D Miallier

G Guérin

N Mercier

T Pilleyre

S Sanzelle

The Clermont radiometric reference rocks: a convenient tool for dosimetric purposes

Boreholes drilled in 8 different rocks situated in the vicinity of the Clermont TL laboratory have been used for testing and calibrating methods devoted to measure the natural radioactivity. The present paper gives updated data for the nuclide contents and internal doserates for those reference media. Two examples of application are presented. The first example shows dose-rate calibration of a scintillator gamma probe using a threshold method. The second example shows a routine technique for TL dosimetry, based on the rocks for dose-rate reference.

-Introduction

Various experiments aimed at testing or calibrating techniques devoted to the measurement of natural gamma and X-ray emissions necessitate reference homogeneous media of well known radioactivity.

For such purpose, the Clermont TL group (Clermont-Ferrand, France) has been using natural rocks for many years [START_REF] Sanzelle | The assessment of gamma dose rate by gamma ray field spectrometer[END_REF], Miallier et al., 1988, Soumana et al., 1994). This approach has also been adopted by other luminescence dating groups [START_REF] Prescott | Cosmic ray and gamma ray dosimetry for TL and ESR[END_REF].

The use of rocks is an alternative to built blocks such as those prepared at the Oxford University with doped concrete [START_REF] Murray | Environmental radiation studies relevant to thermoluminescence dating[END_REF][START_REF] Aitken | Thermoluminescence dating Academic Press[END_REF] or those made of building bricks available in different laboratories (for instance, at Gif-sur-Yvette and Bordeaux). One advantage of natural rocks is that they can easily provide homogeneous media, large enough for representing an infinite volume from the point of view of natural gamma emissions. This is particularly the case for lava flows, which, moreover, are numerous in the vicinity of Clermont-Ferrand. In contrast, the laboratory blocks have generally dimensions lower than the maximal range of the most energetic natural gamma rays. For instance, the cubic Oxford blocks (side = 50 cm) have a thickness (50 g.cm -2 ) which is only equal to around two mean free paths for the 2.61 MeV photons emitted by 208 Tl. Additionally, it is suspected that the Oxford blocks are affected by radon loss in proportions which might attain 10 % (Aitken, Pers. com., 2009 and[START_REF] Bowman | Thermoluminescent dating: the evaluation of radiation dosage[END_REF]. Such effects have to be accounted for in certain calculations, such as, for example, evaluating the factor between the nuclide content and the derived induced radiation dose rate (Soumana, 1993, Rhodes and[START_REF] Rhodes | Dose rate and radioisotope concentrations in the concrete calibration blocks at Oxford[END_REF].

However, the inner radioactivity of naturally occurring rocks is not determined in the course of construction, as it can be theoretically with doped blocks; this can be a drawback for certain experiments using rocks.

So, since the beginning of the 80's, a dozen of boreholes were drilled in a variety of rocks whose bare surface was exposed either naturally or by human action. These different sites are situated within a distance shorter than 25 km from the laboratory. Recently, in order to reduce the distance to be travelled for experiments, two large blocks, weighting 10.5 t and 9.5 t were transported close to the laboratory (Fig. 1). On the other hand, some sites are no longer accessible at present, so that 8 reference rocks are currently available (and possibly 2 more, slightly less convenient). The boreholes are horizontal, they have a diameter of 70 mm and a length between 0.39 m and 1.5 m. The cores extracted in the course of drilling were crushed and homogenized before being distributed among several laboratories for elemental analyses, including nuclide assessment. Some of the nuclides analyses gave rise to inter-laboratory comparisons [START_REF] Faïn | Intercomparaisons dosimétriques dans le cadre de la datation par thermoluminescence et par résonance paramagnétique électronique : validation de milieux naturels témoins de la région de Clermont-Ferrand, Puy-de-Dôme, France[END_REF]. Dose rates in the different rocks were derived from the nuclide contents. Dose rate measurements were also performed in situ, in the holes, by independently calibrated means including TL dosimeters and NaI gamma probes.

The present paper is aimed at giving updated data for those reference media and at presenting two examples of their use. The first one concerns the calibration of a field probe for gamma dose rate measurements. The second one is a simple and advantageous method for TL dosimetry, where the reference rocks are used as radiation-dose-sources, avoiding the use of a laboratory calibrated source.

-Data concerning the reference rocks

The reference rocks include two granites, one sandstone and six lavas (Table 1). Apart from the two blocks settled close to the laboratory (C341 and C347), the rocks do not appear as free blocks, but as outcrops in geologic massive formations. Homogeneity at the metre scale around the boreholes is assumed from the geological nature of the rocks, which are not bedded, and from visual inspection. The water content is nil, or low but stable. Certain lavas are porous; however the pores are not interconnected, so that time-variation in water content is not possible. Although the holes are horizontal, they may sometimes be wet inside, due to rain, but this cannot affect the dose rate.

(Table 1 here) The nuclide contents of the rocks were assessed by various laboratory methods, comprising: low background gamma spectrometry, ICP-MS, NAA and flame photometry (for K). 230 Th was measured by means of alpha spectrometry for recent lavas since these can show a slight disequilibrium in the U-series.

The nuclide contents were also verified in situ for C341 and C347 by using a NaI gamma probe. The laboratories or persons who participated to the measurements are listed in Annex 1.

(Table 2 here).

The gamma dose rates in the different media were calculated on the basis of the conversion coefficients published by Adamiec and [START_REF] Adiamec | Dose-rate conversion factors: update[END_REF], and the updated coefficients given by Guérin and Mercier (submitted) for 40 K and Th-series. Allowance was made for disequilibrium where necessary. The cosmic contribution was evaluated using the data of [START_REF] Prescott | Cosmic ray contributions to dose rates for luminescence and ESR dating: large depths and long-term variations[END_REF].

Radon loss has not been specifically measured. It has been considered as negligible for all the rocks, because of their compactness and it has been indirectly verified by the good agreement between the calculated dose-rates and the in situ measured dose-rates. Moreover, the activity ratios 210 Pb/ 226 Ra for the rocks are not significantly differing from 1.

(Table 3 here)

-Application to the calibration of a portable gamma spectrometer

The Clermont reference rocks were used for calibrating a probe aimed at being a convenient tool for gamma dose rate determinations in the field. The detecting cell of the probe is made of a 1.5" x 1.5" scintillation crystal (LaBr 3 ). According to the manufacturer (Canberra), this material exhibits a higher detection efficiency and a higher resolution than the more classical NaI(Tl) crystals. An example of spectrum recorded in a cubic block made of building bricks (side: 1.5 m) available at the CRP2A laboratory (Bordeaux) is given in Fig. 2. However, this probe has the disadvantage of a relatively high background (Fig. 2), due to the presence of the 138 La isotope in the crystal lattice which generates  rays at 1436 and 789 keV, this second emission following a beta decay (end-point energy: 255 keV) that induces counts in the 789-1044 keV range. Thus, in the background spectrum, one also notices the presence of a line at 1461 keV, probably due to the summation of gamma rays of 1436 keV and X-rays following electron capture, as well as peaks related to the Th-series.

Countings were performed with this probe in the following Clermont reference rocks: C347, C341, PEP, LMP, MAZ and GOU, as well as in the Bordeaux block of bricks in order to get a point at ~2000 µGy/a. As each spectrum is a mixture of -rays coming from the 40 K and Uand Th-series, we analyzed the spectra in applying two threshold techniques (Guérin and Mercier, submitted). With the first technique, the total number of pulses above a fixed threshold was cumulated and counted. This threshold value was determined with the Geant4 code simulating a LaBr 3 cell (encapsulated in a 1 mm thick duraluminium layer) placed in infinite media. These media had various compositions similar to sediments rich in carbonates, silicates, organic materials or lavas; the different radio-emitters -40 K and those of the U-and Th-series-were distributed uniformly. According to these Monte-Carlo simulations, the number of counts detected per unit time by the LaBr 3 cell above an energy of 300 keV (Σ Ni , E > 300 keV), normalized to 1 µGy/a, is independent of whether the -rays originated from K, U or Th, and this value was then used as the low threshold. A high threshold of 2800 keV was set in order to eliminate the cosmic contribution to the counts (see [START_REF] Prescott | Cosmic ray dose rates for luminescence and ESR dating: measured with a scintillation counter[END_REF]. Fig. 3 shows the total count above this threshold between 300 keV and 2800 keV as a function of the gamma dose-rate, indicating that 0.0338 ± 0.008 counts per second for a 1 µGy/a dose-rate are detected with this probe.

The analysis of the same simulated data indicated that above 165 keV, the sum of the energy per unit time i.e. Σ Ni. Ei (which is, for each channel, the product of the number of counts in this channel with the corresponding energy) is also independent when normalized to 1 µGy/a, of the origin of the gamma-rays. In applying this second threshold technique, a larger part (about twice in counts number) of the recorded spectrum is used, which improves the counting statistics used for the dose rate determination. Moreover, Guérin and Mercier showed that this technique is less sensitive than the previous one to the repartition of the gamma dose-rate between 40 K and the U-and Th-series. The same Geant4 simulations indicated that this technique is also nearly insensitive to the medium composition.

With this second technique, a good linearity was found between the signals (Σ Ni . Ei) and the gamma dose rates (Fig. 4).

-In situ TL dosimetry using the reference rocks

.

-1 Verification of the consistency of the dose-rate data.

A campaign of TL dosimetry was especially devoted to check the internal consistency of the dose-rate data (Table 3). For that purpose, powdered Al 2 O 3 :C (provided by Landauer Inc., Stillwater Crystal Growth Division) was used (grain size : 200-315 m). The Clermont laboratory routine dosimeter consists of a stainless steel tube (1.5 mm thick, 0.25 cm 3 of capacity) completely filled with the zeroed powder. The cap is maintained in place by a heat shrinkable tube, slightly longer than the steel tube (+ 1 cm at both ends). When in place and very hot, the shrinkable tube is pinched at both ends so as to form a water proof bag around the steel tube, in the form of a sweet paper.

Such dosimeters were inserted in the holes for a few months and they were afterwards measured in the laboratory, all at the same time. The intensities of the TL peaks were plotted against the known dose rates (Fig. 5). No correction was applied to the results, because possible undesirable effects, like self dose and fading, would be exactly the same for all the dosimeters and are therefore not supposed to affect the linearity of the curve. However, this is not true for attenuation by the walls of the tube, which actually depends both on the gamma spectrum -that is the respective proportions of U, Th and K in the rocks -and on the composition of the rock (see e.g., Valladas, 1982[START_REF] Faïn | Environmental Gamma Dosimetry using TL dosimeters : efficiency and absorption calculations[END_REF]. The exact attenuation in the different media for the given configuration has not been computed yet. It can be expected from preliminary results that the difference of attenuation between the samples is in the range 0 -3 %.

A good correlation between TL and estimated dose-rates was obtained (Fig. 5), thus proving the validity of the data.

-2 TL dosimetry

Routine methods for evaluating the dose acquired in situ by a TL dosimeter imply the use of a calibrated radiation-source (X, beta or gamma) for getting the correspondence: TL vs dose.

Conversion of the measured equivalent dose in terms of in situ annual dose may require application of correction factors such as those evoked above for fading or self-dose; such corrections are routinely made by certain laboratories. Moreover, it necessitates a precise knowledge of the dose-rate delivered by the laboratory source. So, inevitably, errors and uncertainties accumulate in the conversion. To overcome such problems, the Clermont TL group proceeds as follows.

When a set of dosimeters is to be placed in sites to be dated, 3 more dosimeters are prepared and placed in 3 of the 8 reference boreholes at the same time. After the dosimeters have been collected months later, all the phosphors are measured at the same time. Then, the TL intensities are plotted vs annual dose for the three known ones. The dose-rates in the different measured sites are then obtained by a simple interpolation (Fig. 6). The overall uncertainty (systematic + statistic) on the result is estimated at 4.5 % of the annual radiation dose. The 3 reference rocks that have been chosen are C341, C347 and PEP, considering the advantages of such choice: (i) the representative points on the initial experiment (see Fig. 4) are on the mean regression straight-line (least squares method), thus meaning that the dose-rates have been correctly evaluated for those 3 holes; (ii) the dose-rates are significantly different from each other, allowing exploration a large domain of dose-rates and, (iii) the sites are the most convenient, being the closest to the laboratory.

-3 Discussion of the method

The method offers advantages that have already been mentioned: several possible sources of error with the standard techniques have no effect here because they are the same for all the dosimeters and, accordingly, they are automatically corrected for by the interpolation. The method avoids the use of a laboratory source, with the relevant difficulties (authorization and Soumana, S., Faïn, J., Miallier, D., Montret, M., Pilleyre, T., Sanzelle, S., and Akselrod, M. (1994) Gamma and enclosure dosimetry for TL/ESR dating with the new AL2O3:C TL dosemeter. Radiat. Meas., 23, 501-505. Valladas, G., (1982). Mesure de la dose annuelle de l'environnement d'un site archéologique par un dosimètre TL, PACT 6, 77-85.

Table captions

Table 1 : Composition and nature of the reference rocks.

Table 2: Nuclide contents of the reference rocks. The ratios 230 Th/ 238 U and 226 Ra/ 230 Th are given for activities. For the older rocks, PEP, LAS, LMP, MPX, and C347, these ratios were not measured; they were inferred from the ages of the rocks (3 Ma for the youngest one, LMP). Uncertainties are quoted at the 95% level of confidence.

Table 3: Gamma and cosmic dose-rates in the reference rocks. Gamma dose-rates were calculated using the data of Adamiec and Aitken (1998) revised for 40 K and Th-series by Guérin and Mercier (submitted). Cosmic dose-rate was derived from the data of [START_REF] Prescott | Cosmic ray contributions to dose rates for luminescence and ESR dating: large depths and long-term variations[END_REF]. Figure 2: Time-normalized spectra (1000 s) recorded with a LaBr3 probe placed in the block of bricks available at CRP2A (BDX-gamma dose rate= 2010±35 µGy/a) and in a lead housing (Background). High resolution gamma spectrometry performed on bricks used for building the CRP2A block allowed determination of their average radioisotopic contents : U( 238 U)=4.27±0.68 ppm, U( 226 Ra)=4.10±0.14 ppm, Th= 13.7±0.3 ppm, K=3.50±0.05%. Note that the Y-scale is logarithmic. 3). The upper discrimination level was fixed at 2800 keV, in order to eliminate the counts due to cosmic rays sum all the gamma counts. Notice the good linearity and that the intercept is compatible with 0.

Figure captions

Figure 1 :

 1 Figure 1: Drilling the block of granite C347, weighting 9500 kg.

Figure 3 :

 3 Figure 3 : Net counts per second (ΣNi for E> 300 keV) deduced from measurements in the Clermont reference rocks and in the Bordeaux block of bricks as a function of the gamma dose-rate (see values in Table3). The upper discrimination level was fixed at 2800 keV, in order to eliminate the counts due to cosmic rays sum all the gamma counts. Notice the good linearity and that the intercept is compatible with 0.

Figure 4 :

 4 Figure 4 : Time-normalized signal (ΣNi. Ei for 165 keV < E < 2800 keV) deduced from measurements in the Clermont reference rocks and in the Bordeaux block of bricks as a function of the gamma dose-rate. The background was subtracted after time normalization.

Figure 5 :

 5 Figure 5: Plot of TL signal vs dose-rate for 8 reference rocks Figure 6: Plot of TL signal vs dose-rate for 3 selected reference rocks (C341, C347 and PEP) based on a different campaign of measurements than the one for Fig.5. The dotted line shows

  Figure 1

Table 1 Reference [U] ppm ± [Th] ppm ± 230 Th/ 238 U 226 Ra/ 230 Th

 1

												H 2 O	H 2 O
	Reference SiO 2	Al 2 O 3	Fe 2 O 3	MgO	CaO	Na 2 O	K 2 O	TiO 2 P 2 O 5 MnO	(1000°C)	(110°C) total	Nature
	PEP	60.0	16.2	5.6	2.85	3.19	3.36	4.63	0.84		0.08	2.1	0.11	98.96	granite
	LAS	49.5	16.0	10.6	5.67	8.68	4.21	2.33	2.25		0.18	0.21	0.26	99.89	basalt
	LMP	42.9	12.6	12.8	10.6	11.1	2.64	0.87	2.84		0.17	2.1	1.06	99.75	basalt
	MPX	86.0	6.89	0.83	0.11	0.07	0.19	3.08	0.05		0.01	1.35	0.1	98.59	sandstone
	MAZ	49.19	17.13	12.12	4.69	8.47	4.36	2.24	2.39		0.2	0	0.33	100.07 trachyandesite
	GOU	54.9	18.2	7.91	2.25	5.47	5.4	3.13	1.38		0.22	0	0.03	98.9	trachyandesite
	C 347	73.09	15.05	1.45	0.38	0.89	3.62	4.27	0.13	0.19		0.82		99.79	granite
	C 341	46.95	16.67	12.15	6.16	9.59	3.71	1.65	2.44	0.57	0.19	0.17		100.28 trachybasalt

Table 3

 3

Acknowledgements

We are grateful to Professor Martin Aitken for revision of the manuscript and useful comments.

calibration). Moreover, the number of TL (or OSL) measurements is limited: for N dosimeters, the total number of useful series of measurements is N+3 only (a "series "corresponds to the several measurements necessary for reducing statistical uncertainty for a given sample). Additionally, there is no need to measure the background (noise) or to worry about possible spurious signal.

However, the drawback of the method is that the sites of application must not be too far away from the laboratory. For remote sites, it is necessary to introduce complementary measurements for evaluating the travel-dose; in any case, the in situ duration must be long enough for the corresponding dose to be significantly higher than the travel-dose.

Improvements of the method could consist: (i) in using a housing that would induce less dependence of the dose acquired by the TL phosphor on the composition of the measured medium and (ii), in evaluation of the attenuation for a given medium with, e.g., a Monte Carlo code. Note that this applies to the standard methods too.

-Conclusions

The reference rocks established around the Clermont laboratory can be considered as a convenient tool for various dosimetric experiments. The accuracy and precision of the data published in the present paper can still be improved by new independent measurements, either in the boreholes or in the assessment of the nuclide content of samples from the cores.


Benjamin Jourdain
email: jourdain@cermics.enpc.fr

Mohamed Sbai
email: sbai@cermics.enpc.fr

Coupling Index and stocks

come

Introduction

From the early eighties, when trading on stock index was introduced, quantitative finance faced the problem of efficiently pricing and hedging index options along with their underlying components. Many advances have been made for single stock modeling and a variety of solutions to escape from the very restrictive Black & Scholes model has been deeply investigated (such as local volatility models, models with jumps or stochastic volatility models). However, when the number of underlyings is large, index option pricing, or more generally basket option pricing, remains a challenge unless one simply assumes constantly correlated dynamics for the stocks. The problem then is the impossibility of fitting both the stocks and the index smiles.

We try to address this issue by making the dynamics of the stocks depend on the index. The natural fact that the volatility of the index is related to the volatilities of its underlying components has already been accounted for in the works of Avellaneda et al. [START_REF] Avellaneda | Reconstructing volatility[END_REF] and Lee et al. [START_REF] Lee | Index volatility surface via moment-matching techniques[END_REF]. In the first paper, the authors use a large deviation asymptotics valid for small values of the product of the maturity by the square of the volatility to reconstruct the local volatility of the index from the local volatilities of the stocks. They express this dependence in terms of the implied volatilities using the results of Berestecky et al. ([4], [START_REF] Berestycki | An inverse parabolic problem arising in finance[END_REF]). In the second paper, the authors reconstruct the Gram-Charlier expansion of the probability density of the index from the stocks using a moments-matching technique. Both papers consider local volatility models for the stocks and a constant correlation matrix but the generalization to stochastic volatility models or to varying correlation coefficients is not straightforward.

Another point of view is to say that the volatility of a composing stock should be related to the index level, or say to the volatility of the index, in some way. This is not astonishing since the index represents 1 the move of the market and reflects the view of the investors on the state of the economy. Moreover, it is consistent with equilibrium economic models like CAPM. Following this idea, we propose a new modeling framework in which the volatility of the index and the volatilities of the stocks are related. We show that, when the number of underlying stocks tends to infinity, our model reduces to a local volatility model for the index and to a stochastic volatility model for the stocks where the stochastic volatility depends on the index level. This asymptotics is reasonable since the number of stocks composing an index is usually large. As a consequence, the correlation matrix between the stocks in our model is not constant but stochastic and we show that it is consistent with empirical studies. Finally, we address calibration issues and we show that it is possible, within our framework, to fit both index and stocks smiles. The method we introduce is based on the simulation of SDEs nonlinear in the sense of McKean, and non-parametric estimation of conditional expectations.

This paper is organized as follows. In Section 1, we specify our model for the index and its composing stocks and in Section 2 we study the limiting model when the number of underlying stocks goes to infinity. Section 3 is devoted to calibration issues. Numerical results are presented in Section 4 and the conclusion is given in Section 5.

Model Specification

An index is a collection of stocks that reflects the performance of a whole stock market or a specific sector of a market. It is valued as a weighted sum of the value of its underlying components. More precisely, if I M t stands for the value at time t of an index composed of M underlyings, then

I M t = M j=1 w j S j,M t , (1)
where S j,M t is the value of the stock j at time t and the weightings (w j ) j=1...M are given constants 2 . Unless otherwise stated, we always work under a risk-neutral probability measure. In order to account for the influence of the index on its underlying components, we specify the following stochastic differential equations for the stocks ∀j ∈ {1, . . . , M }, dS j,M t S j,M t = (rδ j )dt + β j σ(t, I M t )dB t + η j (t, S j,M t )dW j t , S j,M 0 = s j 0

where

• r is the short interest rate,

• s j 0 is the initial value of the stock j,

• δ j ∈ [0, ∞[ is the continuous dividend rate of the stock j,
• β j is the usual beta coefficient of the stock j that quantifies the sensitivity of the stock returns to the index returns (see the seminal paper of Sharpe [START_REF] Sharpe | Capital asset prices: A theory of market equilibrium under conditions of risk[END_REF]). It is defined as

Cov(rj ,rI )

V ar(rI ) where r j (respectively r I ) is the rate of return of the stock j (respectively of the index), As a consequence, the index satisfies the following stochastic differential equation :

dI M t = rI M t dt -   M j=1 δ j w j S j,M t   dt +   M j=1 β j w j S j,M t   σ(t, I M t )dB t + M j=1 w j S j,M t η j (t, S j,M t )dW j t (3)
Before going any further, let us make some preliminary remarks on this framework.

-We have M coupled stochastic differential equations. The dynamics of a given stock depends on all the other stocks composing the index through the volatility term σ(t, I M t ). Since there are M linearly independent assets and M + 1 driving Brownian motions, the market is incomplete.

-Accounting for the dividends is not relevant for all types of indices. Indeed, for many performancebased indices (such as the German DAX index) dividends and other events are rolled into the final value of the index.

-The cross-correlations between stocks are not constant but stochastic :

ρ ij (t) = β i β j σ 2 (t, I M t ) β 2 i σ 2 (t, I M t ) + η 2 i (t, S i,M t ) β 2 j σ 2 (t, I M t ) + η 2 j (t, S j,M t )
Note that they depend not only on the stocks but also on the index. More importantly, it is commonly observed that the more the market is volatile, the more the stocks tend to be highly correlated. This feature is reproduced here as we can easily check that an increase in the index volatility, with everything else left unchanged, produces an increase in the cross-correlations.

In a recent paper, Cizeau et al. [START_REF] Cizeau | Correlation structure of extreme stock returns[END_REF] show that it is possible to capture the essential features of stocks crosscorrelations, in particular in extreme market conditions, by a simple non-Gaussian one factor model. The authors successfully compare different empirical measures of correlation with the prediction of the following model :

r j (t) = β j r I (t) + ǫ j (t) (4)
where r j (t) =

S j t S j t-1
-1 is the daily return of stock j, r I (t) is the daily return of the market and the residuals ǫ j (t) are independent random variables following a fat-tailed distribution 3 .

3 The authors have chosen a Student distribution in their numerical experiments.

Our model is in line with (4). Indeed, since the beta coefficients are usually narrowly distributed around 1, the factor

M j=1 β j w j S j,M t of σ(t, I M t ) in (3) is close to I M t . Moreover, since      T 0 M j=1 w j S j,M t η j (t, S j,M t )dW j t   2    ≤ M j=1 w 2 j sup 1≤j≤M T 0 (S j,M t η j (t, S j,M t )) 2 dt ∼ M j=1 w 2 j T,
one can neglect the term M j=1 w j S j,M t η j (t, S j,M t )dW j t in the dynamics of the index when M j=1 w 2 j is small. Of course, this approximation worsens when the maturity T increases. The latter condition is satisfied when M is large and the weighting vector (w 1 , . . . , w M ) is close to the vector ( 1 M , . . . , 1 M ) with constant coefficients for which

M j=1 1 M 2 = 1 M .
Then, if we denote by r j the log-return of the stock j and by r I M the log-return of the index, both on a daily basis, we will have

r j = β j r I M + η j ∆W j + drift,
where ∆W j is an independent Gaussian noise. Consequently, in our model too, the return of a stock is decomposed into a systemic part driven by the index, which represents the market, and a residual part.

Asymptotics for a large number of underlying stocks

The number of underlying components of an index is usually large 4 . As discussed in the previous section, when M j=1 w 2 j is small, one can neglect the term M j=1 w j S j,M t η j (t, S j,M t )dW j t in (3) and derive a simplified approximate dynamics for the index. The aim of this section is to quantify the error we commit by doing so.

To be specific, consider the limit candidate (I t ) t∈[0,T ] solution of the following SDE :

dI t = (r -δ)I t dt + βI t σ(t, I t )dB t I 0 = i 0 (5)
where i 0 = M j=1 w j s j 0 and δ and β are two constant parameters that will be discussed later. In the following theorem, we give an upper bound for the L 2p -distance between (I M t ) t∈[0,T ] and (I t ) t∈[0,T ] under mild assumption on the volatility coefficients : Theorem 1 -Let p ∈ AE * . Under assumption (H1) and if the following assumptions on the volatility coefficients hold,

(H2) ∃K b such that ∀(t, s) ∈ [0, T ] × Ê + , |σ(t, s)| + |η j (t, s)| ≤ K b . (H3) ∃K σ such that ∀(t, s 1 , s 2 ) ∈ [0, T ] × Ê + × Ê + , |s 1 σ(t, s 1 ) -s 2 σ(t, s 2 )| ≤ K σ |s 1 -s 2 |. then sup 0≤t≤T |I M t -I t | 2p ≤ C T      M j=1 w 2 j   p +   M j=1 w j |β j -β|   2p +   M j=1 w j |δ j -δ|   2p   
where

C T = 8 2p-1 T p (T p + K p K 2p b )C p exp 4 2p-1 T (2 2p-1 K p T p-1 (βK σ ) 2p + (2T ) 2p-1 δ 2p + r 2p T 2p-1
) and

C p = max 1≤j≤M |s j 0 | 2p exp 2r + (2p -1)(max j≥1 β 2 j + 1)K 2 b pT .
According to this result proved in the appendix, the smaller P M w is small when the weighting vector (w 1 , . . . , w M ) is close to (

È (Y β = β j ) = w j M i=1 w i and È (Y δ = δ j ) = w j M i=1 w i . Then P M β = M i=1 w i × |Y β -β| and P M δ = M i=1 w i × |Y δ -δ| .
Consequently, the optimal choice of the parameters is the median The next theorem states that, under an additional assumption on the volatility coefficients, the L 2pdistance between a stock (S j,M t ) t∈[0,T ] and the solution of the SDE obtained by replacing I M by I

dS j t S j t = (r -δ j )dt + β j σ(t, I t )dB t + η j (t, S j t )dW j t , S j 0 = s j 0 (6)
is also controlled by 2p-powers of P M w , P M β and P M δ . One major drawback of the limiting simplified model ( 5)-(6) is that the limit index I t is only approximately equal to the reconstructed index level

I M t def = M j=1 w j S j
t . The next result also gives an estimation of the difference between I M and I M in terms of P M w , P M β and P M δ , which combined with the previous theorem, provides an estimation of the difference between I and I M .

Theorem 2 -Let p ∈ AE * . Under the assumptions of Theorem 1 and if

(H4) ∃K η such that ∀j, ∀(t, s 1 , s 2 ) ∈ [0, T ] × Ê + × Ê + , |s 1 η j (t, s 1 ) -s 2 η j (t, s 2 )| ≤ K η |s 1 -s 2 |. ∃K Lip such that ∀(t, s 1 , s 2 ) ∈ [0, T ] × Ê + × Ê + , |σ(t, s 1 ) -σ(t, s 2 )| ≤ K Lip |s 1 -s 2 |.
Then, ∀j ∈ {1, . . . , M },

sup 0≤t≤T |S j,M t -S j t | 2p ≤ C j T      M j=1 w 2 j   p +   M j=1 w j |β j -β|   2p +   M j=1 w j |δ j -δ|   2p    5
The median of a real random variable X is any real number m satisfying :

È(X ≤ m) ≥ 1 2
and È(X ≥ m) ≥ where

C j T = 6 2p-1 K p T p β 2p j C 1 2 2p K 2p Lip e 3 2p-1 ((r-δj) 2p T 2p-1 +KpT p-1 K 2p η +2 2p-1 KpT p-1 β 2p j K 2p b )T .
Moreover, for

I M t = M j=1 w j S j t , one has sup 0≤t≤T |I M t -I M t | 2p ≤ C T   M j=1 w j   2p      M j=1 w 2 j   p +   M j=1 w j |β j -β|   2p +   M j=1 w j |δ j -δ|   2p    where C T = max 1≤j≤M C j T .
The proof can also be found in the appendix. In the following corollary, we consider the limit M → ∞ supposing that the weight of the j-th stock, now denoted by w M j , depends on M .

Corollary 3 -Under the assumptions of Theorems 1 and 2 and if

(H5) there exists a finite constant A such that max j≥1 (s j 0 ) 2 + (β j ) 2 + (δ j ) 2 ≤ A, (H6) I M 0 = M j=1 w M j s j 0 -→ M→∞ i 0 ∈ (0, +∞), ( H7
) P M w = M j=1 (w M j ) 2 -→ M→∞ 0, ( H8
) P M β = M j=1 w M j |β j -β| -→ M→∞ 0, ( H9
) P M δ = M j=1 w M j |δ j -δ| -→ M→∞ 0,
then, for any p ∈ AE * , one has

sup 0≤t≤T |I M t -I t | 2p -→ M→∞ 0 and ∀j ∈ AE * , sup 0≤t≤T |S j,M t -S j t | 2p -→ M→∞ 0. If, in addition, sup M M j=1 w M j < ∞, then sup 0≤t≤T |I M t -I M t | 2p -→ M→∞ 0.
Assumptions (H6), (H7), (H8) and (H9) hold for instance when w M j = 1 M for 1 ≤ j ≤ M and s j 0 -→ j→∞ i 0 , β j -→ j→∞ β and δ j -→ j→∞ δ.

Simplified model

To sum up, we have shown that, under mild assumptions, when the number of underlying stocks is large, the original model may be approximated by the following dynamics ∀j ∈ {1, . . . , M },

dS j t S j t = (r -δ j )dt + β j σ(t, I t )dB t + η j (t, S j t )dW j t dI t I t = (r -δ I )dt + σ(t, I t )dB t . (7)
Of course the distance between this limiting model and the original one increases with the maturity. Interestingly, we end up with a local volatility model for the index and, for each stock, a stochastic volatility model decomposed into a systemic part driven by the index level and an intrinsic part. The calibration procedures presented in the next section are based on this intuition : even in the original model, we are going to calibrate σ as if it was the local volatility function of the index.

Note that this simplified model is not valid for options written on the index together with all its composing stocks since the index is no longer an exact, but an approximate, weighted sum of the stocks. In this case, one should consider the reconstructed index

I M t = M j=1 w j S j
t or use the original model. The simplified model can be used for options written on the stocks or on the index or even on the index together with few stocks.

Model calibration

Calibration, which is how to determine the model parameters in order to fit market prices at best, is of paramount importance in practice. In the following, we try to tackle this issue for both our simplified and original models.

Simplified model

In the simplified limiting model, the only factor which influences the dynamics of a given stock is the simplified index I t which evolves according to an autonomous SDE. So it is enough to address the calibration of a given stock together with the index and we drop the index j of the stock for notational simplicity.

dS t S t = (r -δ)dt + β σ(t, I t )dB t + η(t, S t )dW t , S 0 = s 0 dI t I t = (r -δ I )dt + σ(t, I t )dB t , I 0 = i 0 . (8)
The short interest rate and the dividend yields can be extracted from the market. The calibration of the local volatility function σ to fit index option prices is a classical problem. According to Dupire [START_REF] Dupire | Pricing with a smile[END_REF], if C I (t, K) denotes the market price of the call option with maturity t and strike K written on the index, then for

σ 2 (t, K) = 2 ∂CI ∂t (t, K) + (r -δ I )K ∂CI ∂K (t, K) + δ I C I (t, K) K 2 ∂ 2 CI ∂K 2 (t, K) , one has C I (t, K) = (e -rt (I t -K) + ) for all t, K > 0.
Of course, in practice the market quotes call options only for a finite number of couples (t, K). What seems a common practice among banks is to look for σ in a parametric family of functions and compute the parameters minimizing the distance between these quoted prices and the call prices associated with the parametrized local volatility function. Since each practitioner may choose his favorite procedure to address this classical problem of local volatility calibration, we will not enter in more details.

We also assume that a local volatility function is associated with the stock by the same procedure and denote by v loc (t, x) the local variance function of the stock computed as the square of this local volatility function. So the local volatility model

dS t S t = (r -δ)dt + v loc (t, S t )dW t , S 0 = s 0 (9)
is calibrated to the quoted prices of vanilla options written on the stock. In [START_REF] Cizeau | Correlation structure of extreme stock returns[END_REF], by independence between B and W , the variance of the stock at time t is equal to β 2 σ 2 (t, I t ) + η 2 (t, S t ). According to Gyöngy [START_REF] Gyöngy | Mimicking the one-dimensional marginal distributions of processes having an Itô differential[END_REF], if

∀t, x > 0, β 2 σ 2 (t, I t ) + η 2 (t, S t )|S t = x = v loc (t, x)
then [START_REF] Cizeau | Correlation structure of extreme stock returns[END_REF] and the local volatility model ( 9) induce the same marginal distributions for the stock and therefore the same prices for the vanilla call options written on it : (e -rt (S t -K)

+ ) = e -rt (S t -K) + for all t, K > 0. Hence if ∀t, x > 0, η(t, x) = v loc (t, x) -β 2 (σ 2 (t, I t )|S t = x), (10)
then the stock dynamics in ( 8) is calibrated to the quoted prices of the vanilla options written on the stock. It remains to choose the coefficient β and the function η so that this equality is satisfied. The fact that the law of (S t , I t ) given by ( 8) and therefore the conditional expectation in [START_REF] Dupire | Pricing with a smile[END_REF] depend on (β, η) makes this problem difficult. Nevertheless, intuitively, when one fixes a value of β that is not too large, one should be able to find a function η such that ( 10) is satisfied. The calibration of the stock smile seems over-parametrized and one should rely on the interpretation of β as a regression coefficient to choose its value. This issue is discussed in the next section. Then we explain how to approximate the conditional expectation and deduce η for a fixed value of β.

Let us already point out that the calibration of our simplified model gives an advantage to the fit of index option prices in comparison with options written on the stocks, which is in line with the market since index options are usually very liquid in comparison with individual stock options.

Choice of the coefficient β

The interpretation of β as the regression coefficient of the log-returns of the stock with respect to the log-returns of the index makes it possible to estimate this coefficient on historical data. Nevertheless, when the historical estimator β hist is large, then the difference in the r.h.s. of (10) may become negative for some (t, x) when β = β hist . Then the square root is no longer defined and calibration for this choice of β is no longer possible.

In Figure 1, we have plotted the local volatility of the stock x → v loc (T, s 0 x), the local volatility of the index x → σ(T, i 0 x), the systemic part of the volatility of the stock x → β hist σ(T, s 0 x) and x → β hist (σ 2 (T, I T )|S T = s 0 x) when η is set to zero (which intuitively gives the lowest local volatility function of the stock that one can obtain in our model ( 8)) as functions of the moneyness for a maturity T = 1 year. We considered three representative components of the Eurostoxx which is composed of M = 50 stocks : AXA, ALCATEL and CARREFOUR at December 21, 2007. We made this choice deliberately in order to point out the extreme situations that one can face :

• AXA is an example of a stock with a high historical beta coefficient (β hist = 1.4),

• CARREFOUR is an example of a stock with a low historical beta coefficient (β hist = 0.7),

• ALCATEL is an example of a stock with a high volatility level but with a rather flat smile (β hist = 1.1).

Clearly, we can deduce that the market is choosing a β coefficient for both AXA and ALCATEL that is lower than the historical one whereas, for CARREFOUR, one can plug the historical β, or even a larger one, in [START_REF] Cizeau | Correlation structure of extreme stock returns[END_REF] and still be able to calibrate the model. A satisfactory way to handle the estimation of the beta coefficient would be to compute an implied beta calibrated to the prices of options involving the correlation between the stock and the index. Unfortunately, no such option is liquid in the market (the most liquid correlation swaps are sensitive to an average correlation between all the stocks composing the index).

So we suggest to choose

β = min β hist , inf t,x>0 v loc (t, s 0 x) σ(t, i 0 x) . (11)
Even if we have no proof that this choice of beta makes the calibration possible, it is sensible and we have checked that it works on the three examples of AXA, ALCATEL and CARREFOUR. When one is interested in options written on the index together with all its components, one should use the reconstructed index level

I M t = M j=1 w j S j t instead of I t .
Of course, the reconstructed index dynamics will reproduce the quoted prices of vanilla options written on the index all the better as I M t is close to the calibrated limiting index level I t . According to Theorems 1 and 2, for this latter property to hold, one needs P M β=1 = M j=1 w j |β j -1| ≥ | M j=1 w j β j -M j=1 w j | to be small. When, because of the minimum in equality [START_REF] Gyöngy | Mimicking the one-dimensional marginal distributions of processes having an Itô differential[END_REF], P M β=1 is larger for the actual choice of coefficients β than for the historical choice, one may take larger values of beta for stocks like CARREFOUR to decrease P M β=1 and improve the calibration of the reconstructed index.

Estimation of the conditional expectation

The idea behind the following techniques is to circumvent the difficulty of calibrating the volatility coefficient η. Indeed, if we plug the formula [START_REF] Dupire | Pricing with a smile[END_REF] in [START_REF] Cizeau | Correlation structure of extreme stock returns[END_REF], we obtain a stochastic differential equation that is nonlinear in the sense of McKean :

dS t S t = (r -δ)dt + β σ(t, I t )dB t + v loc (t, S t ) -β 2 (σ 2 (t, I t ) | S t )dW t , S 0 = s 0 dI t I t = (r -δ I )dt + σ(t, I t )dB t , I 0 = i 0 . (12)
For an introduction to the stochastic differential equations nonlinear in the sense of McKean and to propagation of chaos, we refer to the lecture notes of Sznitman [START_REF] Sznitman | Topics in propagation of chaos[END_REF] and Méléard [START_REF] Méléard | Asymptotic behaviour of some interacting particle systems; McKean-Vlasov and Boltzmann models[END_REF]. In our case, the nonlinearity appears in the diffusion coefficient through the conditional expectation term. This makes the natural question of existence and uniqueness of a solution very difficult to handle. The case of a drift coefficient involving a conditional expectation has only been handled recently even for a constant diffusion coefficient (see for instance Talay and Vaillant [START_REF] Talay | A stochastic particle method with random weights for the computation of statistical solutions of McKean-Vlasov equations[END_REF] and Dermoune [START_REF] Dermoune | Propagation and conditional propagation of chaos for pressureless gas equations[END_REF]). Meanwhile, it is possible to simulate such a stochastic differential equation by means of a system of N interacting paths using either a non-parametric estimation of the conditional expectation or regression techniques. The advantage of the regression approach over the non-parametric estimation is that it also yields a smooth approximation of the function x → σ 2 (t, I t ) | S t = x whereas, with a non-parametric method, one has to interpolate the estimated function and to carefully tune the window parameter to obtain a smooth approximation.

3.1.2a Non-parametric estimation

Non-parametric estimators of the conditional expectation, and more generally non-parametric density estimators, have been widely studied in the literature. We will focus on kernel estimators of the Nadaraya-Watson type (see [START_REF] Watson | Smooth regression analysis. Sankhyā (Statistics)[END_REF] and [START_REF] Nadaraya | On estimating regression[END_REF]) : given N observations (S i,t , I i,t ) i=1...N of (S t , I t ), we consider the kernel conditional expectation estimator of

σ 2 (t, I t ) | S t = x given by N i=1 σ 2 (t, I i,t )K x -S i,t h N N i=1 K x -S i,t h N
where K is a non-negative kernel such that Ê K(x)dx = 1 and h N is a smoothing parameter which tends to zero as N → +∞. This leads to the following system with N interacting particles :

∀ 1 ≤ i ≤ N,        dSi,N,t Si,N,t = (r -δ)dt + β σ(t, I i,t )dB i,t + v loc (t, S i,N,t ) -β 2 P N j=1 σ 2 (t,Ij,t)K " S i,N,t -S j,N,t h N " P N j=1 K " S i,N,t -S j,N,t h N " dW i,t , S i,N,0 = s 0 dIi,t
Ii,t = (rδ I )dt + σ(t, I i,t )dB i,t , I i,0 = i 0 (13) where (B i , W i ) i≥1 is a sequence of independent two-dimensional Brownian motions. The integer i indexes the sample-paths of the fixed stock that we consider. In their dynamics, the conditional expectation term has been replaced by interaction. The price in the calibrated model of a European option with maturity T and payoff function h : C([0, T ], Ê) → Ê written on the stock may be approximated by

1 N N i=1 e -rT h(S i,N,. ). ( 14
)
The 2N -dimensional SDE may be discretized using the Euler scheme. Let n ∈ AE * and 0

= t 0 < • • • < t n = T be the subdivision with step T n of [0, T ]. For each k ∈ {0, . . . , n -1}, ∀ 1 ≤ i ≤ N,                    S i,N,t k+1 = S i,N,t k 1 + v loc (t k , S i,N,t k ) -β 2 P N j=1 σ 2 (t k ,Ij,t k )K " S i,N,t k -S j,N,t k h N « P N j=1 K " S i,N,t k -S j,N,t k h N « T n Gi,k + (r -δ) T n + β σ(t k , I i,t k ) T n G i,k I i,t k+1 = I i,t k 1 + (r -δ I ) T n + σ(t k , I i,t k ) T n G i,k
where (G i,k ) 1≤i≤N,0≤k≤n-1 and ( Gi,k ) 1≤i≤N,0≤k≤n-1 are independent centered and reduced Gaussian random variables.

3.1.2b Parametric estimation

Another approach to estimate conditional expectations is to use parametric estimators, or projection. This idea has also been widely used and studied previously (for example in finance, one can think of the Longstaff-Schwartz algorithm for pricing American options [START_REF] Longstaff | Valuing American options by simulation: a simple least-squares approach[END_REF]). Noting that the conditional expectation is a projection operator on the space of square integrable random variables, one can approximate σ 2 (t, I t ) | S t = x by the parametric estimator L l=1 α l f l (x) where (f l ) l=1...L is a functional basis and α = (α l ) l=1...L is a vector of parameters estimated by least mean squares : given N observations (S i,t , I i,t ) i=1...N of (S t , I t ), α minimizes

N i=1 σ 2 (t, I i,t ) - L l=1 α l f l (S i,t ) 2 .

Numerical results

3.1.3a A toy example

We try to calibrate a stock with a local variance function v loc constant and equal to v. We choose σ as the local volatility function of the Eurostoxx index fitted to the market at December 21, 2007. We simulate the system of N interacting paths [START_REF] Lee | Index volatility surface via moment-matching techniques[END_REF] and price call options for different strikes using [START_REF] Longstaff | Valuing American options by simulation: a simple least-squares approach[END_REF]. In Figure 2, we plot the implied volatility at T = 1 obtained for independent simulations of N = 5000 paths and see that they are indeed close to the desired volatility level √ v. This example was generated with the following arbitrary set of parameters : S 0 = 100, β = 0.7, r = 0.05, δ = δ I = 0, √ v = 0.6, N = 5000, n = 20.

In this example and for all the following numerical experiments, we use a Gaussian kernel :

K(u) = 1 √ 2π e -u 2 2
. The smoothing parameter h N is set to N -1 5 which is the optimal bandwidth that one obtains when minimizing the asymptotic mean square error of the Nadaraya-Watson estimator under some regularity assumptions and assuming independence of the random variables involved (see for example Bosq [START_REF] Bosq | Nonparametric statistics for stochastic processes[END_REF]).

3.1.3b An example with real data

In the following, we test our model with real data. More precisely, given the local volatilities of the Eurostoxx index and of Carrefour at December 21, 2007, we simulate [START_REF] Karatzas | Brownian motion and stochastic calculus[END_REF] by different methods for a one year maturity.

An acceleration technique

The simulation of the particle system is very time consuming : for each discretization step and for each stock particle, one has to make N computations which yield a global complexity of order O(nN 2 ) where n is the number of time steps in the Euler scheme. Acceleration techniques are thus desirable. One possible method consists in reducing the number of interactions : instead of making N computations for each estimation of the conditional expectation, one can neglect interactions which involve particles which are far away from each other. When the kernel used is non increasing with the absolute value of its argument, the easiest way to implement this idea is to sort the particles at each step and, whenever a contribution of a particle is lower than some fixed threshold, to stop the estimation of the conditional expectation.

Of course, by doing this, we lose in precision for the same number of interacting particles, especially for deep in/out of the money strikes. But what we gain in terms of computation time is much more important : in Figure 3, we plot the implied volatility obtained by the naive method and the method with the above acceleration technique for the same number N = 10000 of particles. We take as threshold 1 N and set h N = N -1 10 for the bandwidth parameter 6 and n = 20 for the number of time steps in the Euler scheme. The computation time, on a computer with a 2.8 Ghz Intel Penthium 4 processor, is of 52 minutes for the naive method and of 5 minutes for the accelerated one. More importantly, we see that the implied volatility σ N obtained by simulation of the system with N interacting particles converges to the exact implied volatility σ exact computed from quoted option prices as N tends to ∞ : see Figure 4 and Table 2. With a reasonable number of simulated paths, N = 200000, the error on the implied volatility remains clearly tolerable for practitioners (of the order of 10 bp) except for a deep in the money call (K = 0.3S 0 ) where it attains 195 bp.

Moneyness (

Independent particles

Unlike the parametric method, non-parametric estimation of the conditional expectation gives the value of the intrinsic volatility η at the simulated points only. However, using an interpolation technique, one can first reconstruct η with N 1 dependent particles and then simulate N 2 independent paths of the 2-dimensional stochastic differential equation [START_REF] Cizeau | Correlation structure of extreme stock returns[END_REF]. By doing so, we speed up the simulations but one has to choose carefully the size N 1 of the particle system in order to have a reasonable estimation of the intrinsic volatility and to tune the bandwidth parameter in order to smooth the estimation (our numerical tests were done with

N 1 = 1000, N 2 = 100000 and h N1 = N -1 10 1
). In Figures 5 and6, we plot the local volatility function v loc (t, x) and the intrinsic volatility function η(t, x) of the stock. This latter is used to draw independent simulations of the index along with the stock and we see in Figure 7 that the implied volatility obtained is close to the right one, especially near the money.

Original model

We now turn to the calibration of our original model :

∀j ∈ {1, . . . , M }, dS j,M t S j,M t = (r -δ j )dt + β j σ(t, I M t )dB t + η j (t, S j,M t )dW j t with I M t = M i=1 w i S i,M t . (15)
It is rather complicated to have a perfect calibration for both index and stocks within this framework. Nevertheless, Theorem 1 ensures that the error of calibration of the index smile is small (at least when the maturity is not too large) when σ is chosen as a local volatility function fitted to this smile. We also suppose that a local volatility function v j loc has been fitted to the market smile of each stock j. For the choice of the coefficients β j , we proceed like in Section 3.1.1. The coefficients η j (t, x) = v j loc (t, x)β 2 j (σ 2 (t, I M t )|S j,M t = x) are then calibrated all at the same time using an adaptation of the non-parametric method presented above based on the simulation of N interacting (M + 1)-dimensional paths.

In comparison with the simplified model, we introduce in the calibration of the index a small error which grows with the maturity T . But we guarantee the additivity constraint

I M t = M i=1 w i S i,M t
. Note that a similar error spoils the calibration of the reconstructed index in the simplified model (see the discussion at the end of Section 3.1.

1).

In what follows, we illustrate the effect of Theorems 1 and 2 and compare our models with a constant correlation model.

Illustration of Theorems 1 and 2 and comparison with a constant correlation model

The objective of this section is to compare index and individual stock smiles obtained with three different models : our original model ( 15), the simplified one (after letting M → ∞) and a model with constant correlation coefficient. More precisely, we consider the following dynamics 1. The original model ∀j ∈ {1, . . . , M },

dS j,M t S j,M t = rdt + σ(t, I M t )dB t + η(t, S j,M t )dW j t with I M t = M i=1 w i S i,M t . (16)
2. The simplified model ∀j ∈ {1, . . . , M },

dS j t S j t = rdt + σ(t, I t )dB t + η(t, S j t )dW j t dI t I t = rdt + σ(t, I t )dB t . (17)
Here we can also compute the reconstructed index

I M t = M i=1 w i S i t . 3. The "market" model ∀j ∈ {1, . . . , M }, dS j t S j t = rdt + v loc (t, S j t )d W j t (18)
with, ∀i = j, d < W i , W j > t = ρ dt.

We deliberately dropped the dividend yields and the beta coefficients in order to simplify the numerical experiment. For the function σ, we take as previously the calibrated local volatility of the Eurostoxx. For η, which does not depend on j, we choose an arbitrary function of the forward moneyness and we evaluate v loc such that the "market" model and the simplified model yield the same implied volatility for individual stocks. According to [START_REF] Gyöngy | Mimicking the one-dimensional marginal distributions of processes having an Itô differential[END_REF], it is enough to take

v loc (t, x) = η 2 (t, x) + (σ 2 (t, I t )|S 1 t = x)
where the conditional expectation is approximated using the non-parametric method presented above. Finally, we fix the correlation coefficient ρ such that the market model and the simplified one have the same ATM implied volatility for the index.

The implied volatilities for the index and for an individual stock obtained by the three models are plotted in Figures 9 and8. We also give the difference in basis points between the implied volatilities obtained with the simplified model and the original one in Tables 4, 5 and 3. The parameters we use in our numerical experiment are the following : Moneyness ( K S0 ) 0.5 0.8 0.9 0.95 1 As suggested by Theorems 1 and 2, we see that the original model and the simplified one yield implied volatility curves that are very close to each other, both for the index and for individual stocks. The difference in basis points between the implied volatilities is reasonable, especially between the reconstructed index in the simplified model and the index in the original model. Concerning the market model, by construction, we have the same implied volatility for an individual stock as in the simplified model but the implied volatility of the index is far from the simplified one. This phenomenon is well known in practice (see [START_REF] Bakshi | Stock return characteristics, skew laws, and the differential pricing of individual equity options[END_REF], [START_REF] Bollen | Does net buying pressure affect the shape of implied volatility functions[END_REF] or [START_REF] Branger | Why is the index smile so steep?[END_REF]) : the implied volatility smile of an index is much steeper than the implied volatility smile of an individual stock. The market model of constantly correlated local volatility dynamics for the stocks is unable to retrieve the shape of the index smile. A more sophisticated dependence structure between stocks is needed. Local correlation models provide an extension of the market model in this direction : the correlation at time t between the Brownian motions driving the local volatility dynamics of the stocks is a function ρ(t, I t ) of the index level. But the way this function ρ influences the index smile is not clear at all. Somehow, our models provide another parametrization of the correlation structure in which, the function σ, that replaces the function ρ, can be interpreted as the local volatility of the index. Yet, the individual stocks can still be properly calibrated.

-S 1 0 = • • • = S M 0 =

Application: Pricing of a worst-of option

Apart from handling both the index and its composing stocks, our models are also relevant for the widespread financial products that are sensitive to correlation in the equity world, such as rainbow options.

One example of such products is the worst-of performance option whose payout is referenced to the worst performer in a basket of shares. For a basket of M shares, the payoff of a call with strike K and maturity obtained by the market model of constantly correlated stocks. The parameters of the numerical experiment are the same as previously and we set the correlation coefficient ρ such that all the models exhibit the same ATM implied volatility for the index. The result, as can be seen in Figure 10, is that our prices are always lower than the market model price, especially in the money. Hence, a model with a constant correlation coefficient, calibrated in order to fit the at the money prices of options written on the index, will always overestimate the risks of worst-of options. The reason is that the correlation level needed to fit the at the money prices is very high. Note that the prices obtained with the original model and the simplified one are barely distinguishable from each other.

Conclusion

In this paper, we have introduced a new model for describing the joint evolution of an index and its composing stocks. The idea behind our view is that an index is not only a weighted sum of stocks but can also be seen as a market factor that influences their dynamics. In order to have a more tractable model, we have studied the limit when the number of underlying stocks goes to infinity and we have shown that our model reduces to a local volatility model for the index and to a stochastic volatility model with volatility driven by the index for each individual stock. We have discussed calibration issues and proposed a simulation-based technique for the calibration of the stock dynamics, which permits us to fit both index and stocks smiles. The numerical results obtained on real data for the Eurostoxx index are very encouraging, especially for accelerated techniques. We have also compared our models (before and after passing to the limit) to a standard market model consisting of local volatility models for the stocks which are constantly correlated and we have seen that they lead to a steeper index smile. Finally, when considering the pricing of worst-of performance options, which are sensitive to the dependence structure between stocks, we have found that our prices are more aggressive than the prices obtained by the standard market model.

To sum up, we list some properties of our models depending on the options one wishes to handle in the -Simulation of an M -dimensional SDE : -few (J << M ) stocks (I, S 1 , . . . , S J ).

(S 1,M , . . . , S M,M ).

-the index.

-Exact calibration of (S j ) 1≤j≤J and I possible. -Exact calibration of (S j,M ) 1≤j≤J possible but requires calibration of all the stocks.

-Approximate calibration of I M .

Options written on

-Simulation of an (M + 1)-dimensional SDE :

-Simulation of an M -dimensional SDE : -all the stocks (I, S 1 , . . . , S M ).

(S 1,M , . . . , S M,M ).

-the index.

-Exact calibration of all the stocks possible.

-Exact calibration of all the stocks possible. -Index value :

I M t = P M j=1 wj S j t .
-Approximate calibration of I M . -Approximate calibration of I M .

Table 6: Which model to use and when.

Appendix

In order to prove the Theorems 1 and 2, we need the following technical estimation Lemma 4 -Under assumption (H2), for all p ≥ 1, one has ∀j ∈ {1, . . . , M },

sup 0≤t≤T |S j,M t | 2p ≤ C p ( 19
)
where

C p = max 1≤j≤M |S j,M 0 | 2p exp 2r + (2p -1)(max j≥1 β 2 j + 1)K 2 b pT .
Proof : By Itô's lemma one has

|S j,M t | 2p = |S j,M 0 | 2p + t 0 |S j,M s | 2p ((2p)(r -δ j ) + p(2p -1)(β 2 j σ 2 (s, I M s ) + η 2 j (s, S j,M s )))ds + t 0 (2p)|S j,M s | 2p (β j σ(s, I M s )dB s + η j (s, S j,M s )dW j s )
In order to get rid of the stochastic integral, we use a localization technique : let ν n be the stopping time defined for each n ∈ AE by ν n := inf{t ≥ 0; |S j,M t | ≥ n}. Then, using (H2), one has

|S j,M t∧νn | 2p = |S j,M 0 | 2p + t∧νn 0 |S j,M s | 2p ((2p)(r -δ j ) + p(2p -1)(β 2 j σ 2 (s, I M s ) + η 2 j (s, S j,M s ))ds ≤ |S j,M 0 | 2p + (2p)(r -δ j )½ {r-δj ≥0} + p(2p -1)(β 2 j + 1)K 2 b t 0 |S j,M s∧νn | 2p ds
So, by Gronwall's lemma and the fact that the dividends are nonnegative,

∀t ≤ T, |S j,M t∧νn | 2p ≤ |S j,M 0 | 2p exp 2rp + p(2p -1)(β 2 j + 1)K 2 b T (20)
Finally, Fatou's lemma permits us to conclude :

sup 0≤t≤T |S j,M t | 2p ≤ |S j,M 0 | 2p exp 2rp + p(2p -1)(β 2 j + 1)K 2 b T . (21) 2
Proof of Theorem 1 : Using the SDEs (3) and ( 5), one has

|I M t -I t | 2p = r t 0 I M s -I s ds - t 0   M j=1 δ j w j S j,M s -δI s   ds + t 0   M j=1 β j w j S j,M s σ(s, I M s ) -βI s σ(s, I s )   dB s + M j=1 w j t 0 S j,M s η j (s, S j,M s )dW j s 2p ≤ 4 2p-1   r 2p t 2p-1 t 0 (I M s -I s ) 2p ds + t 2p-1 t 0   M j=1 δ j w j S j,M s -δI s   2p ds + t 0   M j=1 β j w j S j,M s σ(s, I M s ) -βI s σ(s, I s )   dB s 2p + M j=1 w j t 0 S j,M s η j (s, S j,M s )dW j s 2p  
Hence, using the Burkholder-Davis-Gundy inequality (see Karatzas and Shreve [START_REF] Karatzas | Brownian motion and stochastic calculus[END_REF] p. 166), there exists a universal positive constant K p such that sup 0≤t≤T

|I M t -I t | 2p ≤ 4 2p-1 (a M + b M + c M + d M )
where

• a M = r 2p T 2p-1 T 0 (I M s -I s ) 2p ds • b M = T 2p-1 T 0      M j=1 δ j w j S j,M s -δI s   2p    ds • c M = K p T p-1 T 0      M j=1 β j w j S j,M s σ(s, I M s ) -βI s σ(s, I s )   2p    ds • d M = K p T p-1 T 0     M j=1 w j S j,M s η j (s, S j,M s ) 2   p   ds
The term a M is the easiest one to handle :

a M ≤ r 2p T 2p-1 T 0 sup 0≤u≤s |I M u -I u | 2p ds. (22)
Next, using assumption (H2) for the first inequality, Hölder's inequality for the second and lemma 4 for the third, one gets 2p K 2p Lip e 3 2p-1 ((r-δj) 2p T 2p-1 +KpT p-1 K 2p η +2 2p-1 KpT p-1 β 2p j K 2p b )T .

d M = K p T p-1 T 0 M j1=1 • • • M jp=1 p k=1 w 2 j k (S j k ,M s ) 2 (η j k (s, S j k ,M s )) 2 ds ≤ K p K 2p b T p-1 T 0 M j1=1 • • • M jp=1 ( p k=1 w 2 j k ) p k=1 (S j k ,M s ) 2 ds ≤ K p K 2p b T p-1 T 0 M j1=1 • • • M jp=1 p k=1 w 2 j k (S j k ,M s ) 2p
We conclude by Theorem 1 and the sublinearity of the square root function on Ê + .

We now turn to the L 2p -distance between I M and I M :

|I M t -I M t | 2p =

  |δ j -δ|, the closer I and I M . The first quantity P M

1 2 .

 12 It has the property of minimizing theL 1 -distance to X : m = arg min x∈Ê |X -x|.

Figure 1 :

 1 Figure 1: Local volatility x → v loc (T, s 0 x) together with x → σ(T, i 0 x), x → β hist σ(T, i 0 x) and x → β hist (σ 2 (T, I T )|S T = s 0 x) when η is set to zero for AXA, ALCATEL and CARREFOUR.

Figure 2 :

 2 Figure 2: Implied volatility obtained for nine independent simulations with N = 5000 paths.

Figure 3 :

 3 Figure 3: Comparison between the naive technique and the accelerated one for the same number N = 10000 of particles.

Figure 7 :

 7 Figure 7: Simulated implied volatility with independent draws.

  53, -M , I 0 and the weights w 1 , . . . , w M : the same as of the Eurostoxx index at December 21, 2007, -r = 0.045, -Maturity T = 1 year, -Number of time steps: n = 10, -Number of simulated paths : N = 100000.

Figure 8 :

 8 Figure 8: Implied volatility of an individual stock.

Figure 9 :.

 9 Figure 9: Implied volatility of the index.

Figure 10 :

 10 Figure 10: Worst-of price.

1 p ds ≤β≤ 2 + 2 = C 0 e C1T . 2 25Proof of Theorem 2 :) 1 T 0 (

 ds222210 K p K 2p b T p C p enable us to control the term b M : b M = T 2p-1 u | 2p ds.(24) For the remaining term c M , we will also need the Lipschitz assumption (H3)c M = K p T p-j w j S j,M s σ(s, I M s ) -βI s σ(s, I s ) βI M s σ(s, I M s ) -βI s σ(s, I s )) 2p ds    2p-1 K p T p K 2p b C p 2p-1 K p T p-1 (βK σ ) 2p T 0 sup 0≤u≤s |I M u -I u | 2p ds.(25) So, combining the inequalities (22), (23), (24) and (25), one obtainssup -I u | 2 ds with C 0 = 8 2p-1 T p (T p + K p K 2p b )C p and C 1 = 4 2p-1 (2 2p-1 K p T p-1 (βK σ ) 2p + (2T ) 2p-1 δ 2p + r 2p T 2p-1). Finally, by means of Gronwall's lemma, we conclude thatsup 0≤t≤T |I M t -I t | 2p ≤ C TThe proof is similar to the previous one :|S j,M t -S j t | 2p ≤ 3 2p-1 (rδ j ) 2p t 2p-1 I M s ) -S j s σ(s, I s ))dB s 2phence, using the Burkholder-Davis-Gundy inequality, there exists a constant K p such thatsup 0≤t≤T |S j,M t -S j t | 2p ≤ 3 2p-1 (rδ j ) 2p T 2p-1 -S j s η j (s, S j s )) 2p ds +K p T p-1 β 2p I M s ) -S j s σ(s, I s )) 2p dsUsing assumption (H4), one getsT 0 (S j,M s η j (s, S j,M s ) -S j s η j (s, S j s )) 2p ds ≤ K 2p u | 2p ds.Finally, by means of lemma 4 and assumptions (H2) and (H3), T 0 (S j,M s σ(s, I M s ) -S j s σ(s, I s )) 2p ds ≤ 2 2p-S j,M s ) 2p (σ(s, I M s )σ(s, I s )) 2p ds. -I t | 4p where C j T = 6 2p-1 K p T p β 2p j C 1 2

  1 M , . . . , 1 M ) and M is large. Let us now discuss how to choose β and δ minimizing P M β and P M δ . Let Y β and Y δ be discrete random variables having the following probability distributions :

	∀j ∈ {1, . . . , M },

Table 1 :

 1 5 of Y β for β and the median of Y δ for δ. Nevertheless, to preserve the interpretation of β j as Computation of (P M w ) 2 , β opt and (P M βopt ) 2 for the Eurostoxx index at December 21, 2007. The beta coefficients are estimated on a two year history.

	Cov(rj ,rI ) V ar(rI ) which is equal to	ββj β 2 for the simplified

Table 2 :

 2 Error (in bp) on the implied volatility with N = 200000 particles.

	K S0 )	0.30 0.49 0.69 0.79 0.89 0.99 1.09 1.19 1.28 1.48 1.98
	Error : | σ N -σ exact | 195	36	8	5	2	1	2	9	17	32	56

N=10000 N=200000 Figure 4: Convergence of the implied volatility obtained with non-parametric estimation as N → +∞.

Table 3 :

 3 Difference (in bp) the implied volatilities of an individual stock obtained with the simplified model and with the original model.

	1.05 1.1 1.2 1.3 1.55 1.85 2

Table 4 :

 4 Difference (in bp) between the implied volatilities of the index obtained with the simplified model and with the original model.

	Moneyness ( K I0 )	0.5 0.8 0.9 0.95 1 1.05 1.1 1.2 1.3 1.55 1.85 2
	| σ reconstruct -σ original | 10	5	4	3	2	1	2	5	4	1	0	0

Table 5 :

 5 Difference (in bp) between the implied volatility of the reconstructed index I M in the simplified model and the implied volatility of the index in the original model.

The weightings are periodically updated but, as usually assumed, we suppose that, up to maturities of the options considered, they are constant. When updated, they are often chosen proportional to the market capitalizations of the stocks.

500 stocks for the S&P

index, 100 stocks for the FTSE 100 index, 40 stocks for the CAC40 index, etc.

In order to smooth the estimation, one has to choose a bandwidth parameter that is greater than the theoretical optimal parameter N -1 5 .

Acknowledgements: We thank Lorenzo Bergomi, Julien Guyon and all the equity quantitative research team of Societe Generale CIB for numerous fruitful discussions and for providing us with the market data.


Khaled Gaaloul
email: khaled.gaaloul@sap.com

François Charoy
email: charoy@loria.fr

Task Delegation Based Access Control Models for Workflow Systems

Keywords: Workflow, Task, Delegation, Access Control, Authorisation

e-Government organisations are facilitated and conducted using workflow management systems. Role-based access control (RBAC) is recognised as an efficient access control model for large organisations. The application of RBAC in workflow systems cannot, however, grant permissions to users dynamically while business processes are being executed. We currently observe a move away from predefined strict workflow modelling towards approaches supporting flexibility on the organisational level. One specific approach is that of task delegation. Task delegation is a mechanism that supports organisational flexibility, and ensures delegation of authority in access control systems. In this paper, we propose a Task-oriented Access Control (TAC) model based on RBAC to address these requirements. We aim to reason about task from organisational perspectives and resources perspectives to analyse and specify authorisation constraints. Moreover, we present a fine grained access control protocol to support delegation based on the TAC model.

Introduction

The ongoing prosperity of the "e-" trend such as e-Business, e-Government, and e-Services fosters the ever increasing demand for interactions across organisational boundaries. Electronic government (e-Government) is the civil and political conduct of government, including services provision, using information and communication technologies. The concept of e-Government has been gaining ground from initial isolated to extensive research and applications. The prerequisites for an e-Government enactment strategy are the achievement of a technological interoperability of platforms and a deeper cooperation and security at the organisational level. Those requirements are related with the environment in which the public agencies operate, strictly constrained by norms, regulations, and result-oriented at the same time [START_REF] Traunmüller | e-Government at a Decisive Moment: Sketching a Roadmap to Excellence[END_REF]. Actually, most governmental organisations offer electronic services within a collaborative environment. However, inter-organisational collaboration, especially by means of workflow management systems, is not as widespread.

Currently, we observe a tendency moving away from strict enforcement approaches towards mechanisms supporting exceptions that make it difficult to foresee when modelling a workflow. One specific set of mechanisms ensuring human centric interactions and supporting collaboration cross-organisations is that of task delegation [START_REF] Schaad | A framework for evidence lifecycle management[END_REF]. Security is an essential and integral part of workflow management systems. Protecting application data in workflow systems through access control policies has recently been widely discussed. Sandhu proposed a series of access control models [START_REF] Sandhu | Role-based access control models[END_REF][START_REF] Barka | Framework for role-based delegation models[END_REF]: RBAC0, RBAC1, RBAC2, RBAC3, and discussed a variety of constraints and policies including role hierarchy and separation of duties (SoD). These models are called the RBAC96 models. The central idea of this model is that access rights are associated with roles, to which users are assigned in order to get appropriate authorisations. It also involves the role hierarchy that enables the permission heritage. Since the roles in organisations are relatively stable and the number of roles is much smaller then that of users, the work of administrators can be greatly relieved by applying the concept of roles. Thus it is more adaptable to dynamic environments to a certain extent. However, there is no concept of tasks in RBAC, which makes it difficult to satisfy completely the access control requirements in a rapidly-changing dynamic environment [START_REF] Zhang | A task-oriented access control model for wfms[END_REF][START_REF] Gaaloul | A secure task delegation model for workflows[END_REF]. In this paper, we propose a task-oriented access control model based on RBAC, thereby addressing the authorisation requirements in workflow management systems. Permissions are authorised both to roles and to tasks. The idea is to leverage the RBAC features regarding permissions assignments based-roles. In addition, users can get permissions through tasks when they execute a process, thereby supporting tasks dynamic constraints. Moreover, we offer a fine grained access control solution to compute delegated privileges. The remainder of this paper is organised as follows. Section 2 presents a workflow scenario inspired from a governmental use case to motivate our work. In section 3, we give an overview about delegation and present the delegation scenarios. Section 4 defines workflow authorisations constraints and presents our access control model based-task. In section 5, we define a delegation protocol supporting delegation of authority. In Section 6, we discuss and conclude our approach, and outline several topics of potential future work.

e-Government Workflow Scenario

We introduce a govermental workflow scenario related to the European administrations collaboration. Europol and Eurojust are two key elements of the European system of international collaboration within the areas of law enforcement and justice. A specific scenario for this collaboration is the Mutual Legal Assistance (MLA) [START_REF]Towards e-Administration in the large[END_REF].

Mutual Legal Assistance

Mutual Legal Assistance (MLA) defines a collaborative workflow scenario involving national authorities of two European countries regarding the execution of measures for protection of a witness in a criminal proceeding. Here we describe the MLA process cross Eurojust organisations A and B, and detail the different business actors and resources models involved in the process. Basically, the two organisations work consists of receiving the request of assistance from the Europol member in order to process it and send it the concerned authority in country B. Eurojust infrastructure integrates systems such as MLA service and CMS (Case management System) to process data on the individual cases on which Eurojust national members are working in temporary work files. Eurojust defines an organisational hierarchy working together to achieve common goals. Figure 1 illustrates the organisational role hierarchy and users role memberships in the Eurojust organisation. We applied the Business Process Modeling Notation (BPMN) to the MLA process (see Figure 2). BPMN has emerged as a standard notation for capturing business processes, especially at the level of domain analysis and high-level systems design [START_REF]The Workflow Management Coalition. Process Definition Interface XML Process Definition Language[END_REF]. The notation inherits and combines elements from a number of other proposed notations for business process modeling, including the XML Process Definition Language (XPDL) and the Activity Diagrams component of the Unified Modeling Language (UML).

In our example, we distinguish Prosecutor as the main responsible that collaborates with internal and external employees (Assistant, National Correspondent (NC), Judge and Judicial Authority Officer (JAO)) to process the MLA request. First, Prosecutor A receives the request and checks it in the MLA information service (tasks 1 and 2). If the provided information are correct, the Prosecutor will continue to process the request by asking for the preparation of the request document (task 4). Note that depending on the request context, the application process will differ in the users involved and data that need to be considered. In fact, the specific type of legal document requested will have a direct effect on the involved controls. For instance, the "Translate Request Document" task might be required to carry out the request preparation when exchanged documents are issued in the local language; therefore we need a national cor-Fig. 2. MLA scenario respondent (NC) to translate documents (task 3). After the preparation of the required legal documents, the Prosecutor will send the request to his Eurojust colleagues in country B (task 5). The next steps that need to be taken are the review of the request, the determination of the judicial authority in order to forward the request to the concerned authority in country B (Eurojust B) for the final approval (tasks 6, 7 and 8). The supporting Table 1 summarises the required roles, applications, functions and business objects associated to tasks.

Problem Statement

Several of the depicted tasks involve human interactions and are possibly time consuming. Tasks taken by the Eurojust organisations can involve several business actors such as Prosecutors, Assistants or Judges. Depending on the current control-flow sequence, workflow actors can evolve and change from the predefined workflow model. For instance, the absence of translated document (task 3) can lead to a new rearrangement of actors in order to optimise the process execution. In addition, unexpected events can happen without being modelled beforehand. For example, a Prosecutor delegates a part of his work to a subordinate due to emergency situations. In this scenario, we describe the collaborative work cross-organisations. One of the objectives is to establish a collaboration including information exchange. Those objectives can be achieved using collaborative workflows [START_REF] Schulz | Facilitating cross-organisational workflows with a workflow view approach[END_REF][START_REF] Contenti | A Distributed Architecture for Supporting e-Government Cooperative Processes[END_REF]. However, recent works [START_REF] Jensen | Collaboration, Leadership, Control, and Conflict Negotiation in the NetBeans.org Community[END_REF][START_REF] Schulz | Facilitating cross-organisational workflows with a workflow view approach[END_REF] presented new requirements such as control and transparency in collaborative workflow systems. What is in many cases described as collaboration appears to be coordination and synchronisation of processes by ignoring human-centric interactions. One type of transparency and control supporting mechanism in human-centric collaboration is that of task delegation. Task delegation is a mechanism supporting organisational flexibility in the human-centric workflow systems, and ensuring delegation of authority in access control systems [START_REF] Gaaloul | Modelling Task Delegation for Human-Centric eGovernment Workflows[END_REF].

Delegation in Workflow

In this section, we give a brief overview of delegation in workflows systems. We present the main factors that can motivate delegation and link it to the case study.

Context and Motivations

Task delegation can be very useful for real-world situations where a user who is authorised to perform a task is either unavailable or too overloaded with work to successfully complete it. This can occur, for example, when certain users are sick or on leave. It is frequently the case that delaying these task executions will violate time constraints on the workflow impairing the entire workflow execution. Delegation is a suitable approach to handle such exceptions and to ensure alternative scenarios by making workflow systems flexible and efficient.

Schaad presented a literature review of the different aspects and motivations for delegation [START_REF] Schaad | A Framework for Organisational Control Principles[END_REF]. Generally, delegation is motivated by three main factors: organisational, business process management and resources. In the following, we detail specific factors that can motivate delegation:

1. Lack of resources: The task cannot be achieved due to a lack of resources.

The user holding the task misses one or several necessary resources. He has to delegate to another user possessing the required medium. Examples for such resources could be a lack of time or equipments. 2. Specialisation: A user might be sufficiently competent to achieve a goal, but it is more efficient to delegate to users in specialist positions, such that the achievement is optimised. Specialisation is a part of the business process management factor. 3. Organisational policies: Goals may conflict and specific organisational policies such as the separation of duties (SoD) may require a user to delegate. SoD constraint defines exclusive relation between tasks. For instance, tasks t 1 and t 2 can not be assigned to the same user. This defines one of the motivation criteria of the organisational factor.

Link with the Case Study

During the collaboration between Eurojust organisations A and B, several actors are involved in the MLA process (see Figure 2). We define role-based delegation to support human-centric interactions. We are considering a user-to-user delegation supporting role-based access control model (RBAC) defined in [START_REF] Zhang | A rule-based framework for role-based delegation and revocation[END_REF]. In the following, we present two scenarios describing both local and global delegation.

Definition 1. We define a task delegation relation RD = (T,u 1 ,u 2 ,DC), where T is the delegated task, u 1 the delegator, u 2 the delegatee, and DC the delegation constraints. Constraints refer to the condition of delegating accordingly to the global policy.

Local delegation (DS1):

We consider an instance of the process MLA where no intervention is required from the NC member. We denote user Alice member of role Prosecutor and user Bob member of role Assistant. T5 is assigned to Alice, where Alice needs to send the MLA request to authority B. Alice is overloaded (lack of resources) and need to delegate T5 to one of his assistant.

Delegation criteria is based on the role hierarchy (RH) of Eurojust A, where the Assistant Bob is a subordinate to the Prosecutor Alice based on the global policy definition. The delegation relation (T5,Alice,Bob,(RH,2days)) ∈ RD, where (RH, 2 days) defines the delegation constraints DC regarding the time validity (2 days) and the organisational constraint (RH).

Global delegation (DS2): It defines a delegation cross-organisations. We consider an instance of the process MLA where the MLA request is outdated and exists already in the CMS system of country B. The specialisation of Prosecutor Claude will motivate the prosecutor Alice to delegate T2 for his colleague. Task delegation is defined based on a role mapping (RM) constraint, where distributed resources with external roles are defined in the global policy. The delegation relation (T2,Alice,Claude,RM) ∈ RD.

The next step will be to consider the propagation of authority during delegation. We need to define authorisation requirements with regards to workflow invariants such as task, users and data [START_REF] Gaaloul | A secure task delegation model for workflows[END_REF]. To this end, we propose an access control model based on the workflow specifications and user authorisation information (see Section 4.2).

Workflow Authorisation Constraints

A workflow comprises various activities that are involved in a business process. Activities that are part of a process are represented as tasks. Authorisation information is given which authorises users to perform tasks. Such authorisation information may be specified using a simple access control list or more complex role-based structures [START_REF] Crampton | Delegation and satisfiability in workflow systems[END_REF].

Task Execution Model

We define a task execution model using a UML activity diagram composed of three main activities: Initialisation, Processing and Finalisation. During the initialisation of the task, a task instance is created and then assigned to a user. During task processing, the assigned user can start or delegate the task which gathers all operations and rights over the business objects related to task resources. Finally the task finalisation would notice the workflow management system that the task is terminated, where termination defines completeness, failure or cancellation.

Seeing the task as a block that needs protection against undesired accesses, the activity diagram includes an access control (AC) transition that is in charge with granting or not the access to the task. AC checks defines the transition from the creation of a task to its assignment to a user. This assignment will lead to the processing or the cancellation of the task. Cancellation can be triggered when the assigned user doesn't fulfil the required authorisation to proceed the For instance, the task T7 "Determine Judicial Authorities" requires a permission that defines functions add() and modify() to access the MLA business object (see Table 1). Therefore, the assigned user Cathy member of role Judge needs to be authorised to access T7 task resources.

Task-Oriented Access Control Model

We propose a Task-oriented Access Control (TAC) model to support authorisation requirements in workflow systems (see Figure 4). Authorisation information will be inferred from access control data structures, such as user-role assignment and task-role assignment relations [START_REF] Kandala | Secure role-based workflow models[END_REF]. We leverage the different task requirements regarding human and material resources and model it in a set of relationships building our model. Formally, we define sets U, R, OU, T, P, S and TI as a set of users, roles, organisations units, tasks, permissions, subjects and task instances respectively. We define RH (Role Hierarchy), where RH is a partial order on R. (r i , r j ) ∈ R, RH denotes that r i is a role superior to r j , as a result, r i automatically inherits the permissions of r j .

We define RM (Role Mapping), where RM is a partial order on R belonging to a set of roles defined in the involved organisations hierarchies (OU). RM defines external roles accessing distributed resources cross-organisations [START_REF] Freudenthal | drbac: Distributed role-based access control for dynamic coalition environments[END_REF]. It provide a decentralised access control mechanism where externally known roles are publicly available, where: r k ∈ OU k and r l ∈ OU l , RM denotes that r l is a role mapped to r k , as a result, r l automatically inherits the permissions of r k .

Definitions of Functions:

-SU : S → U a function mapping a subject to the corresponding user.

-SR: S → 2 R , a function mapping each subject to a set of roles, where SR(s i ) ⊆ {r|(SU (s i ), r) ∈ U RA} and subject s i has the permissions; ∪ {r∈SR(si)} {p|(p, r) ∈ RP A}. instance o f : T I → T , a function mapping a task instance to its task type.

claimed b y: T I → S, a function mapping a task instance to a subject to execute it, where:

claimed b y(t i , s i ) = {t i |instance o f (t i , t), (r, u) ∈ U RA|(SR(s i ) = r SU (s i ) = u), (t, r) ∈ T RA}.

Definitions of Constraints:

Here we discuss Separation of duty (SoD) and Binding of duty (BoD) constraints. We define exclusive relation between tasks for SoD, and binding relation between tasks for BoD as follows:

T T SOD = {(t i , t j ) ∈ T |t i is Exclusive with t j } ⊆ TxT T T BOD = {(t i , t j ) ∈ T |t i is Binding with t j } ⊆ TxT, where t i ≤ t j .
If (t 1 , t 2 ) ∈ T T SOD , then t 1 and t 2 can not be assigned to the same subject. For instance, T4 and T6 ∈ T T SOD , where subjects with role Prosecutor must be different. If (t 1 , t 2 ) ∈ T T BOD , then t 1 and t 2 must be assigned to the same subject.

Contributions and Motivations:

We model permission assignment relations for task and role in order to support both human and material resources. The tuple (P,T,R) specifies TRA, TPA and RPA many-to-many relationships which are specifics to the task execution context. The remaining relations are generic relations based on RBAC model [START_REF] Sandhu | Role-based access control models[END_REF]. Definition 3. A task can only be assigned to a role if and only if

(t, r) ∈ T RA ⇒ {p ∈ P |(t, p) ∈ T P A} ⊂ {p|(p, r) ∈ RP A}.
The main contribution is to specify the task assignment conditions based on the RPA and TPA requirements (see Definition 3). Actually, two conditions have to be verified to satisfy TRA relation. The first condition is related to task resources requirements. The user's permissions defined in RPA need to satisfy the permissions defined in TPA. If this condition is satisfied, the task is executed if and only if the user is assigned to it. Basically, having permissions to execute a task but not being in the task worklist will not satisfy those conditions and, therefore, deny the access to task resources. Returning to the example, T2 "Check Request" is assigned a set of permissions (query(), update()) via TPA in order to carry out this task. Once T2 is claimed, TRA is assigned to roles that are authorised to claim it. On one hand, user Bob with role Assistant is not allowed to claim T2. Bobs permissions (add()) do not fulfill T3 requirements. Therefore, the relation for the instance of T2: TRA (T2, Bob) returns false and no authorisation is granted for Bob. On the other hand, user Kevin member of role JAO has the required permissions to carry out T5, however, Kevin does not have the right to claim T2 since the user-task assignments is not defined in the global policy (see Figure 2, Table 1).

Context-Aware Delegation for TAC

Delegation is a mechanism that permits a user to assign a subset of his assigned authorisations (privileges) to other users who currently do not possess it. The user who performs a delegation is referred to as a "delegator" and the user who receives a delegation is referred to as a "delegatee". We provide an optimised method to compute the delegated privileges based on the current requirements of the task instances (resources requirements). The TAC model defines the list of potential delegatees (RPA) that may satisfy the delegated task requirements (TPA). For instance, u 1 and u 2 are members of roles r 1 and r 2 respectively; (t,u 1 ,u 2 ,DC) ∈ RD iff (t, r 2 ) ∈ T RA ⇒ {p ∈ P |(t, p) ∈ T P A} ⊂ {p|(p, r 2 ) ∈ RP A}.

Delegation Protocol

We present a fine grained access control protocol to support delegation. Delegation protocol depicts the dialogue between a delegator and a delegatee during a delegation request. We model the protocol using UML sequence diagrams (see Figure 5). The Authorisation Component supports the access control mechanism to make a policy decision. An access control policy specifies a level of defining access to task resources when starting or delegating a task. The Task Service Manager returns the current task state (started, cancelled, etc.). The Worklist component maintains the user-task assignments during runtime. We detail the basic steps as follows:

1. First the delegator is sending a request for delegation to the Delegation Component (DC) for a specific task and a specific role (Role A). 2. The DC checks with the help of the Authorisation Component (AC) if the delegator can actually delegate based on his policy attributes, then with the Task Service Manager regarding the delegated task status. 3. The DC notifies all the delegatees belonging to the role (Role A) of the availability of the task. 4. The first one to respond is allocated with the task. 5. The DC checks with the help of the AC if the delegatee can actually receive the task. 6. The DC then keeps track of the current delegation within internal history records. 7. The DC updates the appropriate policy in the policy repository. 8. The DC updates the appropriate worklists (delegator and delegatee) if the delegation is related to a task instance. 9. Then the delegation is forwarded to the designated delegatee.

Returning to the example, the scenario DS2 can be satisfied. Actually, Prosecutor Alice can delegate T2 "Check Request" to Prosecutor Claude based on their role mapping constraint. In addition, global policy constraints (SoD, BoD) are not specified for T2. Subsequently, Prosecutor Claude will inherit permissions that will authorise him to claim T2 and access its resources afterwards.

Revocation

Revocation is an important process that must accompany the delegation. It is the subsequent withdrawal of previously delegated objects such as a role or a task. A vast amount of different views on the topic can be found in literature [START_REF] Hagstrom | Revocations-A Classification[END_REF] where each author having their own assumptions and opinions on how to model revocation. For simplification, our model of revocation is closely related to the delegation model based user-to-user. Actually, the decision of revocation is issued from the delegator in order to take away the delegated privileges (permissions), or the desire to go back to the state before privileges were delegated.

Related Work

Role-based access control (RBAC) is recognised as an efficient access control model for large organisations. Most organisations have some business rules related to access control policy. Delegation of authority is among these rules [START_REF] Belokosztolszki | Policy Contexts: Controlling Information Flow in Parameterised RBAC[END_REF]. In [START_REF] Barka | Framework for role-based delegation models[END_REF], authors extend the RBAC96 model by defining some delegations rules.

Barka and Sandhu proposed a role-based delegation model. They deal with userto-user delegation. The unit of delegation in them is a role. However, users may want to delegate a piece of permission from a role.

Zhang and al. propose a flexible delegation model named Permission-based Delegation Model (PBDM) [START_REF] Zhang | PBDM: a flexible delegation model in RBAC[END_REF]. PBDM supports user-to-user and role-to-role delegations with features of multi-step delegation and multi-option revocation. It also supports both role and permission level delegation, which provides great flexibility in authority management. However, neither RBAC nor PBDM support the task-based delegation criteria described in the motivated delegation scenarios.

The eXtensible Access Control Markup Language is an XML-based, declarative access control policy language that lets policy editors to specify the rules about who can do what and when. As an OASIS standard, its greatest strength lies in interoperability [START_REF]eXtensible Access Control Markup Language (XACML v2.0). Standard, Organization for the Advancement of Structured Information Standards (OASIS), February 2005[END_REF]. Unlike other application-specific, proprietary accesscontrol mechanisms, this standard can be specified once and deployed beyond the boundaries of organisations and countries. The current XACML standard does not provide explicit support for task delegation.

In [START_REF] Rissanen | Administrative Delegation in XACML[END_REF], Rissanen and Firozabadi add new structured data-types to express chains of delegation and constraints on delegation. The main result of their research is an administrative delegation. It is about creating new long-term access control policies by means of delegation in a decentralised organisation. However, this approach does not cover ad-hoc interactions and is not suitable to not support decentralized delegation in the context of heavily human centric collaboration.

Conclusion and Future Work

Enormous amounts of data flow cross-organisations along processes and are shared by many different users. Their security must be assured. In this paper, we firstly analyse the relevant authorisation requirements in workflow management systems. Then, based on RBAC model, we propose the task-oriented access control (TAC) model. This model can grant authorisations based on workflow specifications and user authorisation information. The motivation of this direction is inspired from an e-government case study supporting dynamic authorisation changes during delegation. In this context, we proposed a fine grained access control protocol to support delegation based on TAC constraints, thereby ensuring dynamic delegation of authority.

The next stage of our work is the implementation of our approach using the eXtensible Access Control Markup Language (XACML) standard. We propose an extension to XACML specifications supporting task delegation constraints. Future work will look also at enriching our approach with additional delegation constraints supporting historical records. Delegation history will be used to record delegation that have been made to address administrative requirements such as auditing.

Fig. 1 .

 1 Fig. 1. An example of organisational role hierarchy and users in Eurojust

Fig. 3 .

 3 Fig. 3. Task execution model

Fig. 4 .

 4 Fig. 4. Task-oriented access control model

Fig. 5 .

 5 Fig. 5. Task delegation protocol

Table 1 .

 1 Logistic workflow: Relations between tasks, roles, applications and business objects

	Task type	Role	Application	Function Business	Object
						type
	T1. Receive Request Prosecutor MLA Information	read()	Request Document
			Service
	T2. Check Request	Prosecutor MLA Information	query(),	Request Document
			Service		update()
	T3. Translate Docu-	NC	MLA Information	translate()Request Document
	ment		Service
	T4. Prepare Content Assistant CMS	WorkFile	add()	Request Document
			System
	T5. Send Request	Prosecutor CMS	WorkFile	send()	Request File
			System
	T6. Review Request Prosecutor CMS	WorkFile	read(),	Request File
			System		update()
	T7. Determine Judi-	Judge	CMS	WorkFile	add(),	Request File
	cial Authorities		System		modify()
	T8. Forward Request JAO	CMS	WorkFile	send()	Request File
			System