when the WATA system is manipulated before being worn on the ankle. Indeed, the sensors start recording when the device is taken from its case and it can be carried with movement (in a backpack or pocket etc.) during an unknown amount of time. The goal is now to keep among these intervals those that are true strides. To answer this problem, we adopt a statistical learning approach.

From the intervals extraction above, a learning set is built from recordings of a group of people of various ages and heights practicing several activities. A binary label is affected to each interval indicating if it is a stride or not. Our database contains about 5000 positive intervals and also about 5000 negative intervals. In this binary classification problem, we adopt a strategy of supervised machine learning algorithm.

B. Features engineering process

For all recordings, the inertial data and pseudo-speed are projected in the terrestrial frame B terr whose the Z terr axis is aligned with the gravity and the two other axes (X terr and Y terr ) axes are set arbitrarily (Section II). To be robust to this orientation that is dependent to each recording, in the following we compute a new rotation matrix around the Z terr axis for all selected intervals.

Let the variable j in 1, N denotes the index of each interval. These intervals are defined by one start and end that we note start j and end j . We assume that during the beginning and the end of a stride, when the foot is flat on the floor, the ankle is in pure rotation. This mechanics is described in [START_REF] Abu-Faraj | Human gait and clinical movement analysis[END_REF] and is illustrated in Figure 5. From this observation, if the Fig. 5: The three foot rockers during stance phase.

jth interval is a true stride we assume that the ankle speed at start j and end j is given by a lever arm:

               V (start j ) = Ω B terr (start j ) ×   0 0 r   , V (end j ) = Ω B terr (end j ) ×   0 0 r   , (15)
with r the height relative to the ground of the device. In practice we set the value of r at 8 cm. From Equation 9we can compute the forward speed (V f or startj ,endj ) and the backward speed (V back startj ,endj ). If the interval j is a stride, these two speeds are close because we integrate the acceleration during a short period so that the drift stays small. In practice, start j and end j do not necessarily correspond to the ankle rocker. In addition, taking r equals 8 cm is not realistic for all recordings. That is why we observe differences in the residuals |V f or startj ,endj (t) -V back startj ,endj (t)| for t in [start j , end j ]. However, it can be much larger for movements that are not strides as Equation 15do not stand.

Then, thanks to Equation 11, we compute V startj ,endj (t) on the studied interval. By integrating this pseudo-speed, we compute a pseudo-trajectory in the terrestrial reference frame B terr , starting from the origin (0, 0, 0) and ending in (x endj , y endj , z endj ) T :

  x end j y end j z end j   = end j start j V start j ,end j (u)du. ( 16
)
We consider a new terrestrial reference frame B terr j with the Z terr j axis still aligned with the gravity but with X terr j defined by (x end j ,y end j ,z end j ) T ||(x end j ,y end j ,z end j ) T || . We note R terr j the rotation matrix that projects the data from B terr to B terr j . For one stride interval j, we plot the trajectories in B terr and B terr j (Figure 6). As we align the end of the trajectory with the X terr

C. Gradient Boosting Tree algorithm

Following the strategy above, for each element of our database, 1657 features are computed. We want to build a binary classifier that decides if one interval is a stride. Several supervised statistical learning algorithms have been tested, notably random forests which are known to perform well in large dimensions, Support Vector Machine (SVM), LASSO regression and boosting algorithms such as Adaboost and GBT (Gradient Boosting Tree [START_REF] Friedman | Computational statistics and data analysis[END_REF]). We evaluated their performance using the cross-validation method (10-fold cross-validation [START_REF] Stone | Cross-validatory choice and assessment of statistical predictions[END_REF]). The chosen algorithm with the best results is GBT.

The general idea is to compute a series of (very weak) decision trees [START_REF] Breiman | Classification and regression tree[END_REF], learning at each step the prediction error of the previous aggregation. Let {(X 1 , Y 1 ), . . . , (X q , Y q ), . . . (X N , Y N )} the elements of our database. As we computed 1657 features we have X q in R 1657 . We note Y q the binary label of the interval (Y q ∈ {0, 1}). We introduce X = (X 1 , . . . , X N ) and Y = (Y 1 , . . . , Y N ) for describing the GBT algorithm in the following.

pred k (X) = pred k-1 (X) + c f k (X) 5 end
The parameters c and K have to be tuned to avoid the overfitting. They have been set by cross-validation. Pseudo-speed update: 11) The step 13 of the Algorithm 2 is important to counter the integration drift if the ankle movement period [t 0 i , t 1 i ] is large. In that case, the weighted mean of forward speed and backward speed (Equations 10 and 11) may not overtake the integration errors for t far from t 0 i and t 1 i . With the pseudospeed update if strides are detected, the weighted mean is computed for smaller and smaller interval and overcomes the integration drift.

D. Overview

V (t) = V end j ,t 1 i (t), ∀t ∈ [end j , t 1 i ] (Equation

V. APPLICATIONS

The following section describes the performance of the stride detection and experimental results demonstrating the accuracy of the position estimation using the Algorithm 2.

A. Stride detector performance 1) Performance on the database: The database contains 5779 intervals that do not correspond to strides (label 0) and 4870 stride intervals divided into different activities: "atypical step" that includes small step, side step, backward walking etc., walking, running, climbing and descending stairs. The label 0 intervals come from ankle movement that are not strides during bicycling for example and situations when the device is manipulated in the hand, carried in a pocket or backpack before being worn on the ankle. The cross-validation results using GBT are presented in the following confusion matrix (Table I). The mean error is less than 0.3%. This score depends on the difficulty of the database. A lot of atypical strides and ankles movements (labelled -1) that look like true stride from inertial data point of view have been included in the database. As a result, the final score is slightly deteriorated but it leads to more robust classifier.

2) Performance in MOCAP sessions: That is why we also tested our algorithm on 7 MOCAP sessions. The stride intervals detected are manually validated with the video and the MOCAP altitude. The foot has to be on the ground to accept the detection. We ask the wearers to walk at three different paces, small steps and side steps (both sides). In order to observe left and right turns and straight lines, the wearers had to follow a loop path in both directions and an eight-shape reference trajectory. The results are presented in Table II Our algorithm achieves similar performances than existing methods ( [START_REF] Ho | Step-detection and adaptive step-length estimation for pedestrian dead-reckoning at various walking speeds using a smartphone[END_REF], [START_REF] Hannink | Stride length estimation with deep learning[END_REF]) for normal walking but also good performances for atypical strides (around 5 cm of absolute mean error) that are not even studied in the literature.

2) Performance in non controlled environment: In the following we validate the trajectory reconstruction in an everyday life situation. For this test an office worker has worn the system during 5 hours and 30 minutes. The aim is to test the step detector algorithm on strides performed naturally, including small steps. During those 5 hours and 30 minutes, the person was mostly sitting on his office chair. These periods are also interesting because the ankle does not remain inactive and it is important that no stride is wrongly detected. The recording contains 3 walking periods including up and down stairs in the first and last one.

The computed altitude of the first walking period is represented in Figure 8. From this graph we can detect when Fig. 8: Computed altitude during the first walking period.

the wearer is walking in the stairs. We plot in Figure 9 the computed trajectory in two dimensions on the plans of the ground floor and first floor depending on this altitude evolution. We add markers that indicate the beginning/end of the detected stairs from Figure 8 above. The colormap defines the time over the considered walking period: the more the greyscale is dark the more time has elapsed. In addition, the starting point is initialized with the coordinates (0, 0, 0) and the computed trajectory has been rotated to have the correct initial direction. During the second walking period, the wearer stays on the first floor. We plot in two dimensions the computed trajectory on the corresponding plan in Figure 10. experiment illustrates the good performance of the trajectory reconstruction in a difficult environment with narrow ways, small rooms and corridors. In this context, the computed trajectory almost never crosses the walls and we can identify in what room the wearer is at any time or when he is taking the stairs. Figure 8 and Figure 11 indicate a difference in the computed altitude of 3.4 meters for both stairs phases that are composed of 21 stair-treads of 15.4 cm height. The true altitude of the first ground is 3.234 meters so the altitude mean error is less than 1 cm for each stair-tread. In addition, the starting point of the second and third walking period correspond to the ending point of the previous one. It means that no stride is wrongly detected when the wearer is on his chair and moving his ankle.

VI. CONCLUSION

This paper describes an algorithm that compute the trajectory of a pedestrian wearing an ankle worn inertial device. This work is divided in four main steps:

• The projection of the inertial data in a terrestrial reference frame by detecting the gravity in the accelerations. • The extraction of candidate intervals based on the computed pseudo-speed that may correspond to strides. • The binary classification of the intervals using the Gradient Boosting Tree algorithm.

• The computation of an inspired ZUPT technique for the detected stride. For normal walking it shows good results achievable with existing algorithms with 100% stride detection rate and around 3 cm of absolute mean error for the stride length. In addition, the method described in this paper also has a good sensitivity for atypical strides such as small steps, side steps contrary to most algorithms proposed in the literature. It achieves more than 98% detection rate and the absolute mean error of the stride length is about 5 cm.

Moreover existing approaches are likely to produce detection error when the system wearer is moving his ankle but not walking (e.g. sitting). This is a problem as non walking motion would be integrated erroneously in the trajectory. Our algorithm handles those situations without false detection. A challenging test have been performed by recording an office worker during 5 hours and 30 minutes. The building presented narrow areas and stairs forcing the wearer to perform atypical steps. He stayed also for several hours sitting on his chair keeping his ankle moving. In this context, the computed trajectory illustrates the good performance by barely never crossing the walls of the building map and no stride is wrongly detected as false positive.

Fig. 1 :

 1 Fig. 1: Computed trajectory with a strides detection based on inertial thresholds.

Fig. 2 :

 2 Fig. 2: Default device placement.

Fig. 3 :

 3 Fig. 3: Pseudo-speed norm during walking.

Fig. 4 :

 4 Fig. 4: Pseudo-speed norm during fast side stepping.

Fig. 6 :

 6 Fig. 6: Example of a computed pseudo-trajectory in B terr and B terr j . B terr jare not the same for all j and for all recordings but they have the same building specifications. The 3-D interval data we have access to (trajectory, pseudo-speeds, residuals, acceleration and angular velocity) in B terr j are independent to the initial position of the sensors. By proceeding this way We reduced drastically the complexity of the supervised learning problem. We compute features from signal processing techniques in time and frequency domains such as the mean, standard deviation, interquartile range, Fast Fourier Transform etc.

Algorithm 1 : 3 Fit

 13 GBT algorithmInput : Initial prediction: pred 0 (X) ∈ R (N ×1657) Learning rate constant : c ∈ R Number of iterations : K ∈ N Output: Prediction function 1 for k = 1, . . . , K do 2 Compute the error: error k (X) = Y -pred k-1 (X) the weak decision tree f k on (X, error k (X)) 4 Udapte the prediction:

Algorithm 2 : 5 Extraction of candidate stride intervals 6 foreach interval j do 7 8 Features computation 9 GBT binary classification for stride detection 10 if

 25678910 Algorithm of the trajectory reconstructionInput : Recording of the system worn at the ankle Output: Trajectory of the system 1 Projection of the inertial data in a terrestrial reference frame (Section II) 2 Detection of inactivity {(t 0 1 , t 1 1 ), . . . , (t 0 i , t 1 i ), . . . , (t 0 n , t 1 n )} 3 Pseudo-speed computation (Section III) 4 foreach ankle movement period i do Data alignment (Section IV-B) interval classified as a stride then 11 ZUPT on the start and the end of the interval 12 Data integration between the two ZUPTs

13

 13

Fig. 9 :

 9 Fig. 9: Computed trajectory during the first walking period on the ground floor (left) and first floor (right).

Fig. 10 :

 10 Fig. 10: Computed trajectory during the second walking period on the ground floor. The computed altitude of the third walking period is represented in Figure 11. Using the same first walking period

Fig. 11 :Fig. 12 :

 1112 Fig. 11: Computed altitude during the third walking period.

TABLE I :

 I Confusion matrix of GBT algorithm.

  and III.

		Slow walking	Medium walking	Fast walking
		Total Detected	Total Detected	Total Detected
	Wearer 1 291 291 -100% 279 279 -100% 216 216 -100%
	Wearer 2 306 306 -100% 261 261 -100% 195 195 -100%
	Wearer 3 294 294 -100% 219 219 -100% 198 198 -100%
	Wearer 4 297 297 -100% 267 267 -100% 228 228 -100%
	Wearer 5 273 273 -100% 249 249 -100% 213 213 -100%
	Wearer 6 345 345 -100% 339 339 -100% 327 327 -100%
	Wearer 7 342 342 -100% 246 246 -100% 240 240 -100%
	Total	2148 2148 -100% 1860 1860 -100% 1617 1617 -100%

TABLE II :

 II Detection rate for walking phases.All walking strides are detected. We can see on Figure7that the MOCAP database present diversified stride lengths and stride durations. It means our detection achieves 100% accuracy for walking phases with various paces. Some of the Fig.7: Stride lengths as a function of stride durations.walking strides may appear very small but it is due to half turns of the MOCAP sessions. The foot comes in the end very close to the starting point of the stride.

		Small steps	Side steps
		Total Detected	Total	Detected
	Wearer 1 88 88 -100% 287 285 -99.3%
	Wearer 2 67 67 -100% 265 258 -97.4%
	Wearer 3 107 102 -95.3% 143 138 -96.5%
	Wearer 4 145 144 -99.3% 301 301 -100%
	Wearer 5 65 62 -92.3% 246 244 -99.2%
	Wearer 6 90 89 -98.9% 150 149 -99.3%
	Wearer 7 48 44 -91.7% 200 199 -99.5%
	Total	610 596 -97.7% 1592 1574 -98.9%

TABLE III :

 III Detection rate for atypical strides. We first study the trajectory reconstruction performance by comparing the stride length computed by our algorithm to the MOCAP reference during sessions introduced in Section III-B. The results are presented in Tables IV and V.

	Our algorithm does not detect all atypical strides but shows
	good results while most existing methods described in the
	literature do not detect them.
	B. Trajectory reconstruction performance
	1) Performance in MOCAP sessions: Slow walking Medium walking	Fast walking
		Mean (m) Std (m) Mean (m) Std (m) Mean (m) Std (m)
	Wearer 1	0.024	0.038	0.020	0.022	0.029	0.036
	Wearer 2	0.026	0.039	0.016	0.018	0.025	0.034
	Wearer 3	0.023	0.021	0.028	0.024	0.036	0.023
	Wearer 4	0.028	0.020	0.028	0.021	0.023	0.022
	Wearer 5	0.061	0.091	0.025	0.020	0.032	0.029
	Wearer 6	0.018	0.016	0.024	0.024	0.043	0.039
	Wearer 7	0.014	0.026	0.014	0.012	0.023	0.044
	Total	0.028	0.048	0.022	0.021	0.032	0.034

TABLE IV :

 IV Absolute computed stride length error for walking phases.

		Small steps	Side steps
		Mean (m) Std (m) Mean (m) Std (m)
	Wearer 1	0.027	0.070	0.044	0.106
	Wearer 2	0.039	0.048	0.071	0.168
	Wearer 3	0.057	0.082	0.070	0.177
	Wearer 4	0.025	0.024	0.048	0.056
	Wearer 5	0.049	0.082	0.022	0.046
	Wearer 6	0.074	0.061	0.133	0.170
	Wearer 7	0.039	0.055	0.053	0.116
	Total	0.048	0.069	0.056	0.129

TABLE V :

 V Absolute computed stride length error for atypical strides.

ACKNOWLEDGMENT

This work was supported by the French Délégation Générale de l'Armement (DGA) and by ANR project TopData ANR-17-MALN-0003.


Ruben De Smet

Ann Dooms
email: ann.dooms@vub.be

An Braeken
email: an.braeken@vub.be

Jo Pierson
email: jo.pierson@vub.be

Glycos: the basis for a peer-to-peer, private online social network

Keywords: online social network, peer-to-peer, privacy by design, privacy

Typical Web 2.0 applications are built on abstractions, allowing developers to rapidly and securely develop new features. For decentralised applications, these abstractions are often poor or non-existent. By proposing a set of abstract but generic building blocks for the development of peer-to-peer (decentralised), private online social networks, we aim to ease the development of user-facing applications. Additionally, an abstract programming system decouples the application from the data model, allowing to alter the front-end independently from the back-end. The proposed proof-of-concept protocol is based on existing cryptographic building blocks, and its viability is assessed in terms of performance.

Introduction

Privacy on online social media comes in two forms. Platforms generally give plenty of privacy control to platform users, in form of social privacy: users can control which friends can access what content. Recently, the Cambridge Analytica scandal [START_REF] Graham-Harrison | Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach[END_REF] proved again the lack of institutional privacy: while users can choose with whom of their social connections they share data, the host or institute that takes care of the platform usually has unlimited access to personal data. Privacy enhancing tools (PETs) are developed to counter several privacy issues by technological means.

One category of PETs are privacy-preserving databases, where the database of a service itself takes a responsibility on the data it exchanges. This often relates to P3P, which is a web standard that encodes a service's privacy practices in a machine readable way [START_REF]W3C Recommendation. W3C[END_REF]. An overview of privacy-preserving databases is given in Section 3.1.

Another often encountered paradigm in these PETs is moving data away from a central host or institution: decentralisation of services is believed to enhance institutional privacy for its end-users, since the institution itself is taken out of the picture. Several efforts have been made, both academical and community projects, to "re-decentralise" the internet, or parts thereof. In Section 3, we enumerate some notable projects that attempt to decentralise online social media.

We argue that at least one problem in this "re-decentralisation" is the lack of abstractions for developers. Where in typical centralised systems developers have tools like SQL (often in combination with object relational mapping (ORM)), or cookies (often as part of an authentication system), decentralised systems are often built "from scratch", drafting protocols (or extensions thereof) on a per-feature basis.

As an additional consequence, the coupling of the front-end application and the back-end decentralised networking components make it difficult to migrate data, or to fix a security issue in the back-end in a consistent, forward-compatible way.

In Section 4 we propose a proof-of-concept protocol for authenticated, confidential data exchange in a peer-to-peer network. This protocol should allow a participant to share with their friends, and stay anonymous for the rest of the network; it offers a form of cryptographically mandatory access control on the data. Since it is based on a peer-to-peer overlay network and therefore has no central processing infrastructure, the system should be lightweight enough to run on constrained devices like smartphones. We evaluate the performance characteristics in Section 5.

Problem statement

Many protocols on the internet are federated; examples including email or XMPP. In case of email, Mailchimp (a large email marketing company) notes in 2015 that more than 70 % of their email targets Google's gmail.com domain. Their statistics exclude the "foreign" domains hosted on Google's and Microsoft's mail servers, which suggests an even larger market share [START_REF] Khan | Major Email Provider Trends in 2015: Gmail's Lead Increases[END_REF]. Other online resources suggest that both Microsoft and GMail are by far the world most popular email service providers [START_REF] Lewkowicz | Here's What We Learned After Tracking 17 Billion Email Opens[END_REF][START_REF] Datanyze | Email Hosting Market Share Report[END_REF]. This illustrates that federated networks may still lead to centralisation, defeating the decentralisation and privacy-related benefits1 [START_REF] Jamie | On Emergent Centralization[END_REF].

The case of email illustrates another drawback of federated systems: the user has to pick a provider. A quick survey on Google, Bing and DuckDuckGo results in mail.com and gmail.com as top two results, with Microsoft's live.com usually third for the keywords "create email account".

Another prime example of an attempt at decentralising authentication is OpenID, an open standard and authentication protocol. In practice, users employ a large OpenID provider (often Google or Microsoft), which effectively centralises login history with a few providers.

In the Web 2.0 paradigm, developers employ certain tools (abstractions, SDKs, libraries) that aid the development of their applications. For example, SQL (with optional ORM or query builder) is used to store and retrieve data. "Asynchronous Javascript and XML (AJAX)" is used for dynamically changing retrieving information. Cookies (with for example OAuth) are used for authentication and (re-)identification. Similar abstractions can be identified in the mobile app paradigm, building applications for Android or similar.

For decentralised applications, these abstractions are often non-existent, too domain-specific (e.g. Pandora has objects like "Person", "City"), or too low-level: PeerSoN [START_REF] Buchegger | PeerSoN: P2P Social Networking -Early Experiences and Insights[END_REF] uses files, while RetroShare's GXS [START_REF] Soler | A Generic Data Exchange System for Friend-to-Friend Networks[END_REF] uses "groups" containing "messages" as basic building blocks.

The remainder of this paper is concerned with the development of an abstract data model and platform, meant to be at the basis of a peer-to-peer online social network (OSN). It should be portable and efficient enough to run on smartphones, and it should provide a minimum of access-control. These properties fit our interpretation of the privacy definition of Agre and Rotenberg: "The freedom from unreasonable constraints on the construction of one's own identity" [START_REF] Philip | Technology and privacy: The new landscape[END_REF]. OSNs are important in human social communication; they should facilitate social interaction, and their use and development should not be obstructed by technical difficulties.

Related work

Troncoso et al. have enumerated different properties of decentralised systems. A system can be called decentralised, while in fact certain aspects are still inherently or partially centralised, e.g. trackers and supernodes in BitTorrent or Tor's Directory Authorities [START_REF] Troncoso | Systematizing Decentralization and Privacy: Lessons from 15 years of research and deployments[END_REF].

Privacy-preserving databases

The field of privacy-preserving databases is concerned with storing, processing, and releasing data while preserving data. Different database management system (DBMS) have different properties regarding privacy preservation.

Often cited is Platform for Privacy Preferences Project (P3P), a web-based protocol that enables websites to communicate their privacy practices to the browser. The browser interprets and represents this information, and can automatically make decisions based on user preferences [START_REF]W3C Recommendation. W3C[END_REF]. Research is being carried out to develop DBMS that are able to enforce promises encoded in languages such as P3P [START_REF] Bertino | Privacy-Preserving Database Systems[END_REF];

Another research area is the development DBMS that allow queries over encrypted data. These systems are typically cloud-or infrastructure-based, as opposed to peer-to-peer. As an example, Cao et al. developed a graph database that supports queries over its encrypted data [START_REF] Cao | Privacy-preserving query over encrypted graph-structured data in cloud computing[END_REF].

Private online social networks

Efforts for building a decentralised online social network are almost commonplace, with for example Diaspora*, Mastodon, and SecuShare. One notable community project is RetroShare, which is a so-called friend-to-friend network 2 pro-viding file-sharing, fora and other services. In October 2017, Soler published the Generic data eXchange System (GXS) [START_REF] Soler | A Generic Data Exchange System for Friend-to-Friend Networks[END_REF], on which they ported RetroShare's fora and newsgroups. The goal of GXS is to make development of new features easier, by providing an abstract layer for developers.

One academic decentralised online social network is called PeerSoN [START_REF] Buchegger | PeerSoN: P2P Social Networking -Early Experiences and Insights[END_REF]. Peer-SoN uses a distributed hash table (DHT) to localise files on a decentralised network. Writing to and reading from those files is subject to mandatory access control (MAC), implemented using cryptography.

A commercial example is MaidSAFE, who are developing a distributed filesystem [START_REF] Irvine | MaidSafe Distributed File System[END_REF], supported by cryptographic currency [START_REF] Lambert | Safecoin: The Decentralised Network Token[END_REF] based on supernodes.

Cryptographic building blocks

Where centralised applications can rely on the infrastructure granting or denying access, a peer-to-peer system has to rely on cryptography and key management. After all, when data passes through or is stored on unknown or untrusted peers, they should not be able to read it.

The cryptographic currency Monero takes this principle to the extreme: their protocol attempts to hide the sender, receiver and amount of a transaction, while still solving the double-spend problem [START_REF] Van Saberhagen | [END_REF]. Monero relies on a few existing cryptographic building blocks to reach their goal, two of which are at the basis of Glycos.

To conceal the sender, Monero uses ring signatures [START_REF] Rivest | How to leak a secret[END_REF]. This allows the real sender to hide himself among a list of potential senders. Additionally, they anonymise the receiver by computing a related but unlinkable receiver key. We use a variant of both schemes in Section 4.5, with similar purposes.

Solution design

For both centralised and decentralised applications, providing the developer with abstractions has several benefits. Applications are faster, easier and more secure to develop and to maintain, and the developer does not need knowledge of the underlying systems.

We propose a building block for distributed and private data storage, the equivalent of a DBMS in the classical paradigms, based on graph databases.

Privacy by fine-grained access control

Porting privacy definitions to a peer-to-peer setting is anything but trivial, and requires deeper research on its own. An illustration: legislation like the GDPR [START_REF]679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46[END_REF] is concerned with processors and controllers, which both are typically depicted by legal entities that process or control personal data. In a peer-to-peer setting, where the central authority and institution is taken out of the picture, it becomes difficult to clearly point out who is processor or controller: they all depend on the specifics of the considered peer-to-peer system.

In an overlay network like the one presented, one could say the whole network becomes the hosting institution. Institutional privacy thus means privacy with respect to the network's peers.

When we consider the institution as an eavesdropper, some of the properties we want to achieve are: confidentiality The overlay network should not learn the semantic meaning of the data it stores. control The end-user should control the data he stores on the overlay network. unlinkability The overlay network cannot sufficiently distinguish whether two items of interest are related or not [START_REF] Pfitzmann | A terminology for talking about privacy by data minimization: Anonymity, unlinkability, undetectability, unobservability, pseudonymity, and identity management[END_REF].

By storing data in a granular way as edges and vertices, and anonymising every data point, we can ensure unlinkability. We will employ well-established cryptographic building blocks to anonymise data, encrypt data, and provide access control.

Access controlled graph database

A graph database is a database of triplets (s, p, o); a subject s, predicate p, and object o. A triplet (s, p, o) represents the directed edge with label p, from s to o.

We construct a query system wherein vertices and edges are efficiently searchable and traversable for authorised users, while being encrypted, and thus unintelligible for unauthorised users. Data is stored on a DHT based on Kademlia [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the XOR metric[END_REF]. All vertices have an owner and an (optionally empty) access control list; the owner of a vertex can optionally grant others the right to append additional edges to specific vertices. In Figure 1, Alice has granted Bob the right to post on her wall. For this paper, we assume a network of trust; users have access to (correct) key information of their peers. Trust models used in PETs include trust-on-firstuse (e.g. Signal) and offline key exchange (PGP, OTR).

Data model

In a conventional graph database, information does not have access rights; we thus propose a simple3 access control model that extends an RDF-based model [START_REF] Lassila | Resource Description Framework (RDF): Model and Syntax[END_REF]. By splitting up the concept of vertices and edges into two separate objects, it is possible to alter a vertex' content independently from the edge list, and vice versa. It also allows us to add security-related information to both objects.

A vertex s is identified by its owner, and contains an access control list enumerating users that can create edges with s as subject. This allows for typical OSN features like a personal "wall", where Alice's friends can leave posts to be read for her and her friends. Those posts in turn can then contain a comments section, to allow for more interaction.

Notational conventions

Since we will be using a few cryptographic concepts, it is necessary to define some notation. The public key system used throughout the design is Curve25519 [START_REF] Daniel | Curve25519: new Diffie-Hellman speed records[END_REF]. Public keys are points on an elliptic curve, and their discrete logarithms are the respective private keys. When is the size of the underlying field, r ← [0, -1] picks a field element uniformly at random. We will assume a known long term public key pk i LT with corresponding private key sk i LT for every participant i. Identification can happen in a face-to-face meeting: we assume that two persons that want to use the network together have access to correct key information of each other.

H is a cryptographically secure hash function (the Keccak-based [6] SHA 3-256 function), and H s is a hash function onto the underlying field of the elliptic curve.

Implementation

We will store every vertex s of the graph database as an object in a Kademliabased [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the XOR metric[END_REF] DHT, storing vertices that have s as subject alongside s for easy graph traversal. The DHT thus understands two kinds of put operations; one for vertices and one for edges, while the get operation returns both the vertex and the associated edges.

Note that since vertices are identified by their owner, we cannot use the long term pk i LT public key. Instead, inspired on ByteCoin's "Stealth Addresses" [START_REF]Untraceable transactions which can contain a secure message are inevitable[END_REF][START_REF] Todd | Stealth addresses[END_REF] and Monero's "one-time addresses" [START_REF] Van Saberhagen | [END_REF], we derive a random key from the long term key pk i LT : Algorithm 1 (Generate an ephemeral public key). Given the public key A = aG = pk alice LT of Alice, Bob generates an ephemeral (one-time) public key for Alice as follows:

r ←[0, -1] R ←rG, pk alice OT ←H s (rA)G + A, sk alice OT ←H s (aR) + a.
This key clearly belongs to Alice: only Alice knows the integer a required to construct her secret key. She can recognise that this key belongs to her by checking whether A equals pk alice OT in A = H s (aR)G + A.

Due to this property, we will call R the "recogniser". Note that the serialisation of the ephemeral public key together with the recogniser only takes the size of two points (R and pk alice OT ), which is 64 bytes when using Curve25519 [START_REF] Daniel | Curve25519: new Diffie-Hellman speed records[END_REF]. Since r is only used in the key derivation, it is a temporary variable. Note that H s (rA) = H s (aR) is an elliptic-curve Diffie-Hellman key agreement [START_REF] Diffie | New directions in cryptography[END_REF][START_REF] Victor | Use of Elliptic Curves in Cryptography[END_REF] with a random key R = rG.

The ephemeral public key pk alice OT is indistinguishable from random. Formally, the probability distributions of (R = rG, A = aG, pk alice OT ) and (R = rG, A = aG, C = cG) are computationally indistinguishable for r, a, c chosen randomly and uniformly from [0, -1].

Proof. Assume we can distinguish (R = rG, A = aG, pk alice OT ) and (R = rG, A = aG, C = cG) using some distinguisher A. This means we can solve the decisional Diffie-Hellman problem: to distinguish (R, A, K = rA = aR) and (R, A, C), it suffices to run A on (R, A, H s (K)G + A) and (R, A, C).

We can now define a vertex.

Definition 1 (vertex

). A vertex V is a 7-tuple (O, R, ACL, R ACL , v, c, S).
The key O is an ephemeral, unique public key derived from the private key held by the owner of this vertex, the owner key. The point R is the recogniser used to generate key O. The list ACL is the access control list, listing all ephemeral public keys that are allowed to link other vertices from this vertex using edges. The point R ACL is the recogniser used to generate all ephemeral public keys in ACL. Optionally, v is the encrypted associated value or content of the vertex. The clock c is a positive integer to keep track of the vertex version. The Schnorr signature S is a BN N -IBS signature [START_REF] Schnorr | Method for identifying subscribers and for generating and verifying electronic signatures in a data exchange system[END_REF][START_REF] Schnorr | Efficient signature generation by smart cards[END_REF][START_REF] Bellare | Security proofs for identity-based identification and signature schemes[END_REF] of (R, ACL, R ACL , v, c) generated using O.

In this definition, the access control list ACL contains ephemeral public keys generated with a common r, thus having the common recogniser R ACL = rG. This operation effectively anonymises vertex appends, while the assigned users can still recognise (using R ACL ) their eligibility to create edges.

By using Algorithm 1 to generate O and the keys in ACL, these public keys are indistinguishable from random and thus unlinkable to their owners.

There is still one problem to overcome: imagine we use the above (Schnorr) signature to sign an edge. The signer is always identifiable, and Eve -the eavesdropper -could distinguish edges based on their associated signer. Eve should only learn about the validity of the edge. In "How to leak a secret" [START_REF] Rivest | How to leak a secret[END_REF] Rivest, Shamir, and Tauman describe an elegant concept and method to overcome this issue. They propose a so-called "ring-signature", a signature which proves knowledge of one secret key of a set, without revealing which.

A ring-signature scheme based on elliptic curves is documented by Abe, Ohkubo, and Suzuki [1, Appendix A].

Algorithm 2 (Generate ring signature). A signer with secret key x k signs message m with public-key list

R s = Y 0 , Y 1 , . . . , Y n-1 1. Select α, c i ← [0, -1] for i = 0, . . . , n -1, i = k, and compute z = αG + n-1 i=0,i =k c i Y i 2. Compute c = H s (R s ||m||z) c k = c - n-1 i=0,i =k c i mod q s = α -c k x k mod q 3. Return σ = (s, c 0 , . . . , c n-1 )
Algorithm 3 (Verify ring signature). A verifier verifies signature σ. (L, m, σ) by checking whether

n-1 i=0 c i ∼ = H s R s ||m|| sG + n-1 i=0 c i Y i mod q
An edge can now be defined as an object with an encrypted value, pointing from a subject to an object, with the value and identifier of the object being encrypted:

Definition 2 (edge). An edge E between two vertices V s = (O s , R s , ACL s , R ACL,s , v s , c s , S s ) (the subject) and V o = (O o , R o , ACL o , R ACL,o , v o , c o , S o ) (the object) is a 5-tuple E = (O s , ACL E , K ACL , E k (l, O o ), R s , S). The ring R s = {O 1 , O 2 , . . . , O i = O s , . . . , O n }
is a set of public keys containing all n public keys in ACL s . For every key in ACL s , ACL E contains the encrypted key k. It is encrypted n times using a standard hybrid encryption, based on a Diffie-Hellman exchange with the random point K ACL using the symmetric cipher E. l is the label of the edge. S is a ring signature [1, Appendix A] over the ring R s of (O s , ACL E , E k (l||O s )). The label and object are encrypted using the same symmetric cipher E with key k. Fig. 2. The two main components implemented are the middleware for the cryptographic graph, and the custom Kademlia router. The Kademlia router is responsible for connection with other peers, storing and retrieving encrypted graph data on the network. The graph API implements the encryption and decryption of the graph, feeding it from and back to the application.

CryptoGraph Primitive Graph

Vertex: Listing 1. The Android-compatible Java library is used in this example to create a Profile object, assign a name, store it on the network and then asynchronously fetch it from the network.

• owner O • recogniser R • ACL • value v • clock c • signature S Edge: • ACLE • KACL • E k ( , o) • signature Vertex: • owner • value • clock Edge: • subject • predicate • object

Performance evaluation

To validate the technical viability, we have built a demonstrator implementation in Rust4 . We call this demonstrator Glycos, and serves as a middleware providing an interface for traversing the graph with an asynchronous API. It contains the necessary networking and cryptographic components to query the network for, and to create and store vertices and edges. For a graphical overview, refer to Figures 2 and3.

Additionally, it contains an object relational mapping (ORM) interface that maps objects to vertices and edges and vice versa. This allows a developer to think in terms of objects and their relations, like is common when working with relational databases. The ORM-interface contains generated bindings to Java, to demonstrate the viability on the Android platform. Listing 1 contains example code verified testing on both a virtual and a physical Android device.

Since practicality and performance are key in the design, a thorough analysis of both aspects is mandatory. Note that a vertex can be serialised in 156 + |v| + 32|ACL| bytes when taking a 64-bit integer for the clock value. We saved 32 bytes by using the BN N -IBS Schnorr signature [START_REF] Bellare | Security proofs for identity-based identification and signature schemes[END_REF] scheme, which allows us to omit the owner key from the serialisation.

When an edge E is transmitted together with its accompanying vertex, we can omit the subject O s and the ring R s from Es serialisation. This allows a serialisation in 112 + |l| + 80|R s | bytes.

The maximum transmission unit (MTU) for Ethernet is about 1500 bytes, so for a small (< 15) amount of participants both a vertex or an edge could fit a single Ethernet frame. At 1500 bytes, one megabyte can store around 700 vertices or edges, one gigabyte around 700 000. Since modern smartphones and computers come with plenty of storage, often exceeding 8 GB, this is ought to be compact enough. We ran a few benchmarks to measure how fast vertices and edges can be generated and decrypted. Timings correspond to a at least few hundreds of encryptions and decryptions per second. Note that at the time of writing, the ARM based smartphone platform takes no advantage of the available NEON instruction set5 nor from the 64 bit instructions. In other words, the ARM build has still room for optimisation. All notable benchmarks are represented in Table 2.

Table 2. Notable benchmarks. Ring size is taken to be |Rs| = 2 where applicable. A "seal" operation consists of encrypting and signing the vertex or edge (cfr. Figure 3). An "open" operation is the inverse operation: computing the correct keys and decrypting the vertex or edge. Mean times as reported by the criterion library.

Notebook

Conclusion

Decentralisation of a service is believed to lead to more privacy. We noted that today's decentralised online social networks (OSNs) come in two forms: at one hand there are federated OSNs, and at the other there are peer-to-peer OSNs. Federated networks have as disadvantage that the end-user has to choose a provider or "pod", which in the case of e-mail has lead to re-centralisation of users' data.

Most peer-to-peer networks reinvent the wheel: often on a per-feature basis, these systems mainly design a private and secure protocol. This is in contrast with centralised services, where developers employ abstractions like SQL, ORM, and cookies to build applications, often without having to consider cryptography.

An abstract data model can help to overcome this unbalance. While existing data models such as GXS [START_REF] Soler | A Generic Data Exchange System for Friend-to-Friend Networks[END_REF] have also observed this unbalance, proposed solutions are often still application specific. We propose a simple graph databaselike service built upon Kademlia, on which application developers can store and query arbitrary data. This data model is encrypted and authenticated and thus only readable and writeable by users with the necessary permissions. Moreover, it has been made relatively easy to use through the ORM layer, and shown to be efficient enough to run on mobile devices.

Future work

In the current model, efficient update and delete operations are still lacking, due to the risk of replay attacks. By introducing a notion of time, or more precisely the notion of happened-before [START_REF] Lamport | Time, Clocks and the Ordering of Events in a Distributed System[END_REF], these attacks can be countered, and efficient deletion could be implemented. These are important considerations, since these features would increase the user's control over their data.

As touched upon in Section 4.1, privacy properties and definitions are not well studied in a peer-to-peer context. Formally identifying adversaries and their capabilities in a peer-to-peer OSN, and making provable definitions about them can increase confidence in these applications.

Looking at Glycos as a middleware, future research should further enhance the platform in itself, making it more practical to build actual applications and to make peer-to-peer overlay systems simpler to develop.

Fig. 1 .

 1 Fig.1. Bob writes a message on Alice's wall. This is only possible if Alice has granted Bob the rights to do so; otherwise, the network will not accept Bobs post (<#BobsPost>). The definition of those access rights are contained within every vertex.

Table 1 .

 1 Specifications of the devices used for benchmarks. All benchmarks were ran on the notebook, except where otherwise noted.

		Notebook	Smartphone
	Brand	Lenovo Thinkpad X250	Lenovo Moto Z Play
	CPU	Intel Core i5-5200U (Broadwell) ARM Cortex A53 (MSM8953)
	Core count	2 cores, 4 threads	8 cores
	Clock frequency 2.20 GHz	2.0 GHz
	RAM	16 GB DDR 3 at 1600 MT/s	3 GB DDR 3
	Operating system Arch Linux	SailfishOS 2.1.3.7 armv7hl
	Rust compiler	1.29.0-nightly (874dec25e 2018-07-21)

In case of email, it is enough that just one participant in a conversation should be on a malicious server to compromise all communication. PETs such as PGP try to overcome this issue.

Troncoso et al. refer to this as "P2P: Nodes Assist Other Nodes"[START_REF] Troncoso | Systematizing Decentralization and Privacy: Lessons from 15 years of research and deployments[END_REF]

This model is "simple" in the sense that more complex models are possible, and may be interesting for future research: co-ownership, write-only, or read-only rights can all have useful applications.

"Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety." https://www.rust-lang.org/

NEON support is on the roadmap for curve25519-dalek; cfr. https://github.com/ dalek-cryptography/curve25519-dalek/issues/147


Rob Heyman
email: rob.heyman@vub.be

Sharing Is Caring, a Boundary Object Approach to Mapping and Discussing Personal Data Processing

Keywords: GDPR, Boundary object, Smart city. 1

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

This research paper is an answer to a pragmatic question: how to gather and act on personal data in smart city projects using boundary objects? In smart city projects, there is a need to map data processing operations due to risks to privacy and the threat of GDPR 1 fines. Collecting this information is challenging because people with this task rarely have access to the information or have the expertise to understand all technicalities. Also, the nature of smart city projects brings its own challenges. Smart city projects comprise new innovations where multiple departments or organizations have to work 1 The General Data Protection Regulation replaced the Data Protection Directive in May 2018.

An important change in this reform is the principle of accountability. It requires data controllers to be able to demonstrate compliance with GDPR principles. For this requirement smart cities require full awareness about their data processing activities and this is perceived as new by many data controllers.

together on a new technology from concept, prototype to launch. This means that: different smart city stakeholders hold a part of the required information, the project changes over time which results in personal data flows that are vague and under-defined. Because of this complexity, we could say smart city projects exist at the boundaries between different social worlds 2 where GDPR compliance adds extra complexity beyond the complexity of getting a working proof of concept.

Problem statement: How to improve the lack of information about personal data processing in smart city projects through boundary objects? This essay compares boundary objects as an approach that may improve personal data processing documentation required for further steps in GDPR compliance. To answer this question, we look at factors that render this a difficult undertaking and compare these to the data collection challenges that prompted the use of boundary objects as a concept and tool. Relevance: From a societal perspective this is important as more and more cities invest in smart city projects, which means they monitor public space more than before. To prevent a trade-off between more smart city benefits versus privacy, a complete mapping of the data collection process may help in creating the circumstances to have smart city benefits and privacy. From a scientific perspective, there is little research on how to collect and distribute information about an innovation in development and discuss it collectively. The literature is clear on the requirements to mitigate privacy challenges during development but very unclear on how to implement these in the development process. Smart cities, as an object of study, are interesting because it is still an underdefined concept that will most likely crystallize soon. It means that many actors have different views on what a smart city should be. This means two things. That boundary objects are very helpful to bridge different viewpoints and that stakeholders can work together via boundary objects to come to an acceptable definition of smart cities for all. We believe GDPR compliance can only achieve Privacy-by-design if an organization distributes legal requirements on the ground. It will not work if GDPR compliance remains the isolated responsibility of one person. To break GDPR compliance out of its isolation, we need to cross disciplinary boundaries. Last, improving transparency tools like boundary objects for the GDPR may also increase relevance of this regulation as more stakeholders become empowered to take part in smart cities. Results: We found that ensuring GDPR compliance in smart city projects is a context with a high degree of interpretive flexibility; things have different meanings to different people. This is challenging because there is a collective goal of delivering a working proof of concept which is GDPR compliant. Just like museums for vertebrate zoology 3 , there is a need to create a shared language to talk about specific information between different backgrounds and disciplines. I structure this paper as follows. We first summarize the history of boundary objects, their main components and their theoretical background. We then continue by situating smart cities, smart city projects and the challenges for GDPR compliance. Next, we compare how the problems solved with boundary objects in museums are like those of smart city projects. We then conclude with advantages of using boundary objects in smart city projects.

Boundary objects history and architecture

For this part we aim to provide the context in which Star and Griesemer developed boundary objects, the perspectives they are part of and the architecture or basic building blocks they comprise. We require this to compare this context to that of smart city projects.

Boundary objects as a concept resulted from Star and Griesemer's research into cooperative work in the absence of consensus [START_REF] Star | This is Not a Boundary Object: Reflections on the Origin of a Concept[END_REF]. This occurs if different social worlds have to arrive at a coherent (research) result. For example, during the developments of Berkeley's Museum of Vertebrate Zoology, 1907-39 [START_REF] Star | Institutional Ecology, `Translations' and Boundary Objects: Amateurs and Professionals in Berkeley's Museum of Vertebrate Zoology, 1907-39[END_REF]. The cause and context for this research was the authors' search for situations in need of cooperative work where little to no consensus exists.

Star and Griesemer describe the beginning of the 20th century in West America as a situation where zoologic museums were evolving from amateur collections to academic curated collections. Here, amateur enthusiasts curated museums for fellow enthusiasts. In Stars case, these amateurs were interested in Californian ornithology. What changed, was biological science need for large information collections. This meant that amateurs from different hobbies increased their interaction with curators and scientists to create scientific knowledge together.

Grinnel, an ecology biologist and director of Berkeley's Museum of Vertebrate Zoology is instrumental to facilitate this change from amateur museum to a research center: "Joseph Grinnell was the first director of the Museum of Vertebrate Zoology. He worked on problems of speciation, migration and the role of the environment in Darwinian evolution. Grinnell's research required the labours of (among others) university administrators, professors, research scientists, curators, amateur collectors, private sponsors and patrons, occasional field hands, government officials and members of scientific clubs." [START_REF] Star | Institutional Ecology, `Translations' and Boundary Objects: Amateurs and Professionals in Berkeley's Museum of Vertebrate Zoology, 1907-39[END_REF] Grinnell changed the practices of amateur bird collectors and museum curators to fit his needs as a biologist. His aim was to map how environment plays a role in Darwin's evolution theory to support Darwin's work with proof. To do so, Grinnell collected bird sightings, bird cadavers and references to where these were found. This collection needed to be so large Grinnell could not do it alone.

The group of amateurs already gathered information and birds to contribute to the museum but in a non-standardised, incoherent way. Thus the practices of this group did not fit the rigorous reporting Grinnell required. To use their information for scientific progress, Grinnel had to overcome two barriers. First, the work Grinnell expected them to do had to fit in their current activities. Second, he had to discipline amateurs to understand what he expected from them without overburdening their free time.

Grinnell taught his different information providers how to do fieldwork with the bare minimum of required biological knowledge and methods to standardise this. Next, he encouraged the use of boundary objects; specifically structured field notes containing information fields of interest to all involved parties but still rigorous enough for scientists to use as input for their research.

For example, when amateur and professional trappers capture animals, they needed to understand what parts of the animal had to remain intact, how to preserve them and last, what information trappers needed to add about the environment they captured it in. Grinnell facilitated the first two through teaching and the latter with field notes.

In Stars words, the information and the actors that contributed needed discipline. As we will see, this challenge is very similar to our smart city environment where nonexperts collect information and where this information needs discipline as well. This brings us to the following section on how to carry this out.

Boundary object architecture

Boundary objects and standardization facilitate information sharing where actors try to perform cooperative work in the absence of consensus. Interpretive flexibility of a subject causes the latter. Different people see different meanings in the same phenomenon. This poses challenges for collective work because the chances to align everyone spontaneously are non-existent. Therefore, mutual understanding increases through standardisation and boundary objects.

Standardization takes place before the use of boundary objects, because it is work that brings different social worlds together: "By emphasizing how, and not what or why, methods standardization both makes information compatible and allows for a longer 'reach' across divergent worlds." [START_REF] Star | Institutional Ecology, `Translations' and Boundary Objects: Amateurs and Professionals in Berkeley's Museum of Vertebrate Zoology, 1907-39[END_REF] A boundary object is a material or organisational structure to allow groups without consensus to work together. In that regard the object functions as an information carrier to facilitate work between groups that wish to cooperate despite their lack of consensus. It comprises two elements: object and boundary [START_REF] Star | This is Not a Boundary Object: Reflections on the Origin of a Concept[END_REF]. Object refers to something people act toward and with while boundary refers to a line between two worlds or social groups.

The object requires the following [START_REF] Star | This is Not a Boundary Object: Reflections on the Origin of a Concept[END_REF]:

• It has to exist between two or more social worlds • It is vague for common purposes but particular social groups can specify information furthere because it remains open enough • If no consensus exists, it can be a back and forth object until they reach consensus For example, index cards to classify collections of bird samples. These exist between the person who brought in the bird cadaver, the curator and the scientist. It satisfies the first condition. It is open because it contains more information fields than any of the involved parties require. Each actors is interested in a subset of these information fields. Last, the history of the museum Star describes is one where Grinnell and others had to work on convincing others and part of that convincing comprised changing reporting methods to better fit in their free time. This is where Star and Griesemer divert from Actor-Network theory on which they rely. There is a soft kind of steering that strives for coexistence instead of domination: "Grinnell's methods emphasis thus translated the concerns of his allies in such a way that their pleasure was not impaired -the basic activities of going on camping trips, adding to personal hobby collections and preserving California remained virtually untouched. With respect to the collectors, Grinnell created a mesh through which their products must pass if they want money or scientific recognition, but not so narrow a mesh that the products of their labour cannot be easily used." [START_REF] Star | Institutional Ecology, `Translations' and Boundary Objects: Amateurs and Professionals in Berkeley's Museum of Vertebrate Zoology, 1907-39[END_REF]

Origin of the approach

In this section we situate Star and Griesemer's work within the respective disciplines they borrow from, symbolic interactionism and ANT. This is done to show the subtle difference between boundary objects and ANT. This difference will be used in the conclusion to refer to two styles of collaboration.

Symbolic interactionism "is part of a tradition of thought which comes from symbolic interactionism which seeks to qualify articulation mechanisms surrounding the perspectives of authors belonging to heterogeneous social worlds." [START_REF] Trompette | Revisiting the notion of Boundary Object[END_REF] Symbolic interactionism is "a micro-sociology tradition which rejects both sociological and biological determinism and privileges explanation on the basis of dynamic interactions which are observable between individuals. It underlines the fact that the sense of phenomena results from interpretations made by actors in context. These interpretations are to do with interpretive frameworks which move away from interactions between actors (verbal and nonverbal symbolic interactions)." [START_REF] Trompette | Revisiting the notion of Boundary Object[END_REF] Social worlds are defined as "activity groups which have neither clear boundaries nor formal and stable organisations. They develop through the relationship between social interactions which move away from the primary activity and the definition of pattern and reality. The notion derives from the symbolic interactionism tradition." [START_REF] Trompette | Revisiting the notion of Boundary Object[END_REF] ANT is adapted to fit with symbolic interactionism and the aim of the authors, to enable consensus between social worlds where there is none. In order to do that they render ANT more ecological. This means that they approach the interessement phase of Callon [START_REF] Callon | Some elements of a sociology of translation: domestication of the scallops and the fishermen of St Brieuc Bay[END_REF] in a manner where each actor is equally capable of defining translations. In order to understand this we need to define translations, interessement and obligatory passage points.

Translation [START_REF] Callon | Techno-economic networks and irreversibility[END_REF] refers to the situation where one actor A succeeds in convincing another actor B to change their behaviour, usually in the favour of the first actor (A). This is most often initiated by creating interessement [START_REF] Callon | Some elements of a sociology of translation: domestication of the scallops and the fishermen of St Brieuc Bay[END_REF]. This means that actor A needs to redefine his problem in such a way that it also becomes actor B's problem. In obligatory passage points (OPP) actor A has created a situation where B has to pass through because there is no other way and in so doing they change their behaviour to align with the prescribed behaviour A expects from B.

What the authors criticize ANT for, is that the latter's analysis aims at mapping obligatory points of passage. According to Star and Griesemer this means that networks are always reduced to the dominance of one actor.

In my opinion, Star and Griesemer reduce ANT to this top down thinking where one actor is dominant, and this makes sense since ANT is full of examples of OPPs that reinforce this observation. Nevertheless, the method ANT prescribes is one where each actor should be described in the same way without any a priori distinction [START_REF] Law | After ANT: complexity, naming and topology[END_REF][START_REF] Callon | Some elements of a sociology of translation: domestication of the scallops and the fishermen of St Brieuc Bay[END_REF]. What is more, this approach leaves room for resistance in the concept of anti-scripts [START_REF] Latour | Where are the missing masses? The sociology of a few mundane artifacts[END_REF] and circumscription [START_REF] Akrich | The de-scription of technical objects[END_REF], two concepts that refer to resistance of actors to proposed translations.

This theoretical discussion set aside, what can be said is that Star and Griesemer are using ANT in a different context. The context is what they refer to as N-translation [START_REF] Star | Institutional Ecology, `Translations' and Boundary Objects: Amateurs and Professionals in Berkeley's Museum of Vertebrate Zoology, 1907-39[END_REF]. All involved actors are suggesting translations for other actors and because this is a context of collaboration, the question changes from domination to cooperation. How is it possible to have as much translations while keeping consensus? This means that the boundary object approach is more concerned about solutions than contestations. ANT is more suited to unearth hidden conflicts and contestations in dominant configuration. This approach focuses on the critical aspects of social constructivism. Boundary objects as an approach, use the fact that social constructivism exists to enable cooperation between actors; different understandings of the same phenomenon exist and that this can be overcome if all actors agree on standard definitions and approaches that can be used by all because they fit in their practices and social worlds.

Smart city definition and project context

The aim of this part is to summarize what a smart city might mean and what this means for smart city projects that process personal data. Without reducing smart cities in one definition, we could say that this concept broadly refers to a development where multiple actors decide to work together on a smart city challenge. In terms of cooperation, the ideal refers to working with as much stakeholders as possible: "a smart city should focus on collaborating with diverse stakeholders, using technology as an enabler to achieve better and more efficient services to citizens." [ In these definitions stakeholders are defined as members of the quadruple helix which "includes four types of actors (1) policy, (2) citizens, (3) research and ( 4) private partners." [START_REF] Walravens | Co-creating a practical vision on the Smart City[END_REF] We can safely assume and testify in what follows that the quadruple helix consists of actors coming from different social worlds. But also that they wish to cooperate but lack consensus.

Smart city project context

It is impossible to talk about THE smart city, so instead we focus on concrete projects. That is the reason why we refer to the smart city project context. We define this context as an interdisciplinary and inter-organisational context which focuses on results first and GDPR compliance a bit later. Since we focus on GDPR compliance, we will follow with a section on privacy in smart city contexts after the more general description which follows now.

Smart city projects tackle urban challenges first and address GDPR challenges created later. Due to the newness and vagueness of smart cities as a concept, many projects are proofs of concept to illustrate possibilities. As a result, projects are evaluated on their performance first and secondly on their privacy protection. On a more practical level it means that practical solutions to implement a project are added first and that these are then evaluated with regard to the GDPR. This is pragmatic as the GDPR alone cannot steer innovation.

As previously mentioned authors point out the need to include the quadruple helix in smart city projects. These cooperations are believed to foster the exchange of ideas and technology [START_REF] Baccarne | Empowered Cities? An Analysis of the Structure and Generated Value of the Smart City Ghent[END_REF]. This requirement to involve many different stakeholders results in a bigger variety of disciplinary backgrounds or social worlds. We define three challenges that render consensus difficult, a vertical challenge of working on different levels or social worlds. A horizontal challenge of working with different organisations. And lastly, the GDPR compliance challenge itself.

Project vertical (interdisciplinary challenges)

With vertical I refer to the different layers in a single organization and the challenge of reaching consensus in one organization. In each project, different roles have to contribute to the successful implementation of a project: project management, development, legal, user testing, communication are roles that are often taken up by different people inside an organisation. The first challenge consists of aligning these different layers of an organisation. This is difficult because these layers are tied to different social worlds. For example, project managers may not have the same technical background their development team has.

Project horizontal (inter-organisational challenges)

The quadruple helix includes different organisations and stakeholders' involvement in smart city projects. This adds an additional layer of factors that slow down the collection of relevant information and decision making based on this information. We can discern three factors: More time and effort is required to reach the right people that have information, the GDPR itself becomes an item of interpretation between different organisations and all of the vertical challenges apply to each organisation. For example, a city may propose a joint controllership but their partner may not believe that this is really necessary. The newness and vagueness of the text create discussions on what it really means for smart city projects.

Particular compliance context

In this article we limit ourselves to accountability: "as a principle which requires that organisations put in place appropriate technical and organisational measures and be able to demonstrate what they did and its effectiveness when requested." [START_REF]Accountability[END_REF] Here the EDPS refers to the following measures: "adequate documentation on what personal data are processed, how, to what purpose, how long; documented processes and procedures aiming at tackling data protection issues at an early state when building information systems or responding to a data breach; the presence of a Data Protection Officer that be integrated in the organisation planning and operations etc." [START_REF]Accountability[END_REF] In this paper we focus on adequate documentation to ensure the ensuing steps of accountability. This means that the GDPR poses a requirement from the legal layer to the other layers in one organization and between multiple organizations: be able to account for all the data processing on personal information. The challenge is very similar to that of the vertebrate zoology museum. Information has to be gathered in a disciplined manner and information itself has to be standardised to become useful. In practice this means that a person charged with documenting how data are processed has to do two things:

• Ask other parties to collect information about data processing operations

Comparison of situations

In this section we compare the context of the museum with that of smart city projects. What they have in common, is the need to include other parties to gather information, that all involved actors care for a common goal and that there is a need for standardization and boundary objects.

In both cases, the people who have access to the required information for good biological research or data protection, are not the people responsible for this goal. The people who have access to this information have access for different reasons. It means that they are from a different social world than biologists or GDPR managers. In the case of the smart city, these people are in the business of making sure their part of the smart city project works.

All involved stakeholders hold privacy dearly as it is important for the realization of their own goals. Trappers, amateurs, etc. capture and observe birds and care about understanding the environment of these birds. In both cases, there is an overlap but each actor may differ in terms of engagement or degree of importance. An engineer will not add the same priority to GDPR compliance as a compliance manager.

Those who care most about gathered information are the compliance manager and biologist but these have to rely on other actors to gather the necessary information to reach their common goal. Mapping bird ecologies or compliance with the GDPR. Because of this, those that gather information other than the specialists need to use standardized methods and boundary objects to attain this goal.

In conclusion we can say that both situations are highly similar. It could be argued that documenting data processing operations is easier compared to the museum context because the smart city context works with paid professionals rather than hobbyists 4 . GDPR compliance as a goal may also be more contested than the preservation and collection of wild life. GDPR can be motivated positively, for example, because we value privacy, or negatively, because we try not to get fined or receive negative attention.

Incoherent GDPR compliance

This section adds examples of lack of consensus that can either be solved through standardization or boundary objects to further prove the point that this approach would add value to smart city projects. The lack of consensus may lead to a mismatch between legal concepts and other disciplinary concepts, the lacking existing boundary objects to gather information and the need for data visualizations that are understandable for all.

In many cases, the biggest challenge consists of reducing the mismatch between key legal concepts and the definition stemming from other social worlds. For example, knowing what personal data is, is the most important definition because it allows anyone involved in a smart city project to understand that a data collection or processing operation should be documented. A very common mistake consists of interpreting personal data as data the person who sees the data can use to identify an individual. This also means that data that do not allow someone to identify an individual is non-personal. As a result, IP-addresses but also infrared images are too quickly categorised as nonpersonal or anonymous data.

Another challenge is perhaps the need to fill in a data register. This is a repository to store all GDPR required information in an excel or database format. These registers use GDPR jargon making them difficult to use for non-GDPR users. What is more, a data register is a really difficult format to see the risks posed by the data because it is too abstract to identify possible risks. Lastly, a lot of time is lost in discussions where legal concepts have to be applied in agreements that follow reality. Here agreements are drawn without a clear idea of what will happen in the project. A mismatch between the reality that is assumed by the legal department and that of the actual personal data flows may follow as a result.

Conclusion

In the theoretical discussion about Star and Griesemer's divergence from ANT, the big difference was a difference of approach to problems. In ANT a problem was solved through careful manipulation of different actors until they acted in one way as planned by the most dominant actor. In this case, all other actors have to pass through an obligatory passage point. In boundary objects, a more ecological approach is put forward. Collaboration can only exist if knowledge is shared through the largest common denominator and when new actions are aligned with existing practices. For GDPR compliance, we face the same choice. Compliance can be achieved through domination or collaboration.

In the case of domination, this means that a compliance manager needs to take care that GDPR requirements become an obligatory passage point. Regardless of what other actors think or feel, there is no alternative than to comply with the behavior prescribed by the compliance manager. On a more pragmatic level this sort of GDPR compliance will look imposed and top down. A compliance manager will have to impose her or himself in project processes and demand to be reckoned with.

If collaborative GDPR compliance is the goal. This is not achieved by forcing other actors through an obligatory passage point, compliance from the boundary object point of view is achieved by fitting compliance efforts in the actions that already occur in smart city projects. This means that boundary objects and thus compliance documents and methods need to make sense and be useful for other tasks than mere compliance.

The latter approach has advantages for overall privacy in smart cities

• If the aim is to increase privacy-by-design, then GDPR concepts should be present in the minds of developers and project owners. • Boundary objects create a back and forth dynamic and the documentation of such a process may be interesting to understand the development and the meaning of a particular smart city. Moreover, such documents would increase accountability as all decisions are documented. • Boundary objects allow laymen to aid in the easiest tasks of GDPR compliance. By enabling partners to map their own data processing operations, money and effort is saved that would otherwise go to an internal or external specialist. This would not only be costly but also a lost learning opportunity.

  • Facilitate decision making about data processing operationsIn sum, it could be said that knowledge is gathered without really knowing what needs to be collected. Decisions have to be made without really understanding what is at stake. This is a very similar situation to the vertebrate zoology museum. In what follows we explain why and how the Berkeley's Museum of Vertebrate Zoology is the same situation as our smart city projects.

Cfr. infra.

The case Star and Griesemer used to develop the concept of boundary objects.

At least this was the case for the projects this author was involved in. Citizen science and participatory action research are becoming common place in smart city projects which means that hobbyists will become part of the solution. www.curieuzeneuzen.be is an example of an approach including hobbyists.