Nashad Ahmed Safa
email: nasafa@ucalgary.ca

Reihaneh Safavi-Naini

Siamak F Shahandashti
email: siamak.shahandashti@ncl.ac.uk

Privacy-Preserving Implicit Authentication

Keywords: Implicit Authentication, User Privacy, Homomorphic Encryption, Provable Security, Behavioural Features

In an implicit authentication system, a user profile is used as an additional factor to strengthen the authentication of mobile users. The profile consists of features that are constructed using the history of user actions on her mobile device over time. The profile is stored on a server and is used to authenticate an access request originated from the device at a later time. An access request will include a vector of recent features measurements on the device that will be matched against the stored features to accept or reject the request. The features however include private information such as user location or web sites they have visited. In this paper we propose privacy-preserving implicit authentication which achieves implicit authentication without revealing unnecessary information about the users' usage profiles to the server. We propose an architecture, give formal security models, and propose constructions with provable security. We consider two security models, namely for cases where the device behaves semi-honestly or maliciously.

Introduction

In mobile applications such as mobile commerce, users often provide authentication information using Mobile Internet Devices (MIDs) including cell phones and notebooks. In most cases however, password authentication is the primary method of authentication. The weaknesses of password-based authentication systems, including widespread usage of weak passwords, have been widely studied (see e.g. [START_REF] Tsai | Password Authentication Schemes: Current Status and Key Issues[END_REF] and references within). In addition to these weaknesses, limitations of user interface on MIDs results in an error prone process for inputting passwords, encouraging even poorer choices of password by users.

To strengthen authentication, two-factor authentication has been proposed. The second factor, when based on extra hardware such as SecureID tokens, have additional cost and limit their wide application. An attractive method of strengthening password systems is implicit authentication [START_REF] Jakobsson | Implicit Authentication for Mobile Devices[END_REF] which effectively adds a second factor to authentication. The idea is to use the history of device usage to construct features, that are used to provide a second factor for verifying an access request from a user with a claimed identity. Experiments in [START_REF] Jakobsson | Implicit Authentication for Mobile Devices[END_REF] showed that features extracted from device history can be effectively used to distinguish users. Although the approach is applicable to any computing device, it is primarily used to enhance security of mobile users carrying MIDs.

The user profile includes private information including (i) device data, such as GPS location data and WiFi/Bluetooth connections, (ii) carrier data, such as information on cell towers connected to the device, or Internet access pattern, and (iii) cloud data, such as calendar entries. The profile is stored at the carrier to ensure that a compromised device cannot be used to impersonate the legitimate user. This profile however includes private and potentially sensitive user data, that must be protected.

The aim of this paper is to address this problem: we propose an efficient method of privacy preserving implicit authentication systems, and model and prove its security.

We consider a network-based implicit authentication system where user authentication is performed collaboratively by the device (the MID), and the carrier (network service provider). Application servers will use the result of this authentication to grant access to users and do not directly participate in the authentication protocol.

Our implicit authentication protocol generates a score that will be used to accept to reject the user. The score is obtained through secure two party computation between the device and the carrier. User data is encrypted and stored at the carrier and is used by the interactive protocol to compute the authentication. Data privacy against a semi-honest carrier is guaranteed because the user data is stored in encrypted form. Calculating the score is by a specially designed secure two party computation protocol. Secure two party protocols can be implemented through general constructions using secure circuit evaluation, e.g. [START_REF] Yao | How to Generate and Exchange Secrets[END_REF][START_REF] Goldreich | How to Play Any Mental Game -A Completeness Theorem for Protocols with Honest Majority[END_REF], or fully homomorphic encryption [START_REF] Gentry | A Fully Homomorphic Encryption Scheme[END_REF]. These general constructions however will be inefficient in practice.

Because no data is stored on the MID, user data stays protected even if the device is lost or stolen.

Our Contributions

The main contribution of this paper is proposing a profile matching function that uses the statistics of features to accept or reject a new sample presented by a user, and providing a privacy preserving protocol for computing a score function for a newly presented data. We assume the user profile is a vector of features, each corresponding to a random variable, (V 1 , . . . , V n ), with an associated probability distribution. The distribution of V i is stored as the set of values of the variables in the last i successful logins. A new login attempt generates a vector of values, one for each feature. The verification function must decide if this vector indeed has been generated by the claimed user. Our proposed verification algorithm takes each feature separately and decides if the presented value is from the claimed user. The final verdict is reached by combining the decisions from all features. To determine if a new value presented for a feature v i matches the model (stored distribution of the feature), we will use a statistical decision making approach that uses the Average Absolute Deviation (AAD) of the distribution.

We use AAD to define an interval around the read value v i given by [v i -AAD(V i ), v i + AAD(V i )] and determine the concentration of the stored values in the user profile that falls within this Interval: if the number is higher than a specified threshold, then the authentication algorithm accepts the reading. AAD and standard deviation are commonly used measures for estimating the spread of a distribution. Our verification algorithm effectively measures similarity of the presented value with "most common" readings of the variable. Using AAD allows more efficient private computation.

Constructing User Profiles. A user profile is a feature vector (V 1 , . . . , V n ), where feature V i is modelled by a vector of i past samples. The vector can be seen as a sliding window that considers the latest i successful authentication data. Using different i is allowed for better estimation of the feature distribution. Possible features are the frequency of phone calls made or received by the user, user's typical locations at a particular time, commonly used WiFi access-points, websites that the user frequently visits, and the like. Some features might be dependent on other ones. For example, given that the user is in his office and it is lunch time, then there is a higher chance that he receives a call from home. We do not consider dependence of features and in selecting them make special care to select those that appear independent.

We note that usage data such as application accesses and past WiFi connections could enhance performance and usability of the device and applications. However to use such data securely as part of the authentication system, the data must be stored securely at the carrier to be protected from malicious parties who may get hold of the device. In practice a user can be given a choice to use certain device-collected data for authentication and so for such data.

Privacy-Preserving Authentication. All user profile data is stored in encrypted form on the carrier and the decryption keys are only known by the device. To find the authentication score for each feature, the device and the carrier have to perform a secure two-party computation that outputs the authentication score to the carrier, and nothing to the device. We propose a 3-round protocol between the device and the carrier that allows the carrier to "securely" calculate the score. To provide the required efficiency, we have to sacrifice some privacy in the sense that although the actual data samples are not leaked, the protocol does expose structural information related to the relative order of data samples. We give a formal definition of this notion of privacy which guarantees that no information other than the relative order of samples is revealed by a secure protocol. We then prove the security of the protocol, according to the definition, against semi-honest adversaries.

The paper is organized as follows. We discuss the related work in the field of behavioural authentication in Section 1.2. Section 2 contains the preliminaries needed for our scheme. System architecture, the adversarial model, and a basic implicit authentication protocol not guaranteeing privacy are presented in Section 3. We give details of our proposed protocols for semi-honest and malicious devices in Section 4. Security proofs and a detailed discussion on the efficiency of our proposed protocol are provided in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF].

Related Work

The privacy problem in implicit authentication was noted in [START_REF] Jakobsson | Implicit Authentication for Mobile Devices[END_REF]. The three approaches proposed for enhancing privacy are: (i) removing unique identifier information; (ii) using pseudonyms; and (iii) using aggregate data instead of fine grained data. All these methods however have limited effectiveness in protecting users' privacy while maintaining usefulness of the system. It is well known that user data with identification information removed can be combined with other public data to re-identify individuals [START_REF] Tan | A Correlation Attack Against User Mobility Privacy in a Large-Scale WLAN Network[END_REF], and fixed pseudonyms does not prevent linkability of records [START_REF] Krumm | Inference Attacks on Location Tracks[END_REF]. Finally coarse aggregates result in inaccurate authentication decisions.

Further discussion on related work e.g. on privacy-preserving biometric systems [START_REF] Leggett | Dynamic Identity Verification via Keystroke Characteristics[END_REF][START_REF] Monrose | Authentication via Keystroke Dynamics[END_REF][START_REF] Nisenson | Towards Behaviometric Security Systems: Learning to Identify a Typist[END_REF][START_REF] Shahandashti | Private Fingerprint Matching[END_REF] and implicit authentication systems using accelerometers [START_REF] Chang | Inferring Identity Using Accelerometers in Television Remote Controls[END_REF], gait recognition [START_REF] Kale | Gait-Based Recognition of Humans Using Continuous HMMs[END_REF], user location [START_REF] Čapkun | Secure Positioning of Wireless Devices with Application to Sensor Networks[END_REF][START_REF] Singelee | Location Verification Using Secure Distance Bounding Protocols[END_REF][START_REF] Chiang | Secure and Precise Location Verification Using Distance Bounding and Simultaneous Multilateration[END_REF][START_REF] Čapkun | Secure Localization with Hidden and Mobile Base Stations[END_REF], and fingerprints [START_REF] Wang | A New Fingerprint-Based Remote User Authentication Scheme Using Mobile Devices[END_REF] can be found in full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF].

Preliminaries

Our constructions use homomorphic encryption and order preserving symmetric encryption. In the following we first give an overview of these primitives.

Homomorphic Encryption (HE).

We use here an additive homomorphic public key encryption scheme [START_REF] Paillier | Public-Key Cryptosystems Based on Composite Degree Residuosity Classes[END_REF][START_REF] Damgård | A Generalisation, a Simplification and Some Applications of Paillier's Probabilistic Public-Key System[END_REF] which supports addition and scalar multiplication in the ciphertext domain. Let E HE pk (•) denote such an encryption algorithm. Given encryptions of a and b, an encryption of a + b can be computed as

E HE pk (a+b) = E HE pk (a) E HE pk (b)
, where represents an efficient operation in the ciphertext space. The existence of the operation enables scalar multiplication to be possible in the ciphertext domain as well; that is, given an encryption of a, an encryption of ca can be calculated efficiently for a known c. To simplify the notation, we use + for both the operations + and . As an instantiation, we use Paillier Cryptosystem [START_REF] Paillier | Public-Key Cryptosystems Based on Composite Degree Residuosity Classes[END_REF][START_REF] Damgård | A Generalisation, a Simplification and Some Applications of Paillier's Probabilistic Public-Key System[END_REF] in which E HE pk (x + y) = E HE pk (x)E HE pk (y) and

E HE pk (cx) = E HE pk (x) c .
Paillier Cryptosystem is semantically secure under the decisional composite residuosity assumption [START_REF] Paillier | Public-Key Cryptosystems Based on Composite Degree Residuosity Classes[END_REF][START_REF] Damgård | A Generalisation, a Simplification and Some Applications of Paillier's Probabilistic Public-Key System[END_REF].

Order Preserving Symmetric Encryption (OPSE). Order preserving symmetric encryption (OPSE) was introduced in [START_REF] Boldyreva | Order-Preserving Symmetric Encryption[END_REF]. A function f : D → R is order preserving if for all i, j ∈ D: f (i) > f (j) if and only if i > j. A symmetric encryption scheme having plaintext and ciphertext space D, R is order preserving if its encryption algorithm is an order preserving function from D to R for all keys; i.e., an OPSE maps plaintext values to ciphertext space in such a way that the order of the plaintext values remains intact. The construction provided in [START_REF] Boldyreva | Order-Preserving Symmetric Encryption[END_REF] has been proven secure in the POPF-CCA (pseudorandom order preserving function against chosen-ciphertext attack) model. More details on the security model and encryption system are given in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF].

Secure Two-party Computation. In a secure two-party computation, two parties A and B with private inputs x and y, respectively, compute a function f (x, y) ensuring that, privacy and correctness are guaranteed. Privacy means that neither A nor B learns anything about the other party's input. Correctness means that the output is indeed f (x, y) and not something else. To formalize security of a two-party protocol, the execution of the protocol is compared to an "ideal execution" in which parties send their inputs to a trusted third party who computes the function using the inputs that it receives. Informally, a protocol is considered secure if a real adversary in a real execution can learn "the same" amount of information as, or can "change the protocol output" not more than what an ideal adversary can do in the ideal model.

Security of two-party protocols is considered against different types of adversaries. In the semi-honest model (a.k.a. honest-but-curious model), the adversary follows the protocol specification but tries to learn extra information from the protocol transcript. A malicious (a.k.a. dis-honest) adversary however follows an arbitrary strategy (bounded by polynomial time algorithms) and can deviate from the protocol specification.

There are a number of generic constructions for secure two party computation, e.g. [START_REF] Yao | How to Generate and Exchange Secrets[END_REF][START_REF] Goldreich | How to Play Any Mental Game -A Completeness Theorem for Protocols with Honest Majority[END_REF], however they have proven to be too inefficient in practice, specially in resource-restricted devices. An alternative approach to realize specific secure two-party protocols is based on homomorphic encryption (HE). In this approach, one party sends its encrypted inputs to the other party, who then computes the specific desired function in the encrypted domain using the homomorphic properties of the encryption system. Paillier's additively homomorphic cryptosystem [START_REF] Paillier | Public-Key Cryptosystems Based on Composite Degree Residuosity Classes[END_REF] and Gentry's fully homomorphic scheme [START_REF] Gentry | Implementing Gentrys Fully-Homomorphic Encryption Scheme[END_REF] are the commonly used tools in this approach.

Average Absolute Deviation. In our protocol we use a model of feature comparison that uses average absolute deviation. The median of a data set is the numeric value separating the higher half of distribution from the lower half. The average absolute deviation (AAD) of a data set is the average of the absolute deviations and characterizes a summary of statistical dispersion of the data set. For a set X = {x 1 , x 2 , . . . , x N } with a median denoted by Med(X), AAD is defined as 3 System Model Fig. 1 gives the working of the system we consider in practice. The authentication process is between the device and the carrier. In a typical scenario, an application server receives a service request from a device. The user information is forwarded to the carrier that will engage in the authentication protocol with the device. At the completion of the protocol, the results are sent to the application server, and if successful, the device (user) will receive the requested service. The focus of this paper is on the device and carrier authentication. We assume other communication channels are secure and the information will be communicated safely across these channels. User data is stored in encrypted form at the carrier. The device records user's data, encrypts it and sends it to the carrier. No data used to develop the user profile in implicit authentication is stored on the device. This ensures that if the device is compromised, the adversary cannot learn the user profile and simulate its behaviour.

AAD(X) := 1 N N i=1 |x i -Med(X)|.
We only consider the data that is collected by the device to be included in the user profile. The information collected by the carrier is known to the carrier and is not included. Selection of an appropriate set of features that allow distinguishability of users is outside the scope of this paper. The goal of this paper is to provide privacy for user features that are used as part of the user's profile.

Trust Assumptions and the Adversarial Model. We assume that the carrier correctly follows the protocol but may try to learn the users' data. This is a reasonable assumption given the stature and reputation of carriers and difficulty of tracing the source of data leakage. We assume the device is used by the user for a period of time before being compromised. This is the period during which the user profile is constructed. We consider two types of adversaries. Firstly, we consider a less sophisticated adversary that tries to use a stolen device without tampering with the hardware or the software and so the device is assumed to follow the protocol. This also corresponds to the case that the authentication program resides in a tamper proof [START_REF] Haubert | Tamper-Resistant Storage Techniques for Multimedia Systems[END_REF][START_REF] Möller | A Polymer/Semiconductor Write-Once Read-Many-Times Memory[END_REF] part of the device and cannot be modified by the adversary and so a captured device follows the protocol but takes input data from the adversary. We assume the program can be read by the device holder, but cannot be changed. In the second case, the device behaves in a malicious way and may deviate from the protocol to succeed in an authentication scenario.

In both cases the system must guarantee privacy of the user: that is, neither the carrier nor the adversary in possession of the compromised device should learn the user's profile data. A stolen device used by an active malicious user must also fail in authentication.

Authentication without Privacy

A user profile consists of features. A feature is a random variable that can be sampled by the device and in combination with other features provides a reliable means of identifying users. We denote feature i by the random variable V i that is sampled at each authentication request, and if the authentication is successful, is stored by the carrier and used as part of the distribution samples for evaluation of future authentication requests. The variable distribution for the i-th feature is approximated as

V i = (v i (t 1 ), v i (t 2 ), . . . , v i (t li )).
Here, v i (t j ) is the feature value at time t j and l i is a system parameter. As discussed before, we only consider independent features.

The user profile U is a tuple of features; that is

U := (V 1 , V 2 , . . . , V n ),
where n is the total number of features. A sampled feature vector is denoted as (v 1 (t), v 2 (t), . . . , v n (t)) where v i (t) is the current instance of the variable V i . Given a user profile and a new set of measured samples (for features), the scoring algorithm first calculates individual feature scores, and then combines them to generate a total score which is compared to a threshold. Authentication is considered successful if the score is higher than the threshold. The scoring algorithm works as follows.

We assume the final authentication score is obtained as a combination of authentication scores that are calculated for each feature separately. The scoring function for each variable estimates if the new sample belongs to the distribution that is represented by a set of samples from previous successful authentications. For a feature V i we define our scoring function as follows:

s i (t) = Pr[ b i l (t) ≤ V i ≤ b i h (t) ],
where

b i l (t) = v i (t) -AAD(V i ) and b i h (t) = v i (t) + AAD(V i ) . Here, AAD(V i ) represents the average absolute deviation of data in the set V i . The probability Pr[ b i l (t) ≤ V i ≤ b i h (t)
] is approximated by counting the number of elements of V i that fall between b i l (t) and b i h (t) and dividing the count by the number of all elements, i.e. l i .

As will be shown in Section 4, the choice of AAD(V i ) allows the carrier to perform the required computation on encrypted data. The scoring function estimates the likelihood of the new sample belonging to the distribution by counting the number of the previously recorded values of a feature that conform with, i.e. are within a determined interval of, the new sample.

To obtain the combined score of n features, various methods might be used depending on the authentication policy. A simple and popular method in this regard is the weighted sum of the scores as a(t) := w 1 s 1 (t) + • • • + w n s n (t), where w i represents the weight assigned to the i-th feature and a(t) is the combined authentication score.

In summary, the authentication protocol proceeds as follows: The carrier has a user profile which consists of the sample distributions of the user features. The device sends a set of sampled behavioural data to the carrier. The carrier retrieves the sample distribution for each feature and calculates the feature scores. Then it combines the individual feature scores and compares the combined score with a threshold to make an authentication decision.

Privacy-Preserving Authentication

At the heart of the authentication protocol is the score computing algorithm. It basically takes two inputs: the stored distribution and the fresh device sample, and it produces a feature score. All the computation takes place at the carrier side, given the two inputs above, where the former is stored by the carrier, and the latter is provided by the device. Both inputs are in plaintext. In this section, we focus on this algorithm and provide a two-party score computing protocol that is able to calculate the feature score from encrypted profiles stored at the carrier and encrypted fresh samples provided by the device, where the keys to encryptions are only known to the device.

We chose to provide private protocols for score computation on the feature score level, as opposed to the combined score level, for two reasons: first, different carriers might have different authentication policies, and hence different score combination formulas, and our formulation choice leaves the choice of combination method open; second, we consider it an overkill to require that the carrier only finds out about the combined score and nothing about the individual scores, and indeed solutions for such an overkill are likely to be inefficient for practice.

In the following we propose a protocol between a device and a carrier that enables the carrier to calculate a feature score for the device, while provably guaranteeing that no information about the stored profile at the carrier is revealed to the device other than the AAD of the stored feature values, and no information about the fresh feature value provided by the device is revealed to the carrier other than how it is ordered with respect to the stored profile feature values.

A Protocol Secure Against Honest-but-Curious Adversaries

Let HE = (KeyGen HE , E HE , D HE ) be a homomorphic encryption scheme, such as Paillier, and OP SE = (KeyGen OP SE , E OP SE , D OP SE ) be an orderpreserving symmetric encryption scheme. The protocol Π P I we propose consists of four phases: system setup, precomputation, authentication, and AAD update. The protocol works as follows:

System Setup. Performed once for each device, KeyGen HE and KeyGen OP SE are run to generate the HE key pair (pk, sk) and the OPSE key k 2 . Public parameters of the two encryption systems HE and OPSE, including pk, are communicated to the carrier. Precomputation. At any point during the life of the system, the carrier has stored an accumulated user profile containing E HE pk (v i (t j )), E OP SE k2 (v i (t j )) for j = 1, . . . , l i . Before the start of the authentication protocol, the carrier precomputes E HE pk (AAD(V i )) as follows. It first computes:

E HE pk ( AAD(V i ) • l i ) = li j=1 E HE pk (v i (t j )) -E HE pk (Med(V i )) ,
where Med(V i ) denotes the median element of V i and can be found using the OPSE ciphertexts stored in the profile. Then the constant factor l i is removed using the scalar multiplication property of the homomorphic encryption HE. In Paillier cryptosystem, this is done by raising E HE pk (AAD(V i ) • l i ) to the power of l -1 i , where l -1 i is precomputed once and stored along with l i as system parameters. Authentication. Device samples the features (i.e. user data) using its modules. For each feature value v i (t), 1 ≤ i ≤ n, at time t, device computes a pair of encrypted values, e i (t) = (

E HE pk (v i (t)), E OP SE k2 (v i (t))
). The HE ciphertext allows the carrier to perform necessary computations, namely addition and scalar multiplication, in the encrypted domain, while the OPSE ciphertext helps the carrier find the order information necessary to the computation.

Device sends e i (t) values to the carrier. Using these values, carrier calculates E HE pk (b i l (t)) and E HE pk (b i h (t)) as follows:

E HE pk (b i l (t)) ← E HE pk (v i (t)) -E HE pk (AAD(V i )) E HE pk (b i h (t)) ← E HE pk (v i (t)) + E HE pk (AAD(V i )) where V i = {v i (t 1 ), . . . , v i (t li )} and E HE pk (AAD(V i )) is pre-computed as dis- cussed.
Carrier however does not know the order of the newly generated encrypted values with respect to the stored ciphertexts in the user profile. To find the order, carrier interacts with the device: carrier first sends E HE pk (b i l (t)) and E HE pk (b i h (t)) (for all features) back to the device. Device decrypts the ciphertexts using the decryption function D HE sk and gets b i l (t) and b i h (t), and then encrypts the result to find

c i l (t) = E OP SE k2 (b i l (t)) and c i h (t) = E OP SE k2 (b i h (t))
, respectively, using the OPSE scheme. Device sends c i l (t) and c i h (t) back to the carrier. Carrier computes the individual score s i (t) as the number of the OPSE ciphertexts

E OP SE k2 (V i ) in the profile that satisfy c i l (t) ≤ E OP SE k2 (V i ) ≤ c i h (t). Note that this condition is equivalent to b i l (t) ≤ V i ≤ b i h (t)
. The same process is used for all features. The final authentication score is then calculated using the score combination method, e.g. the weighted sum method described earlier. Finally, the final calculated score determines if implicit authentication is successful or not. If implicit authentication is not successful, the device is challenged on an explicit authentication method, e.g. the user is logged out of a service and prompted to log in anew by providing a password. AAD Update. If implicit authentication is successful, or if it is unsuccessful however the device subsequently succeeds in explicitly authenticating itself, then the AAD needs to be updated using the new encrypted features provided in the authentication phase. The current feature history includes a vector of size l i . The new feature is added to this vector first, and then, depending on the carrier's strategy, the oldest feature might be discarded to keep the vector size constant. In both cases, recalculating the AAD only needs constant-size differential calculations and there is no need to recompute AAD from scratch (which instead would be linear in the size of the vector). The reason is that when the median is shifted, for almost half of the existing feature values, the absolute deviation increases by the difference of the old and new medians, and for almost all of the rest of the existing feature values, the absolute deviation decreases by the same value, and these almost totally cancel each other out. Only a few calculations are needed eventually to account for the few that do not cancel out, plus the possible discarded feature, and the new feature.

Complexity. We discuss the computation complexity of the precomputation, authentication, and update phases of our protocol in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF]. We implement Paillier and OPSE to confirm computation benchmarks in the literature, and calculate concrete running times for our protocol. In particular, we show that authentication takes less than 300 milliseconds on a typical device as a background process, and hence our protocol is able to protect user privacy with an insignificant computation overhead cost.

Security. We discuss the security of our protocol considering honest-but-curious devices and carriers in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF]. We provide a formal definition of privacy for our protocol against honest-but-curious devices and carriers. The definition intuitively guarantees that by participating in the protocol, the device only learns the AAD of the usage data stored at the carrier side, and the carrier only learns little beyond the order information of the current sample with respect to the stored data. We argue that the AAD and order information learned during the protocol reveal little about the actual content of the data in question, and hence our definition guarantees a high level of privacy. Eventually, in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF], we prove the following theorem guaranteeing the privacy of our protocol: Theorem 1. Protocol Π P I is provably secure against honest-but-curious devices and honest-but-curious network carriers.

Securing the Protocol against Malicious Devices

In the above version of the protocol, secure against honest but curious adversaries, in the authentication phase the carrier interacts with the device as follows:

the carrier sends homomorphic ciphertexts E HE pk (b i l (t)) and E HE pk (b i h (t)) to the device and the device is expected to reply back order-preserving ciphertexts of the same plaintexts, i.e. E OP SE k2 (b i l (t)) and E OP SE k2 (b i h (t)). These order-preserving ciphertexts are subsequently used to compare the values of b i l (t) and b i h (t) in the order-preserving ciphertext space with the feature values and find out how many feature values lie between b i l (t) and b i h (t). However, a malicious device cannot be trusted to return correctly formatted order-preserving ciphertexts. In the following, we propose a modified version of the protocol secure against malicious devices. We call this modified version Π P I * .

First, we note that the device cannot be forced to use an honest feature value v i (t) to start with. In the absence of a trusted hardware such as tamper-proof hardware, the device may enter the interaction with the carrier on any arbitrary input. Even with the recent advances in smartphone technology, e.g. ARM's TrustZone [1], the device cannot be prevented to change the sensor readings unless the whole algorithm is run in the so called Trusted Execution Environment (TEE). However, the device can be required to show that the ciphertext E HE pk (v i (t)) is well-formed. To enforce this requirement, we require that the device sends an interactive proof of knowledge of the corresponding plaintext v i (t) along with the ciphertext E HE pk (v i (t)). Proofs of knowledge of plaintext exist for most public key encryption schemes. For Paillier encryption, a concrete proof protocol can be found in [START_REF] Baudron | Practical Multi-Candidate Election System[END_REF], which can be made non-interactive using the wellknown Fiat-Shamir heuristic.

Apart from inclusion of the above proof of knowledge, further modification is required to make the protocol secure against malicious devices. The main idea here is as follows: instead of asking the device for order-preserving ciphertexts, the ability to interact with the device is used to directly compare b i l (t) and b i h (t) with the feature values, only using the homomorphic ciphertexts. In each round of interaction b i l (t) (resp. b i h (t)) is compared with an element of the feature vector. The relative position of b i l (t) (resp. b i h (t)) within the elements of the feature vector can be hence found in log l i rounds of interaction following a binary search algorithm.

Assume that in one round the carrier wishes to compare b i l (t) with v i (t j ). The carrier has homomorphic encryptions of both, i.e. E HE pk (b i l (t)) with E HE pk (v i (t j )), and hence can calculate E HE pk (b i l (t) -v i (t j )). The carrier is interested in knowing whether b i l (t) -v i (t j ) is positive, negative, or zero. The carrier chooses k random values and encrypts them using the homomorphic encryption scheme. It also randomises E HE pk (b i l (t) -v i (t j )) using scalar multiplication by either a positive or a negative random blinding factor. The carrier finally shuffles all the k + 1 ciphertexts, including the k random cipheretxts and the blinded version of E HE pk (b i l (t)-v i (t j )), and sends them all to the device. The device decrypts all the received ciphertexts and replies back to the carrier with k+1 responses indicating whether each of the received ciphertexts decrypt to a positive, negative, or zero plaintext. The carrier knows what the response should be for the k random ciphertexts. Hence, it will first check whether all such responses are as expected.

If they are, then the carrier deducts whether b i l (t) -v i (t j ) is positive, negative, or zero, by reversing the effect of the random blinding factor.

The idea in the above interaction is that since all the k + 1 challenges look random (and hence indistinguishable) to the device, a malicious device has at most 1 k+1 chance of cheating and not getting caught. k is a parameter of the protocol and controls a trade-off between complexity and security. The larger k is, the less chance there is for a malicious device to cheat, but at the same time the higher the complexity of the protocol is.

Note that even if the device manages to cheat and not get caught, it does not gain any meaningful advantage in impersonating a legitimate user since the b i l (t)-v i (t j ) value is blinded before being sent to the device. Blinding changes the sign of the b i l (t) -v i (t j ) value with 50% probability. A malicious device therefore is not able to tell which behaviour, being honest or cheating, works in its favour.

Complexity. We discuss the computation complexity of the modified protocol in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF]. In particular, we show that an authentication failure is discovered in less than 4 seconds after the first feature reading is reported by the device.

Security. We discuss the security of our protocol considering malicious devices in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF]. We provide a formal definition of privacy for our protocol against maliciously-controlled devices. The definition intuitively guarantees that even if the device is maliciously controlled, it will not be able to learn any information more than what it would learn during an honest execution of the protocol. Eventually, in the full version of this paper [START_REF] Safa | Privacy-Preserving Implicit Authentication[END_REF], we prove the following theorem guaranteeing the privacy of our protocol: Theorem 2. Protocol Π P I * is provably secure against maliciously-controlled devices (with probability at least k k+1 ), and is provably secure against honestbut-curious carriers.

Conclusion

In this paper we proposed a privacy preserving implicit authentication system that can calculate authentication score using a realistic scoring function. We argued that using user behaviour as an additional factor in authentication has attractive applications. We showed that by relaxing the notion of privacy, one can construct efficient protocols that ensure user privacy and can be used in practice. The low computation and communication complexity of our proposed protocol in the case of semi-honest adversary makes it executable almost in real-time for carrier and modern MIDs. We also provided a modification to the basic protocol to ensure security in the case of a malicious device. Our proposed protocol in this case, has a complexity that grows logarithmically with the size of the user profile. We argued that this translates into a reasonable time-frame for implicit authentication with protection against malicious devices. A complete implementation of the system will be our future

Notation.

  Fig. 1. The System Architecture


L Campagne

L Daridon

O Oussouaddi

S Ahzi

X Sun

Simulation of the Taylor impact test and analysis of damage evolution using a nucleation and growth based approach

Keywords: Taylor Impact, high strain rates, viscoplasticity, void nucleation, void growth, finite element

Computational modeling of the Taylor impact test, using OFHC copper rods are carried out for two impact velocities ( and 365

). The aim of this work is to demonstrate the efficiency of the recently proposed material model for dynamic plasticity and failure for metals.

This model combines the use of a damage approach based on void nucleation and growth, with the Mechanical Threshold Stress (MTS) model for the evolution of the flow stress in isotropic plasticity. The proposed approach is implemented in the finite element code ABAQUS/Explicit via a user material subroutine and the symmetric Taylor impact test, using copper rods, is simulated.

The predicted results are compared to the experimental results reported in the open literature and good agreement is found for both shape change and damage distribution.

Introduction

In 1948, Taylor [START_REF] Taylor | The use of flat-ended projectiles for determining dynamic yield stress. I: theoretical considerations[END_REF], Whiffen [START_REF] Whiffen | The use of flat-ended projectiles for determining dynamic yield stress. II: test on various metallic materials[END_REF] and Carrington and Gayler [START_REF] Carrington | The use of flat-ended projectiles for determining dynamic yield stress. III: changes in microstructure caused by deformation under impact at high-striking velocities[END_REF] conducted series of tests to determine the dynamic yield stress of materials deformed at very high strain rates. For the last 60 years, many studies have been carried out around this test. During the 1980s and 1990s, Taylor impact experiments were performed to study the material mechanical properties under dynamic loading at high strain rates in the range of - 10 s - [START_REF] Johnson | A constitutive model and data for metals subjected to large strains, high strain rates and high temperatures[END_REF][START_REF] Zerilli | Dislocation-mechanics-based constitutive relations for dynamics calculations[END_REF][START_REF] Johnson | Evaluation of Cylinder-impact Test Data for constitutive Models Constants[END_REF][START_REF] Pazienza | Determination of the Armstron-Zerilli Constitutive Model for AISI 316 H Stainless Steel and Application to cylinder Impact Tests, 7 th Dymat Technical Conf[END_REF][START_REF] Allen | Use of the Taylor Impact Test to determine Constant for materials strength models[END_REF]. Recently, work on Taylor impact (Experiment and modelling) has been reported by numerous investigators; for instance Addessio et al. [START_REF] Addessio | The effect of void growth on Taylor cylinder impact experiments[END_REF], Maudlin et al. [START_REF] Maudlin | A continuum mechanics code analysis of steady plastic wave propagation in the Taylor test[END_REF], Rule and Jones [11] among many others. In 1999, House et al. [START_REF] Rule | A revised form for the Johnson-Cook strength model[END_REF] showed how the high-speed photography can be used to approximate the strain rate and the stressstrain curves for the tested material. This study can give additional information on the constitutive properties of material under high strain rate conditions. In 2003, an experimental investigation was reported by Wang et al. [START_REF] Wang | Taylor impact test for ductile porous materials-Part2[END_REF] to study the influence of porosity on the dynamic yield stress of porous metals under high loading rates.

The classic Taylor impact consists of impacting (using a gas gun) a cylindrical rod of the material being tested against an infinitely rigid target [START_REF] Taylor | The use of flat-ended projectiles for determining dynamic yield stress. I: theoretical considerations[END_REF]. The symmetric version of the Taylor impact test is achieved by impacting a stationary target rod with an initial radius, init R , and an identical flyer rod as shown in Figure 1. The impactor and target have an initial cross-sectional area with respectively initial length, , , and an initial material density The strain rate and temperature dependency become particularly important at high strain rate where adiabatic plastic flow may produce significant temperature changes in the material. Several constitutive models have been developed to describe the material deformation behaviour as a function of strain-rate and temperature under dynamic loading. Some of these models are based on dislocations overcoming obstacles through thermal activation as in the Mechanical Threshold Stress (MTS) model [START_REF] Follansbee | A Constitutive Description of the Deformation of Copper Based on the Use of the Mechanical Threshold Stress as an Internal State Variable[END_REF] and the Zerilli-Armstrong model [START_REF] Zerilli | Dislocation-mechanics-based constitutive relations for dynamics calculations[END_REF] and the model of Molinari and

Ravichandran [START_REF] Molinari | Constitutive modeling of high-strain-rate deformation in metals based on the evolution of an effective microstructural length[END_REF]. Others models are based on phenomenological approach such as the model of Molinari and Clifton [START_REF] Molinari | Micromechanical modelling of porous materials under dynamic loading[END_REF], Klopp et al. [START_REF] Klopp | Pressure shear impact and the dynamic viscoplastic response of metals[END_REF] and the Johnson-Cook [START_REF] Johnson | A constitutive model and data for metals subjected to large strains, high strain rates and high temperatures[END_REF] model. The material failure under high strain rate can be divided into two categories: dynamic fracture and dynamic shear localization. We are interested in the case of dynamic failure by fracture involving nucleation, growth, and coalescence of voids or cracks. These mechanisms of failure in polycrystalline materials are often dislocation controlled. Most of the existing failure models are based on phenomenological approaches rather than mechanistic approaches. Reviews of these models can be found in the literature (see for instance Hanim and Ahzi [START_REF] Hanim | A unified approach for pressure and temperature effects in dynamic failure criteria[END_REF]). Several mechanistic-based (void nucleation and growth) approaches for dynamic failure were proposed in the literature. In the works of Tuler and Butcher [START_REF] Tuler | A criterion for time dependence of dynamic fracture[END_REF], Gilman [START_REF] Gilman | Micromechanics of flow in solids[END_REF] an empirical law was proposed to predict spall damage.

However, the works of Curran et al. [START_REF] Curran | Dynamic Failure of Solids[END_REF], Rajendran et al. [START_REF] Rajendran | A void nucleation and growth based failure model for spallation[END_REF] and Addessio et al. [START_REF] Addessio | The effect of void growth on Taylor cylinder impact experiments[END_REF] are based on mechanistic approaches considering void nucleation and growth.

In this paper, we make use of the recently proposed model by Campagne et al. [START_REF] Campagne | A physically based model for dynamic failure in ductile metals[END_REF] for dynamic plasticity and failure in metals to simulate the flow behaviour and damage evolution in OFHC copper rods under symmetric Taylor impact test. The simulations are carried out by implementing the proposed constitutive laws in the commercial finite element code ABAQUS/Explicit [START_REF]Abaqus/Explicit, User's Manual[END_REF] via a user material subroutine VUMAT. The proposed modelling approach combines the MTS model for the flow stress with a model for spherical void nucleation and growth under high strain rates. This model accounts only for a weak coupling between damage and the stress-strain response since it allows the evolved damage to degrade the elastic properties only. The results obtained can therefore be considered as a first approximation. The obtained results from the proposed mechanistic approach are compared to the ones computed using the phenomenological model of Johnson-Cook [START_REF] Johnson | A constitutive model and data for metals subjected to large strains, high strain rates and high temperatures[END_REF] and the experimental result of Addessio et al. [START_REF] Addessio | The effect of void growth on Taylor cylinder impact experiments[END_REF]. Stress": σ . This internal state variable is a function of two components: an athermal stress ˆa σ and a thermally activated stress ˆt σ due to dislocation interaction. Based on this assumption, Follansbee

and Kocks [START_REF] Follansbee | A Constitutive Description of the Deformation of Copper Based on the Use of the Mechanical Threshold Stress as an Internal State Variable[END_REF] derived the following expression for the flow stress y σ :

( ) ( )

1 1 0 3 0 1 p q p eq p y a t eq a a eff kT ˆˆˆˆŜ ,T g G b ε ε σ σ σ ε σ σ σ ⎛ ⎞ ⎡ ⎤ ⎛ ⎞ ⎜ ⎟ ⎢ ⎥ ⎜ ⎟ ⎜ ⎟ ⎜ ⎟ ⎢ ⎥ ⎜ ⎟ ⎝ ⎠ = + = + - -⎢ ⎥ ⎜ ⎢ ⎥ ⎜ ⎟ ⎢ ⎥ ⎜ ⎟ ⎢ ⎥ ⎜ ⎟ ⎣ ⎦ ⎜ ⎟ ⎝ ⎠ ⎟ (1)
where is the effective shear modulus (defined in paragraph 2.2), is the Boltzmann constant, is the temperature, is the Burger's vector,

eff G k T b
eq ε is the equivalent plastic strain rate, 0 ε is a reference strain rate, is the normalized activation energy, and and q are the constants that characterize the shape of the energy barrier (obstacle) profile. The scaling factor S depends on strain rate and temperature.

g p

The hardening rate, θ for OFHC copper which takes into account the dislocation accumulation and the dynamic recovery, is expressed by the following relation:

( ) 0 1 with a p s a eq ˆd tanh(2X) F( X ) F(X)= and X= ˆtanh(2) d σ σ σ θ θ σ σ ε - = = - - (2)
where 0 θ is an experimentally determined stage II strain-hardening rate and s σ is the saturation stress, given by the following expression:

3 0 0 0 S S p S eq Ĝb g ln ln kT ε σ ε σ ε ⎛ ⎞ ⎛ ⎞ ⎜ ⎟= - ⎜ ⎜ ⎟ ⎝ ⎠ ⎝ ⎠ S ⎟ (3)
Here, 0 s ε is the saturation strain rate at 0 , K 0 s σ describes the saturation threshold stress for the deformation at 0 and K 0 s g ε is a normalized activation energy for dislocation-dislocation interaction.

The MTS model accounts for the softening due to the adiabatic heating through the update of the temperature T during the high strain rate deformation. In this case, the temperature rise is given by:

T ∆ p ij ij p T C d χ ∆ σ ρ = ∫ ε (4)
where ij σ are the Cauchy stress tensor components, ij p dε are the increment of plastic strain tensor components, χ is the fraction of plastic work converted to heat, ρ is the density and is the specific heat. The parameters of the MTS model used in our finite element simulations and the material data for OFHC copper rods are given in Table 1 andTable 2 [14].

p C

Material parameters OFHC copper

Normalized activation energy 0 g 1 6 .

p 2 3 / q 1 Stress at 0K 0 s σ [ MPa ] 900
Saturation strain rate at 0 K 0

s ε [ ] -1 s 7 10
Initial strain hardening rate 0

θ [ MPa ] 2315 Athermal stress a σ [ MPa ] 40
Table1. MTS-Model parameters (for OFHC) [START_REF] Follansbee | A Constitutive Description of the Deformation of Copper Based on the Use of the Mechanical Threshold Stress as an Internal State Variable[END_REF] Material data OFHC copper

Specific heat [ ] p C J / kgK 385

Taylor-Quinney's coefficient χ 0 9 .

Poisson's coefficient ν 0 351 .

Young Modulus E [ GPa ] 127 72 .

Density 0 ρ [ ] 3 kg / m 8960 Melting temperature [ m T K ] 1356 3 k / b [ MPa / K ] 0 823 . Shear modulus [ ] GPa 47 27 .
Table2. Material properties for OFHC copper [14]

Damage evolution and failure criterion

In order to model damage evolution, we proposed to use a mechanistic model [START_REF] Campagne | A physically based model for dynamic failure in ductile metals[END_REF]. This approach, associated with the MTS model for plasticity, is based on void nucleation and growth (NAG). As we are interested in high strain rates loading where the damage can quickly reach its critical value for failure due to the rapid void growth, void coalescence process can therefore be neglected.

In the following, we briefly address the constitutive equations used for the damage model since the details can be found in the work of Campagne et al. [START_REF] Campagne | A physically based model for dynamic failure in ductile metals[END_REF]. The material porosity factor is determined from the total relative void volume and given by:

f T V 1 T T V f V = + (5)
where can be expressed as the sum of relative volumes due to preexisting, nucleation and growth of voids:

T V (6) ( ) 0 t T I N N G V V V V dt V ε σ = + + + ∫ in which,
, is the initially relative void volume, is the relative void volume produced by growth,

I V G V N
V ε and N V σ are the relative void volume rates due to nucleation controlled by strain and stress respectively.

(

) 7
3 0 8

I I V N π = R
where 0 R is a nucleation size parameter, which is assumed to be the same for preexisting and nucleated voids. The term is the number per unit volume of preexisting voids.

I N

The nucleated void volume rate controlled by strain is given by:

3 0 0 0 8 w h e r e 1 N V R N N N exp t ε ε ε γ π γ ω ⎡ ⎤ ⎛ ⎞ = = - - ⎢ ⎥ ⎜ ⎝ ⎠ ⎟ ⎣ ⎦ ( 8
)
where ω is a frequency factor and is a material constant which represents the density of nucleation sites per unit time (which can be determined as the density of nucleation sites divided by the incubation time). Also, 0 N 0 N γ and 0 γ are the shear strain rate and reference shear strain rate, respectively.

The nucleated void volume rate controlled by stress is given by:

0 0 0 3 1 0 0 8 w h e r e 0 s N s N N s N P P N N exp if P P P V R N N if P P σ σ σ σ π ⎧ ⎛ ⎞ - = 〉 ⎪ ⎜ ⎟ ⎪ ⎝ ⎠ = ⎨ ⎪ = ≤ ⎪ ⎩ (9)
where s P is the tensile pressure, 0 N P the nucleation threshold pressure and is a reference pressure 1 P Therefore, the relative nucleation void volume, N V ε , controlled by strain is given by:

3 0 0 0 0 0 0 8 1 8 t t N N V V dt R N exp t dt R N 3 ε γ π ω ε ε γ ⎡ ⎤ ⎛ ⎞ ⎛ ⎞ = = - - = ⎢ ⎥ ⎜ ⎟ ∫ ∫ ⎜ ⎟ ⎜ ⎟ ⎢ ⎥ ⎝ ⎠ ⎝ ⎠ ⎣ ⎦ π (10)
And, the relative nucleation void volume, N V σ , controlled by pressure is given by: The tensile pressure is defined from the equation of state. Here, we use the Mie-Grüneisen equation [START_REF] Meyers | Dynamic behavior of materials[END_REF]:

0 3 0 0 0 1 0 8 t t N N N Ps P V V dt R N exp dt R N P 3 0 8 σ σ σ π + ⎛ ⎞ - ⎜ ⎟ = = = ∫ ∫ ⎜ ⎟ ⎝ ⎠ π (
S P 0 1 s s s I P C' E ρ Γρ ρ ⎛ ⎞ = -+ ⎜ ⎟ ⎝ ⎠ ( 12
)
where C' is the bulk modulus ( ), The nucleated microscopic voids will subsequently grow if the applied stress exceeds the growth threshold stress, 0 g σ . The growth equation for the radius of a void is expressed as follow [START_REF] Campagne | A physically based model for dynamic failure in ductile metals[END_REF]:

( ) 2 0 2 2 0 1 16 eff t m g * h 0 R R exp dt g G t π υ σ σ + ⎛ ⎞ - ⎛ ⎜ = - ∫ ⎜ ⎜ ⎝ ⎠ ⎝ ⎠ ⎞ ⎟ ⎟ ⎟ 〉 (13)
In equation ( 13), designates the positive part of . g is a constant, which is representative of the type of the growth process [START_REF] Weertman | Fatigue crack growth theory for ductile material[END_REF].

To perform the simulation of planar impact, the loading cycle is evaluated by the shock theory [START_REF] Meyers | Dynamic behavior of materials[END_REF]. The initial duration of the peak shock pulse in an impact is approximately equal to twice the * t travel time of the shock wave through the projectile. Thus, to determine the loading cycle , we use the following approximate expression:

* t 0 2 * S d t U = (14)
where is the thickness of the projectile and the linear shock velocity 0 d s U is defined by the linear Hugoniot form:

0 S U C sU P = + (15)
where is the velocity of the elastic wave, is an empirical parameter available in the literature for many materials [START_REF] Meyers | Dynamic behavior of materials[END_REF] and is the particle velocity. The velocity of the elastic wave is defined by the following expression:

( ) ( )( )

1 2 0 0 1 1 1 2 E C υ ρ υ υ ⎛ ⎞ - = ⎜ ⎜ + - ⎝ ⎠ ⎟ ⎟ (16)
We have recently proposed this NAG model and used it to predict dynamic failure in different shock problems using the finite element code ABAQUS/Explicit: spalling in planar impact including two geometries are considered, Taylor impact, perforation [START_REF] Campagne | Modélisation et simulation de la viscoplasticité et de l'endommagement en grandes vitesses de déformation[END_REF] and to simulate the blanking process of thin copper sheets [START_REF] Poizat | Modeling and simulation of thin sheet blanking using damage and rupture criteria[END_REF].

Based on the relationship for size distribution proposed by Curran et al. [START_REF] Curran | Dynamic Failure of Solids[END_REF], the relative void volume through growth is obtained by integration over the entire distribution (Eq. 13). The relative volume produced by growth arises from the growth of both nucleated and existing voids, and it can be described by the following equation:

G V [ ] ( )
2 3 0 0 2 2 0 3 1 8 1 16 t G I m e a n g * eff h V R N N N exp dt g G t ε σ π ν π σ + ⎡ ⎤ ⎛ ⎞ - ⎛ ⎞ ⎢ ⎥ ⎜ ⎟ = + + - ∫ ⎜ ⎟ ⎜ ⎟ ⎝ ⎠ ⎢ ⎥ ⎝ ⎠ ⎣ ⎦ σ - (17)
Using Eq. ( 17), ( 10) and ( 7), equation (6) becomes:

[ ] ( )

2 3 0 0 2 2 0 3 1 8 16 t T I m g * eff h V R N N N exp d g G t ε σ π υ π + ⎛ ⎞ - ⎛ ⎜ = + + - ∫ ⎜ ⎜ ⎝ ⎠ ⎝ ⎠ t σ σ ⎞ ⎟ ⎟ ⎟ (18)
The creation of cavities inside a material domain modifies the mechanical properties of this domain.

A damage parameter is introduced so that the elastic modulus and shear modulus are reduced with increasing damage.

eff eff eff eff E E d G G d E E G G d = - = - ⎧ ⎪ ⎨ = = - ⎪ ⎩ ( 19
)
where, E and G are their corresponding initial (undamaged) values. In all of the previous equations, the elastic moduli are updated according to [START_REF] Tuler | A criterion for time dependence of dynamic fracture[END_REF]. The porosity is determined from the total relative void volume (Eq. 5).

f T V
The failure criterion is based on a critical porosity which can be expressed as follows:

C f Damage Failure c c f f f=f 〈 ⇒ ⇒ ( 20
)
The damage parameter d can be derived, as function of the effective porosity * f , from a self- consistent approach [START_REF] Zaoui | Comportement mécanique des matériaux, Tome: Elasticité et Plasticité[END_REF]:

( )

15 1 7 5 * d υ υ - = - f (21)
Here, isotropy is assumed and the porosity factor is assumed to be uniformly distributed. The f . The damage evolution in ductile metals begins after a threshold strain [START_REF] Lemaitre | A Course on Damage Mechanics[END_REF][START_REF] Bonora | A nonlinear CDM model for ductile fracture[END_REF] associated in our case to threshold porosity t f . The effective porosity * f is defined by the following relation [START_REF] Campagne | A physically based model for dynamic failure in ductile metals[END_REF]:

[ ] [

0 i f if if * t * t c c t * c c f f 0, f f f ] t c f f f f , f f f f f f f ⎧ = ∈ ⎪ ⎛ ⎞ - ⎪ = ⎨ ⎜ ⎟ - ⎝ ⎠ ⎪ ⎪ = ≥ ⎩ ∈ ( 22
)
This model is implemented in the Finite Element Code ABAQUS/Explicit [START_REF]Abaqus/Explicit, User's Manual[END_REF] via a user material subroutine (VUMAT). The material parameters for the mechanistic damage model are given in Table 3. Their values lay in a physically acceptable range defined by Curran et al. [START_REF] Curran | Dynamic Failure of Solids[END_REF] and

Weertman [START_REF] Weertman | Fatigue crack growth theory for ductile material[END_REF].

Material parameters data OFHC copper

Nucleation void radius 0 R [ ] m

The Johnson-Cook model

We recall here the basic equations of the dynamic plasticity model of Johnson-Cook [START_REF] Johnson | A constitutive model and data for metals subjected to large strains, high strain rates and high temperatures[END_REF] expresses the evolution of the phenomenological flow stress as a function of the strain, strain rate and temperature. The flow stress is given by multiplicative effects:

( ) 0 1 1 m n r y m r T T A B Cln T T ε σ ε ε ⎛ ⎞ ⎛ ⎞ ⎡ - ⎜ = + + - ⎜ ⎟ ⎤ ⎟ ⎢ ⎥ - ⎜ ⎟ ⎝ ⎠ ⎣ ⎝ ⎠ ⎦ (23)
where and are material parameters, A,B,C,n m ε is the strain rate, 0 ε is a reference strain rate which is usually taken equal 1 , is a reference temperature and is the melting temperature. This model is purely phenomenological and does not take into account any history effect. This model is widely used in basic studies of dynamic plasticity problems and has the advantage of being already implemented in commercial finite elements codes such as ABAQUS. However, the strong coupling between damage evolution and flow stress evolution is not considered.

The corresponding tensile failure criterion of Johnson-Cook, which is already implemented in the commercial finite elements code ABAQUS [START_REF]Abaqus/Explicit, User's Manual[END_REF], is given by:

mean c σ σ = (24)
The material parameters for the phenomenological approach are given in Table 4.

Parameters OFHC copper

Yields stress 0

σ [ MPa ] 90 B [ MPa ] 292 C 0 025 . n 0 31 . m 1 09 . 0 ε 1 Reference temperature [ r T K ] 300
Table4. Parameters data for the Johnson-Cook model for OFHC copper [START_REF] Tanner | Modelling temperature and strain rate history effects in OFHC Cu[END_REF] 4. Application to dynamic failure during the Taylor impact test

In Taylor impact test, a radial relief wave is generated at the lateral surface of the target. At high projectile velocities, when the decompression wave reaches the centerline (symmetry axis in figure 2) of the target (decompression waves collide) results in a region of tension in which the magnitude of the tensile wave can be sufficiently high to produce a damaged zone along the center line of the impacted specimen (figure 2). Furthermore, a plasticized zone appears in the impacted region (figure 2).

In this simulation, rod on rod impact with the same geometries is considered in the work of Addessio et al. [START_REF] Addessio | The effect of void growth on Taylor cylinder impact experiments[END_REF]. The projectile and target materials are OFHC copper of cylindrical shapes and their respective dimensions and boundaries are shown in figure 3.

In this study, the predicted results with two approaches are compared: a physical approach considering the "Mechanical Threshold Stress" model associated with the NAG damage model and a phenomenological approach considering the dynamic plasticity model of Johnson-Cook associated with corresponding tensile rupture criterion described previously. Table 5 summarises the predicted separation time of the projectile from the target for an impact velocity of . 260m / s

Symmetry axis

Porous zone

Plasticized zone These results show that the separation time period (opening of the gap at the cylinder base) is shorter using the physical approach than the phenomenological one (see also figure 4 and figure 5 for an impact at ). This gap appears after the radial release waves arrive at the centreline of the cylinder.

260m / s µ and according to various approaches For an impact velocity of the simulation results using either the physical approach or the phenomenological approach show a similar failure zone along the cylinder axis (see figure 6 and figure 7). This porosity is due to the decompression wave when reaches the centerline of the target (decompression waves collide). It results in a region of tension in which the magnitude of the tensile wave is sufficiently high to produce a porous zone along the center line of the impacted 260m / s, specimen. A similar result is observed in experiment [START_REF] Addessio | The effect of void growth on Taylor cylinder impact experiments[END_REF]. This porosity is created by nucleation which is controlled by pressure. However, the physical approach results in a strong porosity zones on the cylinder periphery (see figure). These defects are created by nucleation which is controlled by the deformation.

For an impact velocity of , similar results for porosity are obtained in the degraded zone (along the axis) for Taylor impact test considering by the two approaches (Johnson-Cook approach and MTS+NAG approach) at 2 5 365m / s . s µ (see Figure 8 and Figure 9). Moreover, the MTS+NAG approach predits porosity in the plastified zone, which is not predicted by the Johnson-Cook approach.

In Figure 10, the profile generated using the proposed (mechanistic) approach is in better agreement with the experimental data than the Johnson Cook model. The difference between our predicted profile and the experimental one, which is about 9 percent [see Table 6], can potentially be improved using a stronger damage-thermo-mechanical coupling.

Conclusion

A computational modeling of Taylor impact on OFHC copper rods are carried out for two impact velocities ( 260 and ), using a physical approach (MTS+NAG models) as well as a phenomenological approach (Johnson-Cook approach). Similar qualitative results for porosity are obtained (for the two velocities) in the degraded zone (along the axis) for Taylor impact test by both approaches. In contrast to the phenomenological approach, our mechanistic approach results in a stronger porosity zone on the cylinder periphery. For an impact velocity of 365 , the profile generated using the proposed (mechanistic) approach is in better agreement with the experimental data than the Johnson Cook type approach. However, some differences between the predicted profiles and the experimental data still remain, and the results can potentially be improved using a strong thermo-mechanical coupling. Nonetheless, the Johnson-Cook approaches (for viscoplasticity and damage) implemented in standard Abaqus/Explicit can not be used with a strong thermomechanical coupling. In addition, this phenomenological approach does not predict damage evolution.

m / s 365m / s m / s

X

  denote the length of the entire deformed and the undeformed section of the impactor and target, respectively.

Figure 1 . 2 . Viscoplasticity and damage evolution modeling 2 . 1

 1221 Figure 1. Schematic of the symmetrical Taylor impact test

ρ

  the current density and 0 ρ the initial density.

  To grow, the void should have nucleated (or preexisted) and the mean stress m

d

  We introduce the notion of effective elastic modulus to account for damage effects on the elastic properties during loading. The effective Young modulus and

f

  is defined such that damage initiates at threshold porosity t f , and that failure occurs when d reaches a critical value corresponding to the critical porosity c d c

  parameters for the proposed mechanistic model for damage evolution and for failure in OFHC copper[START_REF] Campagne | Modélisation et simulation de la viscoplasticité et de l'endommagement en grandes vitesses de déformation[END_REF]

Figure 2 .Figure 3 .

 23 Figure 2. Schematic of the cylinder profile and porosity contour after the impact

Figure 4 .

 4 Figure 4. Calculated porosity contour for = considering Johnson-Cook approach at 3 7 i V 260m / s

Figure 6 Figure 7 .

 67 Figure 6. Porosity contour for = considering Johnson-Cook approach at 3 7 i V 260

  Figure 8. Porosity contour for = considering Johnson-Cook approach at i V 365m / s

  Figure 9. Porosity contour for = 365 considering MTS+NAG approach at i V m / s 2 5 . s µ .

Figure 10 .

 10 Figure 10. Comparison of experimental and simulated final cylinder profiles for the impact velocity of 365 m / s

Table 6

 6 summarises the numerical results of the projectile final diameter, at2 5

	. s µ , for two

Table 5 .

 5 Comparison of the time of separation of the projectile

	at	260m / s	and according to various approaches

Table 6 .

 6 Comparison of the final diameter of the projectile at various

	speeds at 2 5 . s