Farid Abed-Meraim
email: farid.abed-meraim@ensam.eu

Vuong-Dieu Trinh

Alain Combescure

V.-D Trinh

New quadratic solid-shell elements and their evaluation on linear benchmark problems

Keywords: Solid-shell finite elements, Mixed variational principle, Locking phenomena, Reduced integration, Rank deficiency, Benchmark problems

This paper is concerned with the development of a new family of solidshell finite elements. This concept of solid-shell elements is shown to have a number of attractive computational properties as compared to conventional three-dimensional elements. More specifically, two new solid-shell elements are formulated in this work (a fifteen-node and a twenty-node element) on the basis of a purely three-dimensional approach. The performance of these elements is shown through the analysis of various structural problems. Note that one of their main advantages is to allow complex structural shapes to be simulated without classical problems of connecting zones meshed with different element types. These solid-shell elements have a special direction denoted as the "thickness", along which a set of integration points are located. Reduced integration is also used to prevent some locking phenomena and to increase computational efficiency. Focus will be placed here on linear benchmark problems, where it is shown that these solid-shell elements perform much better than their counterparts, conventional solid elements.

Introduction

Nowadays, the numerical simulation at various scales has become widespread in the industry, and concerns practically all key sectors (civil engineering, nuclear, aerospace, automotive, packaging, etc). In computational mechanics, the most adopted approach is certainly the finite element method. Despite the important progress achieved in terms of computer resources, a number of nonlinear three-dimensional (3D) problems still require long hours of calculation times. In this context, the efficiency of finite elements becomes of crucial importance to speed up the design processes, for example, or to reduce the simulation costs in general.

Over the past three decades, considerable effort has been devoted to the development of efficient and reliable finite elements. In this regard, reduced-integration elements have been developed for the efficient treatment of general continuum mechanics problems (see, e.g., [START_REF] Hughes | Generalization of selective integration procedures to anisotropic and nonlinear media[END_REF][START_REF] Flanagan | A uniform strain hexahedron and quadrilateral with orthogonal hourglass control[END_REF][START_REF] Belytschko | Hourglass control in linear and nonlinear problems[END_REF][START_REF] Liu | Multiple-quadrature underintegrated finite elements[END_REF][START_REF] Koh | New improved hourglass control for bilinear and trilinear elements in anisotropic linear elasticity[END_REF][START_REF] Belytschko | Assumed strain stabilization of the eight node hexahedral element[END_REF][START_REF] Stainier | An improved one-point integration method for large strain elastoplastic analysis[END_REF][START_REF] Hu | A one-point quadrature eight-node brick element with hourglass control[END_REF][START_REF] Masud | A stabilized 3D co-rotational formulation for geometrically nonlinear analysis of multi-layered composite shells[END_REF]). Concurrently, for structural applications, a variety of efficient plate and shell elements have been proposed on the basis of mixed formulations or using enhanced assumed strain (EAS) methods in order to avoid locking phenomena (see, e.g., [START_REF] Bathe | Formulation of general shell elements-the use of mixed interpolation of tensorial components[END_REF][START_REF] Onate | Derivation of plate based on assumed shear strain fields[END_REF][START_REF] Cheung | Refined hybrid method for plane isoparametric element using an orthogonal approach[END_REF][START_REF] Boisse | Computation of thin structures at large strains and large rotations using a simple C 0 isoparametric three-node shell element[END_REF][START_REF] Ayad | A new hybrid-mixed variational approach for Reissner-Mindlin plates: The MiSP model[END_REF][START_REF] Chapelle | The finite element analysis of shells-fundamentals[END_REF][16][START_REF] Cardoso | One-point quadrature shell elements: a study on convergence and patch tests[END_REF]).

However, in real-life structures, coexistence of 3D zones with structural components is very common, and both types of finite element technologies often need to be simultaneously used. Therefore, finite elements that are effective in both thin structure simulation and general 3D applications would considerably simplify the modeling of such combined structures. Indeed, they would avoid arbitrary definitions of separation zones between bulk and structural components, as well as the intricacies related to the connection of different element types (e.g., solid and structural elements).

In addition, 3D element formulations have many other advantages: they avoid resorting to complex shell kinematics, they use general fully 3D constitutive laws, they allow evaluation of thickness variation through the calculation of strain components in that direction, they enable an easier treatment for large rotations and the corresponding configuration update, they make it automatic the connection between solid and structural elements since the displacements are the only degrees of freedom, and allow natural contact conditions on both sides of the structure.

Consequently, significant attention has been paid to the development of a new concept of solid-shell elements, specifically dedicated to the modeling of thin structures (see [START_REF] Cho | Stability analysis using a geometrically nonlinear assumed strain solid shell element model[END_REF][START_REF] Hauptmann | A systematic development of solid-shell element formulations for linear and non-linear analyses employing only displacement degrees of freedom[END_REF][START_REF] Sze | A hybrid stress ANS solid-shell element and its generalization for smart structure modelling. Part I-solid-shell element formulation[END_REF][START_REF] Abed-Meraim | SHB8PS-a new adaptive, assumed-strain continuum mechanics shell element for impact analysis[END_REF][START_REF] Vu-Quoc | Optimal solid shells for non-linear analyses of multilayer composites[END_REF][START_REF] Chen | A mixed 8-node hexahedral element based on the Hu-Washizu principle and the field extrapolation technique[END_REF][START_REF] Kim | A resultant 8-node solid-shell element for geometrically nonlinear analysis[END_REF][START_REF] Klinkel | A robust non-linear solid shell element based on a mixed variational formulation[END_REF][START_REF] Reese | A large deformation solid-shell concept based on reduced integration with hourglass stabilization[END_REF]). Most of the methods previously developed were based on enhanced assumed strain fields, and consisted of either the use of a conventional integration rule with appropriate treatment for locking phenomena, or the adoption of a reducedintegration scheme with effective control of zero-energy (hourglass) modes. Both approaches have been extensively investigated and evaluated through a variety of structural applications, as reported in [START_REF] Belytschko | Assumed strain stabilization of the eight node hexahedral element[END_REF][START_REF] Zhu | Unified and mixed formulation of the 8-node hexahedral elements by assumed strain method[END_REF][START_REF] Wall | A deformation dependent stabilization technique, exemplified by EAS elements at large strains[END_REF][START_REF] Puso | A highly efficient enhanced assumed strain physically stabilized hexahedral element[END_REF][START_REF] Soulat | Simulation of continuous fibre reinforced thermoplastic forming using a shell finite element with transverse stress[END_REF].

A first solid-shell element that we have developed, based on some relatively simple principles, is an eight-node hexahedron denoted as SHB8PS [START_REF] Abed-Meraim | SHB8PS-a new adaptive, assumed-strain continuum mechanics shell element for impact analysis[END_REF][START_REF] Abed-Meraim | An improved assumed strain solid-shell element formulation with physical stabilization for geometric nonlinear applications and elastic-plastic stability analysis[END_REF]. This concept aims to combine in a single formulation the well-recognized 3D element advantages with several useful shell features. The evaluation of this element on a variety of benchmark problems confirmed its good performance in terms of accuracy and convergence properties, while using only a single element layer along the thickness. However, with the advent of free mesh generation tools that do not only generate hexahedrons and in order to automatically mesh arbitrarily complex geometries, the development of prismatic solid-shell elements has been made necessary. To this end, a six-node prismatic solid-shell designated as SHB6 has been proposed [START_REF] Trinh | A new assumed strain solid-shell formulation "SHB6" for the six-node prismatic finite element[END_REF]. Although playing a useful role as a complement to the SHB8PS, the SHB6 element exhibits some shear and thickness-type locking, which is common in linear triangular elements where the strain is constant. The latter limitation represents one of the main motivations behind the current development of alternative complementary solid-shell elements. These proposed elements have quadratic interpolation with both versions, hexahedral and prismatic.

The remaining of the paper is outlined as follows. In Sect. 2, the formulation of the proposed quadratic solid-shell elements, denoted as SHB15 and SHB20, is detailed. In these derivations, the common aspects of the two formulations are emphasized whenever possible. In Sect. 3, the resulting elements are evaluated on a set of selective and representative benchmark problems. Finally, some concluding remarks are drawn in Sect. 4.

Formulation of the SHB15 and SHB20 solid-shells

In this section, the formulation of the quadratic solid-shell finite elements SHB15 and SHB20 is detailed. Because the adopted approach has a number of similarities for the two elements, both formulations are conjointly presented to avoid repeating the common aspects.

Kinematics and interpolation

The SHB15 and SHB20 denote a fifteen-node prismatic element and a twenty-node hexahedral element, respectively. Based on a 3D approach, they have only three displacement degrees of freedom per node. However, a special direction is chosen, designated as the "thickness", normal to the mean plane of these elements. Also, an in-plane reduced-integration rule is used with 3 × n int and 4 × n int integration points for the SHB15 and SHB20, respectively. In other words, the in-plane integration employs only 3 points for the SHB15 and 4 for the SHB20, while the number of throughthickness integration points is n int . Similarly to their linear counterparts SHB8PS and SHB6 [START_REF] Abed-Meraim | An improved assumed strain solid-shell element formulation with physical stabilization for geometric nonlinear applications and elastic-plastic stability analysis[END_REF][START_REF] Trinh | A new assumed strain solid-shell formulation "SHB6" for the six-node prismatic finite element[END_REF], n int is a user-defined number, taken equal to two in elasticity and five in plasticity (see Fig. 1).

Note that the integration points for the SHB15 are located along three lines of respective equations: (ξ = 1/2, η = 1/2), (ξ = 0, η = 1/2), and (ξ = 1/2, η = 0), whereas for the SHB20, they are located along the four lines: coordinates of the Gauss points along axis ζ and the associated weights are given in [START_REF] Trinh | Formulation, développement et validation d'éléments finis de type coques volumiques sous-intégrés stabilisés utilisables pour des problèmes à cinématique et comportement non linéaire[END_REF] for the SHB15 and SHB20 for both cases: n int = 2 and n int = 5. Within these two isoparametric elements, the spatial coordinates x i and displacement field components u i are related to the nodal coordinates x i I and nodal displacements u i I , respectively, using the quadratic shape functions N I as

(ξ = -1/ √ 3, η = -1/ √ 3), (ξ = 1/ √ 3, η = -1/ √ 3), (ξ = 1/ √ 3, η = 1/ √ 3), and (ξ = -1/ √ 3, η = 1/ √ 3). The
x i = x i I N I (ξ, η, ζ ), u i = u i I N I (ξ, η, ζ ).
(

In the equation above and hereafter, unless specified otherwise, the implied convention of summation over repeated indices will be followed. Lowercase subscripts i vary from 1 to 3 and represent the spatial coordinate directions, while uppercase subscripts I vary from 1 to 15 for the SHB15 and from 1 to 20 for the SHB20 and correspond to the element nodes. The explicit expressions of the classical quadratic shape functions N I , corresponding to each of the elements SHB15 and SHB20, can be found for instance in [START_REF] Trinh | Formulation, développement et validation d'éléments finis de type coques volumiques sous-intégrés stabilisés utilisables pour des problèmes à cinématique et comportement non linéaire[END_REF].

Discrete gradient operator

The interpolation of the displacement field, Eq. (1), will allow us to define the strain field and to express the relationships relating the strain field to the nodal displacements. By differentiating (1), the linear strain tensor is written as

ε i j = 1 2 u i, j + u j,i = 1 2 u i I N I, j + u j I N I,i .
Combining Eq. ( 1) with the expressions of the shape functions leads to the expansion of the displacement field in the form of a constant term, linear terms in x i , and nonlinear terms involving functions h α , with (α = 1, . . . , 11) for the SHB15, and (α = 1, . . . , 16) for the SHB20. For the SHB15 element, this expansion reads

⎧ ⎪ ⎪ ⎨ ⎪ ⎪ ⎩ u i = a 0i + a 1i x 1 + a 2i x 2 + a 3i x 3 + c 1i h 1 + c 2i h 2 + c 3i h 3 + c 4i h 4 + c 5i h 5 + c 6i h 6 + c 7i h 7 + c 8i h 8 + c 9i h 9 + c 10i h 10 + c 11i h 11 h 1 = ξζ, h 2 = ηζ, h 3 = ξη, h 4 = ξηζ, h 5 = ξ 2 , h 6 = η 2 , h 7 = ζ 2 , h 8 = ξ 2 ζ, h 9 = η 2 ζ, h 10 = ξζ 2 , h 11 = ηζ 2 , i = 1, 2, 3. (2)
Evaluating the above equation at the SHB15 element nodes leads to the following three fifteen-equation systems:

d i = a 0i s+ a 1i x 1 + a 2i x 2 + a 3i x 3 + c 1i h 1 + c 2i h 2 + c 3i h 3 + c 4i h 4 + c 5i h 5 + c 6i h 6 + c 7i h 7 + c 8i h 8 + c 9i h 9 + c 10i h 10 + c 11i h 11 , i = 1, 2, 3 (3)
where the fifteen-component vectors d i and x i represent the nodal displacements and nodal coordinates, respectively, and are defined as

d T i = (u i1 , u i2 , u i3 , . . . . ., u i15 ), x T i = (x i1 , x i2 , x i3 , . . . . ., x i15 ),
while s and h α (α = 1, . . . , 11) are constant vectors given by

⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ s T = (1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1)
2h T 1 = (0, -1, -2, -1, 0, 0, 0, 0, 0, 0, 1, 2, 1, 0, 0) 2h T 2 = (0, 0, 0, -1, -2, -1, 0, 0, 0, 0, 0, 0, 1, 2, 1) 4h T 3 = (0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0) 4h T 4 = (0, 0, 0, -1, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0) 4h T 5 = (0, 1, 4, 1, 0, 0, 0, 4, 0, 0, 1, 4, 1, 0, 0) 4h T 6 = (0, 0, 0, 1, 4, 1, 0, 0, 4, 0, 0, 0, 1, 4, 1)

h T 7 = (1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 1, 1, 1, 1, 1) 4h T 8 = (0, -1, -4, -1, 0, 0, 0, 0, 0, 0, 1, 4, 1, 0, 0) 4h T 9 = (0, 0, 0, -1, -4, -1, 0, 0, 0, 0, 0, 0, 1, 4, 1) 2h T 10 = (0, 1, 2, 1, 0, 0, 0, 0, 0, 0, 1, 2, 1, 0, 0) 2h T 11 = (0, 0, 0, 1, 2, 1, 0, 0, 0, 0, 0, 0, 1, 2, 1)
To determine the unknown constants a ji and c αi in Eq. ( 2), the derivatives of the shape functions, evaluated at the origin of the reference frame, are introduced:

b i = N ,i (0) = ∂N ∂ x i |ξ =η=ζ =0 i = 1, 2, 3 ( 4 )
where vector N has as components the shape functions N I . Explicit expressions for vectors b i can be derived by algebra, which allow us to demonstrate the following orthogonality conditions:

b T i • h α = 0, b T i • s = 0, b T i • x j = δ i j , i, j = 1, . . . , 3 h T 1 • s = 0, h T 2 • s = 0, 2h T 3 • s = 1, h T 4 • s = 0, h T 5 • s = 4, h T 6 • s = 4, h T 7 • s = 12, h T 8 • s = 0, h T 9 • s = 0, h T 10 • s = 4, h T 11 • s = 4 8h T α • h β = ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎣
24 -4 0 2 0 0 0 20 2 0 -4 24 0 2 0 0 0 2 20 0 0 0 1 0 1 1 4 0 0 2 2 2 0 1 0 0 0 1 1 0 0 0 1 0 26 1 24 0 0 20 0 0 1 0 1 26 24 0 0 2 20 0 0 4 0 24 24 96 0 0 32 32 20 2 0 1 0 0 0 18 1 0 2 20 0 1 0 0 0 1 18 0 0 0 2 0 20 2 32 0 0 24 0 0 2 0 2 20 32 0 0 4 24

⎤ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎦ (5)
The constants a ji and c αi can be then determined by the scalar product of ( 3) by b T j , s T , and h T α , successively, and the use of orthogonality conditions (5):

a ji = b T j • d i , c αi = γ T α • d i , (6)
with

γ T α = n α1 h T 1 -h T 1 • x j b T j + n α2 h T 2 -h T 2 • x j b T j + n α3 h T 3 - 1 30 s T - h T 3 - 1 30 s T • x j b T j + n α4 h T 4 -h T 4 • x j b T j + n α5 h T 5 - 4 15 s T - h T 5 - 4 15 s T • x j b T j + n α6 h T 6 - 4 15 s T - h T 6 - 4 15 s T • x j b T j + n α7 h T 7 - 4 5 s T - h T 7 - 4 5 s T • x j b T j + n α8 h T 8 -h T 8 • x j b T j + n α9 h T 9 -h T 9 • x j b T j + n α10 h T 10 - 4 15 s T - h T 10 - 4 15 s T • x j b T j + n α11 h T 11 - 4 15 s T - h T 11 - 4 15 s T • x j b T j and n αβ = ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎣
⎤ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎦ α, β = 1, 2, . . . , 11
In the case of the SHB20 element, repeating exactly the same steps results in

⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ u i = a 0i + a 1i x 1 + a 2i x 2 + a 3i x 3 + c 1i h 1 + c 2i h 2 + c 3i h 3 + c 4i h 4 + c 5i h 5 +c 6i h 6 + c 7i h 7 + c 8i h 8 + c 9i h 9 + c 10i h 10 + c 11i h 11 + c 12i h 12 + c 13i h 13 +c 14i h 14 + c 15i h 15 + c 16i h 16 h 1 = ξζ, h 2 = ηζ, h 3 = ξη, h 4 = ξ 2 , h 5 = η 2 , h 6 = ζ 2 , h 7 = ξηζ, h 8 = ξ 2 η, h 9 = ξ 2 ζ, h 10 = η 2 ξ, h 11 = η 2 ζ, h 12 = ζ 2 ξ, h 13 = ζ 2 η, h 14 = ξ 2 ηζ, h 15 = ξη 2 ζ, h 16 = ξηζ 2
which, evaluated at the element nodes, yields the three twenty-equation systems:

d i = a 0i s + a 1i x 1 + a 2i x 2 + a 3i x 3 + c 1i h 1 + c 2i h 2 + c 3i h 3 + • • • + c 16i h 16 , i = 1, 2, 3. (7)
As before, the twenty-component vectors d i and x i indicate here the nodal displacements and coordinates, while s and h α (α = 1, . . . , 16) are given by

⎧ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎨ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎪ ⎩ s T = (1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) h T 1 = (1, -1, -1, 1, -1, 1, 1, -1, 0, -1, 0, 1, 0, 0, 0, 0, 0, 1, 0, -1) h T 2 = (1, 1, -1, -1, -1, -1, 1, 1, 1, 0, -1, 0, 0, 0, 0, 0, -1, 0, 1, 0) h T 3 = (1, -1, 1, -1, 1, -1, 1, -1, 0, 0, 0, 0, 1, -1, 1, -1, 0, 0, 0, 0) h T 4 = (1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0, 1) h T 5 = (1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 1, 0, 1, 0) h T 6 = (1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 1, 1, 1, 1) h T 7 = (-1, 1, -1, 1, 1, -1, 1
, -1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)

h T 8 = (-1, -1, 1, 1, -1, -1, 1, 1, 0, 0, 0, 0, -1, -1, 1, 1, 0, 0, 0, 0) h T 9 = (-1, -1, -1, -1, 1, 1, 1, 1, 0, -1, 0, -1, 0, 0, 0, 0, 0, 1, 0, 1) h T 10 = (-1, 1, 1, -1, -1, 1, 1, -1, 0, 0, 0, 0, -1, 1, 1, -1, 0, 0, 0, 0) h T 11 = (-1, -1, -1, -1, 1, 1, 1, 1, -1, 0, -1, 0, 0, 0, 0, 0, 1, 0, 1, 0) h T 12 = (-1, 1, 1, -1, -1, 1, 1, -1, 0, 1, 0, -1, 0, 0, 0, 0, 0, 1, 0, -1) h T 13 = (-1, -1, 1, 1, -1, -1, 1, 1, -1, 0, 1, 0, 0, 0, 0, 0, -1, 0, 1, 0) h T 14 = (1, 1, -1, -1, -1, -1, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) h T 15 = (1, -1, -1, 1, -1, 1, 1, -1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) h T 16 = (1, -1, 1, -1, 1, -1, 1
, -1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0)

In the same way, the introduction of the twenty-component vectors b i , defined by Eq. ( 4), allows us to demonstrate the following orthogonality conditions:

b T i • h α = 0, b T i • s = 0, b T i • x j = δ i j , i, j = 1, . . . , 3 h T 1 • s = 0, h T 2 • s = 0, h T 3 • s = 0, h T 4 • s = 16, h T 5 • s = 16, h T 6 • s = 16, h T 7 • s = 0, h T 8 • s = 0, h T 9 • s = 0, h T 10 • s = 0, h T 11 • s = 0, h T 12 • s = 0, h T 13 • s = 0, h T 14 • s = 0, h T 15 • s = 0, h T 16 • s = 0 h T α • h β = ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎣
12 0 0 0 0 0 0 0 0 0 0 0 0 0 8 0 12 0 0 0 0 0 0 0 0 0 0 0 8 0 0 0 12 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 16 12 12 0 0 0 0 0 0 0 0 0 0 0 0 12 16 12 0 0 0 0 0 0 0 0 0 0 0 0 12 12 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 12 0 0 0 0 8 0 0 0 0 0 0 0 0 0 0 12 0 8 0 0 0 0 0 0 0 0 0 0 0 0 0 12 0 8 0 0 0 0 0 0 0 0 0 0 0 8 0 12 0 0 0 0 0 0 0 0 0 0 0 0 0 8 0 12 0 0 0 0 0 0 0 0 0 0 8 0 0 0 0 12 0 0 0 8 0 0 0 0 0 0 0 0 0 0 0 8 0 8 0 0 0 0 0 0 0 0 0 0 0 0 0 8 0 0 8 0 0 0 0 0 0 0 0 0 0 0 0

⎤ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎦
Using the above conditions along with the successive scalar product of ( 7) by b T j , s T , and h T α leads to the same expression [START_REF] Belytschko | Assumed strain stabilization of the eight node hexahedral element[END_REF] for the constants a ji and c αi ; however, the corresponding vectors γ α must be replaced now by

γ T α = n α1 h T 1 -h T 1 • x j b T j + n α2 h T 2 -h T 2 • x j b T j +n α3 h T 3 -h T 3 • x j b T j + n α4 h T 4 - 4 5 s T - h T 4 - 4 5 s T • x j b T j +n α5 h T 5 - 4 5 s T - h T 5 - 4 5 s T • x j b T j +n α6 h T 6 - 4 5 s T - h T 6 - 4 5 s T • x j b T j +n α7 h T 7 -h T 7 • x j b T j + n α8 h T 8 -h T 8 • x j b T j +n α9 h T 9 -h T 9 • x j b T j + n α10 h T 10 -h T 10 • x j b T j +n α11 h T 11 -h T 11 • x j b T j + n α12 h T 12 -h T 12 • x j b T j +n α13 h T 13 -h T 13 • x j b T j + n α14 h T 14 -h T 14 • x j b T j +n α15 h T 15 -h T 15 • x j b T j + n α16 h T 16 -h T 16 • x j b T j with n αβ = ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎣
⎤ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎦ α, β = 1, 2, . . . , 16
After these lengthy derivations, the following expressions for the displacement gradient u i, j and for the discrete gradient operator B, which relates the strain field to the nodal displacements by the relationship ∇ s (u) = B • d, are found:

u i, j = b T j + h α, j γ T α • d i , (8)
B = ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎣ b T x + h α,x γ T α 0 0 0 b T y + h α,y γ T α 0 0 0 b T z + h α,z γ T α b T y + h α,y γ T α b T x + h α,x γ T α 0 0 b T z + h α,z γ T α b T y + h α,y γ T α b T z + h α,z γ T α 0 b T x + h α,x γ T α ⎤ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎦ , ( 9
)
with

∇ s (u) = ⎡ ⎢ ⎢ ⎢ ⎢ ⎢ ⎢ ⎣ u x,x u y,y u z,z u x,y + u y,x u y,z + u z,y u x,z + u z,x ⎤ ⎥ ⎥ ⎥ ⎥ ⎥ ⎥ ⎦ , d = ⎡ ⎣ d x d y d z ⎤ ⎦ .
Note that Eqs. ( 8) and ( 9) are common to both elements, provided that the summation over subscript α is taken from 1 to 11 for the SHB15, and from 1 to 16 for the SHB20.

The compact expression [START_REF] Masud | A stabilized 3D co-rotational formulation for geometrically nonlinear analysis of multi-layered composite shells[END_REF] for the discrete gradient operator B is very convenient because the γ α vectors involved are shown to satisfy the following orthogonality conditions:

γ T α • x j = 0, γ T α • h β = δ αβ , j = 1, . . . , 3, (α, β = 1, . . . , 11) resp. (α, β = 1, . . . , 16).
This would allow each of the deformation modes to be separately handled in order to build a simple form for an assumed-strain field. The formulation (9) also allows us to check any stiffness matrix rank deficiency for these elements. It is noteworthy that no projection for the corresponding discrete gradient operators has been applied to these quadratic solid-shell elements, as no significant locking has been experienced so far in the benchmark problems tested.

Variational principle

The Hu-Washizu mixed variational principle, which was used for the formulation of the linear solid-shell elements SHB8PS and SHB6 [START_REF] Abed-Meraim | An improved assumed strain solid-shell element formulation with physical stabilization for geometric nonlinear applications and elastic-plastic stability analysis[END_REF][START_REF] Trinh | A new assumed strain solid-shell formulation "SHB6" for the six-node prismatic finite element[END_REF], is considered here again. More specifically, a simplified form of this principle, as described by Simo and Hughes [START_REF] Simo | On the variational foundations of assumed strain methods[END_REF], is adopted, which can be written for a single finite element as

π( ε) = e δ εT • σ d -δ ḋT • f ext = 0, (10)
where δ denotes a variation, ε the assumed-strain rate, σ the stress field evaluated from the constitutive equations, ḋ the nodal velocities, and f ext the external nodal forces. The well-known assumed-strain method consists of choosing a B operator, obtained by projection of the classical discrete gradient operator B, such as ε = B • ḋ. The goal of this method is to eliminate most of the locking phenomena (e.g., shear locking, membrane locking, etc) that can be encountered, especially in low-order finite elements. Although this technique has been shown to be consistent, from a variational perspective, with the Hu-Washizu variational principle [START_REF] Simo | On the variational foundations of assumed strain methods[END_REF], this variational justification does not provide a general, systematic way to derive adequate assumedstrain fields. Substituting the stress tensor σ in Eq. ( 10) with the Hooke law σ = C • ε, where C is the elasticity matrix, and using the relationship ε = B • ḋ yields

K e = e BT • C • Bd , f int = e BT • σ( ε) d , ( 11
)
where K e and f int denote the stiffness matrix and the internal force vector, respectively. For the above-mentioned reasons related to the absence of locking for the proposed quadratic solid-shell elements in the benchmark problems tested, no projection for the corresponding discrete gradient operators has been applied here. This amounts to taking B = B in Eq. [START_REF] Onate | Derivation of plate based on assumed shear strain fields[END_REF], which leads to the following classical expressions for the stiffness matrix and internal forces:

K e = e B T • C • Bd = N int I n =1 ω(ζ I n )J (ζ I n )B T (ζ I n ) • C • B ( ζ I n ),
and

f int = e B T • σ d = N int I n =1 ω(ζ I n )J (ζ I n )B T (ζ I n ) • σ(ζ I n ).
In the above equations, which are common to both developed elements, J (ζ I n ) is the Jacobian of the transformation between the reference configuration and the current configuration of the element, ω(ζ I n ) is the weight associated with the Gauss point I n , and the total number of integration points N int is to adapt depending on the element considered: N int = 3 × n int for the SHB15, and N int = 4 × n int for the SHB20.

Numerical tests and performance evaluation

In this section, the performance of the proposed solid-shell elements will be assessed based on the analysis of a set of selective and representative linear benchmark problems. Recall that the formulation of the SHB15 and SHB20 is valid for any number of through-thickness integration points n int , with a minimum number of two. This user-defined number n int is taken equal to two in linear elastic problems, but can be freely modified whenever required for a specific application. To illustrate the performance of the proposed elements, the results obtained for each test problem will be compared to the reference solution and also to the results yielded by other existing finite elements having similar properties in terms of geometry, number of nodes and degrees of freedom.

Test of the maximum aspect ratios

This linear test is specifically designed to evaluate the aspect ratio limits of the elements on a beam bending problem. It was previously applied to the linear solid-shell SHB8PS [START_REF] Legay | Elastoplastic stability analysis of shells using the physically stabilized finite element SHB8PS[END_REF] in order to assess the behavior of the element when non-structured, irregular meshes are employed and to analyze potential locking phenomena in the limit of high aspect ratios. The corresponding cantilever beam geometry is shown in Fig. 2, where regular and irregular mesh data are specified.

In this analysis, the length and the width of the beam are fixed: L = 100, l = 10; while the thickness t is a varying parameter. The elastic properties are E = 68.25×10 6 and ν = 0.3. A bending load, P = 4, is applied to the free end of the beam, and the results are normalized using the reference solution, which is here analytical, given by beam theory.

For the hexahedral elements, a fixed mesh of 10 elements with a single element along the thickness is used in both regular and irregular meshes. For the regular mesh, each element is a 10 × 10 square (i.e., l = 10 is the side of the square, and r = l/t represents the varying aspect ratio). A similar aspect-ratio definition is adopted for the irregular mesh (see Fig. 2). For the prismatic elements, the same procedure as before is followed; then each hexahedron is divided into two prismatic elements, while maintaining a single element layer along the thickness. The normalized vertical displacement at point A for different aspect ratios is reported in Table 1, for the regular mesh, and in Table 2 for the irregular mesh.

In Tables 1 and2, the proposed solid-shells are compared to their conventional 3D counterparts denoted as PRI15 and HEX20. The latter designate the standard full-integration solid elements with fifteen and twenty nodes, respectively. We can observe that the proposed solid-shells perform much better than their 3D counterparts, especially for the irregular meshes. In this test and for the regular mesh, the admissible aspect ratio is about 500 for the SHB20 and 333 for the SHB15. By contrast, the quality of the results for the standard solid elements starts declining for much lower aspect ratios, and this is more remarkable for distorted meshes (see Table 2). This doubly-curved shell problem, which is often used to assess the three-dimensional inextensional bending behavior of shells, has become very popular and has been adopted by many authors since it was proposed by MacNeal and Harder [START_REF] Macneal | A proposed standard set of problems to test finite element accuracy[END_REF]. This test is known to be severe because the transverse shear and membrane locking phenomena are dominant and are further accentuated by the particular geometry of the problem (distorted, skewed elements). Figure 3 shows the geometry, loading, and boundary conditions for this elastic thin shell problem (R/t = 250). The radius is R = 10, the thickness is t = 0.04, Young's modulus is E = 68.25 × 10 6 , and the Poisson ratio is ν = 0.3. Owing to the symmetry of the test (i.e., planes (xz) and (yz)), only one quarter of the hemisphere is meshed using a single layer of elements through the thickness and with two unit loads along the directions Ox and Oy. According to the reference solution (MacNeal and Harder [START_REF] Macneal | A proposed standard set of problems to test finite element accuracy[END_REF]), the displacement of point A along the x-direction is u re f x = 0.0924 (see Fig. 3). The convergence results are reported in Tables 3 and4 in terms of normalized displacements at point A in the x-direction versus the number of elements. For the hexahedral elements, the mesh nomenclature consists of a 3 × (N × N × 1) mesh, in which the quarter of the hemisphere is divided into three zones containing (N × N ×1) elements each (see Fig. 3 for an example of a 3 × (4 × 4 × 1) mesh). For the prismatic elements, by dividing each hexahedron into two prismatic elements, while maintaining a single element layer through the thickness, the mesh nomenclature becomes

(3 × (N × N × 1)) × 2.
The results in Table 3 reveal that the triangular-based elements, SHB15 and PRI15, have a similar convergence in this test problem. Table 4 shows, however, that the quadrangular-based elements converge more rapidly, with a markedly improved performance for the SHB20 as compared to the HEX20. A cylindrical shell loaded with a pair of concentrated vertical forces on its middle section is considered here. Both ends of the cylinder are covered with rigid diaphragms that allow displacements only in the axial direction (see Fig. 4). This test has been treated by many authors, among them Belytschko et al. [START_REF] Belytschko | Assumed strain stabilization procedure for the 9-node Lagrange shell element[END_REF] and Chen and Wu [START_REF] Chen | A mixed 8-node hexahedral element based on the Hu-Washizu principle and the field extrapolation technique[END_REF]. It is considered as a selective test problem since they have shown that shear locking is more severe than membrane locking. The geometric and material parameters for this problem are described in Fig. 4. Owing to the symmetry of the problem, only one eighth of the cylinder is modeled using different N × N × 1 meshes for the hexahedral elements, and (N × N × 1) × 2 meshes for the prismatic elements. For illustration, an example of a (10 × 10 × 1) × 2 mesh is shown in Fig. 4.

The displacement at the load point A in the loading direction is normalized with respect to the reference solution u re f z = -0.18248 × 10 -4 , and reported in Tables 5 and6 for each mesh discretization.

The results in Table 5 reveal once again a similar convergence for the prismatic elements SHB15 and PRI15, with slightly better performance for the SHB15. For the hexahedral elements, Table 6 shows, on the one hand, that their performance is much better than that of the prismatic elements, and on the other hand, that the SHB20 displays a convergence rate significantly better than that of the HEX20.

Test of buckling of a cylinder under external pressure

This test represents a linear stability analysis of a thin cylinder, which is free at its ends and subjected to a uniformly distributed external pressure. This problem also allows us to verify the formulation of the geometric stiffness matrix K σ . Indeed, in this linear buckling analysis, the Euler critical pressure is determined along with the corresponding buckling mode. This critical state is associated with the lowest pressure that makes the global stiffness matrix singular and is classically obtained by solving the following eigenvalue problem: in which λ c is the critical buckling load and X c is the associated buckling mode. The geometric and material parameters for this test are (see, e.g., Fig. 5): the length L = 2, the radius R = 2, the thickness e = 0.02, Young's modulus E = 2 × 10 11 , and the Poisson ratio ν = 0.3. The reference solutions used for comparison are analytical, given by Timoshenko and Gere [START_REF] Timoshenko | Théorie de la stabilité élastique[END_REF] and Brush and Almroth [START_REF] Brush | Buckling of bars, plates and shells[END_REF]. Owing to the symmetry, only one eighth of the cylinder is modeled, and symmetry boundary conditions are applied, which in turn restrict the analysis to symmetric buckling modes (i.e., modes 2, 4, and 6 as shown in Fig. 5). The corresponding critical pressure P cr is given by the following analytical expression:

(K e + λ c K σ ) • X c = 0 (12)
P cr = En 2 12 1 -ν 2 e R 3 , n = 2, 4, 6.
The results obtained for the three modes (n = 2, 4, and 6) are reported in Tables 7 and 8 in terms of critical pressure, normalized with respect to the analytical reference solution.

Similar to the previous discussion, Table 7 reveals that the SHB15 exhibits a convergence rate comparable to that of the PRI15 on this test problem. On the contrary, Table 8 shows that the SHB20 has remarkable coarse-mesh accuracy and performs much better than its standard solid counterpart HEX20. This last benchmark problem also deals with linear elastic stability. The corresponding buckling analysis is based on the eigenvalue equation ( 12), which allows the formulation of the geometric stiffness matrix K σ to be checked once again. The test consists of a portion of a submarine hull subjected to external pressure, as illustrated in Fig. 6. This test was previously used in [40], while in [41] the submarine was modeled in its entirety. The current analysis only considers a single ring, as described in Fig. 6, and the geometric and material data are reported in Table 9.

Note that due to its symmetry, only one quarter of the ring is modeled and subjected to the corresponding symmetry boundary conditions (see Fig. 6). A linear buckling analysis is performed to determine the Euler critical pressure, based on the eigenvalue analysis of the global stiffness matrix (see Eq. ( 12)). The SHB8PS element is first used to determine a reference solution for the first critical load (i.e., dead load buckling The obtained results for the critical pressure, after normalization with respect to the reference solution, are reported in Table 10. The corresponding Euler buckling mode is illustrated in Fig. 7.

The results in Table 10 reveal, as also observed previously, that the hexahedral solid-shell SHB20 is more efficient in terms of accuracy and convergence than the prismatic solid-shell SHB15.

Conclusions

In this paper, the formulation of two new quadratic solid-shell finite elements, denoted as SHB15 and SHB20, has been given in detail. The SHB15 is a fifteen-node prism and the SHB20 is a twenty-node hexahedron, both having only three translational degrees of freedom per node. The key idea of the derivation is the convenient combination of a 3D approach with some essential shell features. For instance, the integration points are distributed along a special direction, designated as the thickness. The corresponding in-plane reduced integration contributes to alleviate several locking phenomena, while increasing the computational efficiency of the elements. To further enhance the element immunity with regard to shear and thickness-type locking, shell-like behavior is intended by adopting a local physical coordinate system for the specification of the constitutive matrix. In such a local frame, the xy plane corresponds to the element mid-plane defined by the ζ -coordinate of the considered integration point.

The performance of the resulting solid-shell elements has been assessed, based on the analysis of various linear benchmark problems. The obtained simulation results have been compared to the reference solutions and also to existing conventional 3D solid elements. In all of the benchmark problems tested, the proposed elements showed very good convergence and accuracy. The performance of the SHB15 solid-shell is often found comparable to that of the standard 3D element PRI15; however, the SHB15 admits larger aspect ratios. The SHB20 solid-shell shows remarkable performance both in terms of coarse-mesh accuracy and computational efficiency. Because these elements have only three degrees of freedom per node, they can automatically be combined to mesh arbitrarily complex structural shapes. This possible combination of effective hexahedral and prismatic elements is useful for many applications, and becomes necessary when free mesh generation tools are employed.

Fig. 1

 1 Fig.1Reference geometry for the SHB15 and SHB20 and location of integration points (n int = 5)

Fig. 2

 2 Fig. 2 Test of admissible aspect ratios: Cantilever beam geometry and mesh description

Fig. 3

 3 Fig. 3 Test of the pinched hemispherical shell: a example of a 3 × (4 × 4 × 1) mesh, and b initial and deformed configurations

( 3 × ( 5 × 5 × 1 )Fig. 4

 35514 Fig. 4 Test of the pinched cylinder with diaphragms: a geometry and data specifications, and b example of a (10 × 10 × 1) × 2 mesh with prismatic elements

Fig. 5

 5 Fig. 5 Buckling of a cylinder under external pressure: buckling modes n o 2, 4, and 6, and example of a (20 × 30 × 1) × 2 mesh with prismatic elements

Fig. 6 5

 65 Fig.[START_REF] Belytschko | Assumed strain stabilization of the eight node hexahedral element[END_REF] Geometry and boundary conditions for a quarter of a single ring: an example of a mixed mesh using 260 hexahedral elements for the stiffener and 360 prismatic elements for the main shell

Table 1

 1 Normalized displacement at point A for the regular mesh

	Aspect ratio (r = l/t)	HEX20	SHB20	PRI15	SHB15
		u z u	re f z	u z u	re f z	u z u	re f z	u z u	re f z
	1	1.005	1.009	1.000	1.009
	10	0.984	0.998	0.975	0.997
	100	0.951	0.997	0.967	0.995
	200	0.959	0.996	0.953	1.019
	333			0.998	0.860	0.988
	500			1.004

Table 2

 2 Normalized displacement at point A for the irregular mesh

	Aspect ratio (r = l/t)	HEX20	SHB20	PRI15	SHB15
		u z u	re f z	u z u	re f z	u z u	re f z	u z u	re f z
	1	0.981	1.010	0.974	0.985
	10	0.682	0.997	0.871	0.945
	100	0.345	0.995	0.832	0.944
	200	0.294	1.002	0.832	0.944
	333	0.251	0.984	0.878	0.926

Table 3

 3

	Normalized displacement at point A of	Mesh	PRI15	SHB15
	pinched hemispherical shell (prismatic elements)		u x u	re f x	u x u	re f x

Table 5

 5

	Normalized displacement at point A of the	Mesh	PRI15	SHB15
	pinched cylinder (prismatic elements)		u z u	re f z	u z u	re f z
		(10 × 10 × 1) × 2	0.625	0.646
		(15 × 15 × 1) × 2	0.838	0.913
		(20 × 20 × 1) × 2	0.919	0.951
		(25 × 25 × 1) × 2	0.956	0.996
	Table 6 Normalized displacement at point A of the	Mesh	HEX20		SHB20
	pinched cylinder (hexahedral elements)		u z u	re f z		u z u	re f z
		4 × 4 × 1	0.140		0.883
		6 × 6 × 1	0.328		0.961
		8 × 8 × 1	0.523		0.979
		10 × 10 × 1	0.675		0.990

Table 7

 7 Normalized critical pressure for the thin cylinder under pressure (prismatic elements)

	Mesh	Mode 2		Mode 4		Mode 6
		P cr /P (2) cr (re f ) (2)	P cr /P (4) cr (re f ) (4)	P cr /P (6) cr (re f ) (6)
		PRI15	SHB15	PRI15	SHB15	PRI15	SHB15
	(10 × 10 × 1) × 2	1.31	1.43	1.35	1.45	1.42	1.50
	(12 × 10 × 1) × 2	1.14	1.17	1.16	1.18	1.20	1.20
	(14 × 10 × 1) × 2	1.07	1.08	1.08	1.08	1.11	1.09
	(16 × 10 × 1) × 2	1.03	1.03	1.04	1.04	1.06	1.04
	(20 × 10 × 1) × 2	1.00	1.00	1.01	1.00	1.02	1.00

Table 8

 8 Normalized critical pressure for the thin cylinder under pressure (hexahedral elements)

	Mesh	Mode 2		Mode 4		Mode 6
		P cr /P (2) cr (re f ) (2)		P cr /P (4) cr (re f ) (4)		P cr /P (6) cr (re f ) (6)
		HEX20	SHB20	HEX20	SHB20	HEX20	SHB20
	3 × 3 × 1	5 3 .33	1.00	70.58	1.05	51.73	1.26
	4 × 4 × 1	1 7 .27	0.99	21.14	1.01	25.92	1.07
	5 × 5 × 1	7 .60	0.99	8.76	0.99	10.48	1.02
	6 × 6 × 1	4 .16	0.98	4.61	0.99	5.31	1.00
	7 × 7 × 1	2 .70	0.98	2.91	0.99	3.24	0.99

Table 9

 9 Geometric and material properties for the stiffened ring under external pressure

	Frame spacing	L s	0.6
	Mean radius	R	2.488
	Shell thickness	e	0.024
	Web height	h w	0.156
	Flange width	W f	0.120
	Web thickness	e w	0.010
	Flange thickness	e f	0.024
	Young's modulus	E	200 × 10 9
	Poisson's ratio	ν	0.3

Table 10

 10 Normalized critical buckling pressure for the stiffened cylindrical ring Mesh P cr /P cr (re f )

	300 PRI15 elements	1.01
	300 SHB15 elements	1.00
	100 HEX20 elements	1.01
	100 SHB20 elements	0.99

Fig. 7 Illustration of the first Euler buckling mode for the stiffened cylindrical ring under pressure pressure). A converged solution obtained with a fine mesh of 440 SHB8PS elements is 7.06 × 10 6 , which is in good agreement with previously reported results [40,41].

× (1 × 1 × 1) 0.001 0.115 3 × (2 × 2 × 1) 0.014 0.564 3 × (3 × 3 × 1) 0.065 0.927 3 × (4 ×

× 1) 0.177 0.985 3 × (5 ×

× 1) 0.342 0.997

Acknowledgments This work has been carried out within a project jointly funded by EDF R&D (French Electricity Company) and CETIM (Technical Center for Mechanical Industries). The authors would like to thank EDF R&D and CETIM for their financial support.


Bertrand Mathieu

Guillaume Doyen

Wissam Mallouli

Thomas Silverston

Olivier Bettan

François-Xavier Aguessy

Thibault Cholez

Abdelkader Lahmadi

Patrick Truong

Edgardo Montes De Oca

Monitoring and Securing New Functions Deployed in a Virtualized Networking Environment

Network operators are currently very cautious before deploying a new network equipment. This is done only if the new networking solution is fully monitored, secured and can provide rapid revenues (short Return of Investment). For example, the NDN (Named Data Networking) solution is admitted as promising but still uncertain, thus making network operators reluctant to deploy it. Having a flexible environment would allow network operators to initiate the deployment of new network solutions at low cost and low risk. The virtualization techniques, appeared a few years ago, can help to provide such a flexible networking architecture. However, with it, emerge monitoring and security issues which should be solved. In this paper, we present our secure virtualized networking environment to deploy new functions and protocol stacks in the network, with a specific focus on the NDN use-case as one of the potential Future Internet technology. As strong requirements for a network operator, we then focus on monitoring and security components, highlighting where and how they can be deployed and used. Finally, we introduce our preliminary evaluation, with a focus on security, before presenting the testbed, involving end-users consuming real contents, that we will set up for the assessment of our approach.

I. INTRODUCTION

Network equipment is often designed for a specific usage, proprietary, and running on a specific hardware; making it very expensive to integrate (e.g. sizing, implementing, configuring and managing). Since the decision to deploy such a set of devices follows a logic based on RoI (Return of Investment), this drastically limits the ambition of network operators and the innovation in the network they operate. For example, network operators are reluctant to globally deploy a Named Data Networking (NDN) solution [START_REF] Jacobson | Networking Named Content[END_REF], a novel networking paradigm, proposing an Internet data plane that shifts from host-based network mechanisms to content-based ones, even if it could be considered as a solid alternative to the current IP stack. 1 Bertrand Mathieu and Patrick Truong are with Orange Labs, Lannion, France. Guillaume Doyen is with Charles Delaunay Institute, UMR CNRS 6281, France Wissam Mallouli and Edgardo Montes de Oca are with Montimage, Paris, France. Thomas Silverston, Thibault Cholez, Abdelkader Lahmadi are with Loria, Nancy, France Olivier Bettan and François-Xavier Aguessy are with Thales Services, Palaiseau, France A new trend in the networking area has emerged in the last few years: the virtualization of network functions. NFV (Network Virtualization Function), as defined by the European Telecommunications Standards Institute (ETSI) [START_REF]Network Functions Virtualisation -An Introduction, Benefits, Enablers, Challenges & Call for Action[END_REF], is the key technology that leverages this concept. It involves implementing network functions in software that can run on a range of industry standard commodity server hardware. This initiative favors the progressive deployment of new network functions or protocols. In this paper, we propose to push towards the adoption of these new standards by enabling a secure use of virtualized network equipment, which will ease the deployment of novel networking architectures. To illustrate our solution, we consider the case of NDN as an example of a new emerging stack. The co-existence of IP and NDN, and the progressive migration of traffic from one stack to the other in a virtualized environment are introduced, with a practical methodology consisting of setting up a real testbed. This testbed will allow end-users to access web sites (e.g., YouTube, Dailymotion, etc.) using the developed virtualized networking environment, hosting the NDN networking stack in parallel with IP. The testbed aims at proving the feasibility of the approach and also provides real traces, whose goal is to feed the monitoring and security aspects of our virtualized architecture. Indeed, monitoring and security are primary operator requirements that need to be assured before deploying new solutions. As such, we investigate how to design and deploy monitoring functions in such a virtualized environment. With the NDN specific use-case in mind, we study the type of information to monitor, the way to collect it and the way to analyze it. Leveraging a virtualized networking technology requires a full rethought of the way the security has to be designed, implemented and orchestrated. We focus here on the secure deployment, attack detection and mitigation, for protocols deployed in an NFV framework as network functions. This paper is organized as follows: Section II presents our secured network architecture composed of virtualized network functions, with NDN use-case. Section III details our monitoring solution for such environment and its relationship with the security modules, so as to secure the system. Section IV introduces our preliminary evaluation as well as the testbed we will set up to assess our solutions. Section V presents the related work and Section VI concludes the paper.

II. A SECURED ARCHITECTURE FOR VIRTUAL NETWORK

FUNCTIONS: NDN USE-CASE Leveraging the network virtualization to ease the deployment of new protocol stacks and functions appears as a strong mean to incite network operators to adopt these technologies. To reach this target, we propose in this paper an innovative secured virtualized network architecture (Figure 1). It is modular, as it is composed of a set of virtualized nodes that can host different protocol stacks (e.g. IP and NDN stacks in our use-case), network functions and validate their co-existence and correct behavior.

Named Data Networking (NDN) [START_REF] Jacobson | Networking Named Content[END_REF] is a novel networking paradigm, which proposes an Internet data plane that shifts from host-based network mechanisms to content-based ones. The match of requested content rather than the location of the endpoint that provides it thus dictates the establishment of a communication in NDN. Furthermore, NDN natively offers interesting features such as caching, multicasting, mobility, data integrity and authentication, etc. However, even if very promising, network operators are reluctant to deploy such a novel data plane architecture, for the following reasons: (1) the huge initial investment costs it requires; and, (2) the security risk involved in introducing such a technical breakthrough and migrating from IP to the NDN paradigm. In this context the architecture we propose, makes possible the deployment of such a NDN protocol stack in virtualized network nodes, thus avoiding any risk nor any additional hardware cost (the equipment is already deployed). Furthermore, it does not exclude the use of IP, since both can co-exist in the same physical node, each one having its own virtualized space. Thanks to a virtualized infrastructure, NDN can be deployed incrementally along with IP. More precisely, network operators can deploy NDN only in specific network locations (e.g. access networks, Point-of-Presence routers, mobile backhauling) and for specific services (e.g. social network applications, live video streaming, etc.) in selected nodes, which can help to improve the delivery of such services, with lower investment and risks.

For the NDN use-case, two deployment options are envisioned. First, the whole NDN stack is deployed as a single standalone component. This is the most straightforward way to deploy this NDN software. Second, the individual components forming the NDN node, such as the FIB (Forwarding Information Base), the PIT (Pending Interest Table) and the CS (Content Store) are deployed into the virtualized node as individual elements. The later allows composing the NDN nodes with components possibly coming from different providers (if one is more efficient for forwarding, while another provider offers a better caching mechanism for its CS). This second option allows more flexibility, and it was one of the main objectives at the beginning of the virtualization techniques, with more deployment options according to the NDN operators (low-cost operator, high quality operator, small-size operator dealing with few contents or on the contrary, large-size operator, etc.). Together with the deployment of NDN, the monitoring and security aspects should be considered, since it is a necessary condition for its adoption. As compared to an IP stack, the case of NDN is highly challenging since, no solution exists for this architecture to (1) identify traffic, flows and link them to a particular activity; and, (2) probe, aggregate, correlate and disseminate monitored information in an efficient and scalable monitoring plane. The following section presents our defined monitoring and securing solution.

III. MONITORING AND SECURING FUNCTIONS IN VIRTUALIZED ENVIRONMENTS

A. Location of the monitoring component

Our solution introduces virtualized networks and functions that need to be monitored. To be able to ensure end-to-end QoS and security, a monitoring architecture needs to be defined and deployed in order to measure and analyze the network flows at different observation points that could include any component of the system, such as physical and virtual machines. Setting up several observation points will help to better diagnose the problems detected. With SDN (stands for Software Defined Network) [START_REF]Software-Defined Networking: The New Norm for Networks[END_REF], it is possible to create network monitoring applications that collect information and make decisions based on a network-wide holistic view. This enables centralized event correlation on the network controller, and allows new ways of mitigating network faults.

The monitoring probes can be deployed in different points of the system.

Figure 3. Network-based protection

Let's consider a single hardware entity that is controlled by a hypervisor that manages the virtual machines. A first approach consists of installing the monitoring solution, MMT (Montimage Monitoring Tool) [START_REF] Mallouli | Online Network Traffic Security Inspection Using MMT Tool[END_REF] in the host system (hypervisor) that operates and administers the virtual machines (see Figure 3), in this way providing a global view of the whole system. This approach requires less processing power and memory to perform the monitoring operations, since the protection enforcement is located in a central point.

In this way, network connections between the host and the virtual machines can be easily tracked allowing early detection of any security and performance issue. The main problem of this approach resides in the minimum visibility that the host machine has inside the virtual machines, not being able to access to key parameters such as the internal state, the intercommunication between virtual machines, or the memory content.

Figure 4. Virtual machine introspection

Monitoring probes can also be located in a single privileged virtual machine that is responsible for inspection and monitoring of the rest (see Figure 4). This approach is called Virtual Machine Introspection (VMI) [START_REF] Garfinkel | A Virtual Machine Introspection Based Architecture for Intrusion Detection[END_REF] and offers good performance since the monitoring function is co-located on the same machine as the host it is monitoring and leverages a virtual machine monitor to isolate it from the monitored host.

In this way, the activity of the host is analyzed by directly observing hard-ware state and inferring software state based on a priori knowledge of its structure. VMI allows the monitoring function to maintain high levels of visibility, evasion resistance (even if host is compromised), and attack resistance (isolation), and even enables the manipulation of the state of virtual machines. Unfortunately, VMI based monitoring software is highly dependent on the particular deployment and requires privileged access that cloud providers need to authorize.

Figure 5. Host-based protection

The approach that offers the best security performance is the deployment of the monitoring tools in every virtual machine (see Figure 5). In this way robust protection can be achieved since the security software has a complete view of the This third solution offers the best performance in terms of security. Here, the processing power and memory required are distributed among the virtual machines. Furthermore, its deployment is simpler than other approaches since it can be included in the software image of the virtual machine, so it is automatically initiated when instantiating each virtual machine with no further configuration needed.

B. SDN-based Monitoring Architecture

Despite of the individual probes installed on each virtual machine, there is the need of a global monitoring coordinator that supervises the monitoring tasks of each probe installed on each virtual machine. For this, each probe must be able to directly interact with any other probe, as well as with the monitoring coordinator. Local decisions can be taken by the individual monitoring probes installed on each virtual machine, and the monitoring coordinator can perform coordination, orchestration and complex event detection.

Considering the different monitoring deployments presented in the previous section, herein, a whole architecture integrating monitoring probes and coordinator is presented.

Figure 6 represents a possible deployment scenario for MMT in an SDN environment. As depicted, MMT probes capture performance and security meta-data from each virtual machine. These data are also to perform countermeasures to mitigate attacks and security risks (see section IV). MMT probes have the capacity of P2P communication, so they can share relevant information with the aim of increasing the efficiency of the mechanisms and, thus, ensure the correct operation of the whole system. To perform coordination and orchestration of the whole monitoring system, a central MMT Operator will receive information from the distributed MMT probes. The MMT Operator is also in charge of correlating events to create reports to inform network managers of the system activities, attacks avoided and countermeasures taken. Furthermore, it will be able to globally analyze the information provided by individual MMT probes with the ultimate objective of detecting complex situations that may compromise the system. The architecture detailed in Figure 6 shows the deployment of MMT (MMT probes and MMT Operator) over a set of physical hardware platforms. The MMT Operator will be in charge of coordinating the diverse probes deployed in each virtual machine and provide a global view.

C. Coordinating Security and Monitoring

Network security must be considered parallel to the traffic management and as an integral part of the network management. In SDN, due to its dynamic nature, this becomes even more critical since a security lapse of the centralized controller will adversely affect setting the traffic flow rules on other data path elements managed by the same controller. Similarly, network security policies and procedures must be updated in the case there are changes in the architecture or topology. The combination of proactive and reactive techniques synchronized with traffic management leads to a better security framework. Proactive operations help minimizing security lapses and service degradation; thus favoring a controllable usage of resources.

Reactive mechanisms have to be adequately located to avoid an impact on the performance even when providing a fine-grained control to access the resources. Synchronization in SDN is possible since the controller has a global view of all the network elements, flows and their security requirements and all the security policies. It is necessary to assure, for instance that: the traffic from data-path elements does not stop due to controller failure because of attacks through other data-path elements under the jurisdiction of the controller; and, the security (e.g., access control and firewalls) is configured and active as soon as the flows are directed to new routes (e.g., due to changes in topology).

The following two section present our solution for proactive and reactive security, for the NDN use-case. Virtualizing the deployment of NDN may lead to new threats that need to be identified and mitigated. The investigation of these threats and their impact is performed using a dedicated tool for risk analysis based on attack graphs, which is part of the proactive security mechanism in our architecture. This tool is benefiting from the Software Defined Networking (SDN) built-in capability to provide exhaustive topological information and application network requirements, needed as inputs to compute an efficient vulnerability analysis. The attack graph engine, based on MulVAL [START_REF] Ou | Mulval: A logic-based network security analyzer[END_REF], is configured to take into account vulnerabilities specific to virtualized NDN such as cache poisoning or polluting, or Interest Flooding attack, in addition to the IP-based vulnerabilities that are already provided. Interest Flooding attack consists, for an attacker, to generate malicious Interest packets for non-existing data in the Internet. As a consequence, nodes tables (and especially Pending Interest Tables) grow up to the time where legitimate Interests can no longer be stored, leading to the node resources exhaustion. The consequences of the exploitation of such vulnerabilities (for example the change or deletion of cache content, or the Deny of Service of components) are described in the rules used by the attack graph engine, to be able to see their effects on the global architecture. This allows seeing how attacks specific to NDN may spread to IP or vice versa. This proactive security analysis is used to determine the most likely and impacting multi-steps attacks and propose different remediation strategies in order to increase the level of security of the infrastructure, following the process described in Figure 7 [5]. The first step of this process is to score the impact and probability of attack paths, extracted from the attack graph taking into account both IP and virtualized NDN vulnerabilities. Each path is then processed to compute remediation candidates allowing to mitigate or prevent it. Such remediations are for example the deployment of Virtualized Network Functions (VNF), such as virtualized monitoring probes, or the reconfiguration of the network by benefiting from the SDN. It is also possible to dynamically reconfigure the MMT probes, to have the attacks described in attack paths detected by them. The remediation candidates are then ranked using their operational and impact cost known thanks to the topological information and application network requirements collected through the SDN. In order to have an insight of the effects that a remediation candidate has on the whole information system, the chosen candidate is then applied on a simulated network, and a new security analysis is done and compared with the current one. This process of remediation proposal allows enhancing proactively the security of the network and configuring the MMT probes to detect the possible attacks.

2) Reactive security mechanism

Besides the potential vulnerabilities affecting virtualized NDN, models for the known attack scenarios (called attack patterns) are generated to be able to deduce for each attack path the characteristics of traffic, caches or forwarding tables, which are potential evidences that an attack is occurring or progressing. By identifying the main vulnerabilities and threats tackling our virtualized network, we define the metrics and indicators to be collected for dynamic security monitoring and assessment, thanks to dedicated virtual probes based on MMT. MMT can be deployed in several strategic network observation points to perform local analysis. Besides, locally collected data are shared among the different monitoring entities providing thus a distributed knowledge plane. The data is then processed by virtualized components running detection algorithms. The choice of the detection method (e.g. statistical model, learning methods, etc.) is adapted to the considered attack scenario characteristics and to the observed elements (e.g., traffic, routing tables, caches etc.). By integrating MMT and MulVal, the detection of vulnerabilities becomes a dynamic process which constitutes an important added-value for the assurance of security in such virtualized environment. The scalability of the solution is guaranteed by limiting the attack path analysis to only the dynamically detected protocols and applications, and by providing MMT with the set of properties that are needed for a given situation Besides, dedicated components allow identifying a set of countermeasures that can be engaged over the virtualized networking architecture to stop or mitigate an attack and allow the system to return to normal behavior (for example, by configuring a virtualized Firewall, or deploying new rules for virtual Intrusion Detection Systems). On the basis of this identification, for each of the detected attacks provided as an output of MMT, a set of automated or semi-automated control actions will be selected and orchestrated in a distributed manner. For this, a decentralized orchestration plane, relying on autonomous components is implemented over virtualized MMT. Cooperative algorithms potentially relying on the peer-to-peer paradigm are considered to deal with the scalability and dynamics of the system. Also, the configuration changes made on controlled components are achieved through a SDN approach.

IV. PRELIMINARY EVALUATION

A. Reduce CAPEX and OPEX costs

Network Functions Virtualization offers the potential for both enhancing service delivery and reducing overall operating expenses (OpEx) or capital expenses (CapEx). By enabling NFV with Software-Defined Networking (SDN), network operators can realize even greater benefits from this promising new use of cloud technology.

The first evaluations of the virtualization of the NDN concept target the estimation of this cost reduction that is evident since the proposed architecture allows to dynamically deploy network functions on existing network infrastructure with minimum CAPEX costs. The adoption of the SDN concept to orchestrate the different virtualized components (e.g. NDN nodes) makes their management more flexible (dynamic configuration, counter-measures, etc.) and as a consequence reduces the OPEX costs.

B. Risk-based monitoring solution

The proposed architecture also include proactive and reactive security enforcement based on risk analysis to detect potential security vulnerabilities using the MulVal tool (proactive) as well as a continuous monitoring to detect and mitigate intrusions and attacks using the MMT tool (reactive). This integration between these tools allows to increase the detection capabilities of MMT in NDN based networks as well as its performance. Indeed, the risk analysis provides valuable information to the monitoring tool that activates relevant security proprieties to be checked according to a deployment context and discards irrelevant ones. This improves security analysis efficiency and intrusion detection and prevention performance (estimated to +20%).

The demand for safe and secure networks, that are becoming more and more complex, is growing and requires integrated methodologies. It is expected that the evaluation results obtained, applied to NDN-based networks, will allow a reduction of monitoring costs and development time, improve reliability and lower time-to-market compared with competing products that are complex, expensive and difficult to deploy and adapt. These virtualized networks are often complex, involve multi-vendors and stakeholders, and need to evolve in a very dynamic way. All this introduces vulnerabilities related to the dynamically changing configurations and versions of the software and hardware products. These characteristics make it necessary to introduce self-configuration, self-maintenance, self-healing and self-protection capabilities.

The solution proposed will help detect vulnerabilities during operation, based on the identification of attack paths and the use of data from different sources (i.e., vulnerability scanners and database, application/system traces, network behaviour and pattern analysis, etc.). In this way the self-* capabilities can better be addressed in this kind of virtualized networks.

C. Testbed

Together with the proof of the feasibility, one of our main objectives is to evaluate our solution in a real configuration environment. For this, we will set up a testbed, interconnecting end-users, consuming contents from web sites (as depicted in Figure 1). Our testbed is divided into two sites (campus of Troyes and campus of Nancy, both in France). At each site, virtualization technologies enable the hosting of network functions carrying NDN nodes or components. The testbed of both sites will be interconnected so that to reproduce the case of two autonomous systems operating independent NDN domains, thus leading to basic inter-domain routing. Students of the site campus will be involved to feed the testbed with real traffic they generate. Collected traces are of a long term so that they enable the design of realistic traffic models for NDN. From a technical perspective, HTTP flows will have to be redirected toward the testbed and a dedicated gateway will be implemented. Existing proposals and implementations in that area will be considered, such as [START_REF] Wang | On adapting HTTP protocol to content centric networking[END_REF].

As a first objective, through the use of the monitoring tool, the testbed will allow us to measure, collect and analyse the quality of service of NDN traffic for real video flows. Additionally, satisfying polls of end-users will enable the cross-analysis of QoS metrics against their perceived quality of experience. That way, it will allow us to provide a concrete feedback to network operators on the use of an emerging protocol stack such as NDN for a selected traffic over customizable network topologies.

The second objective of the testbed is related to the overall security of the architecture. Here, we propose to consider both the virtualization layer and NDN to deal with potential vulnerabilities of these combined technologies and also leverage the virtualization to control the NDN network functions. As a use-case, we consider the case of Interest Flooding attack that is one of the acknowledged security issue of NDN, as introduced in section II.A. Through the implementation of this testbed coupled with real end-users, we expect to provide valuable feedback on the use of our approach.

V. RELATED WORK

The concept of virtualization has already been studied in several research fields including operating system virtualization [START_REF] Barham | Xen and the art of virtualization[END_REF], application resource virtualization [START_REF] Barham | Xen and the art of virtualization[END_REF], Link and node virtualization [START_REF] Fox | Above the clouds: A Berkeley view of cloud computing[END_REF] and Data center virtualization [START_REF] Valdez-Vivas | Apostolopoulos: Dynamic resource management in virtualized data centers with bursty traffic[END_REF]. Now, network virtualization is largely discussed. Amongst the most promising network virtualization effort, the ETSI group NFV [START_REF]Network Functions Virtualisation -An Introduction, Benefits, Enablers, Challenges & Call for Action[END_REF] proposes to implement network functions in software that can run on a range of industry standard commodity server hardware. We can distinguish 3 types of network virtualization: As another related work, we can also mention specific works such as [START_REF] Martins | ClickOS and the Art of Network Function Virtualization[END_REF], where the authors proposed ClickOS, a high performance NFV platform with small footprint machines optimized for middlebox processing, but not addressing our objectives. For monitoring, type 2 and 1 virtualization techniques offer some tools for managing virtual network functions, but limited to their lifecyle and do not manage the entire network neither address security issues we investigate. Monitoring systems for virtual machines have appeared over the last decade targeting specific technologies (Xen, VMWare, etc.) [14][15]. A recent IETF initiative [17] proposes building a generic management interface for Virtual Machines Monitoring. This takes the form of an SMI Management Information Base providing the necessary abstractions and objects of interest for monitoring hypervisor based virtual machines.

Regarding virtual machine security, work has been done building on introspection capabilities to identify security incidents [START_REF] Garfinkel | A Virtual Machine Introspection Based Architecture for Intrusion Detection[END_REF]. Approaches like CloudSec [START_REF] Ibrahim | A security monitoring appliance for Virtual Machines in the IaaS cloud model[END_REF] follow this path by offering in depth memory inspection of the monitored virtual machine. Other systems, like Revirt [START_REF] Dunlap | ReVirt: enabling intrusion analysis through virtual-machine logging and replay[END_REF], operate below the operating system for doing both the logging and log-based intrusion detection on hypervisor-built logs.

To conclude, if all the related work presented above aims at addressing the individual challenges a complete NDN over NFV infrastructure has to deal with, none of these efforts address them as a whole while bringing efficient and secured global infrastructures is a key aspect to enable their adoption by involved stake-holders. As such, the Doctor takes part of that effort.

VI. CONCLUSIONS & FUTURE WORK

In this article, we described an architecture using Network Functions Virtualization (NFV) that makes possible the deployment and securing of new functions and protocols in virtualized environments. This architecture is modular and composed of a set of virtualized nodes hosting different protocol stacks. It allows, firstly, proactive security through an attack graph approach for risk analysis and, secondly, responsiveness thanks to the monitoring tool. We preconized base implementations to allow a gradual migration from IP to NDN while enabling the co-existence of both technologies. We finally introduced the testbed that will be deployed on real life use cases, for end-users, to assess and take full advantage of this novel architecture's deployment costs and risk reduction benefits. NFV having been identified as a main programmable network technology to be leveraged in future 5G networks, this work will have to stay aligned with the coming 5G challenges, especially: flexibility, privacy by design, QoS and Quality of Experience for end-user, location and context information, manageability and multi-tenancy to provide service solutions across different infrastructure ownerships, with the different co-existing networks.

Figure 1 .

 1 Figure 1. Overall virtualized secured functions-based network architecture

Figure 2 .

 2 Figure 2. Virtualized node architecture

Figure 6 .

 6 Figure 6. MMT architecture deployment for SDN

Figure 7 .

 7 Figure 7. Vulnerabilities identification and remediation management 1) Proactive security mechanismVirtualizing the deployment of NDN may lead to new threats that need to be identified and mitigated. The investigation of these threats and their impact is performed using a dedicated tool for risk analysis based on attack graphs, which is part of the proactive security mechanism in our architecture. This tool is benefiting from the Software Defined Networking (SDN) built-in capability to provide exhaustive topological information and application network requirements, needed as inputs to compute an efficient vulnerability analysis. The attack graph engine, based on MulVAL[START_REF] Ou | Mulval: A logic-based network security analyzer[END_REF], is configured to take into account vulnerabilities specific to virtualized NDN such as cache poisoning or polluting, or Interest Flooding attack, in addition to the IP-based vulnerabilities that are already provided. Interest Flooding attack consists, for an attacker, to generate malicious Interest packets for non-existing data in the Internet. As a consequence, nodes tables (and especially Pending Interest Tables) grow up to the time where legitimate Interests can no longer be stored, leading to the node resources exhaustion. The consequences of the exploitation of such vulnerabilities (for example the change or deletion of cache content, or the Deny of Service of components) are described in the rules used by the attack graph engine, to be able to see their effects on the global architecture. This allows seeing how attacks specific to NDN may spread to IP or vice versa. This proactive security analysis is used to determine the most likely and impacting multi-steps attacks and propose different remediation strategies in order to increase the level of security of the infrastructure, following the process described in Figure7 [5]. The first step of this process is to score the impact and probability of attack paths, extracted from the attack graph taking into account both IP and virtualized NDN vulnerabilities. Each path is then processed to compute remediation candidates allowing to mitigate or prevent it. Such remediations are for example the deployment of Virtualized Network Functions (VNF), such as virtualized monitoring probes, or the reconfiguration of the network by benefiting from the SDN. It is also possible to dynamically reconfigure the MMT probes, to have the attacks described in attack paths detected by them. The remediation candidates are then ranked using their operational and impact cost known thanks to the topological information and application network requirements collected through the SDN. In order to have an insight of the effects that a remediation candidate has on the whole information system, the chosen candidate is

ACKNOWLEDGEMENT

This work is partially funded by the French National Research Agency (ANR), DOCTOR project, <ANR-14-CE28-0001>, started in 01/12/2014 and supported by the French Systematic cluster.