Julien A Thomas
email: julien.thomas@telecom-bretagne.eu

Environmental Constraints Management in Digital Right Licences

Keywords: Environmental Constraints, Certifications, Digital Right Management, Licences

In the past years, Digital Rights Management (DRM) has been used in order to control media's resources usage, for instance for the consumers. Several proposals have been made in order to define what kind of controls one could apply and how to apply them. It has also been proposed more recently to use DRM mechanisms in the enterprises (EDRM), not to control media's resources usage but to protect the enterprise resources. However, current studies about EDRM do not take into account an important aspect of the enterprises security information: the environment. In this article, we will define a framework to express environmental constraints based licences and to evaluate them. Examples will be given to show that the environment can be used to define more expressive licences and to apply better security policies for DRM based solutions.

Introduction

In the past years, Digital Rights Management (DRM) has been used in order to control media's resources usage with immediate applications in the industry and the well known worldwide controversy it has provoked. In order to apply this notion of rights to contents, several proposals have been made in order to define what kind of controls a provider could apply and how to apply them. These proposals rely on licences, which define who is able to do what on what under which circumstances. Among them, MPEG-REL [START_REF]Information Technology -Multimedia Framework (MPEG REL) -Part 5: Rights Expression Language[END_REF] (previously XrML) and OMA-DRM [START_REF]ODRL Initiative. Open Digital Rights Language (ODRL)[END_REF] (previously ODRL) are the most famous proposals. More recently, several attempts [AH07, DSG + 04] have been made to adapt this notion of content controls for the enterprises, not to control media's resources usage but to control and protect the enterprises' resources.

However, an important aspect of the enterprises security information has not been taken into account: the environment. Many organizations tend to pass certifications with respect to governmental laws such as Sarbanes-Oxley, HIPAA or governmental requirements such as PRIS [START_REF] Sgdn Dcssi Adae | Politique de référencement intersectorielle de sécuritéservice de signature -politique de certification type[END_REF] (France), the Department of Defense Architecture Framework [START_REF]DoD Architecture Framework[END_REF] (United States) and the Ministry of Defense Architecture Framework [START_REF] Modaf Partners | MOD Architectural Framework[END_REF] (United Kingdom). These documents provide a guide to define a way to manage efficiently sensitive information and to assess that organizational processes are well defined.

Based on these certifications, organizations can for instance assess that the DRMrendering applications are based on a Trusted Computing Base (TCB) [START_REF] Butler Lampson | Authentication in distributed systems: Theory and practice[END_REF] or that the user identity is provided by an identity provider compliant with the French security requirements described in PRIS. Such assessments can be used to evaluate the security of the end-user environment. We thus argue that environmental information can be used to define more expressive DRM controls and apply better security policies inside DRM based solutions.

Our article is organized as follows. In section 1, we present basic notions such as certifications and environmental information. We also present existing DRM systems and their lack of expressivity for EDRM purposes. In section 2, we describe our environmental constraints management proposal, with formal models and evaluation principles. We also introduce with an example how our proposal can be introduced into existing DRM standards (XML-based), as an extension of the existing constraints. In section 3, we introduce the implementation of our environmental constraints management process.

1 Related Works

Environmental Constraints

We claim that environmental constraints describe environment aspects that may impact the security and thus have to be expressed in DRM licences. In this section, we describe several environmental notions mentionned in the literature.

The Analog Hole [START_REF]Content Protection Status Report I, II & III[END_REF][START_REF] Sensenbrenner | Digital Transition Content Security Act of 2005[END_REF] has been introduced in 2002 in a federal court of the US by the Motion Picture Association of America [START_REF]Content Protection Status Report I, II & III[END_REF]. Also named analog reconversion issue, it describes an issue that DRM-based solution still have to face: the operations that are not computer-based and thus not controllable with DRM-based mechanisms. For instance, no DRM-solution can counter the operation that consists in hand-writing the content that one is reading and then mailing it. This issue into account has been an important challenge (e.g. the Digital Transition Content Security Act of 2005 [START_REF] Sensenbrenner | Digital Transition Content Security Act of 2005[END_REF])

The execution environment is also a point to take into account for security enhancement purposes. For the (E)DRM purposes, we found the following relevant information. This enumeration is an example of relevant information. In section 2, we will propose a generic and thus extensible model.

• the software environment. If the software is certified compliant with a norm N , modification-detectable or deployed on a TCB ([LABW92]), we do not put the same trust in it as when it has no certification at all. Besides, one may not have the same trust in the same software tunning on different platforms.

• the organization environment. If the organization is certified compliant with a norm N , we do not put the same trust in the DRM-based software as when the firm has no certification. For instance, it may be easier to plug the Analog Hole in a governmental organization than at home.

• the user environment. Whether the user identity is well managed (due to the enforcement of some security and quality procedures inside the organization, as described for instance in the French specification PRIS [START_REF] Sgdn Dcssi Adae | Politique de référencement intersectorielle de sécuritéservice de signature -politique de certification type[END_REF] with the security level *** (the highest security level in PRIS) ) or not (such as a shared account) makes the user identity trustfully or not.

Finally, based on the asymmetric encryption and signature mechanisms (see [START_REF] Elizabeth | Cryptography and data security[END_REF] for an introduction about encryption), certifications are also important for the evaluation of the organizations environment. Nowadays, certificates have been standardized (e.g. X.509 certificates) and several international organizations are accredited to generate them. The signature principle is the core of the certification mechanism: the use of the chain principle provides a lightweight certification mechanism. For instance, it is widely used on the web (SSL certificates for web-transactions, websites identifications, ...) or for any digital certificates. In the literature, several attempts have been made to study certifications mechanisms and to model them. We can mention the ETSI model ETSI TS 11 456 [ETS02] which describes the requirements certification authorities have to meet in European countries. For instance, the French specification PRIS [START_REF] Sgdn Dcssi Adae | Politique de référencement intersectorielle de sécuritéservice de signature -politique de certification type[END_REF] is an application of the ETSI requirements for the French governmental organizations and the end-users that want to communicate with them.

Digital Rights Management Overview

(E)DRM Principles DRM Solutions are encryption based frameworks which provide a way to control who can decipher the encrypted content and for which purposes. As described in the figure 1a, the global framework can consider (at least) three parties: the content provider, which distributes the protected content, the licence provider and the rendering application with the considered user. DRM solutions provide a way to specify which interactions are possible.

In order to specify the authorizations, the content provider will define a licence, which will specify allowed interactions between the subject (i.e. the considered user) and the object (the content). The figure 1b defined1 by Parrott [START_REF] Parrott | Requirements for a rights data dictionary and rights expression language version 1.0[END_REF] shows the different components of the DRM-licences. Using our licence language model, we will be able to define specific constraints such as the considered rendering application or the end-user identity affiliation. Many proposals for licences language, called Right Expression Languages (RELs), can be found in the literature and some of them were standardized. We can mention the two most famous ones, MPEG-REL [START_REF]Information Technology -Multimedia Framework (MPEG REL) -Part 5: Rights Expression Language[END_REF] and OMA-DRM [START_REF]ODRL Initiative. Open Digital Rights Language (ODRL)[END_REF]. These two RELs are based on XML models and are used by several companies (these two standards are supported by different consortiums). Other proposals, not based on XML, have been proposed. For instance, LicenseScript [CCE + 03] is based on Prolog. OpenIPMP [START_REF] Mollis | OpenIPMP project[END_REF] and MPEG REL SDK [START_REF] Contentguard | MPEG REL SDK 1.0 for Java[END_REF] are two examples of the existing DRM projects.

More recently, it has been proposed ([AH07, DSG + 04]) to use DRM mechanisms in the enterprises, no to control media's resources usage but to control the organizations' resources usage and protect sensitive information. These solutions, named EDRM (Enterprise DRM) provide a new way to manage documents security as the documents can still be controlled even if they are not inside the companies access control perimeter anymore.

Lacks Of Expressivity of the Existing RELs

In the current right expression languages, models are used to describes the RELs expressivity. Considering models bound to the environmental constraints issues, for instance in ODRL, we found two relevant model:

• The Constraint Model specifies information such as Users, Devices or Aspects, which are obviously bound to our environmental constraints

• The Security Model supports encryption standards, for ODRL licence elements Though these models express security and environmental information, they do not take into account environmental constraints. Requirements such as «parts of the organization which are certified PRISv2 ***» can not be expressed with current RELs as the Constraints model does not take environmental information into account for the security issues.

Environmental Constraints Management

As introduced in the previous section, several concepts can be implemented in (E)DRM models to specify organization contexts. As existing RELs fail to express these contexts (see section 1.2), we present in this section our environmental constraints management model (section 2.2). We first specify in section 2.1 an environment analysis model. Using this evaluation model, which can be seen as an extension of our basic environmental constraints proposal, we obtain a more expressive environmental constraints management model. Finally, contexts evaluation and the identity control issue are presented.

Environment Analyze (Certification) Model

Information providers

The issue consists in modeling where the information about the environment come from. The end-user based evaluations and provider based evaluations, which respectively refer to performing the environmental constraints evaluations using information from the end-user and using information from the content provider, are two interesting solutions but not relevant in our case. The following two paragraphs describe why, in our case, these models fail. We then present our third-party based proposal.

End-user based evaluations irrelevance

As DRM-based software are supposed to be trusted, it may be interesting to perform local evaluations of the environment: the software analyzes the environment and then evaluates the environmental constraints. However, this approach fails for at least two reasons:

• the trust in the software depends on several conditions such as the considered platform or the user privileges. With nowadays DRM-software, we can not assure that the software are totally trustworthy: no TCB, no resilience to modifications, ...

• the evaluation of the environment requires environmental information. Even if the software is trustworthy, we can not assure that the software can obtain the required information or that these information are correct.

Provider based evaluations drawbacks A provider based evaluation is a good way to evaluate environmental information, or at least to trust the information. However, this solution implies requirements that are not required for current DRM solutions: as every constraints evaluation needs the content provider evaluations about the considered environment, the content provider has to be always available. This solution is thus incompatible with superdistribution scenarios.

Third Parties based evaluations Third parties based evaluations combine the benefits of the two previous solutions: as the licence provider and the software trust these third parties, information can be trusted and no control from the licence provider is required.

As described in FORM [START_REF] Cuppens | Form: A federated rights expression model for open drm frameworks[END_REF], a common way to generalize DRM framework is to use remote evaluations. In FORM, third parties information are used for entities identification, with the identity providers. In our solution, we use third parties information for the evaluation of the environment: accredited authorities can evaluate the environment and assure that the entities respect the specified requirements. The certificates are used by these third parties to assure that they are the issuers of the environment evaluations. Besides, it is compliant with actual applications, in which certificates and environment evaluations are provided by accredited authorities.

Certification Model

As presented in the section 1, PRIS [START_REF] Sgdn Dcssi Adae | Politique de référencement intersectorielle de sécuritéservice de signature -politique de certification type[END_REF] is a proposal made by the French government to define security requirements for governmental organizations and the end-users that want to communicate with them. In this referential, the ETSI [ETS02] proposal is used and refined, to define precise requirements about the certification authorities, such as security levels (PRIS*, ** and ***) about the cryptographic techniques they use. Thus, these two proposals provide information about certification authorities (at least the European ones) and which of their components are considered as relevant for security purposes. Based on these proposals, we define a model to express security requirements for certification authorities. By integrating this certification model in environmental constraints, we are thus able to express the accredited authorities security levels. This model describes the components of a certification authority, such as the publication service (Publication service), and associates to these components • the security level SECURITY_LEVEL of each service they provide.

• the security level OPTIONAL_LEVEL for the services that are optional, which consists in defining a security level SECURITY_LEVEL or stating that the operation is REFUSED.

• the norm SECURITY_NORM the services are compliant to, for the services that are not associated to a security level, as the certificates validation of the publication service.

Environmental Constraints Management Model

We can now define the environmental constraints. In the subsection 2.2.1, we present the grammar the environmental constraints rely on. In the other subsection, we illustrate our grammar with examples.

Environmental Constraints Expression Model

The environmental constraints expression model is used to express environmental constraints. It must let users express their requirements with a grain as fine as possible:

• constraints may be combined to express requirements such as «Constraints1 and (Constraints2 or Constraints3)». CONNECTOR allows such requirements.

• the environmental constraints model may be defined or refined. The use of environments_constraints_element allows users to extend our model.

Environmental Constraints Taxonomy

The taxonomy of the environmental constraints is a way to evaluate the expressivity of the model. We present in this section the environmentals constraints we need to express basic constraints about the entities identity and the software environment. They extend the common constraints of standardized DRM licences about the rendering application (software) and the end-user (organization environment and user environment), the subjects of our environmental constraints.

software_environment_constraint := SOFTWARE: <s_e_c> s_e_c:= "is certified " <SOFTWARE_CERT> " by " <CERT_AUTHORITY> || "id is certified " <ID_CERTIFICATION> " by " <CERT_AUTHORITY> || "id_management is certified " <ID_MGMT> " by " <CERT_AUTHORITY> organization_environment_constraint := ORGANIZATION: <o_e_c> o_e_c:= "is certified " <ORGA_NORM> " by " <CERT_AUTHORITY> || "id is certified " <ID_CERTIFICATION> " by " <CERT_AUTHORITY> || "id_management is certified " <ID_MGMT> " by " <CERT_AUTHORITY> user_environment_constraint := USER: <u_e_c> u_e_c:= "id is certified " <ID_CERTIFICATION> " by " <CERT_AUTHORITY> || "id_management is certified " <ID_MGMT> " by " <CERT_AUTHORITY> Based on the information about the environments described in section 1.1, we use the following certification values, where CERT_AUTHORITY refers to the certificaton model and the certification value CONFINED is introduced in section 2.4.

Examples

In the introduction, we have stressed the lack of expressivity of current RELs, to express environmental constraints. In this section, we present examples of new constraints that can be expressed with our model. We first present constraints about the organizations environment then about the entities identity and finally about the software environment.

Organization constraints

We can specify constraints about the organization security level, which can be abstracted by the certificates it possesses. For instance, a French organization that meets the security level PRIS *** of the PRIS [START_REF] Sgdn Dcssi Adae | Politique de référencement intersectorielle de sécuritéservice de signature -politique de certification type[END_REF] proposal is certified EAL4+ and uses RSA keys of 2048 bytes. If it behaves as a certification authority, it also satisfies other requirements such as a cryptographic module certified ELA4+ for the generation of the private keys of the certification authority and the recipients certificates.

Thus, a constraint such as «organizations that are certified PRIS ***» allows the usage of the contents in organizations that meet strong requirements. This constraint can be expressed in our model by [ORGANIZATION: is certified PRIS*** by X].

Identity constraints Current models allow the use of identity providers to identify users, software and so one and thus to express constraints such as <<id is provided by X>>. However, it is not possible to specify the identity provider security-level, such as ANY which is certified TRUSTED_LEVEL by X and the identity security.

We can now express requirements such as the unicity of the user identity with [USER: id is certified UNIQUE by X] and the security level of the identity provider with [USER: id is certified ANY by X] where we put the requirement is certified PRIS ** by Y for the certification authority X, as described in the section 2.1.2.

Software constraints

The final part of our examples concerns the software constraints. These constraints, checked for a first time before the rendering application obtains the deciphering key, can be used to trust the rendering application. For instance, the following requirements assure that the software will at least not be modified and that the superdistribution process (SUPERDISTRIB_CERTIFIED) will be respected:

([SOFTWARE:is certified UNMODIFIABLE by X] OR [SOFTWARE:is certified TCB_BASED by X]) AND [SOFTWARE:is certified SUPERDISTRIB_CERTIFIED by X]

Environmental Constraints Evaluation

The evaluation of our constraints is similar to the evaluation of any existing DRM licence: before allowing an action, the licence is evaluated to check if the action meets its requirements and constraints. In this section, we thus describe the global scheme of our evaluation, an extension of existing evaluation scheme, based on certificates evaluation.

As the environment evaluation is based on third party analyses, the evaluation of the environmental constraints consists in analyzing the certificates issued by these certification authorities. For each certificate, we have to control:

• the entity identity and the certificate recipient

• the certification and the environmental constraint requirements (e.g. TCB_BASED)

• the certificate issuer and the certification authority of the licence.

As the validity of the entity identity is checked by current DRM schemes, we do not have to implement it in our evaluation scheme. However, we must assure that the Common Name used for the identity control and the one used for the certificates evaluation are the same. This process is summarized in figure 2. We extended the standard DRM evaluation process (full arrows) with the environmental constraints evaluations. These new evaluations rely on the certificates provided by the accredited third parties and the licence information.

Software Constraints Issue

As one can specify software constraints, these constraints have also to be validated before the key is sent to the software. As mentioned previously, the organization identity must be checked too, with a trustfully process (different from the organization identity checking process, as we consider here a distribution scheme). This requirement is illustrated in the figure 2. are XML-based. In this paragraph, we thus present how our environmental constraints can be be transformed into a XML format. The evaluation of our constraints «only» requires, then, the implementation of a licence evaluation extension in current DRM tools.

Consider the following example, simplified due to space limitation: the content provider wants to be assured that the rendering application is based on a trusted computing base with the constraints [SOFTWARE: is certified "TCB_BASED" by [XID, "XKEY"]] where [XID, "XKEY"] identify a certification authority the content provider trusts. Using our generic transformer, this constraint can be transformed into a XML constraint:

<software_constraint> <certification_value>TCB_BASED</certification_value> <certification_authority> <certification_ID>XID</certification_ID> <certification_key>"XKEY"</certification_key> </certification_authority> </software_constraint>

Identity Control: the main issue

As we will see in this section, the identity Control is a main issue of our model. Users dependent certificates and organization certificate based controls are also discussed in this section, to show why the users dependent certificates solution is better.

The Identity Control Issue

In the previous section, we defined a scheme to evaluate the end-user environment, before authorizing the use of DRM-based contents and the deciphering key distribution. However, the certifications used in this scheme are linked to the organization where the environment evaluation is performed. Thus, the evaluation of environmental constraints depends on sensitive information: the organization identity. For instance, deployment of software are performed in a company and thus certificates about the environment of the software depend on the company identity.

The organization identity is thus essential in the process: if it is not well protected, one can use at home the identity he was given by his company, pretending being at work. The best way to enforce this requirement is to define a certification rule such as [ORGANIZATION: id_management is certified CONFINED by X], where X is an entity we trust for the confinement evaluation.

Identity Checking Model Checking the organization identity can be performed using two different approaches. The first approach relies on a single and well protected global certificate, attesting the organization identity. However, in this case, the security of the whole organization relies on the non-compromission of a single private key, the one associated to the certificate.

In order to enhance the protocol robustness, we chose the second solution. It is a decentralized identity checking process, based on the users' organization certificates. This process can express the same functionalities as the centralized one but mitigates the impact of the lost/diffusion of a private key: in such a case, only a user certificate would have to be revoked and regenerated, not the organization one. The process, summarized in the figure 3, consists of the three following steps.

• the user logs in the DRM system and uses his/her confidential access key, which is also his/her certificate deciphering key

• the software is able to decipher the protected certificates

• the software can then use the identity of the user and its organization

The use of ciphering techniques for the storage of the certificates protects these sensitives information from compromission by physical access. As described in section 2.4, the organization identity control is the core issue of the environmental constraints management. In this section, we thus choose to describe the implementation of such a control process. We first present the functional aspects of our tool and then the confinement module, to assure that nobody except the identity control process can access to the sensitive information. This second part describes a way to assure the control of the organization identity and be certified [ORGANIZATION: id_management is certified CONFINED by X].

Identity Checker

For the Identity Checking Process, two actions have to be performed: the certificate deciphering action and the certificate analysis action. We can consider these operations as two actions of the same process and develop a single module but we considered two modules for several reasons described below. The figure 4 summarizes our Identity Checking Process, tested with an implementation developed in C and based on the CryptLib [Gut08] library.

• Several encryption standards already exist and using a deciphering module does not imply a specific encryption technique for the model.

• Certificates analysis is independent of the certificates ciphering technique. One can thus develop a personal certification platform or use an existing standard.

• From a security point of view, the two modules do not require the same authorizations (see subsection 3.2.1). We can thus define a more fine grained policy.

Identity Certificates Confinement

In the previous section, we have presented the functional aspects of our confinement module. However, the identity checking process (processes and data) must be confined in order to enhance the global security. We will then be able to asset that each part of our process can access only the information it needs (for instance, the deciphering tool must not be Figure 4: Identity Checking Model able to leak information about the certificates) and that other parts of the system are not able to access to sensitive information, which is required to get the desired certification.

In this section, we thus describe the implementation of the identity checking process confinement module. The implementation of such a confinment requires the use of a flow control mechanism, at the operating system layer. SELinux [START_REF] Loscocco | Integrating flexible support for security policies into the linux operating system[END_REF] is an example of such implementation in Linux. In a first subsection, we present the SELinux security model. This let us define the minimal trust we need in each module of the process. In the next subsection, we briefly present the different parts of our module, in order to show how we have implemented the confinement module.

SELinux Security Model

The Security model is an extension of the identity checking model (figure 4). In our module, we first (figure 5) define domains and types labels, in order to formalize the environment. We have deployed the identity checking module in /etc/drm, labelled etc_t, and the deciphering tools decipher certificates in deciphered_certs/, labelled certs_DRM_dir_t. The SELinux environment is important for the module deployment as labels have to be correctly instantiated to guarantee that the module behaves securely: domains have to be well defined in order to assure that only the desired domain can access the specified information and the security policy defined the authorized translations between the domains. The modules authorizations are described in the table 1. • the deciphering tool must not generate false deciphered contents or false answers Environmental Constraints Management in Digital Licences must be at least detectable, for instance in case of an incorrect behavior. As any output is labelled certificates_DRM_deciphered_t and any unspecified flow is forbidden, the deciphering tool cannot leak intentionaly any information.

• the checking tool must be trusted, as it reads deciphered certificates. and thus may disclose confidential information.

If these two requirements about the process modules are satisfied, the identity checking confinement certification (associated to the constraint [ORGANIZATION: id_management is certified CONFINED by X]) is also satisfied.

SELinux Model Environment

The identity checking confinement module has been implemented in Gentoo (see [Fou]) with the LSM (Linux Security Module) SELinux [START_REF] Loscocco | Integrating flexible support for security policies into the linux operating system[END_REF]. In order to simplify the example, we only describe the deciphering tool rules, as they are similar to the identity checking tool rules, except the authorizations ones.

Types and domains of the SELinux Model

The first part of the SELinux policy specify our SELinux environment presented in the section 3.

  Figure 1: DRM Principles

  Based on the PRIS proposal, we define the security levels PRIS *, PRIS ** and PRIS *** where the requirements needed to meet the security level PRIS *** encompass the requirements of the security level PRIS **, which encompass the requirements of the security level PRIS *. We thus have PRIS * < PRIS ** < PRIS *** and SECURITY_LEVEL_ELEMENT := PRIS* || PRIS ** || PRIS *** SECURITY_NORM := PRIS

  This model, of type LL(k), is as follows: environments_constraints := [environments_constraints_element] || (environments_constraints CONNECTOR environments_constraints) || NOT (environments_constraints) environments_constraints_element := <software_environment_constraint> || <organization_environment_constraint> || <user_environment_constraint> CONNECTOR := AND || OR

  SOFTWARE_CERT := TCB_BASED || UNMODIFIABLE ; ID_MGMT := CONFINED ID_CERTIFICATION := ANY || UNIQUE ; ORGA_NORM := PRIS || PRIS* || PRIS** || PRIS***

Figure 2 :

 2 Figure 2: Environmental Constraints Evaluation Principle

Figure 3 :

 3 Figure 3: Identity Evaluation Model

Figure 5 :

 5 Figure 5: Identity Checking Model in SELinux Environment

Table 1

 1

		: Identity Checking Model Authorizations
	Domain	Data	Access
	staff_t	certificates_DRM_decipher_t	execute
	staff_t	certificates_DRM_OrgaChecker_t execute
	certs_DRM_decipher_d	certificates_DRM_ciphered_t	read
	certs_DRM_decipher_d	certificates_DRM_deciphered_t	write
	certificates_DRM_checker_d certificates_DRM_deciphered_t	read

  2.1.Flows control Another part of the SELinux policy defines the transitions between the domains. For instance, we must specify the following rules:• who (user's domain) can execute the deciphering tool • which user and which program can enter the certs_DRM_decipher_d domain This is defined by the following SELinux statements:

	type certs_DRM_decipher_d;
	typeattribute certs_DRM_decipher_d domain;
	role staff_r types certs_DRM_decipher_d;
	type certs_DRM_decipher_t; type certs_DRM_ciphered_t;
	type certs_DRM_deciphered_t; type certs_DRM_dir_t;
	type_transition staff_t certs_DRM_decipher_t:process certs_DRM_decipher_d;
	allow certs_DRM_decipher_d certs_DRM_decipher_t:file entrypoint;
	allow staff_t certs_DRM_decipher_t:file {execute getattr read ioctl};
	allow staff_t certs_DRM_decipher_d:process
	{transition noatsecure rlimitinh siginh signal sigchld};
	type_transition certs_DRM_decipher_d certs_DRM_dir_t:file
	certs_DRM_deciphered_t;

Note that the DRM structure definition is out of scope. Thus, we do not discuss it here.

Acknowledgements

The study is funded by the DGA under a DGA/CNRS grant.

Conclusion and future works

In this paper, we have proposed an extension of current (E)DRM model in order to be able to express environmental constraints. These constraints, such as «DRM-rendering applications are based on a trusted Computing Base (TCB)», can be used to enhance the security of DRM based solutions. We have also presented how this proposal can be included in existing XML-based licences, as an extension of the existing constraints.

We have then stressed the fact that the organization identity is a central problem for environmental constraints, as the DRM-based tools must be able to know with certainty in which organization it is. We have thus proposed a global process for the control of the organization identity, with an example of implementation, in SELinux, to assure the validity of the organization identity.

In future works, we will study the implementation of our solution with concrete licences and use our proposal to enhance existing content management proposals.


Léopold Cudilla
email: leopold.cudilla@etu.univ-nantes.fr

Simon Perrin
email: simon.perrin@etu.univ-nantes.fr

Yejing Xie
email: yejing.xie@ls2n.frharold.mouchere@ls2n.fr

Harold Mouchère

Isabelle Marthot

Homer restored: Virtual reconstruction of Papyrus Bodmer 1

Keywords: Applied computing → Digital libraries and archives;, Computing methodologies → Reconstruction Generative Adversarial Networks, papyrus, inpainting

teaching and research institutions in France or abroad, or from public or private research centers.

INTRODUCTION

Documents from Antiquity rarely reach us in a complete state. Therefore, one of the tasks of archaeologists and historians is to propose hypotheses for reconstructing the original state of the objects they study. The Papyrus Bodmer 1 is an exceptional piece: it preserves a part of a land register written in Middle Egypt (Panopolis) around 215 AD that is 31 cm high and 5.70m long while it could have been up to 11m long when it was complete [START_REF] Tomasz Derda | A Land List from the Upper Panopolite Nome in Upper Egypt (after AD 213/4)[END_REF]. At an unknown moment after 215 AD, a scribe cut this roll into two and copied on the back Book 5 and 6 of Homer's Iliad. For yet unexplained reasons, he chose a different number of verses per column between the two books (29 to 31 in Book 5, 38 to 40 in Book 6). For this work, we chose to focus on one column of Book 5 (see Figure 1). Images of the other parts and information on the papyrus are available on the online catalog of the Bodmer foundation 1 . One of the interests of this long and rather well-preserved papyrus is to offer evidence of how a unique document (the land register) of major historical value was reused to bear a key piece of ancient literature (the Iliad). The semi-cursive handwriting of the Iliad part is more challenging than calligraphic scripts where all letters are detached, but is also more comparable with dated specimens. It thus forms an ideal case study for computational restoration assisting current research in ancient History.

Image reconstruction methods have become increasingly powerful in recent years, thanks in particular to advances in the field of deep learning. As far as the restoration of old documents is concerned, work in the field of automatic image processing focuses mainly on improving the overall quality of documents, by removing blur, increasing the definition of the document or retrieving a deleted text [START_REF] Hollaus | CNN based binarization of multispectral document images[END_REF]. Very recently, some work has also focused on assembling fragments for the reconstruction of old documents. In 2022, a PhD thesis [START_REF] Pirrone | Apprentissage profond auto-supervisé de métriques : application à la prédiction d'assemblage de fragments de papyrus[END_REF] focused on the pairing of papyrus fragments using Siamese networks. Another work from 2020 [START_REF] Ostertag | Using Graph Neural Networks to Reconstruct Ancient Documents[END_REF] deals with the reconstruction of a papyrus using its fragments. This one proposes a solution using a graph neural network to create a graph representing the reconstruction of the papyrus by linking each fragment to its neighbors.

Despite these advances, the reconstruction of damaged ancient documents with known text but missing fragments has, to our knowledge, not been studied much. There is currently no machine learning solution for this task. Moreover, in the case of papyri, there are little data to train a model.

The main contributions of the paper are summarized as follows:

(1) We propose a novel method for reconstructing heavily degraded papyri by restoring the original text with knowledge of it, (2) We show that it is possible to use GANs or more handcraft inpainting methods to restore heavily degraded papyri.

In the following section, we cover the related works about inpainting of image and documents. In section 3, we explain the proposed methods to complete the missing parts of one column of the Papyrus Bodmer 1. Then, in section 4, we present our experiments, and finally, we show and discuss different results in section 5.

RELATED WORKS

Inpainting is the process of filling in the missing parts of an image. It can be done physically as an artwork by a conservator-restorer, or digitally, as a computer vision task, using various techniques.

Among the first digital inpainting techniques proposed are Efros et al. [START_REF] Efros | Texture synthesis by non-parametric sampling[END_REF] and Bertalmio et al. [START_REF] Bertalmio | Image inpainting[END_REF]. The first proposed a method which consists in extending an image made of a regular pattern, by synthesizing the texture. This method uses statistical information on the image patterns, modeled by a Markov random field model. A pixel is synthesized at a time, according to its neighboring pixels, by finding in the image a neighborhood of similar pixels. The second used diffusion process (Laplacian) to propagate pixels surrounding the area to inpaint.

Deep learning techniques have allowed for semantically meaningful inpainting [START_REF] Pathak | Context encoders: Feature learning by inpainting[END_REF][START_REF] Yeh | Semantic image inpainting with deep generative models[END_REF]. Many model architectures have been used to perform this task.

Liu et al. proposed in [START_REF] Liu | Rethinking image inpainting via a mutual encoder-decoder with feature equalizations[END_REF] an encoder-decoder based convolutional neural network (CNN) method to inpaint images with missing parts of various shapes and sizes.

A method of inpainting on historical documents to restore irregular holes using a U-Net [START_REF] Ronneberger | U-net: Convolutional networks for biomedical image segmentation[END_REF] and Partial Convolution [START_REF] Liu | Image inpainting for irregular holes using partial convolutions[END_REF] is proposed in [START_REF] Kaur | Inpainting of irregular holes in a manuscript using unet and partial convolution[END_REF]. The U-Net generates a mask of the irregular holes from the historical degraded document. Partial convolution is used to inpaint the holes using the generated mask and the document image.

Autoencoders are neural networks that learn two functions: encode the input and decode to recreate the input from the code generated just before. Some inpainting methods have been developed using an autoencoder [START_REF] Mohammad Hossein Givkashi | Image Inpainting Using AutoEncoder and Guided Selection of Predicted Pixels[END_REF][START_REF] Žižakić | Autoencoder-learned local image descriptor for image inpainting[END_REF].

Generative Adversarial Networks (GAN) [START_REF] Goodfellow | Generative adversarial networks[END_REF] are neural networks that generate data by making two networks confront each other. The first network, called the "generator", attempts to generate the most realistic data possible, in order to make the second network, the "discriminator", believe that the generated data are real data. The discriminator is trained with real data, and must detect whether a sample is real or generated by the generator. Several GAN-based methods were developed for inpainting [START_REF] Demir | Patch-based image inpainting with generative adversarial networks[END_REF][START_REF] Liu | Pd-gan: Probabilistic diverse gan for image inpainting[END_REF][START_REF] Shin | Pepsi++: Fast and lightweight network for image inpainting[END_REF][START_REF] Zhao | Large scale image completion via co-modulated generative adversarial networks[END_REF]. Kim et al. focused in [START_REF] Kim | Old document restoration using super resolution GAN and semantic image inpainting[END_REF] on using a Super-resolution GAN to inpaint the fold lines of old documents. The fold lines to be inpainted are manually marked. The method used does not aim to reconstruct heavily degraded documents, as inpainting is applied on very small areas of the documents.

DeepFillv2 is presented in [START_REF] Yu | Free-form image inpainting with gated convolution[END_REF]. DeepFillv2 is a GAN-based architecture used to inpaint images with free-form mask and guidance. The generator is composed of two networks, the first generates a "coarse" inpainted version of the masked image. The second takes as input the "coarse" inpainted image and the masked image to produce a more detailed inpainted image. The generator uses Gated Convolution and a contextual attention block.

Transformers models [START_REF] Vaswani | Attention is All you Need[END_REF] are deep learning models based on attention mechanisms. Inpainting models based on transformers are able to inpaint large missing parts of images and output semantically plausible results [START_REF] Li | MAT: Mask-Aware Transformer for Large Hole Image Inpainting[END_REF][START_REF] Yu | Diverse Image Inpainting with Bidirectional and Autoregressive Transformers (MM '21)[END_REF].

Diffusion models are probabilistic machine learning models, using Markov chains. Very recently, different methods based on diffusion models for inpainting, denoising, image generation, and image resolution enhancement have appeared. The method proposed by Saharia et al. [START_REF] Saharia | Palette: Image-to-image diffusion models[END_REF] is based on a conditional diffusion model, which allows coloring of images, increasing the quality of images, or inpainting. It is able to restore complex structures in missing areas of the images. Lugmayr et al. [START_REF] Lugmayr | Repaint: Inpainting using denoising diffusion probabilistic models[END_REF] proposed a denoising diffusion probabilistic model to inpaint images with a free-form mask.

While some methods presented above, especially neural networkbased ones, can sometimes reconstruct the missing text of an image, none of them preserves the semantics of that text. They are therefore unsuitable for the text reconstruction of a heavily degraded document.

PROPOSED METHOD

In this section, we detail our two phases methodology to reconstruct the papyrus. The first phase aims to reconstruct the text of the papyrus, which is no longer present due to damage. In order to do this, since we otherwise know the text of the Iliad, we have used the preserved characters on the papyrus and pasted them at possible locations on the image to obtain a readable text. The second phase aims to reconstruct the papyrus background (the papyrus paper) in order to obtain a realistic reconstruction.

Text reconstruction

In the first phase, we aim at reconstructing the missing parts of the Iliad in order to recreate the full original text. A character patch dictionary is created using the annotation file provided by the papyrologists (this file describes the position, the associated Greek letter and the state quality of the visible characters, from BT1 for complete to BT3 for not recognizable anymore). For each character present in the annotation file, a patch, associated with its Greek letter, is extracted. Only the characters with the best quality (tagged BT1) and not exceeding a width of 50 pixels are extracted. Thanks to these two conditions, we avoid characters that would hardly be readable or too wide to fit in the reconstruction. The dictionary allows us to have several patches for a letter, and thus to vary the patch used. Several reconstructions with randomly selected characters were tested.

The papyrus background is removed during extraction so that only the character ink remains (see Figure 3). This step is done with a basic method, only the darkest pixels (corresponding to the ink) are selected, defined as having a value lower than the average pixel of the patch. 3.1.2 Character placement. Once all the character patches have been extracted and the text file has been read, the characters can be placed in their probable locations.

For each area where characters are missing, the characters that should be present are determined, and corresponding patches for each of them are randomly drawn from the character patch dictionary.

To take advantage of all the available space in each zone, the characters are placed so that there is an equal amount of space between each character patch from the same row. If it is not possible to have any space between the patches (the total width of the patches is greater than the space available), then the patches will overlap slightly. Only pixels with minimum values are kept on the overlapping areas so that the characters are visible despite the overlap.

A part of the papyrus column at this phase with only the reconstructed text is shown in Figure 4. Some noise comes from the darkest papyrus fibers and illustrate the issue of ink fragmentation on papyri as seen during the DIBCO competition at ICDAR 2019 [START_REF] Pratikakis | 2019 International Conference on Document Analysis and Recognition (ICDAR)[END_REF], where binarizing papyri images proved difficult.

Background reconstruction

In order to reconstruct the background of the papyrus, inpainting methods are used throughout the document. Two methods have been used. The first is a more traditional method, and the second involves deep learning with a GAN.

Traditional inpainting. The first method is extremely simple.

A strip without writing from the column to be reconstructed is extracted and used to complete the document. An image of a blank papyrus leaf, of the same size as the input image, is created in which the extracted strip is pasted several times until it covers the entire image. Then, the image containing the reconstructed text is pasted over the new image, except the areas in black without papyrus.

GAN.

The second method is the one using a GAN to reconstruct the papyrus background. For this purpose, we decided to use deepfillv2 [START_REF] Yu | Free-form image inpainting with gated convolution[END_REF] for technical reasons (amount of data available and computational power for training) and its ability to do inpainting with free-form masks.

The deepfillv2 generator can be separated into two neural networks. The first network consists of gated convolution blocks that produce a "coarse" inpainted version of the masked image. The second network contains two branches of gated convolution blocks and a contextual attention block, to refine the "coarse" version resulting from the first network, and thus produce a detailed inpainting consistent with the rest of the image. The activation function between the layers is Leaky ReLu, and the output function of the first and second networks is tanh. To train the generator, we compute the hinge loss function on the output of the generator, the mean absolute error (MAE) on the output of the two networks, as well as a "perceptual" loss function, obtained by using a pre-trained CNN neural network to compute the MAE between the feature maps of the base image and the inpainted image. The discriminator is composed of six convolution blocks, to divide the image into 32×32 patches. For each patch, the discriminator determines if the patch is real or generated by the generator. The hinge loss function is then calculated to train the discriminator.

We scanned the image vertically and horizontally to apply inpainting to patches of the image. To do so, the patch must contain a piece of papyrus and an area to be filled in. For this reason, the inpainting application path starts at the center left of the image, on a perfectly completed area and not at the top left of the image (black area without papyrus). Thus, we gradually extend the papyrus over the areas to be restored.

EXPERIMENTS 4.1 Dataset

The dataset used to train deepfillv2 is composed of patches extracted from online images of Papyrus Bodmer 1. The patches are extracted from areas without writing.

The masks are created either by randomly selecting patches from the base papyrus where torn edges can be seen and using the part without papyrus of these patches as masks, or by generating black rectangles a quarter or an eighth of the size of a patch. The masks are then applied to a corner of a patch without writing.

For each mask, a patch is extracted, and a character is randomly pasted onto the patch. A total of 633 patches of size 256×256 on three channels (RGB) are extracted from Papyrus Bodmer 1 for training (see Figure 5 for an example) and 633 masks are generated.

Implementation Details

The deepfillv2 discriminator and generator were trained with the Adam optimizer and a learning rate of 0.0001 for both. No learning rate decay was used, and the networks were trained during 430 epochs. The mini-batch size was set to 1.

The method was implemented using PyTorch 1.3.11 [START_REF] Paszke | Pytorch: An imperative style, high-performance deep learning library[END_REF], Python 3.9.10 and CUDA 11.6. The implementation of deepfillv2 with Py-Torch is the one from csqiangwen on GitHub 4 .

Training was carried out using an NVIDIA RTX 3060 Laptop 6GB VRAM GPU, 8GB of RAM and an AMD Ryzen 5 5600H 3.3Ghz CPU.

The removal of the character background (presented in this section 3.1.1) is deactivated for the reconstruction of the papyrus with the GAN, as the results were less relevant following different tests.

RESULTS AND DISCUSSIONS

The evaluation of the results was done in a subjective visual way and with the help of the experts' opinion, as we do not have as Ground Truth the original papyrus to compare our result to. The two complete reconstructions, a reconstruction of the text and the original image of the Papyrus Bodmer 1 column, can be found at the following Link.

Subjective visual analysis

Inpainting results with the reconstructed text are shown on Figure 6 and Figure 1 (the full column).

The reconstruction results obtained on real data (Figure 6) show that the colors of the papyrus are decently synthesized, but the texture aspect of the papyrus is missing. The fibers of the papyrus are not reconstructed. Furthermore, the general color of the papyrus is reconstructed, but it is easy to see on the bottom image at epoch 430 that the color tone doesn't quite match the rest of the patch. A slight dark edge at the tear is also visible, due to compression artifacts of the papyrus column image, causing the papyrus to not be clearly separated from the black background. Figure 7 compares the same section of the papyrus in the two reconstructions. The top one corresponds to the reconstruction using the traditional inpainting method (copying the strip). With this technique, the texture of the document is perfectly recovered, but a repetitive pattern can be observed and there is no continuity in the fibers between reconstructed and original parts. The bottom reconstruction is the one using GAN. The textures of the papyrus are largely missing in the reconstructed parts and patterns are repeated very strongly on the upper right part. As in the other reconstruction, the continuity of the fibers is not kept.

In both reconstructions, the text is correctly reconstructed and readable.

Analysis by papyrology experts

Both proposed methods to reconstruct a full column of Iliad allow specialists and lay audience picturing how the original papyrus could have looked like. In a detailed view, it cannot be mistaken for a genuine piece due to the still visible transitions between the reconstructed parts and the original ones as well as the erratic aspect of the reconstructed text that has not fully managed to mimic a cursive script (see Figure 8). At the column level, however, it provides a convincing general impression and ground for future discussions among specialists, for instance on the motivation to chose a given number of verses per column. The most convincing restoration of the background is the traditional inpainting because it preserves the vertical pattern of the fibers. This is possible because a) it is written on the side where the fibers are vertical (on the other side of the roll, the fibers are horizontal, thus along and not across the writing) and b) it has a large, well-preserved lower margin to take a coherent strip from. We can thus speculate that this solution would be less successful and more time consuming if extended to the almost 6-meter long roll, and maybe not applicable on a text written along the fibers.

CONCLUSION AND FUTURE WORK

In this paper, we proposed a complete method to reconstruct a column of papyrus with both its written text and background starting from the preserved parts of the original. The choices made to restore the text (random selection of individual letters to avoid repetition, ink segmentation method) and the two approaches tested for the backgrounds have yielded convincing results at the page (column) level that are already useful to foster discussions among specialists and provide educational information to a lay audience.

A future advance for this method would be to propose a better generation of the background by including the texture of the papyrus. Since no relation is attested so far between the fibers and the appearance of the text, if the final purpose is to provide a hypothetical reconstruction of a roll in its complete state, one could choose in the future to segment all the written text and paste it on a homogeneous papyrus background that would not be the original. Another direction would be to generate characters as proposed in [START_REF] Matthew I Swindall | Dataset Augmentation in Papyrology with Generative Models: A Study of Synthetic Ancient Greek Character Images[END_REF] to avoid reusing those already present in the document and better take into account the cursive aspects of the handwriting (each letter shape is influenced if not modified by its direct neighbors). Last, a metric could be developed to evaluate the result of a papyrus reconstruction without knowing the original document. The study of Papyrus Bodmer 1 shall continue in the future towards a complete reconstruction of this fascinating manuscript to better understand its production and shed new light on ancient books in general.

Figure 1 :

 1 Figure 1: Part of Papyrus Bodmer 1 (Iliad 5.645-678) from the 3rd century AD and the proposed reconstruction.

Figure 2 :

 2 Figure 2: Global scheme of the proposed method. (a) Papyrus column to reconstruct. (b) Papyrus images to train deepfillv2. (c) Papyrus with reconstructed text. (d) Papyrus strip for traditional inpainting. (e) Papyrus column reconstructed with traditional inpainting. (f) Papyrus column reconstructed with a GAN (deepfillv2).

3. 1 . 1

 11 Data processing. The image of one column of the papyrus, a text file containing its transcription, and the annotations of the visible characters are used as input. The text file indicates which parts of the text are visible and which are missing on the image of the papyrus. The annotations are in COCO format (in a JSON file) exported from the Research Environment for Ancient Documents (READ) 2 interface and can be seen online 3 .

  2 https://github.com/readsoftware/read 3 https://showcase.d-scribes.philhist.unibas.ch/ViewerBodmer

Figure 3 :

 3 Figure 3: Example of papyrus background removal.

Figure 4 :

 4 Figure 4: Extract of the papyrus column at the text reconstruction phase.

Figure 5 :

 5 Figure 5: Example of an image and mask from the dataset. From left to right: a blank papyrus patch; an image with the black background to be extracted to create the mask; the extracted mask; the first image with the mask.

4. 1 . 1

 11 Data augmentation. To augment the size of the dataset, 75% of the masks are re-added as flipped, top to bottom, left to right or both. This way, 475 new masks are created, and for each mask, a new papyrus patch is extracted.

Figure 6 :

 6 Figure 6: Examples of inpainting using GAN on patches from the image containing the reconstructed text at different epochs.

Figure 7 :

 7 Figure 7: The same section of the papyrus in the two reconstruction methods: (a) traditional inpainting with the strip, (b) GAN. The reconstructed text is different in the two images due to randomness in character patches selection.

Figure 8 :

 8 Figure 8: Part of the reconstruction of Papyrus Bodmer 1 column with the delimitation between the original (right) and the reconstructed part, using traditional inpainting (left).

https://bodmerlab.unige.ch/fr/constellations/papyri/barcode/1072205286

https://github.com/csqiangwen/DeepFillv2_Pytorch

ACKNOWLEDGMENTS

This work was partially supported by the Swiss National Science Foundation as part of the project no. PZ00P1-174149 "Reuniting fragments, identifying scribes and characterizing scripts: the Digital paleography of Greek and Coptic papyri (d-scribes)".