Mathilde Groussard

Fausto Viader

Valérie Hubert

Brigitte Landeau

Ahmed Abbas

Béatrice Desgranges

Francis Eustache

Hervé Platel
email: herve.platel@unicaen.fr

Musical and verbal semantic memory: two distinct neural networks?

Keywords: semantic memory, music, verbal memory, temporal cortex, prefrontal cortex, PET

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Over the last few decades, neuropsychological studies of brain-damaged patients have revealed the compartmentalization of the musical and verbal domains of the brain [START_REF] Luria | Aphasia in a composer (V. G. Shebalin)[END_REF][START_REF] Signoret | Aphasia without amusia in a blind organist. Verbal alexia-agraphia without musical alexia-agraphia in braille[END_REF].

Specific abilities to perceive music may be selectively impaired in cases of amusia without aphasia [START_REF] Eustache | Identification and discrimination disorders in auditory perception: a report on two cases[END_REF][START_REF] Lechevalier | Neuropsychology of musical identification[END_REF]. Moreover, the left hemisphere appears to be specialized for both rhythm, syntax and access to musical semantic representations (i.e. identification and recognition of melodies) [START_REF] Peretz | Processing of local and global musical information by unilateral braindamaged patients[END_REF][START_REF] Platel | The structural components of music perception. A functional anatomical study[END_REF][START_REF] Patel | Processing syntactic relations in language and music: an event-related potential study[END_REF] whereas the right hemisphere appears to be specialized for melodic (e.g. pitch contour) and timbre perception (Zatorre et al. 1992;[START_REF] Platel | The structural components of music perception. A functional anatomical study[END_REF]). In contrast with clinical and neuroimaging studies of music perception, there have been very few studies of musical memory and, rather surprisingly, the similarity and differences between language and music are mainly studied in the syntactic processing [START_REF] Koelsch | Bach speaks: a cortical "language-network" serves the processing of music[END_REF][START_REF] Patel | Language, music, syntax and the brain[END_REF] and rarely discussed for memory [START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF] .

The aim of the present study was to investigate if the musical semantic memory is sustained by a specific neural network; in other words, we looked for the neural substrates of the musical lexicon. As defined by Tulving back in 1972, "Semantic memory is the memory necessary for use of language. It is a mental thesaurus, organized knowledge a person possesses about words and other verbal symbols, their meaning and referents, about relations among them, and about rules, formulas, and algorithms for manipulations of these symbols, concepts, and relations. Semantic memory does not register perceptible properties of inputs, but rather cognitive referents of input signals." Nowadays, semantic memory in general is defined as the memory for concepts, regardless of the spatial or temporal circumstances of learning [START_REF] Tulving | Memory and consciousness[END_REF][START_REF] Tulving | Episodic memory and common sense: how far apart?[END_REF], while musical semantic memory in particular serves to register "well-known" melodies, but not the spatial or temporal circumstances of learning. This form of semantic memory enables us to identify songs and melodies or to have a strong feeling of knowing them. [START_REF] Peretz | Can we lose memory for music? A case of music agnosia in a non musician[END_REF] reported the observation of a patient (CN) with bilateral temporal lesions who was able to learn verbal material, but not new musical tunes. This clinical case argues for the existence of a long-term memory system devoted to musical material. Starting from neuropsychological dissociations observed in clinical cases, [START_REF] Peretz | Functional dissociations following bilateral lesions of auditory cortex[END_REF] proposed a cognitive model of the access to musical lexicon. In this model, the recognition of a musical tune is based both on a melodic and a temporal dimension. This model postulates the existence of a verbal and a musical lexicon. They are independent but still have a privileged relationship. Musical semantic memory, as considered in our study, can be assimilated to Peretz"s musical lexicon. Both of these concepts (musical semantic memory or musical lexicon) differ from Koelsch et al."s conception of the meaning of music [START_REF] Koelsch | Music, language and meaning: brain signatures of semantic processing[END_REF]). Actually, these authors considered that "aspects of musical meaning might comprise:

(i) meaning that emerges from common patterns or forms; (ii) meaning that arises from the suggestion of particular mood; (iii) meaning arising from extra-musical associations and (iv) meaning arising from combinations of formal structures that create tension" [START_REF] Koelsch | Music, language and meaning: brain signatures of semantic processing[END_REF]). In fact, they referred to associations between musical perception and semantic meaning through sounds association with verbal concepts, but not to the idea of a musical lexicon per se.

Whereas numerous functional imaging studies have already examined the neural basis of semantic memory using mainly verbal and visual material [START_REF] Cabeza | Imaging cognition II: An empirical review of 275 PET and fMRI studies[END_REF][START_REF] Cappa | Imaging studies of semantic memory[END_REF]), only a handful of authors have studied semantic memory using very familiar musical material [START_REF] Besson | Comparison between language and music[END_REF][START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF][START_REF] Satoh | Positron-emission tomography of brain regions activated by recognition of familiar music[END_REF][START_REF] Plailly | The feeling of familiarity of music and odors: the same neural signature?[END_REF]). Besson and Schön (2001) argued that a distinction should be made between the long-term memory systems for music and language. Using the event-related brain potentials (ERP) method, they recorded differential ERP effects for semantic processing when subjects focused all their attention on either the lyrics or the music of opera excerpts. [START_REF] Halpern | When that tune runs through your head: a PET investigation of auditory imagery for familiar melodies[END_REF] examined the cerebral network involved during a musical imagery task and suggested a right frontal lobe implication during the retrieval from musical semantic memory.

Nevertheless, this last result could more reflect the musical episodic memory retrieval, as found in our previous study [START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF]. Actually, the participants heard the melodies just before the experiment and had to judge their rate of familiarity. This reminder of familiar melodies could allow some subjects to refer to this melodies listening context when they imagined the following of the melodies.

Our previous PET study of the neural substrates underlying the semantic and episodic components of musical memory suggested the existence of a neural distinction between these two kinds of memory [START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF]. Semantic memory for musical material seems to involve the left anterior temporal cortex. [START_REF] Satoh | Positron-emission tomography of brain regions activated by recognition of familiar music[END_REF] studied cerebral blood flow by means of H 2 O 15 PET scanning during the recognition of familiar melodies. They observed the activation of the anterior part of both temporal lobes, the middle part of the left superior temporal gyrus and the medial frontal cortices. Using fMRI, [START_REF] Plailly | The feeling of familiarity of music and odors: the same neural signature?[END_REF] investigated the neural bases of the familiarity-based processing of music and odors. They reported involvement of the left-sided frontal (e.g. inferior frontal gyrus) and parieto-occipital areas, for both types of stimuli. This result suggests that it is a multimodal neural system that contributes to the feeling of familiarity.

Contrary to neuropsychological studies of brain-damaged patients, neuroimaging studies of semantic memory have failed to demonstrate a clear-cut distinction between the neural networks involved in semantic retrieval processes for verbal and musical semantic memory.

Thus, the question of independence between the musical and verbal lexicons remains open.

Moreover, no neuroimaging study has so far directly assessed neural activity during comparable musical and verbal semantic memory retrieval tasks. The comparisons between language and music mainly focused on syntactic processing and suggested a common network as regards prefrontal brain areas and different structural representations in the posterior brain regions [START_REF] Patel | Language, music, syntax and the brain[END_REF][START_REF] Koelsch | Significance of Broca's area and ventral premotor cortex for musicsyntactic processing[END_REF]. Based on previous studies of musical syntax [START_REF] Minati | FMRI/ERP of musical syntax: comparison of melodies and unstructured note sequences[END_REF], musical semantic memory [START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF], and language [START_REF] Vigneau | Meta-analyzing left hemisphere language areas: phonology, semantics, and sentence processing[END_REF], we hypothesized that there is a partial neural distinction between verbal semantic memory and musical semantic memory. This neural specificity for musical semantic memory would appear to be present throughout the temporal cortex and prefrontal areas. Tasks with musical material, i.e. nonverbal material, have usually been found to involve the anterior part of the temporal cortex, whereas tasks with verbal material tend to produce more posterior activations [START_REF] Drury | Functional specializations in human cerebral cortex analyzed using the Visible Man surface-based atlas[END_REF][START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF][START_REF] Vigneau | Meta-analyzing left hemisphere language areas: phonology, semantics, and sentence processing[END_REF]. We therefore predicted that musical semantic processes would induce more anterior activations than verbal semantic processes, notably in the temporal cortex.

Subjects and methods

Subjects

Twelve healthy men (mean age = 23.6 years, range 20-27 years, S.D. = 1.96) were selected from a population of university students (mean educational level = 15.6, S.D. = 1.11) to take part in this study. All were right-handed (as determined by the Edinburgh Handedness Inventory, Oldfield, 1971) and had normal hearing.

Because musicians may develop specific cognitive strategies due to musical expertise, we purposely enrolled non-musicians (none had received music lessons or participated in musical performances) so that our findings could be generalized to most people. Our subjects also had to meet two additional criteria. First, they had to be "common listeners" (i.e. not music lovers, who tend to listen to one specific type of music only), and second, they had to score normally on two tests of pitch perception : (1) comparison of two sequences of notes varying exclusively in term of pitch difference of one note, 2) comparisons of pitch between two notes). Throughout the study, all participants were told that the experiment in which they were taking part related to the perception of music, but they were never informed that the musical and verbal components of semantic memory were being specifically studied, in order to avoid their memorizing melodies or very familiar French proverbs and popular sayings before the experiment. All gave written informed consent prior to participation and the research protocol was approved by the regional ethics committee.

Nature of the musical and verbal material

The musical material was drawn from a pre-experimental study featuring 31 "familiar" 1 tunes (data not shown). These were short tonal melodies (5s) (no lyrics) taken from both the classical and modern repertoires and played on a single instrument (flute). Popular songs and melodies associated with French lyrics were avoided so as to minimize verbal associations, as were those which might spontaneously evoke autobiographical memories, such as the "Wedding March" or melodies used in popular TV commercials. During the post experimental debriefing, we have verified that no one had looked for lyrics during the experiment. All melodies were rated as "very familiar" by more than 70% of subjects in a pilot study of 50 subjects matched with the experimental sample. For the musical reference condition, we used 32 pairs of tonal sequences of notes (5s duration) played with the same instrument as those in the semantic musical task. The melodies used in this reference condition were real melodies, extracted mainly from the classical repertory, which were rated as "completely unknown" by more than 80% of the same pre-experimental sample. After completing the study, no participant declared having found any melody to be familiar to him.

The sequences in one given pair were either the same or differed by the pitch of a single note.

All musical stimuli were played by using a synthesizer set to flute-tone without orchestration and had a short length (between 5-7 seconds). The verbal semantic memory task used 35 "familiar" French proverbs or popular sayings2 of approximately 4 seconds duration also drawn from a pre-experimental study. The sentences were uttered by a female speaker with as neutral a prosody as possible, in order to minimize their emotional contents. All were rated as "very familiar" by more than 70% of subjects in a pilot study of 50 subjects matched with the experimental sample. For the verbal reference condition, we constructed 35 "pseudosentences" of the same duration made up of non-words. We had chosen to use "pseudosentences" of non-words for the verbal reference task to avoid automatic semantic memory access, inevitable if we had used a lexical task with real words. Thus, the construction of the experimental material of our two reference tasks was guided by the two following objectives: 1] to obtain verbal and musical materials which were acoustically the nearest possible of the stimuli presented in the semantic tasks, with an aim of withdrawing the maximum of perceptual processes in the memory conditions; 2] to use stimuli not inducing automatic research in semantic memory, consequently unknown of the subjects (for the musical material), and not referring to words of the mother tongue (for the verbal material).

Paradigm

During the PET study, the participant was placed in a supine position on an adjustable table.

An intravenous catheter was placed in the left arm for the administration of H 2 O 15 .

Headphones were positioned on the subject"s head, so that he could hear both the stimuli and instructions. He had to perform two similar categories of semantic memory tasks, one musical (hereafter called "MusSem") and one verbal ("VerbSem"). In the former, the subject heard the beginning of a well-known tune, followed by a short silence and a beep tone (mean interval 800ms), then either the next part of the melody or a different familiar melody. He had to decide whether the second part matched (i.e. was the end of) the first or not. If not, the second part belonged to another familiar melody (corresponding to 36.6% of stimuli). To highlight any specific activation brought about by musical semantic memory processes, the semantic memory task was contrasted with the perceptual control condition (the musical reference task or "MusRef") in which the subject was asked to indicate whether or not two original sequences of notes were similar. This task was supposed to call on decisional and motor processes to the same extent as the experimental task, but not on musical semantic memory since the musical sequences were unknown to the participant.

In the verbal semantic memory task, the subject listened to the beginning of a French proverb or popular saying, followed by silence and a beep tone (mean interval 800ms), and then by either the right or a wrong ending (which then belonged to another proverb). He had to decide whether or not the second part matched the first. This verbal semantic memory test was contrasted with the perceptual control condition (the verbal reference task or "VerbRef") in order to subtract the brain activation produced by decisional and motor processes. In this task the subject had to indicate whether or not two meaningless sequences of syllables (non-words respecting French phonological rules) were similar.

To resume the instructions: -for the semantic tasks, the participant had to press on the left button of a computer mouse (right index) if the continuation of the melody or proverb was the good one, and on the right button (right middle finger) if the continuation of the melody or proverb was not that expected. For the perceptual references tasks, the subject had to press on the left button of the mouse (right index), when the second melody or pseudo-words series was identical to the first sequence, and on the right button (right middle) when there was, in the second sequence, at least a note with a different pitch, or a different syllable in the second series of pseudo-words.

The difficulty of the verbal and musical semantic tasks was tested and adjusted during the pilot study. Each subject underwent 10 consecutive scans (injection of H 2 O 15 ) during a single PET session lasting 1½ hours, including 2 repetitions of 4 different experimental conditions and 2 resting scans (see Fig 1). The musical task was given prior to the verbal task in order to reduce any possible verbal contamination during the musical task (i.e. by remembering or thinking of proverbs). During each scan, the subject was instructed to keep his eyes closed.

The height of the table and the mouse location were adjusted for each subject to achieve the most comfortable position. Each task lasted 2 minutes and consisted of 15-18 stimuli (depending on conditions) of 5 seconds duration. The response interval between two stimuli was set at 3 seconds in order to minimize automatic subvocal naming or episodic memory processes during this time.

Data acquisition

Behavioral data acquisition

Sound stimuli were presented at a comfortable loudness level using an E-Prime software. The responses and reaction times were recorded using a specific module written in E-Prime.

PET data acquisition

Measurements of the regional distribution of radioactivity were performed using a Siemens ECAT HR+ PET camera with full-volume acquisition allowing for the reconstruction of 63 planes. Transmission scans were obtained with a 68 Ga source prior to emission scans. The duration of each emission scan was 90 s. Approximately 6 mCi of H 2 O 15 were administered as a slow bolus in the left antecubital vein, using an automatic infusion pump. Each experimental condition began 30 s before data acquisition and continued until scan completion. This process was repeated for each of the 10 scans, for a total injected dose of ≈60mCi. The interval between injections was 6 min. 40 s. The head was gently immobilized in a dedicated headrest. Head position was aligned transaxially to the orbitomeatal line with a laser beam.

The position of the head was checked with the laser beam prior to each injection.

Image handling and transformation

All calculations and image transformations were performed on Unix System workstations.

First of all, the 10 scans of each subject were realigned, using AIR 3.0 software. For They were smoothed using a 12-mm Gaussian filter. As the images were scaled to an overall CBF grand mean of 50ml/100g/min., we shall refer to "adjusted rCBF" hereafter. We used a gray matter threshold of 80% of the whole brain mean and covariates were centered before inclusion in the design matrix. We then used the same procedure as that described in [START_REF] Hubert | The dynamic network subserving the three phases of cognitive procedural learning[END_REF][START_REF] Cappa | Imaging studies of semantic memory[END_REF]. An ANCOVA (analysis of covariance), with global activity as a confounding covariate, was performed on a voxel-by-voxel basis. The results of the t statistic (SPM {t}) were then transformed into a normal standard distribution (SPM {z}). The significant cut-off was set at the p<0.001 uncorrected for all multiple comparisons. The anatomical/cytoarchitectonic location of significant activation was based on the SPM5 MNI template. All the coordinates listed in the sections below are SPM5 coordinates.

Data analysis

Behavioral data analysis

We performed a repeated-measures ANOVA on performance and response time, and Tukey"s post-hoc analyses.

PET scan analysis

Twelve sets of scans were acquired but only 11 were analyzed. One subject was excluded because of his poor experimental performance due to non-compliance with the instructions in one of the tasks.

Subtraction analyses: Using t-tests, two planned comparisons of means were carried out between each of the two semantic tasks and rest "musical semantic -rest" (named hereafter MusSem-Rest) and "verbal semantic -rest" (named hereafter VerbSem-Rest), in order to unravel the cerebral rCBF changes associated with perceptual, motor and semantic processes.

The comparisons between each reference task and rest (MusRef-Rest) and (VerbRef-Rest) were realized to highlight the components related to acoustic processing, working memory and motor decision.

Similar analyses were conducted between each semantic task (verbal/musical) and its corresponding reference task "Musical semantic -musical reference" (named hereafter MusSem-MusRef) and "Verbal semantic -verbal reference" (named hereafter VerbSem-VerbRef). Hit rates were added as a covariate, to avoid possible confounding effects of any difference between musical and verbal subjects" performances (which was, indeed, the case, see Behavioral data below).

Although the direct comparison between the musical and the verbal semantic tasks seemed the more relevant contrast, this direct comparison allowed exclusively highlighting the more significant amplitude changes between the two tasks, including perceptual, executive and memory processes. Given that we had built these two memory tasks with very similar semantic processing, the more significant difference between them was produced in large part by the perceptual processes. Thus, to reveal brain activation specifically associated to musical semantic memory processes, excluding both the effects of perceptual activity and contamination by semantic verbal components, we performed the direct comparison between the two semantic tasks after the subtraction of the respective reference tasks [MusSem-MusRef] -[VerbSem-VerbRef]. We have also reported the results of the reverse comparison

([VerbSem-VerbRef] -[MusSem-MusRef]
) that is expected to highlight the neural substrates of verbal semantic memory. These comparisons were carried out, using an explicit mask (p< 0.001 uncorrected for multiple comparisons), within the brain areas activated in the previous contrasts MusSem-MusRef and VerbSem-VerbRef, so as to remove differences that would result from deactivations.

Conjunction analysis: To identify the cerebral substrates involved in both the verbal semantic task vs. rest (VerbSem-Rest) and musical semantic task vs. rest (MusSem-Rest) comparisons, and thus to pinpoint the cerebral network associated with perceptual, motor and semantic processes, we used a conjunction analysis based on the recently proposed "valid conjunction inference with the minimum statistic" (Nichols et al., 2005). In this test, each comparison in the conjunction was individually significant, corresponding to the valid test for a "logical AND".

All activations are reported at p<0.001 (uncorrected). This threshold was chosen in light of empirical studies showing that such a threshold protects against false positives [START_REF] Bailey | A method for measuring the absolute sensitivity of positron emission tomographic scanners[END_REF]. Only activations involving clusters with more than 50 voxels are reported.

RESULTS

Behavioral data

The mean accuracy of performances was 85.45% (S.D.=9.74) for the musical semantic task, 98.39% (S.D.=2.60) for the verbal semantic task, and 95.24% (S.D.=5.50) and 98.17% (S.D.=3.15) for the musical and verbal reference tasks respectively. The accuracy was lower for the musical semantic task than for either the verbal semantic or any of the reference tasks (p<0.001). These performances were not significantly different from those of the subjects in our pre-experimental population.

PET data

Semantic versus Rest

Comparing the musical semantic memory task with the resting state (MusSem-Rest) revealed bilateral activation of the superior temporal lobe (extending into the middle temporal lobe).

When compared with rest (VerbSem-Rest), the verbal semantic memory task elicited bilateral activation of the middle temporal area, though this was more extensive on the left than on the right (Table1 and Fig. 2). Using 2x2 repeated-measures ANOVA (on mean cluster values of each subject), we observed an interaction between the stimulus type and the side of activation.

The temporal activation triggered by verbal material was mainly left-sided, whereas with musical material the temporal activation was mainly right-sided (p< 0.001 uncorrected).

Conjunction Semantic versus Rest

The conjunction analysis revealed activation in the bilateral middle and superior temporal lobe extending into the superior temporal pole and inferior frontal area (BA 11/22), and right activation in the angular (BA 39) and superior frontal areas (BA 11) (Table 1 and Fig. 2).

Reference versus rest

The comparison between musical reference task with the resting state (MusRef-Rest) involved bilateral activations of the superior temporal area (BA 22) (extending into the middle temporal region), right activation of the inferior and superior frontal gyri (BA 45/11), bilateral activations of the cerebellum structures and right activations of the inferior parietal area (BA 39) (Table 2 and Fig. 3). Verbal reference versus rest (VerbRef-Rest) revealed extensive activation of the bilateral superior and inferior temporal areas (BA 22), bilateral activation of the orbital part of the superior frontal region (BA 11), and right activation of the parahippocampal, amygdala (BA 48) and superior parietal area (BA 7).

Semantic versus Reference

Comparing the musical semantic with the musical perceptual reference task (MusSem-MusRef) revealed extensive activation of anterior part of the left superior temporal areas (extending into the superior temporal pole) and pars triangularis of the inferior and middle frontal areas (BA 38/47/48), as well as of the right inferior frontal (BA 44) and middle and anterior cingulate areas (BA 32) (Table 3 and Fig. 4). Comparing the verbal semantic and verbal perceptual reference tasks (VerbSem-VerbRef) revealed activation of the posterior part of the left middle temporal area (BA 21) and right cerebellum (Table 3 and Fig. 4).

Musical versus Verbal

The comparison between musical and verbal semantic tasks ([MusSem-MusRef] -[VerbSem-VerbRef]) showed activation of the left inferior frontal areas (extending into the superior temporal pole) (BA 38/44) and the pars triangularis and orbital of the inferior frontal areas (BA 47) (Table 3 and Fig. 5).

Verbal versus Musical

The direct comparison between verbal semantic and musical semantic ([VerbSem-VerbRef] -[MusSem-MusRef]) implicated activation of the right cerebellum (verbal semantic task) (Table 3 and Fig. 5). Using a less conservative threshold for this comparison, we found an additional activation of the left posterior part of the middle temporal lobe.

DISCUSSION

The neural distinction between music and language has already been suggested in the neuroimaging literature of syntactic and semantic processing as in the synthetic model of the localization of music and language in the brain proposed by Brown and colleagues (2006).

Nevertheless, this distinction had never been shown with direct comparisons between music and language using comparable semantic memory tasks.

Comparisons with rest:

Compared with the resting-state condition (Fig. 2), the musical and verbal semantic tasks triggered activation in similar temporal areas. These contrasts reflected both memory and perceptual processes. The left verbal semantic activation produced by the verbal semantic task was that which is habitually found in semantic processing, whereas the right posterior temporal activation produced by the verbal semantic task is classically involved in the processing of the human voice [START_REF] Kriegstein | Distinct functional substrates along the right superior temporal sulcus for the processing of voices[END_REF][START_REF] Alho | Selective attention to human voice enhances brain activity bilaterally in the superior temporal sulcus[END_REF]. This activation was more bilateral during the musical semantic task than during the verbal one. Consistent with previous studies, we found predominant right hemispheric involvement for music, induced by the music perception processes and related mainly to tonal pitch perception [START_REF] Limb | Structural and functional neural correlates of music perception[END_REF]Zatorre et al. 2007). The conjunction analysis between verbal and musical semantic tasks vs. rest (Fig. 2) revealed activation in the bilateral middle and superior temporal lobe extending into the superior temporal pole and the inferior frontal area, as well as the right angular and superior frontal cortex. This activation reflects the common neural network involved in perceptual and semantic processes, whatever the nature of the material (verbal or musical).

Regarding our present results (Fig. 2 and3) compared with rest and the comparison of cerebral activity in the reference musical vs. rest tasks, we observed bilateral activation restricted to the temporal area, with right hemisphere dominance. It seems likely that the right temporal activation was partly associated with perceptual processes, whereas the left temporal lobe seems to be more dedicated to semantic processes [START_REF] Cabeza | Imaging cognition II: An empirical review of 275 PET and fMRI studies[END_REF][START_REF] Thompson-Schill | Neuroimaging studies of semantic memory: inferring "how" from "where[END_REF] and feeling of familiarity [START_REF] Plailly | The feeling of familiarity of music and odors: the same neural signature?[END_REF].

Comparisons with reference tasks:

When contrasting the participants" performances at the musical semantic vs. musical reference and verbal semantic vs. verbal reference tasks, the musical semantic task appeared to be more difficult than both the verbal semantic task and perceptual reference tasks, as already found in the pre-experimental study. This may be because in everyday life, nonmusicians use words far more frequently than notes, and semantic verbal tasks are therefore comparatively easier than musical ones. As explained before, this bias was overcome by adding hit rates as a covariate in comparing the verbal and musical semantic tasks to each other.

Semantic Musical

Compared with the reference task, the musical semantic memory task was associated with a relative rCBF increase in the left superior temporal cortex, including its foremost part, the middle and pars triangularis both inferior frontal areas, as well as the right inferior frontal and middle and anterior cingulate areas. According to [START_REF] Copland | Neural correlates of semantic priming for ambiguous words: an event-related fMRI study[END_REF], the right anterior cingulate is involved in the successful detection of a prime-target relationship. In our study, activation of the right anterior cingulate could be associated with the successful detection of the relationship between the beginning and the end of a melody, as our subjects had to decide whether or not the second part was the correct following. Whereas activations obtained in the left inferior frontal gyrus (BA 44/48, also named "Broca"s area") seem to be associated to musical syntactic processing, as proposed by [START_REF] Koelsch | Music, language and meaning: brain signatures of semantic processing[END_REF]. Therefore, these frontal activation could be linked to the detection of incongruity, producing a syntactic process (Tillman et al. 2003), particularly for the stimuli in which the second part of the melody does not match the first one. On the other hand, we think that activation in the left ventral frontal area (BA 47) and in the temporal pole (BA 38) imply more specifically semantic processes [START_REF] Greenberg | Coactivation of the amygdala, hippocampus and inferior frontal gyrus during autobiographical memory retrieval[END_REF][START_REF] Satoh | Positron-emission tomography of brain regions activated by recognition of familiar music[END_REF]. In our musical semantic memory task, participants had to access their semantic memory to retrieve musical representations (knowledge) of the melodies they heard in order to decide if the following part was the correct one or not. During debriefing, all participants confirmed a semantic memory access to solve the task. Moreover, they were not able to recall the first time they heard a particular melody. Thus, activation of the left pars triangularis of the inferior frontal area, extending into the superior temporal pole, has previously been observed in studies of musical memory [START_REF] Platel | The structural components of music perception. A functional anatomical study[END_REF][START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF]. Regarding the left inferior frontal area, similar results have been obtained with different musical material and experimental paradigms [START_REF] Satoh | Positron-emission tomography of brain regions activated by recognition of familiar music[END_REF][START_REF] Plailly | The feeling of familiarity of music and odors: the same neural signature?[END_REF]). [START_REF] Satoh | Positron-emission tomography of brain regions activated by recognition of familiar music[END_REF] observed activation of the left inferior frontal gyrus during a recognition task of familiar music (compared to musical reference task). [START_REF] Plailly | The feeling of familiarity of music and odors: the same neural signature?[END_REF] also recorded activation of the left inferior and middle frontal gyrus prompted by feelings of familiarity for musical but also olfactory items (compared to unfamiliar items). Considering that in the musical semantic vs. perceptual reference task comparison the most of the common perceptual processes between the two conditions was subtracted, we think, therefore, that in our study, activation of the inferior and middle frontal gyrus could specifically reflect the feeling of familiarity for musical material [START_REF] Kikyo | Neural correlates for feeling-of-knowing: an fMRI parametric analysis[END_REF][START_REF] Kikyo | Temporal lobe activations of "feeling-of-knowing" induced by face-name associations[END_REF][START_REF] Satoh | Positron-emission tomography of brain regions activated by recognition of familiar music[END_REF][START_REF] Plailly | The feeling of familiarity of music and odors: the same neural signature?[END_REF]). These results are confirmed by the direct comparison between verbal and musical semantic processing (Fig. 5). The left inferior frontal areas (extending into the superior temporal pole, BA 38) and the pars triangularis and orbital of the inferior frontal areas (BA 47) activate during the musical, but not during the verbal semantic memory task. This suggests they may be predominantly involved in the musical semantic processing.

In addition, left superior temporal pole activation has previously been demonstrated during the retrieval of specific or unique semantic information (for example: the Eiffel Tower in the "towers" category or concepts at a subordinate level) [START_REF] Rogers | Anterior temporal cortex and semantic memory: reconciling findings from neuropsychology and functional imaging[END_REF][START_REF] Patterson | Where do you know what you know? The representation of semantic knowledge in the human brain[END_REF]), abstract concepts [START_REF] Fliessbach | The effect of word concreteness on recognition memory[END_REF], personal semantic information [START_REF] Svoboda | The functional neuroanatomy of autobiographical memory: a meta-analysis[END_REF], person identity information [START_REF] Tsukiura | Differential contributions of the anterior temporal and medial temporal lobe to the retrieval of memory for person identity information[END_REF]), emotional material [START_REF] Olson | The Enigmatic temporal pole: a review of findings on social and emotional processing[END_REF]) and famous faces and buildings (Gorno-Tempini and Price 2001). Some authors have suggested that the left anterior temporal region may contribute to the processing of specific or unique semantic information [START_REF] Martin | Semantic memory and the brain: structure and processes[END_REF][START_REF] Rogers | Anterior temporal cortex and semantic memory: reconciling findings from neuropsychology and functional imaging[END_REF][START_REF] Tsukiura | Differential contributions of the anterior temporal and medial temporal lobe to the retrieval of memory for person identity information[END_REF]). As early as 1987, Jackendoff proposed in his semantic/conceptual structure theory a differentiation of knowledge for unique entities/categories terms. On the basis of these previous findings, we can consider that each familiar melody refers to an unique semantic representation, just as face identity memory does (Gorno-Tempini and Price 2001). In other words, each individual melody is highly specific compared with other items in the same category and, as already postulated by [START_REF] Sacks | The power of music[END_REF], memories for familiar melodies are specifically related to earlier personal events, encounters or states of mind evoked by listening to them. The anterior-posterior distinction hypothesis was postulated only for the left hemisphere. This view is not in disagreement with the clinical observations of pitch discrimination impairment following posterior temporal excisions [START_REF] Liégeois-Chauvel | Contribution of different cortical areas in the temporal lobes to music processing[END_REF] or with the results obtained by [START_REF] Halpern | When that tune runs through your head: a PET investigation of auditory imagery for familiar melodies[END_REF] in their musical imagery task. These last authors observed, during a musical imagery task, activation in the right inferior frontal area and assumed that it reflected the involvement of these regions in the retrieval of familiar musical information but perhaps contaminated by episodic memory. In addition, considering the recent work of [START_REF] Peretz | Music lexical networks: the cortical organization of music recognition[END_REF] regarding the cortical organization of the musical lexicon, we hypothesize that our right-sided activation preferentially refers to the storage in perceptual memory of the melodic traces for familiar tunes, as previously proposed by [START_REF] Samson | Effects of prior exposure on music liking and recognition in patients with temporal lobe lesions[END_REF] regarding the patients with temporal lesions (consistent with the idea of a participation of posterior temporal regions in musical perceptual processes, as found in the musical reference vs rest contrast, Fig 3).

Whereas left-sided activation is linked to access to semantic attributes or associations (knowledge of style or personal information relating to a particular melody) involved in the explicit retrieval of melodies. Our PET findings are in good accord with this proposition: we found most right-lateralized activation in the MusSem-Rest contrast (Fig. 2) and MusRef-Rest (Fig. 3), reflecting certainly perceptual memory processes, and most left-lateralized activation for the MusSem-MusRef (Fig. 4), more specifically reflecting semantic memory associations. However, our participants were non-musicians, unlike those of Halpern and Zatorre who had an average of 9.5 years of musical education, and it is possible that bilateral (predominantly right) activations elicited by musical imagery were linked to the musical expertise during the musical information retrieval process.

Semantic Verbal

The verbal semantic memory task was associated with the activation of the left middle temporal area and right cerebellum. These temporal and cerebellar regions are usually highlighted in studies of semantic memory [START_REF] Cabeza | Imaging cognition II: An empirical review of 275 PET and fMRI studies[END_REF][START_REF] Thompson-Schill | Neuroimaging studies of semantic memory: inferring "how" from "where[END_REF] and are known to be particularly dedicated to language comprehension in general [START_REF] Price | The anatomy of language: contributions from functional neuroimaging[END_REF] and auditory comprehension in particular [START_REF] Jobard | Impact of modality and linguistic complexity during reading and listening tasks[END_REF]). The middle temporal gyrus was known to be the locus of lexical representation storage [START_REF] Lau | A cortical network for semantics: (de)constructing the N400[END_REF]. The results of our study suggest that the verbal semantic memory of French proverbs and popular sayings draws on a more posterior part of the temporal cortex than does music. This finding is consistent with previous knowledge about the antero-posterior distribution of semantic representations across the left temporal lobe, with unique semantic information being more anteriorly represented than general semantic information (such as superordinate level concepts, as animals) [START_REF] Martin | Semantic memory and the brain: structure and processes[END_REF][START_REF] Rogers | Anterior temporal cortex and semantic memory: reconciling findings from neuropsychology and functional imaging[END_REF]. The verbal memory task used in our study probably referred to more general semantic representations than the musical memory task did. The verbal stimuli we used probably had little emotional and personal specificity compared with the musical ones, and the activation they brought about may reflect a category-specific effect (shared by everybody and associated with several concepts) rather than an item-specific one.

The right cerebellum activation observed during the verbal semantic task, in the "Verbal semantic -verbal reference" comparison (Fig. 4) and in the direct semantic verbal comparison ([VerbSem-VerbRef] -[MusSem-MusRef]) (Fig. 5), is not surprising, given that this area has been shown to be involved in several cognitive processes, such as semantic memory or language comprehension and production. Right-sided cerebellar activation during semantic processing has been associated with the amplification and improvement of representations to facilitate correct decision-making [START_REF] Booth | The role of the basal ganglia and cerebellum in language processing[END_REF]. Our results are also consistent with the fact that the right cerebellum has reciprocal connections with the left lateral temporal cortex.

In summary, consistent with our previous studies [START_REF] Platel | The structural components of music perception. A functional anatomical study[END_REF][START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF], we observed activation throughout the left temporal and prefrontal cortex for musical semantic processes. In light of direct comparisons between language and music, we propose that our results are consistent with the hypothesis of antero-posterior temporal organization for semantic concepts, with musical semantic retrieval involving the anterior temporal lobe more than verbal semantic retrieval. To specify the nature of this neural distribution, we suggest that musical material may be associated with the retrieval of unique semantic representations (such as faces or famous buildings) involving left anterior temporal regions, whereas verbal material may be associated with the retrieval of more general semantic representations involving more posterior temporal regions.

To conclude, our results show that verbal and musical semantic memory processes mostly activate a left temporal and prefrontal neural network, previously described for semantic and syntax processing. However, within this left common network, it appears that musical semantic processes involve to a greater extent the left anterior temporal areas and produce more bilateral activations than the verbal semantic ones. Consistent with clinical dissociations [START_REF] Eustache | Identification and discrimination disorders in auditory perception: a report on two cases[END_REF], we found that verbal and musical material draw on two different networks, suggesting that the musical lexicon [START_REF] Peretz | Modularity of music processing[END_REF][START_REF] Platel | Semantic and episodic memory of music are subserved by distinct neural networks[END_REF][START_REF] Peretz | Music lexical networks: the cortical organization of music recognition[END_REF] is sustained by a largely distributed bilateral temporo-prefrontal cerebral network involving right cerebral regions for the retrieval of melodic traces in perceptual memory, whereas left cerebral areas are linked to access to the verbal and nonverbal semantic attributes and knowledge of familiar tunes. Zatorre,R.J., Evans,A.C., Meyer,E., and Gjedde,A., 1992. Lateralization of phonetic and pitch discrimination in speech processing. Science. 256, 846-849.

Zatorre,R.J., Chen,J.L., and Penhune,V.B., 2007. When the brain plays music: auditory-motor interactions in music perception and production. Nat Rev Neurosci. 8, 547-558.

  subsequent data analysis, we used Statistical Parametric Mapping software (SPM5, Wellcome Department of Cognitive Neurology) implemented in the MATLAB environment. The images were nonlinearly transformed into a standard space, i.e. the MNI PET template of SPM5.

Fig. 1 :

 1 Fig. 1: Overall design of the experimental paradigm

Fig. 3 :

 3 Fig. 3: PET scan comparisons: brain activation in the musical reference versus rest (yellow), verbal reference versus rest (blue) and overlap (green). Significantly activated regions with an uncorrected p-value threshold of 0.001, with multiple-comparison correction.

Figure 5 :

 5 Figure 5: PET scan comparisons: brain activation in the musical semantic versus verbal semantic [MusSem-MusRef] -[VerbSem-VerbRef] and verbal semantic versus musical semantic [VerbSem-VerbRef]-[MusSem-MusRef] (using an explicit mask). Significantly activated regions at the p-value threshold of 0.001 uncorrected for multiple comparisons. The plots represent the relative contribution of the different conditions of our paradigm, according to the "effect of interest", for selected peaks. The first column corresponds to the musical reference condition and the 2 nd , 3 rd , and 4 th columns correspond selectively to the musical semantic, verbal semantic and verbal reference conditions.

Table 1 .

 1 Brain regions activated during the musical semantic and verbal semantic tasks vs rest; and conjunction analysis of musical semantic vs. rest and verbal semantic vs. rest. Areas significantly activated at p<0.001 uncorrected.

	Contrast and anatomical location	Cluster size (in pixels)	x	y	z	Z score
	Musical semantic -Rest
	Right superior and middle temporal (Ba22)	7027	64 -20 0	> 7.80
	Left superior and middle temporal (Ba22)	6010	-50 -20 0	> 7.80
	Right angular (Ba39)	1192	40 -64 46	5.57
	Right middle and superior frontal (Ba11)	553	18 48 -22	4.93
	Right middle and anterior cingulate (Ba 32)	161	6	32 28	4.52
	Left cerebellum crus I & II	387	-10 -82 -28	4.18
	Right cerebellum	98	30 -62 -26	3.98
	Verbal semantic -Rest
	Left middle and superior temporal (Ba22)	7755	-62 -20 0	> 7.80
	Right superior and middle temporal (Ba22)	3890	58 -26 2	6.46
	Right superior frontal (Ba11)	754	6	52 -20	5.02
	Right angular (Ba39)	447	44 -62 42	4.98
	Left superior frontal (Ba11)	405	-18 28 -20	4.32
	Left inferior frontal (Ba48)	93	-38 12 28	3.93
	Right cerebellum crus II	70	18 -88 -32	3.71
	Left angular (Ba7)	88	-40 -70 42	3.61
	Conjunction (MusSem -Rest and VerbSem -Rest)
	Left middle and superior temporal (Ba11)	5571	-52 -24 -2	7.33
	Right middle and superior temporal (Ba22)	3767	58 -26 2	6.46
	Right angular (Ba39)	441	44 -62 42	4.98
	Right superior frontal (Ba11)	161	16 52 -18	3.83

Table 2 .

 2 Brain regions activated during in the musical reference vs. rest), verbal reference vs rest. Areas significantly activated at p<0.001 uncorrected, for all comparisons.

Table 3 .

 3 Brain regions activated during the musical semantic vs. musical reference tasks and verbal semantic vs. verbal reference tasks (adding hit rates as a covariate). Verbal semantic corresponded to the [VerbSem-VerbRef] -[MusSem-MusRef] comparison and Musical semantic corresponded to the [MusSem-MusRef] -[VerbSem-VerbRef] comparison.).Areas significantly activated at p<0.001 uncorrected, for all comparisons.

	Contrast and anatomical location	Cluster size (in pixels)	x	y	z		Z score
	Musical reference -Rest
	Right superior temporal (Ba22)	4956	72 -30 6		>7.80
	Left superior temporal (Ba22)	4159	-48 -22 0		7.44
	Right inferior frontal (Ba45)	170	52 22 6		4.03
	Right superior frontal (Ba11)	91	18 46 -22		3.97
	Right cerebellum (Ba19)	147	28 -64 -22		3.90
	Right cerebellum	63	16 -68 -50		3.75
	Left cerebellum	79	-22 -86 -28		3.61
	Right inferior parietal (Ba39)	93	48 -56 46		3.49
	Verbal reference -Rest
	Left superior temporal (Ba22)	6265	-50 -20 0		7.77
	Right superior temporal (Ba22)	3504	64 -16 -2		6.30
	Left superior frontal (Ba11)	860	-18 32 -20		4.82
	Right superior frontal (Ba11)	290	18 48 -22		4.36
	Right parahippocampal/amygdale (Ba48)	131	22 10 -14		3.91
	Left inferior temporal (Ba20)	135	-52 -46 -16		3.60
	Right superior parietal (Ba7)	54	32 -78 46		3.59
	Right superior frontal (Ba11)	77	12 28 -24		3.57
	Contrast and anatomical location	Cluster size (in pixels)	x	y	z	Z score
	Musical semantic -Musical reference
	Left pole superior temporal and inferior frontal
	(Ba38/47/48)	1774		-50 6 -10	5.81
	Right inferior and middle frontal (Ba44)	135		52 26 30	4.41
	Right anterior and middle cingulate (Ba32)	142		8	30 26	3.89
	Verbal semantic -Verbal reference
	Right cerebellum crus I & II	320		24 -70 -30	4.26
	Left middle temporal (Ba21)	54		-62 -38 0	3.70
	Musical semantic
	Left inferior frontal, pole and superior temporal
	(Ba38/44)	299		-50 6 -10	4.54
	Left inferior frontal (Ba47)	52		-40 40 -2	3.58
	Verbal semantic
	Left cerebellum crus I	85		24 -70 -30	3.83

Here are some examples of selected familiar tunes: Vangelis, "Conquest of Paradise"; E. Grieg, excerpts from the "Peer Gynt Suite".

Here are some examples of selected familiar French proverbs: "Strike while the iron"s hot= Il faut battre le fer pendant qu"il est chaud"; "The more you get the more you want = L"appétit vient en mangeant"; "Every cloud has a silver lining = Après la pluie, le beau temps".

Acknowledgments:

We would like to thank C. Lebouleux, M.H. Noel, O. Tirel, A. Pélerin, N. Jacques, P. Gagnepain, N. Villain, G. Chételat, G. Rauchs and the staff of the Cyceron cyclotron unit for their assistance. The authors thank Elizabeth Portier for reviewing the English style. We are also grateful to the subjects for agreeing to take part in the study. This research was supported by a " Music and Memory" French National Research Agency (ANR) grant and by the French Ministry of Research.


Brice Morin
email: brice.morin@inria.fr

Tejeddine Mouelhi
email: tejeddine.mouelhi@telecom-bretagne.eu

Franck Fleurey
email: franck.fleurey@sintef.no

Yves Le Traon
email: yves.letraon@uni.lu

Olivier Barais

Jean-Marc Jézéquel

Security-Driven Model-Based Dynamic Adaptation *

Keywords: D2.11 [Software Engineering]: Software Architectures; K6.5 [Management of Computing and Information Systems]: Security and Protection Design, Security Access-control, Adaptive System, Model-Driven Engineering, Models@Runtime

Security is a key-challenge for software engineering, especially when considering access control and software evolutions. No satisfying solution exists for maintaining the alignment of access control policies with the business logic. Current implementations of access control rely on the separation between the policy and the application code. In practice, this separation is not so strict and some rules are hardcoded within the application, making the evolution of the policy difficult. We propose a new methodology for implementing security-driven applications. From a policy defined by a security expert, we generate an architectural model, reflecting the access control policy. We leverage the advances in the models@runtime domain to keep this model synchronized with the running system. When the policy is updated, the architectural model is updated, which in turn reconfigures the running system. As a proof of concept, we apply the approach to the development of a library management system.

INTRODUCTION

Security is a key issue in modern software-intensive systems driving the every-day life of billions of people all around the world. Software systems deployed in large companies, banks, airports, etc, must be available 24/7 with a high level of security. Among different security concerns (user authentication, data encryption, etc), access control plays a critical role. It ensures that users, depending on their roles, can only access the resources they are supposed to access.

Designing, implementing and executing such systems requires the highest attention from the different stakeholders. A small error in the specification or in the implementation of the access control concern could make a critical resource accessible to standard users. Several security models, like RBAC [START_REF] Ferraiolo | Proposed NIST standard for role-based access control[END_REF] or OrBAC [START_REF] El Kalam | Organization Based Access Control[END_REF], propose high-level abstractions to security experts in order to specify access control policies. The current implementation techniques consist in using a standard architecture that involves designing a dedicated security component, called the policy decision point (PDP), which can be configured independently from the rest of the implementation containing the business logic of the application. The execution of functions in the business logic includes calls to the PDP (called PEPs -policy enforcement points), which grants or denies access to the protected resources/functionalities of the system. Such an architecture can for example be implemented with Aspect-Oriented Programming [START_REF] Kiczales | An Overview of AspectJ[END_REF][START_REF] Mouelhi | A Model-Based Framework for Security Policies Specification, Deployment and Testing[END_REF] techniques.

The main limitation of the current implementation techniques is that they do not allow for flexible access control mechanisms. In fact, the access control policy cannot be modified without previously modifying the code to support the new access control rule. This is an expected effect of the separation between the security code (access control mechanism) and the functional code. In fact, because of this approach, the functional code may contain some hard-coded access control mechanisms implementing some access control rules. Modifying these specific rules requires locating these hidden mechanisms and removing them. In this paper, we address this issue by providing flexible access control mechanisms.

In this paper, we propose to leverage Model-Driven Engineering (MDE) techniques to provide a very flexible approach for managing access control. On one side, access control policies are defined by security experts, using a Domain-Specific Modeling Language (DSML), which describes the concepts of access control, as well as their relationships. On the other side, the application is designed using another DSML for describing the architecture of a system in terms of components and bindings. This component-based software architecture only contains the business components of the application, which encapsulate the functionalities of the system, without any security concern. Then, we define mappings between both DSMLs describing how security concepts are mapped to architectural concepts. We use these mappings to fully generate an architecture that enforces the security rules. When the security policy is updated, the architecture is also updated. Finally, we leverage the notion of models@runtime in order to keep the architectural model (itself synchronized with the access control model) synchronized with the running system. This way, we can dynamically update the running system in order to reflect changes in the security policy. Only users who have the right to access a resource can actually access this resource.

The remainder of the paper is organized as follows. Section 2 presents a background on access control and motivates the need for more flexible access control policies. Section 3 describes an overview of our approach. Section 4 presents the security and the architecture metamodels, and how they are composed. Section 5 describes how the architecture model is impacted when the security policy is updated, and how these changes are automatically reflected at runtime. Section 6 presents related work. Section 7 concludes and presents future work.

MOTIVATIONS FOR DYNAMIC ACCESS CONTROL

Access Control aims at securing a system by controlling the access of users, processes or components (or any other entity) to the resources of the system. This access is controlled through the enforcement of an access control policy, which expresses a set of rules for allowing or denying the access to the system resources. Several access control models [START_REF] Ferraiolo | Proposed NIST standard for role-based access control[END_REF][START_REF] El Kalam | Organization Based Access Control[END_REF] allow defining access control policies.

This section presents the motivation behind the need for a more dynamic access control. To show the limitation of the existing platforms, we first present the existing architecture for implementing access control policies. Then we explain the various reasons that lead to the need to provide a new approach for enforcing dynamic access control policies.

Current Architecture for Managing Access Control

Figure 1 depicts a security architecture typically used for implementing the security policy. Roughly, there are two main components:

• The Policy Decision Point (PDP) is the point where policy decisions are made. It encapsulates the Access Control Policy and implements a mechanism to process requests coming from the business logic (via the PEP) and returns a response which can be "deny" or "permit". Policies can be stored in various ways: Data Base, eXtensible Access Control Markup Language (XACML) files, etc.

• The Policy Enforcement Point (PEP) is the point in the business logic where the policy decisions are enforced. It is a security mechanism, which has been intentionally inserted in the application functional code. Before the service is executed, the PEP sends a request to the PDP to get the suitable response (grant or deny), which depends on the user requesting the service, and on the current context. Based on the PDP response, if the access is granted the service executes, else the access is denied and the PEP forbids the execution of the service. This architecture clearly separates the access control decision from its enforcement, thus improving the testability of the system. In addition, the security rules are centralized, improving the observability of the system. One can easily monitor the enforced security rules to detect bugs or security flaws.

Limitations of Current Approaches

Although current approaches allow the security rules to be updated and modified, the enforcement of these modifications is problematic. This is due to the existence of some access control mechanisms hard-coded into the business logic. These hidden mechanisms enforce some of the access control rules making the system's policy more rigid and difficult to modify. There are two kinds of mechanisms, identified in [START_REF] Mouelhi | A Model-Based Framework for Security Policies Specification, Deployment and Testing[END_REF]; the implicit mechanisms and the explicit mechanisms. The implicit mechanisms are implemented by construction through the design model or the deployment architecture. For instance, Figure 2 illustrates such an implicit mechanism. In this example, by construction, the secretaries are not allowed to update accounts. The access control policy can however be easily updated to allow secretaries to update accounts. However, to enforce this new rule, refactoring is required. A simple refactoring would consist of moving the association "access" and the methods to the level of the class Personnel. Such a refactoring would also allow any Personnel instance to access the personnel accounts, which may be an unexpected change. So, the program will have to be carefully modified in several locations to implement the desired evolution of the access control policy. The second kind of hidden mechanisms is the explicit mechanisms, which are implemented within some portions of the application code that is not documented. Figure 3 shows an example of these explicit mechanisms: In the body of the method, after the PEP call to the PDP, a new check is done which forbids borrowing books during week-ends. If the policy has to be modified to allow borrowing books during week-ends, this hidden mechanism should be located and deleted.

Discussion

Both the explicit and the implicit mechanisms reduce the flexibility of the system. They are also inevitable since they are due to the way the system is developed. In fact, the security mechanism (the PDP) is developed separately from the application logic and then integrated into the application logic by the PEP. For these reasons, we need to take into account access control during the modeling and the deployment of secured systems. This is the main contribution of this work, which involves providing a complete process that includes access control throughout the modeling and the deployment processes.

OVERVIEW

In commercial and government environments, any change to the security policies normally requires impact assessments, risk analysis and such changes should go through the RFC (Request for Change) process. However, in case of urgency (crisis events, intrusion detection, server crashes, interoperability with external systems to deal with a critical situation), the adaptation of a security policy at runtime is a necessity. This adaptation may or may not have been already predicted or planned.

The proposed approach and the combination of composition and dynamic adaptation techniques shown in Figure 4 show how the security policy can be adapted conforming to a defined adaptation plan or in an unplanned way. The security adaptation mechanisms we propose deal with the challenging issue of how to provide running systems supporting planned and unplanned security policy adaptations. The inputs of the process are two independent models: the business architecture model of the system and the security model. These two models are expressed in different domain-specific modeling languages: the core business architecture with an architecture modeling language (Section 4.2) and the security policy with an access-control language (Section 4.1). By dynamically composing the security model with the architecture model, the approach allows adapting the application security policy according to pre-defined adaptation rules but also to cope with any unplanned changes of the security model. The adaptive security model contains a set of access control rules and a description of the context in which these rules apply. At runtime, depending on the context information coming from the system the appropriate set of rules has to be chosen. This is the reasoning shown as (1) in Figure 4. The reasoning phase processes the security model based on the context information coming from the system to produce the security policy to be enforced. Basically, when some events are triggered, security rules can be activated or deactivated. Once the appropriate security policy has been defined, it has to be composed into the architecture model of the application, see (2) in Figure 4. The models to compose here are of different nature: an architecture model on one side and a security policy on the other side. The composition is done in two steps:

Business

Models at runtime

1. the security policy is transformed into an architecture model realizing it, 2. this architecture model is composed with the business architecture model

The implementation of this complex composition operator is discussed in section 4. The output of the composition is a plain architecture model which enforces the security policy in the application.

Step ( 3) and ( 4) in Figure 4 correspond to the synchronization of the architecture model with the running system and the monitoring of the system environment. For both of these tasks, the approach proposed in this paper reuses existing runtime adaptation techniques.

Basically the idea is to leverage monitoring and runtime reconfiguration mechanisms offered by middleware platforms in order to extract context information and update the running system to match the desired architecture. Finally, point [START_REF] Cazzola | Architectural reflection : Bridging the gap between a running system and its architectural specification[END_REF] in Figure 4 corresponds to an evolution of the security model. The proposed approach allows changing the security model at any point in time. Here, it does not only consist in activating/deactivating existing rules, but also consists in adding, removing or updating rules or roles. This paper focuses on how the architecture (and the running system) causally evolves when the security policy is updated. Context monitoring and reasoning can be realized by existing adaptive system modeling techniques such as [START_REF] Fleurey | Modeling and Validating Dynamic Adaptation[END_REF].

COMPOSING SECURITY AND ARCHI-TECTURE METAMODELS

In this section, we describe how we compose the architecture metamodel into the security metamodel. We first introduce a generic metamodel for describing access control policies. Then, we introduce our generic metamodel for describing component-based architecture. Finally, we detail how we map security concepts to architectural concepts.

A Generic Metamodel for Describing Access Control Policies

The metamodel we use to describe access control policies is illustrated in Figure 12 at the end of this paper. It defines the concepts and their relationships needed to design access control models. The root concept is the Policy. A policy contains Resources, Roles, Users and Rules. A resource (e.g., a book) define some actions (e.g., borrow). Each user of the system has one role. Rules allow specifying the action the users (via their role) can perform on the resources of the system. We distinguish two types of rules:

• Permission: specifies the actions that the user of a given role can perform. By default, users can access the actions associated with their roles.

• Delegation: specifies the actions that a user (delegator) delegates to another user (delegatee). By default, no delegation is active.

Each rule can be associated with a context. A context specifies when a rule should be active, depending of the environment. For example, users can borrow books from Monday to Friday if they have not exceeded their quota. A context is a boolean expression involving some context variables. A metamodel for describing such context can be found in [START_REF] Fleurey | Modeling and Validating Dynamic Adaptation[END_REF].

Rules with no associated context are active by default, but could be deactivated.

A Core Metamodel for (Runtime) Architectures

Our generic metamodel is illustrated in Figure 13 at then end of this paper. A component type contains some ports. Each port has a UML-like cardinality (upper and lower bounds) indicating if the port is optional (lowerBound = 0) or mandatory (lowerBound > 0). It also indicates if the port only allows single bindings (upperBound = 1) or multiple bindings (upperBound > 1). A port also declares a role (client or server) and is associated to a service. A service encapsulates some operations, defined by a name, a return type and some parameters. A service has a similar structure as Java interface.

A component instance has a type and a state (ON/OFF), specifying whether the component is started or stopped. It can be bound to other instances by a transmission binding, linking a provided service (server port) to a required service (client port). A composite instance can additionally declare sub-instances and delegation bindings. A delegation binding specifies that a service from a sub-component is exported by the composite instance.

Mapping Security Concepts to Architectural Concepts

In this sub-section we propose to map the security concepts (Section 4.1) to architectural concepts (Section 4.2). This mapping is performed by the seamless weaving engine provided by Kermeta [START_REF] Muller | Weaving Executability into Object-Oriented Meta-languages[END_REF] that allows designers to extend a metamodel with additional elements 1 : attributes, references, contracts (invariants and pre/post conditions), operations (or implement an already existing abstract operation). Kermeta allows designer to extend their metamodels defined in Ecore/EMF 2 (which is the defacto standard integrated into Eclipse to design metamodels) with operational semantics. It makes it possible to check, simulate, transform models using a Java-like imperative style combined with OCL-like constructs dedicated to the navigation into models.

The rationale of this mapping is to automatically reflect the access control policy at the architectural level. This mapping is realized as follows, and illustrated in Figures 5,6 and 7:

• Each resource is mapped to a component instance (Figure 5). This proxy component provides and requires all the services offered by the resource. Additionally, each resource is mapped to a set of business components, from the base architecture, realizing the resource. The mapping with business components is provided by the designer, via a graphical editor.

• Each action is mapped to an operation (Figure 5). An OCL constraint ensures that every action (belonging to a single resource) is mapped to an operation belonging to the component type of a component realizing the resource. This mapping is also provided by the designer. 1 http://www.kermeta.org/docs/html.chunked/ KerMeta-Manual/ch02.html#section_weaving.link 2 http://www.eclipse.org/modeling/emf/

• Each role is mapped to a component (Figure 6). This proxy component provides and requires all the services that a user of this role can potentially access.

• Each user is mapped to a component (Figure 6). By default, this component is connected to the corresponding role component.

• Each permission is mapped to a pair of ports and a binding (Figure 6):

-Each permission granted to a role is mapped to a pair of ports: a required port associated with the role component, a provided port associated with the resource, and a binding linking these ports.

-Each permission granted to a user is also mapped to a pair of ports: a required and a provided ports associated with the user component. The bindings links the required port to the corresponding provided port of the component corresponding to the user's role.

• Each delegation (Figure 7) is mapped to a pair of ports and a binding. A required and a provided ports are associated with the user (delegatee) component. The binding links the required port to the corresponding port provided by another (delegator) component. The initial architecture is automatically created by using the mappings provided by the designer (resources and actions), and by visiting the security model to set the woven references. Figure 8 In this section, we showed how the security (access control) concern is composed with a base architecture, to finally obtain a 4-layered software architecture. This mapping leverages the meta-level aspect weaving facilities provided by the Kermeta [START_REF] Muller | Weaving Executability into Object-Oriented Meta-languages[END_REF] language, as well as its model transformation capabilities.

SECURITY-DRIVEN DYNAMIC ADAPTA-TION

In this section, we first present how we synchronize architectural models with a running system. Then, we explain how the architecture evolves when access control rules are activated or deactivated. Finally, we show how we handle deeper evolutions of the access control policy i.e., when rules or roles are removed, created or updated.

Synchronizing the Architecture Model with the Running System

Modern adaptive execution platforms like OSGi [START_REF]OSGi Service Platform Core Specification, Release 4.1[END_REF] propose low-level APIs to reconfigure a system at runtime. It is possible to dynamically reconfigure applications running on these platforms by executing platform-specific reconfiguration scripts specifying which components have to be stopped, which components and/or bindings should be added and/or removed. These scripts have to be carefully written in order to avoid life-cycle exceptions (e.g, when a component is removed while still active) and dangling bindings (e.g., when a component is removed while it is still connected to other (client) components).

To prevent errors in writing such error-prone scripts, we rely on our previous work that leverages MDE techniques to generate safe reconfiguration scripts [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF][START_REF] Morin | An Aspect-Oriented and Model-Driven Approach for Managing DynamicVariability[END_REF][START_REF] Morin | Models@ run.time to support dynamic adaptation[END_REF], as illustrated in Figure 9. The key idea is to keep an architectural model synchronized with the running system [START_REF] Cazzola | Architectural reflection : Bridging the gap between a running system and its architectural specification[END_REF][START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF][START_REF] Morin | An Aspect-Oriented and Model-Driven Approach for Managing DynamicVariability[END_REF]. This reflection model, which conforms to the architecture metamodel (Section 4.2), is updated (Figure 9, 1) when significant changes appears in the running system (addition/removal of components/bindings). It is important to note that the reflection model can only be modified according to runtime events. Still, it is possible to work on a copy of this reflection model and modify it: model transformation, aspect model weaving, manipulation by hand in a graphical editor, etc. In other words, the reflection model is really a mirror of the reality (the running system) and not a means for manipulating the reality.

When a target architectural model is defined (e.g. after updating the access control policy), it is first validated (Figure 9, 2) using classic design-time validation techniques, such as invariant checking [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF] or simulation. This new model, if valid, represents the target configuration that the running system should reach. We automatically generate the reconfiguration script, which allows to switch the system from its current configuration to the new target. We first perform a model comparison between the source configuration (the reflection model) and the target configuration (Figure 9, 3), which produces an ordered set of reconfiguration commands. This safe sequence of commands is then submitted (Figure 9, 4) to the running system in order to actually reconfigure it. Finally, the reflection model is automatically updated and becomes equivalent to the target model (Figure 9, 1).

Readers interested in more details about the causal connection are referred to our previous works [START_REF] Morin | Taming Dynamically Adaptive Systems with Models and Aspects[END_REF][START_REF] Morin | An Aspect-Oriented and Model-Driven Approach for Managing DynamicVariability[END_REF][START_REF] Morin | Models@ run.time to support dynamic adaptation[END_REF].

In the next two sub-sections we leverage this causal connection and the mappings (Section 4) in order to automatically update the architecture when the security policy is modified.

Activation/deactivation of security rules

Default permissions can temporarily be deactivated for several reasons: maintenance of a resource that requires the resource to be "offline", repression of bad or abusive behavior, etc. In some cases, default permissions should be deactivated for a particular role, while in some other cases they should be deactivated for a particular user. Delegations are temporarily activated by a user when he goes on holidays, when he is not available, etc, and deactivated when the user is back to work. Deactivating a permission, either for a role of for a user, is straightforward: it simply consists in removing the binding associated with the rule. This way, the chain-of-responsibility cannot process to the business components. Re-activating a permission is exactly the opposite: we have to create a binding and insert it a the right place. Delegations are handled exactly in the same way.

Figure 10 shows a code snippet written in Kermeta [START_REF] Muller | Weaving Executability into Object-Oriented Meta-languages[END_REF]. The aspect keyword means that we re-open the Permission meta-class, defined in the security metamodel (Section 4.1, Figure 12). We add 3 new references, corresponding to the mappings we have defined in Section 4.3, and an operation. The activate operation describes the impact on the architecture when a permission is activated. We first create a binding (Line 8) and set the four references needed to properly introduce the binding: the client and the server ports (Lines 9 and 10), and the client and server component instances (Lines 11 and 12). The activation and deactivation of permissions for particular users follow the same principle. In Figure 8, we can see that John Smith has delegated his role to Jane Smith. At the architectural level, this means that the component associated with Jane Smith has now 3 additional ports that are delegated to the component associated to John Smith. Jane Smith still has the permissions associated with her role (Secretary), but she now also has the permissions associated to the Director role, via the John Smith component. In the same Figure, we can see that the "bad student" user has lost all his permissions. However, the permissions have not been deactivated for all the students. At the architectural level, all the bindings formerly connected to the component associated with the "bad student" have been removed. In other words, the "bad student" is now totally isolated from the system. The modifications of the architecture, implied by the (de)activation of rules, are automatically reflected to the running system using the causal connection, as explained in Section 5.1.

At runtime, the removal/addition of binding is very fast. It simply consists in calling a setter method on the client component to (un)link it to/from a server. In the case where the permissions of all the users of a given role should be removed, we simply disconnect the role component from the resource components. This way, we do not have to remove all the (numerous) bindings between the user components and the role component. In the case where a given user loses his permissions, we remove the binding between its component and its associated role component. This way, other users are not impacted by this modification.

Evolution of the Access Control Policy

In the previous sub-section, we explained how the activation and deactivation of rules update the architecture, which in turn dynamically reconfigure the system. However, our model-driven approach also makes it possible to deeply modify the access control policy, by adding, removing, updating, rules, resources, roles or users, which is very difficult and often impossible using traditional security architectures [START_REF] El Kalam | Organization Based Access Control[END_REF][START_REF] Ferraiolo | Proposed NIST standard for role-based access control[END_REF][START_REF] Mouelhi | A Model-Based Framework for Security Policies Specification, Deployment and Testing[END_REF]. For example, if the policy is too permissive, the security manager would like to remove some permissions granted to a role, or create a new role with less permissions. On the other hand, a policy could be too restrictive to be actually usable in practice. In the former security policy, only the director could create and update borrower accounts. To help the director in this task, it has been decided that the administrator of the system could now also perform these tasks. One possible solution would be to ask the director (John Smith) to delegate his role (or at least the actions related to borrower accounts) to John Doe, the administrator. Since delegations are temporary by nature, this solution is not well suited. The best solution is to modify the security policy by creating 3 new permissions to allow the administrator to create, consult and modify borrower accounts.

Figure 11 focuses on the architectural elements related to the administrator role before and after the change in the policy. After the new architecture has been re-generated, we can see that the administrator can now access to the borrower accounts.

When the new architecture is submitted to our causal connection, this produces the following reconfiguration script:

Discussion

Unlike the classic architecture (based on PDP and PEP, see Section 2.1), our architecture introduces several additional components to properly manage access control. Indeed, we introduce a component for each resource and each role defined in the access control policy. These components are implemented as OSGi bundles, and we rely on the OSGi API to manage these components. The code of these components is straightforward and efficient: it simply delegates all their provided services to another component. For example, the following script illustrates the pseudo-code of the ResourceX in Figure ??. op1(...){ myBusinessComponent1.op1(...)} op2(...){ myBusinessComponent1.op2(...)} op2(...){ myBusinessComponent2.op3(...)} This code contains no logic (no reflection, no if-then-else, etc to dispatch the calls), but a very simple indirection. User components delegates to role components (permissions) or to other user components (delegation). Role components delegate to resource components, which finally delegate to the business components, which contains all the business logic. The code of these proxy components is automatically generated using a code template. Since OSGi offers powerful mechanisms to manage the classpath at runtime, it is possible to generate, compile and package this code at runtime. In the case where a user has the permission to use a resource, it thus has to transit through 3 simple indirections: user → role → resources → business code. This is comparable to the classic architecture: user → eval(PDP) → business code, where we have 2 indirections, plus the evaluation of the result of the PDP.

The activation/deactivation of permission simply consists in setting a Java reference using a setter method, which is automatically invoked during the reconfiguration step (see Section 5.1). De-activating a permission thus "physically" breaks the chain between the user and the real resources.

Our approach also reifies users as components. Unlike resources and roles, we do not encapsulate these components as OSGi bundles. Instead, we simply manipulate these components as pure objects, similarly to session objects we can find in applications that should handle multiple users. These light-weight components are instantiated when needed e.g., when users log in, with no overhead comparing to classic session objects.

RELATED WORK

A substantial work [START_REF] Barker | Flexible access control policy specification with constraint logic programming[END_REF][START_REF] Bertolissi | Dynamic event-based access control as term rewriting[END_REF][START_REF] Jajodia | Flexible support for multiple access control policies[END_REF] focused on access control formalization that guarantees flexibility and allows policies to be easily modified and updated.

In this context, we present some of the work related to this area. In [START_REF] Bertino | A flexible authorization mechanism for relational data management systems[END_REF], Bertino et al. proposed a new access control model which allows expressing flexible policies that can be easily modified and updated by users to adapt them to specific contexts. The advantage of their model resides in the ability to change the access control rules by granting or revoking access based on specific exceptions. Their model provides a wide range of interesting features that increase the flexibility of the access control policy. It allows advanced administrative functions for regulating the specification of access controls rules. In addition, their model supports delegation, which enables users to temporarily grant other users some of their permissions (like a director would do during his vacations).

In addition, Bertolissi et al. proposed DEBAC [START_REF] Bertolissi | Dynamic event-based access control as term rewriting[END_REF] a new access control model based on the notion of event and that allows the policy to be adapted to distributed and changing environments. Their model is represented as a term rewriting system [START_REF] Barker | Term rewriting for access control[END_REF], which allows specifying changing and dynamic access control policies.

As far as we know, no previous work dealt with the problem of maintaining the alignment of access control policies with the business logic by providing a process or a framework for integrating this access control mechanism into the deployed system. However, several researchers proposed model-driven approaches for implementing model based methodologies for securing applications. They focused on providing model based methodologies for security. Some approaches were proposed to help modeling access control formalisms in UML diagrams such as RBAC or MAC. RBAC was modeled using a dedicated UML diagram template [START_REF] Kim | Modeling role-based access control using parameterized uml models[END_REF]. In addition, Doan et al. proposed a methodology [START_REF] Doan | Mac and uml for secure software design[END_REF] to incorporate MAC in UML diagrams during the design process. All these approaches allow access control formalisms to be expressed during the design. UMLsec [START_REF] Jürjens | UMLsec: Extending UML for Secure Systems Development[END_REF] which is an extension of UML allows security properties to be expressed in UML diagrams. In addition, Lodderstedt et al. [START_REF] Lodderstedt | SecureUML: A UML-Based Modeling Language for Model-Driven Security[END_REF] propose SecureUML which provides a methodology for generating security components from specific models. The approach proposes a security modeling language to define the access control model. The resulting security model is combined with the UML business model in order to automatically produce the access control infrastructure. More precisely, they use the Meta-Object facility to create a new modeling language to define RBAC policies (extended to include constraints on rules). They apply their technique in different examples of distributed system architectures including Enterprise Java Beans and Microsoft Enterprise Services for .NET. However, their approach does not provide a flexible access control mechanism because updating the rules implies generating the security mechanisms again. The approach provides a tool for specifying the access control rules along with the model-driven development process and then automatically exporting these rules to generate the access control infrastructure. Our approach provides a flexible access control architecture that supports updating the access control rules.

CONCLUSIONS AND FUTURE WORK

In this paper, we have presented an approach that leverages Domain-Specific Languages, Model-Driven Engineering and models@runtime. Access control policies are expressed by a security expert using a dedicated DSML. This DSML is mapped to another DSML describing (runtime) software architectures. When the access control policy is modified, the architecture is causally impacted. Finally, we reused our previous work in order to synchronize architectural models with a system running on a component-based platform. This way, the running system always reflects the access control policy.

In future work, we plan to extend this work according to two different axis. First, along with the access control mechanism, we will include support for usage control. Usage control aims at enforcing security rules specifying how the data must be used, modified or distributed after access is granted. In addition, we will try to complement our security mechanism by adding new features like an intrusion detection system able to automatically reconfigure the system. Second, we plan to map other domain metamodels, such as workflow, GUI, house-automation [START_REF] Nain | Using MDE to Build a Schizofrenic Middleware for Home/Building Automation[END_REF], etc to our architectural metamodel connected to a running system. This way, it would be possible to drive the execution of a software system by manipulating domain concepts, rather than by directly manipulating the architecture.

Figure 1 :

 1 Figure 1: The Security Architecture

Figure 2 :

 2 Figure 2: Implicit security mechanism

Figure 3 :

 3 Figure 3: Explicit security mechanism

Figure 4 :

 4 Figure 4: Overview of the proposed approach

  of) RoleY can access the actionW of the ResourceZ actionW actionW rX (of RoleY) can access the actionW of the ResourceZ

Figure 5 :

 5 Figure 5: Mapping Resources to Architectural Concepts

Figure 6 :

 6 Figure 6: Mapping Permissions to Architectural Concepts

Figure 8 : 3 -

 83 Figure 8: 3-Layered architecture reflecting access control policies

Figure 9 :

 9 Figure 9: Leveraging MDE to generate safe reconfiguration scripts

1 aspect class Permission { 2 /:= b 14 end 15 }Figure 10 :

 21510 Figure10: The Permission meta-class aspectized with Kermeta[START_REF] Muller | Weaving Executability into Object-Oriented Meta-languages[END_REF]

  John Doe to Admin via createPersonnelAccount interface bind component John Doe to Admin via consultPersonnelAccount interface bind component John Doe to Admin via modifyPersonnelAccount interface bind component John Doe to Admin via createBorrowerAccount interface bind component John Doe to Admin via consultBorrowerAccount interface bind component John Doe to Admin via modifyBorrowerAccount interface //same actions between Admin and PersonnelAccount //same actions between Admin and BorrowerAccount start Admin start John Doe

	User layer	Role layer	Resource layer
			create
	John Doe	Admin	consult	Personnel
			modify	Account
	Before
	After
			create
	John Doe	Admin	consult	Borrower Account
			modify
	Figure 11: Architecture after 3 new permissions
	have been added
	unbind component John Doe from modifyPersonnelAccount interface
	//same actions for the Admin component
	remove component John Doe
	remove component Admin
	generate John Doe
	generate Admin
	add component John Doe
	add component Admin
	bind component
	stop component John Doe
	stop component Admin
	unbind component John Doe from createPersonnelAccount interface
	unbind component John Doe from consultPersonnelAccount interface

This work was partially funded by the DiVA project (EU FP7 STREP, contract 215412, http://www.ict-diva.eu/) ASE