J G Alfaro

F Cuppens
email: nora.cuppens@enst-bretagne.fr

N Cuppens-Boulahia

Analysis of Policy Anomalies on Distributed Network Security Setups

The use of different network security components, such as firewalls and network intrusion detection systems (NIDSs), is the dominant method to survey and guarantee the security policy in current corporate networks. On the one hand, firewalls are traditional security components which provide means to filter traffic within corporate networks, as well as to police the incoming and outcoming interaction with the Internet. On the other hand, NIDSs are complementary security components used to enhance the visibility level of the network, pointing to malicious or anomalous traffic. To properly configure both firewalls and NIDSs, it is necessary to use several sets of filtering and alerting rules. Nevertheless, the existence of anomalies between those rules, particularly in distributed multi-component scenarios, is very likely to degrade the network security policy. The discovering and removal of these anomalies is a serious and complex problem to solve. In this paper, we present a set of algorithms for such a management.

Introduction

Generally, once a security administrator has specified a security policy, he or she aims to enforce it in the information system to be protected. This enforcement consists in distributing the security rules expressed in this policy over different security components of the information system -such as firewalls, intrusion detection systems (IDSs), intrusion prevention systems (IPSs), proxies, etcboth at application, system, and network level. This implies cohesion of the security functions supplied by these components. In other words, security rules deployed over the different components must be consistent, not redundant and, as far as possible, optimal.

An approach based on a formal security policy refinement mechanism (using for instance abstract machines grounded on set theory and first order logic) ensures cohesion, completeness and optimization as built-in properties. Unfortunately, in most cases, such an approach has not a wide follow and the policy is more often than not empirically deployed based on security administrator expertise and flair. It is then advisable to analyze the security rules deployed to detect and correct some policy anomalies -often referred in the literature as intra-and inter-configuration anomalies [START_REF] Al-Shaer | Taxonomy of Conflicts in Network Security Policies[END_REF].

These anomalies might be the origin of security holes and/or heaviness of intrusion prevention and detection processes. Firewalls [START_REF] Cheswick | Firewalls and Internet security: repelling the wily hacker[END_REF] and network intrusion detection systems (NIDSs) [START_REF] Northcutt | Network Intrusion Detection: An analyst's Hand Book[END_REF] are the most commonly used security components and, in this paper, we focus particularly on their security rules. Firewalls are prevention devices ensuring the access control. They manage the traffic between the public network and the private network zones on one hand and between private zones in the local network in the other hand. The undesirable traffic is blocked or deviated by such a component. NIDSs are detection devices ensuring a monitoring role. They are components that supervise the traffic and generate alerts in the case of suspicious traffic. The attributes used to block or to generate alerts are almost the same. The challenge, when these two kinds of components coexist in the security architecture of an information system is then to avoid inter-configuration anomalies.

In [START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF][START_REF] Cuppens | Misconfiguration Management of Network Security Components[END_REF], we presented an audit process to manage intra-firewall policy anomalies, in order to detect and remove anomalies within the set of rules of a given firewall. This audit process is based on the existence of relationships between the condition attributes of the filtering rules, such as coincidence, disjunction, and inclusion, and proposes a transformation process which derives from an initial set of rules -with potential policy anomalies -to an equivalent one which is completely free of errors. Furthermore, the resulting rules are completely disjoint, i.e., the ordering of rules is no longer relevant.

In this paper, we extend our proposal of detecting and removing intra-firewall policy anomalies [START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF][START_REF] Cuppens | Misconfiguration Management of Network Security Components[END_REF], to a distributed setup where both firewalls and NIDSs are in charge of the network security policy. This way, assuming that the role of both prevention and detection of network attacks is assigned to several components, our objective is to avoid intra and inter-component anomalies between filtering and alerting rules. The proposed approach is based on the similarity between the parameters of a filtering rule and those of an alerting rule. This way, we can check whether there are errors in those configurations regarding the policy deployment over each component which matches the same traffic.

The advantages of our proposal are threefold. First, as opposite to the related work we show in Section 6, our approach not only considers the analysis of relationships between rules two by two but also a complete analysis of the whole set of rules. This way, those conflicts due to the union of rules that are not detected by other proposals (such as [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF][START_REF] Gupta | Algorithms for Routing Lookups and Packet Classification[END_REF]) are properly discovered by our intra-and inter-component algorithms. Second, after applying our intracomponent algorithms the resulting rules of each component are totally disjoint, i.e., the ordering of rules is no longer relevant. Hence, one can perform a second rewriting of rules in a close or open manner, generating a configuration that only contains deny (or alert) rules if the component default policy is open, and accept (or pass) rules if the default policy is close (cf. Section 3.1). Third, we also present in this paper a network model to determine which components are crossed by a given packet knowing its source and destination, as well as other network properties. Thanks to this model, our approach better defines all the set of anomalies studied in the related work. Furthermore the lack of this model in other approaches, such as [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF], may lead to inappropriate decisions.

The rest of this paper is organized as follows. Section 2 starts by introducing a network model that is further used in Section 3 and Section 4 when presenting, respectively, our intra and inter-component anomaly's classifications and algorithms. Section 5 overviews the performance of our proposed algorithms. Section 6 shows an analysis of some related work. Finally Section 7 closes the paper with some conclusions and gives an outlook on future work.

Network Model

The purpose of our network model is to determine which components within the network are crossed by a given packet, knowing its source and destination. It is defined as follows. First, and concerning the traffic flowing from two different zones of the distributed policy scenario, we may determine the set of components that are crossed by this flow. Regarding the scenario shown in Figure 1, for example, the set of components crossed by the network traffic flowing from zone external network to zone private 3 equals [C 1 ,C 2 ,C 4 ], and the set of components crossed by the network traffic flowing from zone private 3 to zone

private 2 equals [C 4 ,C 2 ,C 3 ].
Let C be a set of components and let Z be a set of zones. We assume that each pair of zones in Z are mutually disjoint, i.e., if z i ∈ Z and z j ∈ Z then z i ∩ z j = ∅. We then define the predicate connected(c 1 , c 2 ) as a symmetric and anti-reflexive function which becomes true whether there exists, at least, one interface connecting component c 1 to component c 2 . On the other hand, we define the predicate adjacent(c, z) as a relation between components and zones which becomes true whether the zone z is interfaced to component c. Referring to Figure 1, we can verify that predicates connected(C 1 , C 2 ) and connected(C 1 , C 3 ), as well as adjacent(C 1 , DM Z), adjacent(C 2 , private 1 ), adjacent(C 3 , DM Z), and so on, become true. Let us now define a set of functions related with the order between paths. We first define functions f irst, last, and the order functor between paths. We define functions f irst and last, respectively, from P in C, such that if p is a path, then f irst(p) corresponds to the first component in the path, and last(p) corresponds to the last component in the path. We then define the order functor between paths as p 1 ≤ p 2 , such that path p 1 is shorter than p 2 , and where all the components within p 1 are also within p 2 . We also define the predicates isF irewall(c) and isN IDS(c) which become true whether the component c is, respectively, a firewall or a NIDS.

Two additional functions are route and minimal route. We first define function route from Z to Z in 2 P , such that p ∈ route(z 1 , z 2 ) iff the path p connects zone z 1 to zone z 2 . Formally, we define that p ∈ route(z 1 , z 2 ) iff adjacent(f irst(p), z 1 ) and adjacent(last(p), z 2 ). Similarly, we then define minimal route from Z to Z in 2 P , such that p ∈ minimal route(z 1 , z 2 ) iff the following conditions hold: (1) p ∈ route(z 1 , z 2 ); (2) There does not exist p ′ ∈ route(z 1 , z 2 ) such that p ′ < p. Regarding Figure 1, we can verify that the minimal route from zone private 3 to zone private

2 equals [C 4 , C 2 , C 3 ], i.e., minimal route(private 3 , private 2 ) = {[C 4 , C 2 , C 3 ]}.
Let us finally conclude this section by defining the predicate affects(Z, A c ) as a boolean expression which becomes true whether there is, at least, an element z ∈ Z such that the configuration of z is vulnerable to the attack category A c ∈ V , where V is a vulnerability set built from a vulnerability database, such as CVE/CAN [START_REF]Common Vulnerabilities and Exposures[END_REF] or OSVDB [START_REF]Open Source Vulnerability Database[END_REF].

Intra-Component Analysis

In this section we extend our previous work on analysis of network access control rules for the configuration of firewalls [START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF][START_REF] Cuppens | Misconfiguration Management of Network Security Components[END_REF], concentrating on anomalies that may also arise in NIDS setups. In particular, a new case of anomaly is pointed out (cf. Intra-Component Irrelevance) and the associated code of our intra-component algorithms has been properly revised 3 .

For our work, we define the security rules of both firewalls and NIDSs as filtering and alerting rules, respectively. In turn, both filtering and alerting rules are specific cases of a more general configuration rule, which typically defines a decision (such as deny, alert, accept, or pass) that applies over a set of condition attributes, such as protocol, source, destination, classification, and so on. We define a general configuration rule as follows:

R i : {condition i } → decision i ( 1
)
where i is the relative position of the rule within the set of rules, {condition i } is the conjunctive set of condition attributes such that {condition i } equals C 1 ∧ C 2 ∧ ... ∧ C p -being p the number of condition attributes of the given rule -and decision is a boolean value in {true, f alse}.

We shall notice that the decision of a filtering rule will be positive (true) whether it applies to a specific value related to deny (or filter) the traffic it matches, and will be negative (f alse) whether it applies to a specific value related to accept (or ignore) the traffic it matches. Similarly, the decision of an alerting rule will be positive (true) whether it applies to a specific value related to alert (or warn) about the traffic it matches, and will be negative (f alse) whether it applies to a specific value related to pass (or ignore) the traffic it matches.

Let us continue by classifying the complete set of anomalies that can occur within a single component configuration. An example for each anomaly will be illustrated through the sample scenario shown in Figure 2.

Intra-Component Shadowing

A configuration rule R i is shadowed in a set of configuration rules R whether such a rule never applies because all the packets that R i may match, are previously matched by another rule, or combination of rules, with higher priority. Regarding Figure 2, rule C 1 {R 6 } is shadowed by the union of rules C 1 {R 3 } and C 1 {R 5 }.

Intra-Component Irrelevance

A configuration rule R i is irrelevant in a set of configuration rules R if one of the following conditions holds:

(1) Both source and destination address are within the same zone. For instance, rule C 1 {R 1 } is irrelevant since the source of its address, external network, as well as its destination, is the same.

(2) The component is not within the minimal route that connects the source zone, concerning the irrelevant rule which causes the anomaly, to the destination zone. Hence, the rule is irrelevant since it matches traffic which does not flow through this component. Rule C 1 {R 2 }, for example, is irrelevant since component C 1 is not in the path which corresponds to the minimal route between the source zone unix network to the destination zone windows network.

(3) The component is a nids, i.e., the predicate isN IDS(c) (cf. Section 2) becomes true, and, at least, one of the condition attributes in R i is related with a classification of attack A c which does not affect the destination zone of such a rule -i.e., the predicate affects(z d , A c ) becomes f alse. Regarding Figure 2, we can see that rule C 2 {R 2 } is irrelevant since the nodes in the destination zone unix network are not affected by vulnerabilities classified as winworm.

Default policies

Each component implements a positive (i.e., close) or negative (i.e., open) default policy. In the positive policy, the default policy is to alert or to deny a packet when any configuration rule applies. Conversely, the negative policy will accept or pass a packet when no rule applies.

After rewriting the rules with the intra-component-audit algorithms (cf. Appendix A), we can actually remove every rule whose decision is pass or accept if the default policy of this component is negative (else this rule is redundant with the default policy) and, similarly, we can remove every rule whose decision is deny or alert if the default policy is positive. Thus, we can consider that our proposed intra-component-audit algorithm generates a configuration that only contains positive rules if the component default policy is negative, and negative rules if the default policy is positive.

Inter-Component Analysis

The objective of the inter-component audit algorithms is the complete detection of policy anomalies that could exist in a multi-component policy, i.e., to discover and warn the security officer about potential anomalies between policies of different components.

The main hypotheses to deploy our algorithms hold the following: (1) An upstream network traffic flows away from the closest component to the origin of this traffic (i.e., the most-upstream component [START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF]) towards the closest component to the remote destination (i.e., the most-downstream component [START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF]); (2) Every component's policy in the network has been rewritten using the intracomponent algorithms defined in Appendix A, i.e., it does not contain intracomponent anomalies and the rules within such a policy are completely independent between them.

Inter-Component Anomalies Classification

In this section, we classify the complete set of anomalies that can occur within a multi-component policy. Our classification is based on the network model pre-sented in Section 2. An example for each anomaly will be illustrated through the distributed multi-component policy setup shown in Figure 3.

Inter-Component Shadowing

A shadowing anomaly occurs between two components whether the following conditions hold: (1) The most-upstream component is a firewall; (2) The downstream component, where the anomaly is detected, does not block or report (completely or partially) traffic that is blocked (explicitly, by means of positive rules; or implicitly, by means of its default policy), by the most-upstream component.

The explicit shadowing as result of the union of rules C 6 {R 7 } and C 6 {R 8 } to the traffic that the component C 3 matches by means of rule C 3 {R 1 } is a proper example of full shadowing between a firewall and a NIDS. Similarly, the anomaly between rules C 3 {R 2 } and C 6 {R 8 } shows an example of an explicit partial shadowing anomaly between a firewall and a NIDS.

On the other hand, the implicit shadowing between the rule C 1 {R 5 } and the default policy of component C 2 is a proper example of implicit full shadowing between two firewalls. Finally, the anomaly between the rule C 1 {R 6 }, C 2 {R 1 }, and the default policy of component C 2 shows an example of an implicit partial shadowing anomaly between two firewalls.

Inter-Component Redundancy

A redundancy anomaly occurs between two components whether the following conditions hold: (1) The most-upstream component is a firewall; (2) The downstream component, where the anomaly is detected, blocks or reports (completely or partially) traffic that is blocked by the most-upstream component.

Rules C 5 {R 3 } and C 6 {R 1 } show a proper example of full redundancy between two firewalls, whereas rules C 4 {R 3 } and C 6 {R 5 } show an example of full redundancy between a firewall and a NIDS. Similarly, rules C 5 {R 4 } and C 6 {R 2 } show a proper example of partial redundancy between two firewalls, whereas rules C 4 {R 4 } and C 6 {R 6 } show an example of partial redundancy between a firewall and a NIDS.

Sometimes, this kind of redundancy is expressly introduced by network administrators (e.g., to guarantee the forbidden traffic will not reach the destination). Nonetheless, it is important to discover it since, if such a rule is applied, we may conclude that at least one of the redundant components is wrongly working.

Inter-Component Misconnection

A misconnection anomaly occurs between two components whether the following conditions hold: (1) The most-upstream component is a firewall; (2) the most-upstream firewall permits (explicitly, by

Inter-Component Analysis Algorithms

For reasons of clarity, we split the whole analysis process in four different algorithms. The input for the first algorithm (cf. Algorithm 5) is the set of components C, such that for all c ∈ C, we note c[rules] as the set of configuration rules of component c, and c[policy] ∈ {true, f alse} as the default policy of such a component c. In turn, each rule r ∈ c[rules] consists of a boolean expression over the attributes szone (source zone), dzone (destination zone), sport (source port), dport (destination port), protocol, and decision (true or false).

Let us recall here the functions source(r) = szone and dest(r) = dzone. Thus, we compute for each component c ∈ C and for each rule r ∈ c[rules], each one of the source zones z 1 ∈ Z s and destination zones z 2 ∈ Z d -whose intersection with respectively szone and dzone is not empty -which become, together with a reference to each component c and each rule r, the input for the second algorithm (i.e., Algorithm 6).

Once in Algorithm 6, we compute the minimal route of components that connects zone z 1 to z 2 , i.e., [C 1 , C 2 , . . . , C n ] ∈ minimal route(z 1 , z 2 ). Then, we decompose the set of components inside each path in downstream path (path d ) and upstream path (path u ). To do so, we use the implicit functions head and tail. The first component c d ∈ path d , and the last component c u ∈ path u are passed, respectively, as argument to the last two algorithms (i.e., Algorithm 7 and Algorithm 8) in order to conclude the set of necessary checks that guarantee the audit process 4 .

Let us conclude by giving an outlook in Figure 4 to the set of warnings after the execution of Algorithm 5 over the scenario of Figure 3: In this section, we present an evaluation of the performance of MIRAGE (which stands for MIsconfiguRAtion manaGEr), a software prototype that implements the intra and inter-firewall algorithms presented in sections 3 and 4. MIRAGE has been developed using PHP, a scripting language that is especially suited for web services development and can be embedded into HTML for the construction of client-side GUI based applications [START_REF] Castagnetto | Professional PHP Programming[END_REF]. MIRAGE can be locally or remotely executed by using a HTTP server and a web browser.

C 1 {R 3 } -C 6 {R 3 , R 4 }: Full Shadowing C 1 {R 4 } -C 6 {R 4 }: Partial Shadowing C 1 {R 5 } -C 2 {pol.}: Full Shadowing C 1 {R 6 } -C 2 {R 1 , pol.}: Partial Shadowing C 2 {R 3 } -C 1 {pol.}: Full Misconnection C 2 {R 4 } -C 1 {R 7 , pol.}: Partial Misconnection C 3 {R 1 } -C 6 {R 7 , R 8 }: Full Shadowing C 3 {R 2 } -C 6 {R 8 }: Partial Shadowing C 4 {R 1 } -C 2 {R 5 }: Full Misconnection C 4 {R 2 } -C 2 {R 5 }: Partial Misconnection C 4 {R 3 } -C 6 {R 5 }: Full Redundancy C 4 {R 4 } -C 6 {R 6 }: Partial Redundancy C 4 {R 5 } -C 6 {pol.}: Full Misconnection C 5 {R 1 } -C 2 {R 2 }: Full Misconnection C 5 {R 2 } -C 2 {R 2 }: Partial Misconnection C 5 {R 3 } -C 6 {R 1 }: Full Redundancy C 5 {R 4 } -C 6 {R 2 }: Partial Redundancy C 5 {R 5 } -C 6 {pol.}: Full Misconnection
Inspired by the experiments done in [START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF], we evaluated our algorithms through a set of experiments over two different IPv4 real networks. The topology for the first network consisted of a single firewall based Netfilter [START_REF] Welte | The netfilter project: firewalling, nat and packet mangling for linux 2[END_REF], and a single NIDS based on Snort [START_REF] Roesch | Snort: lightweight intrusion detection for networks[END_REF] -connected to three different zones with more than 50 hosts. The topology for the second network consisted of six different components -based on netfilter, ipfilter [START_REF] Reed | [END_REF], and snort [START_REF] Roesch | Snort: lightweight intrusion detection for networks[END_REF] -protecting six different zones with more than 200 hosts. The whole of these experiments were carried out on an Intel-Pentium M 1.4 GHz processor with 512 MB RAM, running Debian GNU/Linux 2.6.8, and using Apache/1.3 with PHP/4.3 configured.

During a first phase, we measured the memory space and the processing time needed to perform Algorithm 4 over several sets of IPv4 policies for the first IPv4 network, according to the three following security officer profiles: beginner, intermediate, and expert -where the probability to have overlaps between rules increases from 5% to 90%. The results of these measurements are plotted in Figure 5(a) and Figure 5(b). Though those plots reflect strong memory and process time requirements, we consider they are reasonable for off-line analysis, since it is not part of the critical performance of a single component.

We conducted, in a second phase, similar experiments to measure the performance and scalability of Algorithm 5 through a progressive increment of auto-generated rules, firewalls and zones for the second network. The results of these measurements are plotted in Figure 5(c) and Figure 5(d). Similarly to the intra-component evaluation, we consider these requirements very reasonable for off-line inter-component analysis. Some related proposals to our work, such as [START_REF] Adiseshu | Detecting and Resolving Packet Filter Conflicts[END_REF][START_REF] Gupta | Algorithms for Routing Lookups and Packet Classification[END_REF][START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF][START_REF] Gouda | Firewall Design: Consistency, Completeness and Compactness[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF][START_REF] Al-Shaer | Taxonomy of Conflicts in Network Security Policies[END_REF], provide means to directly manage the discovery of anomalies from the components' configuration. For instance, the authors in [START_REF] Adiseshu | Detecting and Resolving Packet Filter Conflicts[END_REF] consider that, in a configuration set, two rules are in conflict when the first rule in order matches some packets that match the second rule, and the second rule also matches some of the packets that match the first rule. This approach is very limited since it just detects a particular case of ambiguity within a single component configuration. Furthermore, it does not provide detection on multiple-component configurations.

In [START_REF] Gupta | Algorithms for Routing Lookups and Packet Classification[END_REF], two cases of anomalies are considered. First, a rule R j is defined as backward redundant iff there exists another rule R i with higher priority in order such that all the packets that match rule R j also match rule R i . Second, a rule R i is defined as forward redundant iff there exists another rule R j with the same decision and less priority in order such that the following conditions hold: (1) all the packets that match R i also match R j ; (2) for each rule R k between R i and R j , and that matches all the packets that also match rule R i , R k has the same decision as R i . Although this approach seems to head in the right direction, we consider it as incomplete, since it does not detect all the possible cases of intracomponent anomalies (as we define in this paper). For instance, given the set of rules shown in Figure 6(a), since R 2 comes after R 1 , rule R 2 only applies over the interval [51, 70] -i.e., R 2 is not necessary, since, if we remove this rule from the configuration, the filtering policy does not change. The detection proposal, as defined in [START_REF] Gupta | Algorithms for Routing Lookups and Packet Classification[END_REF], cannot detect the redundancy of rule R 2 within the configuration of such a given firewall. Furthermore, neither [START_REF] Gupta | Algorithms for Routing Lookups and Packet Classification[END_REF] nor [START_REF] Gouda | Firewall Design: Consistency, Completeness and Compactness[END_REF] provide detection on multiple-component configurations. To our best knowledge, the approach presented in [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF][START_REF] Al-Shaer | Taxonomy of Conflicts in Network Security Policies[END_REF] propose the most efficient set of techniques and algorithms to detect policy anomalies in both single and multi-firewall configuration setups. In addition to the discovery process, their approach also attempts an optimal insertion of arbitrary rules into an existing configuration, through a tree based representation of the filtering criteria. Nonetheless, and even though the efficiency of their proposed discovering algorithms and techniques is very promising, we also consider this approach as incomplete. First, their intra-and inter-component discovery approach is not complete since, given a single-or multiple-component security policy, their detection algorithms are based on the analysis of relationships between rules two by two. This way, errors due to the union of rules are not explicitly considered (as our approach does). The set of rules shown in Figure 6(b), for example, may lead their discovery algorithms to inappropriate decisions. The approach defined in [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF] cannot detect that rule R 3 will be never applied due to the union of rules R 1 and R 2 . Just a correlation signal -that is obviously a weaker signal than a shadowing one -would be labeled. Though in [START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF] the authors pointed out to this problematic, claiming that they break down the initial set of rules into an equivalent set of rules free of overlaps between rules, no specific algorithms have been provided for solving it in [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF][START_REF] Al-Shaer | Taxonomy of Conflicts in Network Security Policies[END_REF].

Second, their inter-component discovery approach considers as anomalies some situations that, from our point of view, must be suited to avoid inconsistent decisions between components used in the same policy to control or survey to different zones. For instance, given the following scenario: their algorithms will inappropriately report a redundancy anomaly between filtering rules F W 1 {R 1 } and F W 2 {R 1 }. This is because rule F W 1 {R 1 } matches every packet that also F W 2 {R 1 } does. As a consequence, [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF] considers rule F W 2 {R 1 } as redundant since packets denied by this rule are already denied by rule F W 1 {R 1 }. However, this conclusion is not appropriate because rule F W 1 {R 1 } applies to packets from the external zone to the private zone whereas rule F W 2 {R 1 } applies to packets from the DMZ zone to the private zone. So, rule F W 2 {R 1 } is useful and cannot be removed. Though in [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF] the authors claim that their analysis technique marks every rule that is used on a network path, no specific algorithms have been provided for doing so. The main advantage of our proposal over their approach is that it includes a model of the traffic which flows through each component. We consider this is necessary to draw the right conclusion in this case.

Finally, although in [START_REF] Al-Shaer | Taxonomy of Conflicts in Network Security Policies[END_REF] the authors consider their work as sufficiently general to be used for verifying many other filtering based security policies such as intrusion detection and prevention systems, no specific mechanisms have been provided for doing so.

In this paper we presented an audit process to set a distributed security scenario composed of both firewalls and network intrusion detection systems (NIDSs) free of anomalies. Our audit process has been presented in two main blocks. We first presented, in Section 3, a set of algorithms for intra-component analysis, according to the discovering and removal of policy anomalies over singlecomponent environments. We then presented, in Section 4, a set of algorithms for inter-component analysis, in order to detect and warn the security officer about the complete existence of anomalies over a multi-component environment. Some advantages of our approach are the following. First, our intra-firewall transformation process verifies that the resulting rules are completely independent between them. Otherwise, each rule considered as useless during the process is reported to the security officer, in order to verify the correctness of the whole process. Second, we can perform a second rewriting of rules, generating a configuration that only contains positive rules if the component default policy is negative, and negative rules if the default policy is positive. Third, the network model presented in Section 2 allows us to determine which components are crossed by a given packet knowing its source and destination, as well as other network properties. Thanks to this model, our approach better defines all the set of anomalies studied in the related work, and it reports, moreover, two new anomalies (irrelevance and misconnection) not reported, as defined in this paper, in none of the other approaches. Furthermore, and as pointed out in Section 6, the lack of this model in [START_REF] Al-Shaer | Discovery of Policy Anomalies in Distributed Firewalls[END_REF][START_REF] Al-Shaer | Conflict Classification and Analysis of Distributed Firewall Policies[END_REF][START_REF] Al-Shaer | Taxonomy of Conflicts in Network Security Policies[END_REF] leads to inappropriate decisions.

The implementation of our approach in a software prototype demonstrates the practicability of our work. We shortly discussed this implementation, based on a scripting language [START_REF] Castagnetto | Professional PHP Programming[END_REF], and presented an evaluation of its performance. Although these experimental results show that our algorithms have strong requirements, we believe that these requirements are reasonable for off-line analysis, since it is not part of the critical performance of the audited component.

As future work, we are currently studying the anomaly problems of security rules in the case where the security architecture includes firewalls, IDS/IPS, and IPSec devices. Though there is a real similarity between the parameters of those devices' rules, more investigation has to be done in order to extend our proposal. In parallel to this work, we are also considering to extend our approach to the analysis of stateful policies.

A Intra-Component Algorithms

Our proposed audit process is a way to alert the security officer in charge of the network about these configuration errors, as well as to remove all the useless rules in the initial firewall configuration. The data to be used for the detection process is the following. A set of rules R as a list of initial size n, where n equals count(R), and where each element is an associative array with the strings condition, decision, shadowing, redundancy, and irrelevance as keys to access each necessary value.

For reasons of clarity, we assume one can access a linked-list through the operator R i , where i is the relative position regarding the initial list sizecount(R). We also assume one can add new values to the list as any other normal variable does (element ← value), as well as to remove elements through the addition of an empty set (element ← ∅). The internal order of elements from the linked-list R keeps with the relative ordering of rules.

Each element R i [condition] is a boolean expression over p possible attributes. To simplify, we only consider as attributes the following ones: szone (source zone), dzone (destination zone), sport (source port), dport (destination port), protocol, and attack class -or A c for short -which will be empty whether the component is a firewall. In turn, each element R i [decision] is a boolean variable whose values are in {true, f alse}. Elements R i [shadowing], R i [redundancy], and R i [irrelevance] are boolean variables in {true, f alse} -which will be initialized to f alse by default.

We split the whole process in four different algorithms. The first algorithm (cf. Algorithm 1) is an auxiliary function whose input is two rules, A and B. Once executed, this auxiliary function returns a further rule, C, whose set of condition attributes is the exclusion of the set of conditions from A over B. In order to simplify the representation of this algorithm, we use the notation A i as an abbreviation of the variable A[condition][i], and the notation B i as an abbreviation of the variable B[condition][i] -where i in [1, p].

The second algorithm (cf. Algorithm 2) is a boolean function in {true, f alse} which applies the necessary verifications to decide whether a rule r is irrelevant for the configuration of a component c. To properly execute such an algorithm, let us define source(r) as a function in Z such that source(r) = szone, and dest(r) as a function in Z such that dest(r) = dzone.

The third algorithm (cf. Algorithm 3) is a boolean function in {true, f alse} which, in turn, applies the transformation exclusion (Algorithm 1) over a set of configuration rules to check whether the rule obtained as a parameter is potentially redundant.

The last algorithm (cf. Algorithm 4) performs the whole process of detecting and removing the complete set of intra-component anomalies. This process is split in three different phases. During the first phase, a set of shadowing rules are detected and removed from a top-bottom scope, by iteratively applying Algorithm 1 -when the decision field of the two rules is different. Let us notice that this stage of detecting and removing shadowed rules is applied before the detection and removal of proper redundant and irrelevant rules.

The resulting set of rules is then used when applying the second phase, also from a top-bottom scope. This stage is performed to detect and remove proper redundant rules, through an iterative call to Algorithm 3 (i.e., testRedundancy), as well as to detect and remove all the further shadowed rules remaining during the latter process. Finally, during a third phase the whole set of non-empty rules is analyzed in order to detect and remove irrelevance, through an iterative call to Algorithm 2 (i.e., testIrrelevance).

  We then define the set of paths, P , as follows. If c ∈ C then [c] ∈ P is an atomic path. Similarly, if [p.c 1 ] ∈ P (be "." a concatenation functor) and c 2 ∈ C, such that c 2 / ∈ p and connected(c 1 , c 2 ), then [p.c 1 .c 2 ] ∈ P . This way, we can notice that, concerning Figure 1, [C 1 , C 2 , C 4 ] ∈ P and [C 1 , C 3 ] ∈ P .

Fig. 1 .

 1 Fig. 1. Simple distributed policy setup.

  (a) Example scenario of a filtering policy. (b) Example scenario of an alerting policy.

Fig. 2 .

 2 Fig. 2. Example filtering and alerting policies.

Fig. 3 .

 3 Fig. 3. An example for a distributed network policy setup.

Fig. 4 .

 4 Fig. 4. Execution of Algorithm 5 over the scenario of Figure 3.

Fig. 5 .

 5 Fig. 5. Evaluation of our set of intra-and inter-component algorithms.

R1Fig. 6 .

 6 Fig. 6. Example of some firewall configurations.

  .1.[0,255] 111.222.0.[0,255] FW 1{R1} : p = tcp s any d 111.222.1.0/24 dport = 80 deny FW 2{R1} : p = tcp s 111.222.0.0/24 d 111.222.1.0/24 dport = 80 deny external network DMZ private

Because of the similarity between the revision and the previous work already covered in[START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF][START_REF] Cuppens | Misconfiguration Management of Network Security Components[END_REF], we move our intra-component audit algorithms to Appendix A. Their correctness and complexity can also be found in[START_REF] Cuppens | Detection and Removal of Firewall Misconfiguration[END_REF][START_REF] Cuppens | Misconfiguration Management of Network Security Components[END_REF].

The operator "∽" within algorithms 7 and 8 denotes that two rules ri and rj are correlated if every attribute in Ri has a non empty intersection with the corresponding attribute in Rj .

Acknowledgements

This work was supported by funding from the French ministry of research, under the ACI DESIRS project, the Spanish Government project TIC2003-02041, and the Catalan Government grants 2003FI126 and 2005BE77.


CERMES Siavash Ghabezloo
email: siavash.ghabezloo@enpc.fr

Jean Sulem

Temperature induced pore fluid pressurization in geomaterials Temperature induced pore fluid pressurization in geomaterials

Keywords: thermal pressurization, pore pressure, undrained heating, drainage system, dead volume, triaxial cell, thermo-poro-elasticity

The theoretical basis of the thermal response of the fluid-saturated porous materials in undrained condition is presented. It has been demonstrated that the thermal pressurization phenomenon is controlled by the discrepancy between the thermal expansion of the pore fluid and of the solid phase, the stress-dependency of the compressibility and the non-elastic volume changes of the porous material. For evaluation of the undrained thermo-poro-elastic properties of saturated porous materials in conventional triaxial cells, it is important to take into account the effect of the dead volume of the drainage system. A simple correction method is presented to correct the measured pore pressure change and also the measured volumetric strain during an undrained heating test. It is shown that the porosity of the tested material, its drained compressibility and the ratio of the volume of the drainage system to the one of the tested sample, are the key parameters which influence the most the error induced on the measurements by the drainage system. An example of the experimental evaluation of undrained thermoelastic parameters is presented for an undrained heating test performed on a fluidsaturated granular rock.

Introduction

It is common in geomechanics to find situations in which an increase of temperature in a fluid saturated ground induces pore pressure increase. Considering the effect of transport of heat and fluid and the duration of event studied, two extreme cases arise, one corresponding to very large transport terms leading to a quasi drained and isothermal condition and one corresponding to very small transport terms leading to a quasi undrained and adiabatic condition. From basic mass balance laws the evolution of pore pressure is classically expressed in terms of a production/diffusion equation where appears the rate of pressure change due to temperature change under constant pore fluid mass fraction (i.e. undrained condition).

Temperature increase in saturated porous materials under undrained condition leads to thermal pressurization of the pore fluid because of the discrepancy between the thermal expansion coefficients of the pore fluid and of the pore volume. This increase in the pore fluid pressure induces a reduction of the effective mean stress, and can lead to shear failure or hydraulic fracturing. The thermal pressurization phenomenon is important in studies of rapid landslides when frictional heating tends to increase the pore pressure and to decrease the effective compressive stress and the shearing resistance of the material. The potential contribution of this phenomenon in the catastrophic loss of strength that occurred in Vaiont slide is studied by several authors (e.g. [START_REF] Vardoulakis | Dynamic thermo-poro-mechanical analysis of catastrophic landslides[END_REF], Veveakis et al., 2007).

The thermal pressurization phenomenon is also important in petroleum engineering where the reservoir rock and the well cement lining undergo sudden temperature changes. This is for example the case when extracting heavy oils by steam injection methods where steam is injected into the reservoir to heat the oil to a temperature at which it flows. This rapid increase of temperature could damage cement sheath integrity of wells and lead to loss of zonal isolation. This phenomenon is also important in environmental engineering for radioactive waste disposal in deep clay geological formations [START_REF] Gens | In situ behaviour of a stiff layered clay subject to thermal loading: observations and interpretation[END_REF][START_REF] François | Thermo-hydro-mechanical simulation of ATLAS in situ large scale test in Boom Clay[END_REF]. The onset of thermal pressurization is also important in earthquake science to explain dynamic fault weakening during coseismic slip [START_REF] Rempel | Thermal pressurization and onset of melting in fault zones[END_REF]Rice 2006, Sulem et al. 2007). Important theoretical advances have been proposed in the study of thermal weakening of fault during coseismic slip and one can find an extensive literature review on the subject in the comprehensive paper of [START_REF] Rice | Heating and weakening of faults during earthquake slip[END_REF]. In this paper, Rice emphasises the need of laboratory data to constrain theoretical modelling of these mechanisms. In particular thermal pressurization of rocks during seismic slip is highly influenced by damage and inelastic deformation inside the fault zones. The presence of clay material in fault zones also affects thermal pressurization as possible collapse of the clay under thermal loading may activate fluid pressurization [START_REF] Sulem | Thermo-Poro-Mechanical Properties of Clayey Gouge and Application to Rapid Fault Shearing[END_REF]).

The values of the undrained thermal pressurization coefficient, defined as the pore pressure increase due to a unit temperature increase in undrained condition, is thus largely dependent upon the nature of the material, the state of stress, the range of temperature change, the induced damage. In the literature we can find values that differ from two orders of magnitude: In [START_REF] Campanella | Influence of temperature variations on soil behaviour[END_REF] different values are found from 0.01 MPa/°C for clay to 0.05 MPa/°C for sandstone. Palciauskas and Domenica (1982) estimate a value of 0.59MPa/°C for Kayenta sandstone. On the basis of [START_REF] Sultan | Etude du comportement thermo-mécanique de l'argile de Boom : expériences et modélisation[END_REF] experimental data on Boom clay, [START_REF] Vardoulakis | Dynamic thermo-poro-mechanical analysis of catastrophic landslides[END_REF] estimates this coefficient as 0.06 MPa/°C. For a clayey fault gouge extracted at a depth of 760m in Aigion fault in the Gulf of Corinth (Greece), the value obtained by [START_REF] Sulem | Experimental characterization of the thermo-poro-mechanical properties of the Aegion fault gouge[END_REF] is 0.1 MPa/°C and for intact rock at great depth, the value given by [START_REF] Lachenbruch | Frictional heating, fluid pressure and the resistance to fault motion[END_REF] is 1.5 MPa/°C. For a mature fault at 7km depth at normal stress of 196 MPa, ambient pore pressure of 70 MPa, and ambient temperature of 210°C, [START_REF] Rice | Heating and weakening of faults during earthquake slip[END_REF] estimates this coefficient as 0.92MPa/°C in case of intact fault walls and 0.31MPa/°C in case of damage fault wall.

The thermal pressurization coefficient of a hardened cement paste is evaluated experimentally by Ghabezloo et al. (2009), equal to 0.6 MPa/°C.

The large variability of the thermal pressurization coefficient in different geomaterials highlights the necessity of laboratory studies. The aim of this paper is to present the theoretical basis of thermal pressurization phenomenon and some aspects of its experimental evaluation.

Theoretical framework

The equations governing the phenomenon of the thermo-mechanical pressurization of porous materials are presented here for an ideal porous material characterized by a fully connected pore space and by a microscopically homogeneous (i.e., composed of only one solid material) and isotropic solid phase.

These equations can be derived using the approach of Bishop and Eldin (1950). In this approach, schematized on Figure (1), the problem of thermo-mechanical loading is broken up into three independent sub-problems. Assuming isotropic elasticity, the volumetric changes of the porous material element and its components, are written separately, as presented on table (1). In this table, V is the total volume and n is the Lagrangian porosity defined as the pore volume per unit volume of porous material in the reference state. The problem (a) in the Figure (1) corresponds to a particular loading case, called 'unjacketed' loading case, where an isotropic stress and a pore pressure of equal magnitudes are simultaneously applied to a volume element. This loading is as if the sample is submerged, without a jacket, in a fluid under pressure and results in a uniform pressure distribution in the solid phase. In the case of an ideal porous material, the material would deform as if all the pores were filled with the solid component and the skeleton and the solid component experience a uniform volumetric strain (Detournay and Cheng, 1993). The problem (b) in the Figure (1) corresponds to Terzaghi effective stress loading. In this case the isotropic stress acting on the solid phase is ( ) ( )

s n s n V V V V V V ∆ ∆ ∆ = = (1)
0 0 f n V c u - ∆ ( ) 0 0 1 s n V c u -- ∆ 0 s V c u - ∆ (b) - ( ) 0 s V c u σ - ∆ -∆ ( ) 0 d V c u σ - ∆ -∆ (c) 0 0 f n V T α ∆ ( ) 0 0 1 s n V T α - ∆ 0 s V T α ∆
0 1 u n σ ∆ -∆ -
and the corresponding variation of volume is given by: ( )

0 0 0 0 (1 ) 1 s s s u V n V c V c u n σ σ ∆ -∆ ∆ = -- = - ∆ -∆ - (2)
The problem (c) in the Figure ( 1) is a drained thermal loading under constant total stress. For an ideal porous material, the variations of volume of the porous element and also one of the pore volume are characterized by the thermal expansion coefficient of the solid phase s α , because an isotropic thermal expansion would cause a proportional change in every linear dimension of the body [START_REF] Mctigue | Thermoelastic response of fluid-saturated porous rock[END_REF].

Assuming incremental linear thermo-elasticity, the volumetric strain of the element v ε (positive in contraction) is obtained as the sum of the variations of volume in the three sub-problems per unit total volume (in reference state):

( )

0 v s d s V c u c u T V ε σ α ∆ = - = ∆ + ∆ -∆ -∆ (3)
The variation of the porosity n , can be written as the difference between the volume change of the element and the volume change of the solid phase:

( ) ( ) ( ) ( ) 0 0 0 1 1 s s d s s s s V V n c u c u T V n c u c u n T σ α σ α ∆ -∆ ∆ = = -∆ - ∆ -∆ + ∆    --- ∆ -∆ -∆ + - ∆    (4)
Equation ( 4) can be simplified to obtain the following expression for the elastic change of porosity in drained condition:

( )

0 0 d s n n n c c n c u n T σ α ∆ = - -∆ + ∆ + ∆ (5)
where n c and n α are respectively the compressibility and the volumetric thermal expansion coefficient of pore-volume defined by the following expressions:

( )

0 0 1 1 n d s c c n c n =  -+    (6) n s α α = (7)
The undrained condition is defined theoretically as a condition in which there is no change in the pore fluid mass of the material. For a saturated porous material the fluid mass variation is written as

f n f f n m V V ρ ρ ∆ = ∆ + ∆ . By setting 0 f m ∆ =
and from the definitions of the fluid compressibility and thermal expansion coefficient one obtains:

f n f f n f V c u T V ρ α ρ ∆ ∆ = - = -∆ + ∆ (8)
From the definition of the porosity and by using only the first order terms we have:

0 n n V n V n ∆ ∆ ≃ (9)
Replacing equations ( 8) and (9) in equation ( 5) the following expression is obtained for the pore pressure change due to an undrained thermo-mechanical loading.

u B T σ ∆ = ∆ + Λ ∆ ( 10
)
where B is the [START_REF] Skempton | The Pore Pressure Coefficients A and B[END_REF] coefficient:

( )

0 d s f n c c B n c c - = + ( 11
)
and Λ is the coefficient of thermal pressurization, as presented by [START_REF] Rice | Heating and weakening of faults during earthquake slip[END_REF]:

f n f n c c α α - Λ = + (12)
Equation ( 12) clearly highlights that the discrepancy between the thermal expansion of the pore fluid and that of the pore volume is the factor causing the thermal pressurization of porous materials.

By replacing u ∆ in equation ( 3) with the expression given in equation ( 10), one finds the following expression for the volumetric deformation of a porous material subjected to a thermo-mechanical loading in undrained condition:

v u u c T ε σ α = ∆ -∆ (13)
where u c and u α are respectively the undrained compressibility and the undrained volumetric thermal expansion coefficient of porous material expressed by the following equations:

( )

u d d s c c B c c = - - (14) ( ) u s d s c c α α = + Λ - ( 15
)
Using the equations ( 11) and ( 12) the expression of the undrained thermal expansion coefficient of a thermo-elastic porous material given by [START_REF] Mctigue | Thermoelastic response of fluid-saturated porous rock[END_REF] is retrieved.

( )

0 u s f s Bn α α α α = + - (16)

Effect of non-elastic strains

The above framework can be extended to account for the effect of non-elastic strains. These strains can be plastic, viscoelastic or viscoplastic and induce non-elastic porosity changes. The non-elastic changes of the total volume, pore volume and solid volume are defined by: ;

;

ne e ne e ne e n n n s s s V V V V V V V V V ∆ = ∆ -∆ ∆ = ∆ -∆ ∆ = ∆ -∆ (17)
The equation (3) can be re-written with the additional contribution of the non-elastic volume changes:

( )

0 ne v s d s v V c u c u T V ε σ α ε ∆ = - = ∆ + ∆ -∆ -∆ + (18)
In the same way, equation ( 5) can be re-written taking into account the non-elastic variation of the porosity ne n ∆ :

( )

0 0 ne d s n n n c c n c u n T n σ α ∆ = - -∆ + ∆ + ∆ + ∆ (19)
The non-elastic variation of porosity ne n ∆ can be calculated from the definition of the porosity and

knowing that n s V V V = -. 0 0 (1 ) ne ne ne ne n v s V n n V ε ε ∆ ∆ = = -+ - (20)
Using equations ( 8), ( 9) and (20) in equation ( 19) the following relation is obtained for the variations pore pressure with the confining pressure and temperature in undrained condition, in presence of nonelastic volume changes:

( ) ( ) 0 0 1 ne ne v s f n n u B T n c c ε ε σ -- ∆ = ∆ + Λ∆ + + (21)
Equation ( 21) shows that non-elastic volume changes add an additional term in the generated pore pressure. The contracting volume changes, like in the case of thermal collapse of normally consolidated clays, will induce a pore pressure increase, while the dilating volume changes, as for example in the case of damage of fault walls, will induce a pore pressure reduction. In the case of a material for which the solid phase is elastic ( 0 ne s ε = ), equation ( 21) can be rewritten as:

( )

0 ne v f n u B T n c c ε σ ∆ = ∆ + Λ∆ + + (22)

Evaluation of thermal pressurization coefficient

The thermal pressurization coefficient can be evaluated indirectly using equation ( 12) by knowing the thermoelastic properties of the material and the physical properties of the pore fluid. The thermal expansion coefficient and the compressibility of water are known as functions of temperature and pore pressure [START_REF] Spang | Excel Add-In for Properties of Water and Steam in SI-Units[END_REF]. Figure ( 2) present the variations of the thermal expansion coefficient and the compressibility of water for temperature between 10°C and 90°C and pore pressures between 1 MPa and 60 MPa [START_REF] Spang | Excel Add-In for Properties of Water and Steam in SI-Units[END_REF]. One can see that the variation of the thermal expansion coefficient with temperature is very important and have a significant effect on the evaluation of the thermal pressurization coefficient. For evaluation of the thermal pressurization coefficient, the pore volume compressibility n c should be evaluated using equation ( 6). The drained compressibility of the material should be known from the results of drained compression tests. In the case of a simple porous material which is constituted of one single solid component, the compressibility s c is equal to the compressibility of the solid component. Table 2 presents the bulk moduli of some commonly observed minerals. In the case of a porous material which is constituted of several solid components, the unjacketed compressibility s c can be estimated by knowing the mineralogy of the rock and the compressibility of each constituent.

The homogenized unjacketed modulus can be evaluated using [START_REF] Hill | The elastic behavior of crystalline aggregate[END_REF] average formula which is simply the mid-sum of the Voigt (upper) and Reuss (lower) bounds:

( ) ( ) 1 hom 1 2 i i s i s i s f K f K K -       = +           ∑ ∑ (23)
where i f and ( ) i s K are the volume fraction and the compression modulus of the i th constituent respectively.

Mineral

Quartz Calcite Dolomite Feldspars Clay minerals Bulk modulus (GPa) 38 ( 1) 73 ( 1) 95 ( 1) 69 ( 1) 50 (3) Volumetric thermal expansion (×10 -6 (°C) -1 ) 24.3 (2) 33.4 (4) 3.8 (2) 22.8 (2) 8.9-15.6 ( 2) 34 ( 3)

(1) Bass (1995) , ( 2) Fei (1995) , (3) McTigue ( 1986) , ( 4) [START_REF] Palciauskas | Characterization of drained and undrained response of thermally loaded repository rocks[END_REF] Table

2: Bulk modulus and volumetric thermal expansion coefficient of some minerals

When the porous material is constituted of a single solid component, the pore volume thermal expansion coefficient n α is equal to the thermal expansion coefficient of the solid component. Some typical values of volumetric thermal expansion coefficient of minerals are presented in Table (2). For a porous material which is constituted of several solid components, the homogenized coefficient of thermal expansion of the solid phase s α can also be evaluated using homogenisation theory, knowing the mineralogy of the rock and the thermal expansion coefficients of its constituents. The following equation can be used to calculate the average thermal expansion coefficient of a two phase linear thermo-elastic composite material [START_REF] Berryman | Mixture Theories for Rock Properties, in Rock physics & phase relations: A Handbook of Physical Constants[END_REF][START_REF] Zaoui | Matériaux hétérogènes et composites[END_REF]:

( ) ( ) ( ) ( ) 1 2 hom 1 2 hom (1) (2) ( 2) (1) 1 2 (2) (1) 1 1 1 s s s s s s s s s s f f K K K f f K K α α α α α   - +       = + + - - (24)
where ( ) i s α is the thermal expansion coefficient of the i th constituent. The other parameters are introduced before in equation ( 23). A uniform temperature variation imposed on a heterogeneous material induces residual thermal stresses due to thermal expansion mismatch between the different phases. This effect is reflected in the second term of the left-hand side of equation ( 24) as the compressibility of the constituents and of the composite material affects its thermal expansion.

Laboratory testing

The experimental evaluation of thermal pressurization coefficient can be performed in an undrained heating test. In a triaxial cell, this test is performed on a fully saturated sample under a constant confining pressure. During the test the temperature is varied at a constant rate or in several steps and the resulting pore pressure change is recorded. The effective stress is thus changing during the test. If the compressibility of the porous material is stress-dependent, the evaluated thermal pressurization coefficient will be influenced by changes of effective stress.

The undrained condition is defined theoretically as a condition in which there is no change in the fluid mass of the porous material. For performing an undrained test in the laboratory, this condition cannot be achieved just by closing the valves of the drainage system as it is done classically in a conventional triaxial system (Figure ( 3)). In a triaxial cell, the tested sample is connected to the drainage system of the cell and also to the pore pressure transducer. As the drainage system has a non-zero volume filled with fluid, it experiences volume changes due to its compressibility and its thermal expansivity. The variations of the volume of the drainage system and of the fluid filling the drainage system induce a fluid flow into or out of the sample to achieve pressure equilibrium between the sample and the drainage system. This fluid mass exchanged between the sample and the drainage system modifies the measured pore pressure and consequently the measured strains during the test. [START_REF] Wissa | Pore pressure measurement in saturated stiff soils[END_REF] was the first who studied this problem for a mechanical undrained loading. He presented an expression for the measured pore pressure increase as a function of the compressibilities of porewater, soil skeleton, pore-water lines and pressure measurement system, but the compressibility of the solid phase was not considered in his work. [START_REF] Bishop | The influence of system compressibility on the observed pore pressure response to an undrained change in stress in saturated rock[END_REF] presented an extension of the work of [START_REF] Wissa | Pore pressure measurement in saturated stiff soils[END_REF] taking into account the compressibility of the solid grains. The proposed method was first used by [START_REF] Mesri | Pore-pressure response in rock to undrained change in allaround stress[END_REF] to correct the measured pore pressure in undrained isotropic compression tests. Ghabezloo and Sulem (2009a) have presented an extension to the work of [START_REF] Bishop | The influence of system compressibility on the observed pore pressure response to an undrained change in stress in saturated rock[END_REF] to correct the pore pressure measured during undrained heating and cooling tests by taking into account the thermal expansion of the drainage system, the inhomogeneous temperature distribution in the drainage system and also the thermal expansion of the fluid filling the drainage system. The proposed method was applied to the results of undrained heating tests performed on Rothbach sandstone (Ghabezloo and Sulem, 2009a) and on a hardened cement paste (Ghabezloo et al., 2009).

The correction method was then extended for the correction of the measured strains and consequently the correction of the measured undrained thermal expansion coefficient in Ghabezloo and Sulem (2009b). This correction method is summarized in the following section.

Correction of the effect of drainage system

In a triaxial cell the tested sample is connected to the drainage system of the cell and the undrained condition is achieved by closing the valves of this system (Figure ( 3)). Consequently, the condition 0 f m ∆ = is applied to the total volume of the fluid which fills the pore volume of the sample and also the drainage system:

f n f L fL m V V ρ ρ = + (25)
where L V is the volume of the drainage system and fL ρ is the density of the fluid in the drainage system. As the sample and the drainage system may have different temperatures and considering that the fluid density varies with temperature, different densities are considered for the pore-fluid of the sample and for the fluid filling the drainage system. The variation of volume of the drainage system can be written in the following form:

L L L L L L V c u T V α κ σ ∆ = ∆ + ∆ -∆ (26)
where L T ∆ is the equivalent temperature change in the drainage system, L c and L κ are isothermal compressibilities and L α is the thermal expansion coefficient of the drainage system defined as:

, 1 L L L T L V c V u σ ∂   =   ∂   (27) , 1 L L L L u V V T σ α   ∂ =   ∂   (28) , 1 L L L u T L V V κ σ ∂   = -  ∂   (29)
The parameter L c is equivalent to ( ) [START_REF] Wissa | Pore pressure measurement in saturated stiff soils[END_REF] and [START_REF] Bishop | The influence of system compressibility on the observed pore pressure response to an undrained change in stress in saturated rock[END_REF]. Based on the data provided by these authors, some typical values of L c can be evaluated which vary between 0.008 GPa - 1 and 0.16 GPa -1 . It should be mentioned that the parameters L c and L α defined in equations ( 27) and ( 28) are equivalent respectively to L L c V and L L V α in Ghabezloo and Sulem (2009a).

L M L c c V + in
In most triaxial devices, the drainage system can be separated into two parts: one situated inside the ( )

fL n L f f fL L fL L L n n f V V c u T c u c u T T V V ρ α α β α β κ σ ρ ∆ = -∆ + ∆ + -∆ -∆ + ∆ - ∆ + ∆ (31)
As the thermal expansion coefficient and the compressibility of the pore fluid both vary with temperature, the parameters used for the fluid in the drainage system, fL ( )

( ) ( ) 0 0 0 fL L d s L f mes fL L f n fL L f V c c V B V n c c c c V ρ κ ρ ρ ρ - + = + + + (32) ( ) ( ) ( ) ( ) 0 0 0 0 fL L f n fL L f mes fL L f n fL L f V n V V n c c c c V ρ α α β α α ρ ρ ρ - + - Λ = + + + (33)
The comparison of the equations ( 32) and ( 33) respectively with equations ( 11) and ( 12) shows the effect of the drainage system of the triaxial cell on the measured coefficients. Using equations ( 32), ( 11) and ( 14) the expressions of the corrected Skempton coefficient cor B and the corrected undrained bulk compressibility cor u c are found:

( ) ( ) 0 1 mes cor L fL mes L fL L f d s B B V B c c V c c ρ κ ρ =   + - +   - (34) ( ) ( ) 0 1 mes cor d u u d mes L fL d u L fL L f d s d s c c c c V c c c c V c c c c ρ κ ρ - = -   - + - +   - -   (35)
Similarly using equations ( 33), ( 12) and ( 15) the following expressions are obtained for the corrected thermal pressurization coefficient cor Λ and the corrected undrained thermal expansion coefficient

cor u α : ( ) ( ) ( ) 0 0 1 mes cor L fL mes fL L fL L f f n V c c n V ρ β α α ρ α α Λ Λ =   + - -Λ +   - (36) ) ( ) ( ) 0 0 1 mes cor u d u d L fL fL L mes fL L u d d s f f n V c c c c n V α α α α ρ β α α α α ρ α α - = + +   + - - -   - -   (37)
Equation ( 34) is similar to the one presented by [START_REF] Bishop | The influence of system compressibility on the observed pore pressure response to an undrained change in stress in saturated rock[END_REF], but differs in two points. The first one is that Bishop did not account for the influence of the confining pressure on the dead volume of the drainage system. This effect appears in equation ( 34) through the parameter L

κ . The second one is that Bishop assumed equal densities and compressibilities for the sample's pore fluid and the fluid in the drainage system, which is a correct assumption for an isothermal undrained test performed at ambient temperature. The same assumption is also made by Ghabezloo and Sulem (2009a). For an isothermal undrained test performed at an elevated temperature, the situation depends on the heating system of the triaxial cell. If the heating system is such that the temperature change is uniform in the sample and in the drainage system, the assumption of similar properties for the sample's pore fluid and the fluid in the drainage system can be used. Otherwise, as shown in Figure (3), the sample temperature is different from the average temperature in the drainage system so that different properties should be considered for the sample's pore fluid and the fluid in the drainage system.

The correction method proposed here in equations ( 34) and ( 35) is applied directly on the results of the test, but it is restricted to an elastic response of the sample and of the drainage system. It differs from the method proposed by [START_REF] Lockner | Undrained poroelastic response of sandstones to deviatoric stress change[END_REF] who have modified the procedure of the test itself by imposing a computer-generated virtual 'no-flow boundary condition' at the sample-endplug interface to insure that no volume change occurs in the drainage system.

Calibration of the correction parameters

The drainage system is composed of all the parts of the system which are connected to the pore volume of the sample and filled with the fluid, including pipes, pore pressure transducers, porous stones. The volume of fluid in the drainage system L V , can be measured directly or evaluated by using the geometrical dimensions of the drainage system. For the triaxial cell used in the present study, the volume of the drainage system was measured directly using a pressure/volume controller. As can be seen in Figure (3), the drainage system has two main parts: one connected to the top and the other connected to the bottom of the sample. Before performing the measurement, the drainage system was emptied using compressed air and then each part was connected to the pressure/volume controller keeping the valve of the drainage system closed. The connection pipe between the pressure/volume controller and the drainage system was filled with water. Then a small pressure was applied by the pressure/volume controller and its volume was set to zero before opening the valve of the drainage system. By opening the valve, the fluid flows into the drainage system. As soon as the first drop of the fluid flows out of the porous stone, the pressure/volume controller is stopped and the volume of the fluid which has filled the corresponding part of the drainage system is directly given by the volume change of the pressure/volume controller. The measurement was repeated for each part of the drainage system and the total volume of the drainage system was evaluated equal to 3 2300 mm

L V = .
The compressibility of the drainage and pressure measurement systems L c is evaluated by applying a fluid pressure and by measuring the corresponding volume change in the pressure/volume controller.

A metallic sample is installed inside the cell to prevent the fluid to go out from the drainage system.

Fluid mass conservation is written in the following equation which is used to calculate the compressibility L c of the drainage system:

( )

L L fL L V c c u V ∆ = + ∆ (
1 2 1 2 L L L L L L L V V c c c V V = + (39)
The estimated value is

-1 0.117GPa L c =
. This is equivalent to the compressibility that can be obtained in a single measurement in which the pressure/volume controller is connected simultaneously to the both parts of the drainage system using a T-connection.

The parameter β and the thermal expansivity of the drainage system L α are evaluated using the results of an undrained heating test performed using a metallic sample with the measurement of the fluid pressure change in the drainage system. For the metallic sample 0 0 n = and d s c c = so that equation ( 33) is reduced to the following equation:

( ) fL L mes fL L c c β α α - Λ = + ( 40
)
The thermal expansion coefficient fL The evaluation of the compressibility L κ which represents the effect of the confining pressure on the volume of the drainage system is performed using an analytical method. As can be seen in Figure (3), only a part of the drainage system which is the pipe connected to the top of the sample, is influenced by the confining pressure. The effect of the confining pressure on the variations of the volume of this pipe can be evaluated using the elastic solution of the radial displacement of a hollow cylinder.

Considering a hollow cylinder with inner radius a and outer radius b and radial stresses i p and o p , respectively at the inner and outer boundaries, the following expression is obtained for the compressibility L κ using the well-known Lamé solution:

( ) ( )

2 2 2 2 2 4 1 L L a b L b a V E π ν κ - = - ( 41
)
where E and ν are respectively Young's modulus and Poisson's coefficient and L is the length of the pipe. The details of the derivation are presented in Ghabezloo and Sulem (2009b). For the pressure variations on the volume of the drainage system. This is due to the fact that only a small part of the drainage system, less than 8% of its volume, is influenced by the confining pressure.

considered pipe 0.25mm a = , 0.8mm b = , 900mm L = , 190GPa E

Parametric study of measurement error

In this section, a parametric study on the error made on the measurement of the thermal pressurization coefficient and the undrained thermal expansion coefficient is presented. A similar parametric study for Skempton coefficient and the undrained compressibility is presented in Ghabezloo and Sulem (2009b). The error on a quantity Q is evaluated as ( )

measured real real Q Q Q -
and takes positive or negative values with indicates if the measurement overestimates or underestimates the considered quantity. As shown in the following, among the different parameters appearing in equations ( 36) and

(37), the porosity 0 n of the tested material, its drained compressibility d c and the ratio of the volume of the drainage system to the one of the tested sample, 0 L V V are the most influent parameters. For this parametric study the parameters of the drainage system are taken equal to the ones of the triaxial system used in this study, as presented in section 4.2. We take also V V . Three different values of the drained compressibility are considered, respectively equal to 0.03GPa -1 , 0.1GPa -1 and 0.5GPa -1 , which covers a range from a rock with a low compressibility to a relatively highly compressible rock. The porosity is varied from 0.05 to 0.35. The ratio 0 L V V is taken equal to 0.025 which corresponds to the conditions of the triaxial system used in this study. We analyze also the effect of a greater volume of the drainage system on the measurement errors by choosing another value twice bigger, equal to 0.05. We observe that the error of the measurement for Λ varies between -40% and +10%, which shows that the measured value may be smaller or greater than the real one. Considering the tested material, the measurement error is more significant for low-porosity rocks with low-compressibility. We can also see the significant effect of the volume of the drainage system on the measurement error. The error for the undrained thermal expansion coefficient u α varies between -6% and +4%, which is a narrower range, as compared to the thermal pressurization coefficient.

Example of an experimental study on a granular rock

An example of the experimental evaluation of undrained thermoelastic parameters and of the application of the correction method is presented for an undrained heating test performed on a fluidsaturated granular rock, Rothbach sandstone. The rock has a porosity of n=16% and is composed of 85% quartz, 12% feldspars and 3% clay. As can be seen in equations ( 36) and ( 37), the application of the correction method needs the knowledge of the drained and the unjacketed thermo-poro-elastic parameters of the tested material. The required parameters are evaluated and presented by Ghabezloo and Sulem (2009a). The laboratory experiments are performed on cylindrical sample with a diameter of 40mm and a height of 80mm. The volume of the sample is thus

Experimental setting

The triaxial cell used in this study can sustain a confining pressure up to 60MPa. It contains a system of hydraulic self-compensated piston. The loading piston is then equilibrated during the confining pressure build up and directly applies the deviatoric stress. The axial and radial strains are measured directly on the sample inside the cell with two axial transducers and four radial ones of LVDT type.

The confining pressure is applied by a servo controlled high pressure generator. Hydraulic oil is used as confining fluid. The pore pressure is applied by another servo-controlled pressure generator with possible control of pore volume or pore pressure.

The heating system consists of a heating belt around the cell which can apply a temperature change with a given rate and regulate the temperature, and a thermocouple which measures the temperature of the heater. In order to limit the temperature loss, an insulation layer is inserted between the heater element and the external wall of the cell. A second insulation element is also installed beneath the cell.

The heating system heats the confining oil and the sample is heated consequently. Therefore there is a discrepancy between the temperature of the heating element in the exterior part of the cell and that of the sample. In order to control the temperature in the centre of the cell, a second thermocouple is placed at the vicinity of sample. The temperature given by this transducer is considered as the sample temperature in the analysis of the test results. A schematic view of this triaxial cell is presented in Ghabezloo and Sulem (2009a) and [START_REF] Sulem | Hydromechanical Behaviour of Fontainebleau Sandstone[END_REF].

Drained heating test

In order to measure the drained thermal expansion coefficient of the rock, a drained heating test (see sub-problem (c) in Figure ( 1)) was carried out under a constant confining pressure. The initial temperature of the performed drained heating test was 21°C. The confining pressure and the pore water pressure during the test were maintained constant at 2.5 MPa and 1.0 MPa respectively. The drained thermal expansion coefficient is the slope of the temperature-volumetric strain response and is evaluated as 6)). The coefficient of thermal expansion can also be evaluated indirectly using homogenisation theory, knowing the mineralogy of the rock and the thermal expansion coefficients of its constituents, as presented in equation ( 24). In order to evaluate the thermal expansion coefficient from this equation, we need first to evaluate the solid phase bulk modulus s K using equation (23 and thermal expansion of the pore water. More details about the mechanism governing this non-linear behaviour can be found in Ghabezloo and Sulem (2009a). At the beginning of the test the volumetric strain could not be recorded due to a failure of the displacement sensors inside the triaxial cell.

( ) 1 6 28 10 °C - - × (Figure (
Therefore the volumetric strain-temperature curve, presented in The test results are corrected using equations ( 36) and (37) for the effect of the dead volume of the drainage system. At each data point the relevant thermal expansion and compressibility of water are used as a function of the current pore pressure and temperature [START_REF] Spang | Excel Add-In for Properties of Water and Steam in SI-Units[END_REF]. The drained compressibility is also calculated at each point as a function of Terzaghi effective stress (equation ( 42)

). The variation of the mechanical properties of the sandstone with temperature is neglected in the analysis. It should be mentioned that the very good compatibility obtained by Ghabezloo and Sulem (2009a) between the results of an analytical simulation of this test and the experimental results showed the negligible effect of this assumption. The corrected values of the pore pressure, thermal pressurization coefficient, volumetric strain and undrained thermal expansion coefficient are presented along with the measured values respectively on Figures ( 7) and ( 8). The corrected pore pressure and thermal pressurization coefficient are bigger than the measured values. The corrected volumetric strain and undrained thermal expansion coefficient are slightly smaller than the measured values, but the average difference between the corrected and measured curves is about 1%. As can be seen in equations ( 36) and ( 37), apart from the properties of the drainage system, the correction depends also on the measured values of thermal pressurization coefficient and undrained thermal expansion coefficient. For the same triaxial cell, the correction of the observed pore pressure during an undrained heating test performed on a hardened cement paste (Ghabezloo et al. 2009) is more important than the one obtained here for Rothbach sandstone.

Using the non-linear elastic model presented in equation ( 42 and is bigger for higher temperatures and smaller effective stresses. This strong nonlinearity of the thermal response of the rock in undrained condition is mainly due to the variations of the thermal expansion and the compressibility of water with temperature and pore pressure. Moreover, the stress dependency of the compressibility of the material has important consequences on its thermal response in undrained condition.

Conclusion

The theoretical basis of the thermal response of the fluid-saturated porous materials in undrained condition is presented. The temperature increase in undrained condition leads to the pore pressure increase and deformation of the material. It has been demonstrated that the thermal pressurization phenomenon is controlled, on one hand by the discrepancy between the thermal behaviour of the pore fluid and of the solid phase, and on the other hand by the compressibility of the pore volume. The strong influence of temperature and stress on thermal pressurization of rocks is explained by the effect of temperature and pressure on the physical properties of water and by the stress-dependent character of the compressibility of porous rocks. Moreover, the important effect of the non-elastic strains of the material on the variations of the pore pressure has been also demonstrated. These non-elastic volume changes induce a pore pressure increase when they are contracting, while the dilating volume changes induce a pore pressure reduction.

For evaluation of the undrained thermo-poro-elastic properties of saturated porous materials in conventional triaxial cells, it is important to take into account the effect of the dead volume of the drainage system. The compressibility and the thermal expansion of the drainage system along with the dead volume of the fluid filling this system, influence the measured pore pressure and volumetric strain during an undrained thermal or mechanical loading in a triaxial cell. A simple correction method is presented to correct the measured pore pressure change and also the measured volumetric strain and consequently the evaluated thermal pressurization and undrained thermal expansion coefficients during an undrained heating test. A parametric study has demonstrated that the porosity of the tested material, its drained compressibility d c and the ratio of the volume of the drainage system to the one of the tested sample, 0 L V V are the key parameters which influence the most the error induced on the measurements by the drainage system. It has also shown that the measurement of thermal pressurization coefficient is much more affected than the measurement of the undrained thermal expansion coefficient.

  σ ∆ , T ∆ and u ∆ are the variations of the mean stress (positive in compression), the temperature and the pore pressure respectively. d c and s c are respectively the drained compressibility of the porous material and the compressibility of the solid phase. s α is the volumetric thermal expansion coefficient of the solid phase and f c and f α are respectively the compressibility and the thermal expansion coefficient of the pore fluid. The index 0 denotes the reference state.

Figure 1 :

 1 Figure 1: Decomposition of the problem of a thermo-mechanical loading into three independent problems

Figure 2 :

 2 Figure 2: Variation of the physical properties of water with temperature and pressure (a) thermal expansion coefficient, (b) compressibility

Figure 3 -

 3 Figure 3-Schematic view of a conventional triaxial cell

  triaxial cell and the other one situated outside the cell. In the part inside the cell, one can assume that the temperature change T ∆ is identical to the one of the sample; in the other part situated outside the cell, the temperature change is smaller than T ∆ and varies along the drainage lines. We define an equivalent homogeneous temperature change L T ∆ such that the volume change of the entire drainage system caused by L T ∆ is equal to the volume change induced by the true non-homogeneous temperature field.The temperature ratio β is an additional parameter which is defined below and evaluated on a calibration test as explained further: using equation (26) and taking into account the variations of the fluid density with pore pressure and temperature changes, the following expression is obtained for the variations of the pore volume of the tested sample:

  for the pore fluid of the porous material. Replacing equations (31) and (9) in equation (5) the expressions of the measured Skempton coefficient and thermal pressurization coefficient, mes B and mes Λ are obtained.

  applied pore pressure and the volume change measured by the pressure/volume controller. For a single measurement, the volume change L V ∆ accounts also for the compressibility of the pressure/volume controller and of the lines used to connect the pressure/volume controller to the main drainage system. To exclude the compressibility of these parts, a second measurement is done only on the pressure/volume controller and the connecting lines. The volume change L V ∆ used in equation (38) is the difference between these two measurements. The measurements were performed separately for the two parts of the drainage system with volume 1 respectively. The compressibility of the entire system L c is simply obtained as the weighted average of the compressibilities of each part ( 1 L c and 2 L c respectively):

α

  and the compressibility fL c of water are known as functions of temperature and fluid pressure. As these variations are highly non-linear, the parameters β and L α cannot be evaluated directly but are back analysed from the calibration test results: the undrained heating test of the metallic sample is simulated analytically using equation (40) with a step by step increase of the temperature. For each step the corresponding water thermal expansion and compressibility are used (Spang 2002). The parameters β and L α are back-calculated by minimizing the error between the measurements and the computed results using a least-square algorithm. The test result and the back analysis are presented in Figure (4). The parameter β is found equal to 0.46 and the thermal expansion coefficient of the drainage system L α for this test is found equal to 1.57×10 -4(°C) -1 .

Figure 4 -

 4 Figure 4-Calibration test for the evaluation of the temperature ratio β and the thermal expansion L α of the drainage system-comparison.

  account the effect of the pore

  values for minerals. Figure (5) present the error on the measurements of the thermal pressurization coefficient Λ and of the undrained thermal expansion coefficient u α as a function of the sample porosity 0 n , for three different values of drained compressibility and two different values of the ratio 0 L

Figure 5 -

 5 Figure 5-Parametric study of the error on (a) the thermal pressurization coefficient Λ , (b) the undrained thermal expansion coefficient u α

  of the drainage system evaluated to 2300mm 3 is thus 14% of the volume of the porous space.The unjacketed modulus 1s s K c =of the rock was evaluated in an unjacketed compression test and found equal to 41.6 GPa. A drained isotropic compression test was performed with a loading-unloading cycle and the tangent drained bulk modulus 1

  of clay in Rothbach sandstone, the equation (24) can be used to calculate the homogenized thermal expansion coefficient of solid grains by neglecting this part and taking into account only quartz and feldspar minerals. Using the given parameters and the hom s K calculated with equation (23), the thermal expansion coefficient of Rothbach sandstone is found equal to This value is in very good accordance with the measured thermal expansion coefficient equal to

Figure 6 -

 6 Figure 6-Drained heating test on Rothbach sandstone: Volumetric strain response

  Figure (8a), only starts from 40°C.The slope of this curve gives the undrained thermal expansion coefficient and is presented in Figure(8b) as a function of the temperature increase. We can see the increase of this coefficient with temperature which is mostly due to the significant increase of the thermal expansion coefficient of the water with temperature.

Figure 7 -Figure 8 -

 78 Figure 7-Undrained heating test on Rothbach sandstone: (a) Measured and corrected pore pressure response, (b) Measured and corrected thermal pressurization coefficient

  ), the measured values of s α and s c and knowing the compressibility and thermal expansion coefficient of water as functions of temperature and pore pressure, we can evaluate the thermal pressurization coefficient Λ and the undrained thermal expansion coefficient of Rothbach sandstone as a function of temperature and effective stress, using equations (12) and (15). The calculated coefficients Λ and u α are presented on Figure (9) as a function of the effective stress up to 15 MPa and for different temperatures from 20°C to 90°C. The results show clearly the (effective) stress and temperature dependent character of the thermal pressurization coefficient and the undrained thermal expansion coefficient. The stress-dependency is significant in the range of stress-dependency of the rock compressibility (up to 9 MPa). The values of the coefficient Λ vary from 0.02 to 0.72 MPa/°C depending on the effective stress and the temperature. The value of undrained thermal expansion coefficient u

Figure 9 :

 9 Figure 9: Effect of effective stress and temperature on (a) the thermal pressurization coefficient, (b) the undrained thermal expansion coefficient of Rothbach sandstone

Table 1 : Variation of volume of the porous material and its constituents for the three independent problems presented in Figure (1)

 1

  ). As mentioned above, the Rothbach sandstone contains 85% quartz, 12% feldspars and 3% clay. The values of elastic properties of different minerals are presented inTable (2). The compression modulus of quartz and the average compression modulus of feldspars are equal to 37.8 and 69.1 GPa respectively. The compression modulus of the clay solid grains is equal to 50 GPa. Using equation (23) the homogenized unjacketed modulus of Rothbach sandstone is evaluated equal to 41.1 GPa which is very close to the experimentally measured value, equal to 41.6 GPa. From Table(2) the thermal expansion coefficient of quartz is equal to

An example of the experimental evaluation of undrained thermoelastic parameters and of the application of the correction method is presented for an undrained heating test performed on a fluidsaturated granular rock. The experimental results show the strong non-linearity of the thermal response of the rock in undrained condition. This non-linearity is mainly due to the variations of the thermal expansion and the compressibility of water with temperature and pore pressure. Moreover, the stress dependency of the compressibility of the material has important consequences on its thermal response in undrained condition.

Acknowledgments

The authors wish to thank François Martineau for his assistance in the experimental work.