Marie-Hélène Beausejour

Yvan Petit

Jeremy Hagen

Pierre-Jean Arnoux

Jean-Marc Mac Thiong

Eric Wagnac
email: eric.wagnac@etsmtl.ca

Contribution of Injured Posterior Ligamentous Complex and Intervertebral Disc on Post-Traumatic Instability at the Cervical Spine

Keywords: spine, disco-ligamentous structures, post-trauma, injury biomechanics, finite element modeling

Posterior ligamentous complex (PLC) and intervertebral disc (IVD) injuries are common cervical spine flexion-distraction injuries, but the residual stability following their disruption is misknown. The objective of this study was to evaluate the effect of PLC and IVD disruption on post-traumatic cervical spine stability under low flexion moment (2 Nm) using a finite element (FE) model of C2-T1. The PLC was removed first and a progressive disc rupture (one third, two thirds and complete rupture) was modeled to simulate IVD disruption at C2-C3, C4-C5 and C6-C7. At each step, a non-traumatic flexion moment was applied and the change in stability was evaluated. PLC removal had little impact at C2-C3 but increased local range of motion (ROM) at the injured level by 77.2% and 190.7% at C4-C5 and C6-C7 respectively. Complete IVD rupture had the largest impact on C2-C3, increasing C2-C3 ROM by 181 % and creating a large anteroposterior displacement of the C2-C3 segment. The FE analysis showed PLC and disc injuries create spinal instability. However, the PLC played a bigger role in the stability of the middle and lower cervical spine while the IVD was more important at the upper cervical spine. Stabilization appears important when managing patients with soft tissue injuries.

Introduction

The posterior ligamentous complex (PLC), which comprises the ligamentum flavum (LF), interspinous ligament (ISL) and nuchal ligament (NL) [START_REF] Rasoulinejad | The importance of the posterior osteoligamentous complex to subaxial cervical spine stability in relation to a unilateral facet injury[END_REF], and the intervertebral disc (IVD) [START_REF] Nadeau | A biomechanical assessment of soft-tissue damage in the cervical spine following a unilateral facet injury[END_REF]) play a critical role in cervical spine stability. Flexion-distraction injuries characterized by PLC and IVD disruption are frequent at the cervical spine and result in serious neurological consequences [START_REF] Blauth | Classification of injuries of the subaxial cervical spine[END_REF].

In vitro studies have proposed stability criteria based on the comparison of preand post-trauma flexibility [START_REF] Goel | An in-vitro study of the kinematics of the normal, injured and stabilized cervical spine[END_REF]White and Panjabi 1990). At the cervical spine, the changes in angular and horizontal displacement prior to failure in flexion and extension was evaluated in vitro by reducing the disco-ligamentous elements sequentially from the anterior or posterior [START_REF] Panjabi | Cervical spine mechanics as a function of transection of components[END_REF]. However, specimens of only one functional spinal unit (FSU) were used. The impact of sequential removal of NL, ISL and facet capsules (FC) at C5-C6 on rotation at C4-C5 and C5-C6 was evaluated in all three anatomical planes using C2-T2 segments but only up to 0.3 Nm [START_REF] Goel | An in-vitro study of the kinematics of the normal, injured and stabilized cervical spine[END_REF]). One study tested the impact of sequential disco-ligamentous injuries at C5-C6 inflicted from the anterior on the neutral zone and range of motion (ROM) [START_REF] Richter | Load-displacement properties of the normal and injured lower cervical spine in vitro[END_REF]. Another study evaluated the effect of discectomy, anterior fixation and the subsequent progressive disruption of the PLC on the intervertebral ROM [START_REF] Pitzen | Anterior cervical plate fixation: biomechanical effectiveness as a function of posterior element injury[END_REF]), but little is known about the contribution of the PLC versus the IVD in flexion-distraction type injuries on spinal stability at the cervical spine.

Finite element (FE) models have been used to evaluate the contribution of different structures under quasi-static [START_REF] Ng | Nonlinear finite-element analysis of the lower cervical spine (C4-C6) under axial loading[END_REF][START_REF] Erbulut | Application of an asymmetric finite element model of the C2-T1 cervical spine for evaluating the role of soft tissues in stability[END_REF], low and high dynamic loading conditions (DeWit and Cronin 2012; [START_REF] Mustafy | Injury mechanisms of the ligamentous cervical C2-C3 Functional Spinal Unit to complex loading modes: Finite Element study[END_REF].

However, no FE study has investigated spinal instability induced by annulus fibrosus (AF) rupture while it is frequent in flexion-distraction injuries of the cervical spine [START_REF] Crowell | Cervical injuries under flexion and compression loading[END_REF][START_REF] Taylor | Acute injuries to cervical joints. An autopsy study of neck sprain[END_REF].

Secondary spinal cord injury can be aggravated by patient management [START_REF] Engsberg | Cervical spine motion during extrication[END_REF] due to joint instabilities. However, unlike unstable bone fractures and dislocations, the level of prehospital immobilization required to prevent luxation and secondary spinal injuries remains unclear [START_REF] Ala | Should suspected cervical spinal cord injury be immobilised?: a systematic review[END_REF]. Cervical collars (CC) are commonly used following neck trauma to limit movement during pre-hospital care and transportation. However, their efficiency has been criticized. A study conducted on healthy volunteers showed that different CC were mostly successful at reducing axial rotation while 19.8 to 40.7 % of flexion is preserved compared to no collar [START_REF] Kim | Comparison of the efficacy of three cervical collars in restricting cervical range of motion: A randomized study[END_REF]. Log-roll transfers simulations performed by paramedics on healthy volunteers wearing a CC showed peak relative head motion of 9.5 to 40.8 degrees [START_REF] Lebel | Quantitative Approach Based on Wearable Inertial Sensors to Assess and Identify Motion and Errors in Techniques Used during Training of Transfers of Simulated c-Spine-Injured Patients[END_REF]. [START_REF] Horodyski | Cervical collars are insufficient for immobilizing an unstable cervical spine injury[END_REF] measured around 30 degrees of flexion on a cadaver model wearing a CC with a C5-C6 global instability. Excessive flexion is very undesirable following flexion-distraction injuries since it could lead to subluxation at the injured level [START_REF] Blauth | Classification of injuries of the subaxial cervical spine[END_REF]) and cause or aggravate a spinal cord injury.

However, the extent of posterior disco-ligamentous injury that should be considered critical and would require proper immobilization is not known.

The main objective of this study was to investigate the relative contribution of the PLC and IVD on the post-traumatic spinal stability of the cervical spine under low flexion moment following a flexion-distraction injury using a C2-T1 FE model.

Materials and methods

Finite Element Model

A detailed C2-T1 finite element model presented previously [START_REF] Taso | Anteroposterior compression of the spinal cord leading to cervical myelopathy: a finite element analysis[END_REF] was used for this study (Fig. 1a). The initial model included the vertebrae, IVD and cervical spinal ligaments. The C2-C7 cobb angle of the model is 22.7 degrees of lordosis which corresponds to an upright position in comparison to data from healthy volunteers [START_REF] Gore | Roentgenographic findings of the cervical spine in asymptomatic people[END_REF].Surface models of vertebrae were created from computed tomography scan images (contiguous slices of 0.6 mm) of a 50th percentile male volunteer. In consequence, the geometry of the model is naturally asymmetrical. The surface models were meshed using 3-nodes shell elements. Cancellous bone of each vertebra was obtained by filling shell elements with 4-nodes solid elements (Wagnac et al. 2012).

The average characteristic size of the elements for the vertebra was 0.77 mm. In this quasi-static study, the vertebrae were set as rigid bodies. IVD were created between adjacent vertebral endplates and divided into nucleus pulposus and AF. Tied interfaces, kinematic links, were modeled between the caudal and cranial surface of the IVD and the adjacent vertebral endplates. The nucleus occupies 20% of disc volume at the cervical segment [START_REF] Park | Changes in range of motion, intradiscal pressure, and facet joint force after intervertebral disc and facet joint degeneration in the cervical spine[END_REF]. Both structures were meshed using 8-nodes solid elements with an average characteristic size of 0.9 mm. First-order Mooney-Rivlin hyper-elastic material laws with non-pathological quasi-static properties [START_REF] Schmidt | Application of a new calibration method for a three-dimensional finite element model of a human lumbar annulus fibrosus[END_REF]) were assigned to these elements (Table 1). Collagen fibers were embedded into the AF using tension-only spring elements organized in concentric lamella with a crosswise pattern at ±35°. Six spinal ligaments were created between each FSU: anterior longitudinal ligament (ALL), posterior longitudinal ligament (PLL), capsular ligament (CL), LF, ISL and NL (Fig. 1b). The ligaments geometry and insertion were based on dissection sessions data [START_REF] Pintar | Biomechanical properties of human lumbar spine ligaments[END_REF][START_REF] Przybylski | Human anterior and posterior cervical longitudinal ligaments possess similar tensile properties[END_REF]. They were meshed using 3-nodes (CL only) and 4-nodes shell elements with an average characteristic size of 0.63 mm. The facet joints were considered as frictionless contact interfaces. The model contains 391 941 elements and 90 5223 nodes In this study, modifications were done to the FE model to improve its flexionextension behavior under quasi-static flexion-extension loadings. In brief, quasi-static material properties were implemented to the IVD components and non-linear stress-strain curves were applied to the ligaments. These properties were then calibrated to adjust the intradiscal pressure and the flexion-extension range of motion (ROM) of the model as described below.

The disc was separated into three sections (anterior, posterior and lateral) with collagen fibers force-displacement curves scaled by a specific factor (Table 1) [START_REF] Schmidt | Application of a new calibration method for a three-dimensional finite element model of a human lumbar annulus fibrosus[END_REF]). The nucleus parameters C 10 and C 01 of the Mooney-Rivlin material law were calibrated by a factor f=2 (Table 1) to adjust the intradiscal pressure (IDP) in comparison to in vitro results [START_REF] Pospiech | Intradiscal pressure recordings in the cervical spine[END_REF]). [Table 1 near here] The IDP was measured as the average of the pressure, corresponding to the negative one-third of the trace of the stress tensor, of all the nucleus elements.

Stress-strain curves of each ligament were derived from mean force-deflection curves measured experimentally under tensile conditions [START_REF] Mattucci | Strain rate dependent properties of younger human cervical spine ligaments[END_REF][START_REF] Mattucci | A method to characterize average cervical spine ligament response based on raw data sets for implementation into injury biomechanics models[END_REF]. The ISL force-deflection curves were applied to the adjacent NL since this ligament was not included in the aforementioned studies. The curves were calibrated using the method further described. [Figure 1 near here]

Calibration of the Finite Element Model

Pure moments of 2 Nm in flexion and extension were applied on C2, in the sagittal plane defined by the global coordinate system (Fig. 1), while T1 was fixed to reproduce experimental conditions (Wheeldon et al. 2006). The coordinate system and point of origin were defined by the CT-scan reconstruction and corresponds to the standard anatomical planes and axes. Ligaments properties were adjusted by shifting the "toe region" of the tabulated curves until the simulated ROM fitted into the experimental corridors [START_REF] Nightingale | Comparative strengths and structural properties of the upper and lower cervical spine in flexion and extension[END_REF]Wheeldon et al. 2006;[START_REF] Nightingale | Flexion and extension structural properties and strengths for male cervical spine segments[END_REF]) as previously proposed [START_REF] Kallemeyn | Validation of a C2-C7 cervical spine finite element model using specimen-specific flexibility data[END_REF]. This adjustment was necessary to take into account the ligaments initial elongation in the model. C2-T1 ROM in flexionextension was finally compared to in vitro data (Wheeldon et al. 2006). The ROM were calculated from the rotation in the sagittal plane of each FSU in the global coordinate system.

Simulation of Posterior Ligamentous Complex and Intervertebral Disc Injury

PLC injury was modeled by removing the NL, ISL and LF (injury configuration #1).

The disc injury was modeled by splitting the disc postero-anteriorly at the middle of the disc (Fig. 2) and removing the PLL. The injury was modeled progressively as a third of the disc antero-posterior length, two thirds and finally the disc was completely transected (injury configurations #2 to 4). A frictionless contact interface was added between the disc caudal and cranial parts of the ruptured IVD. The CL was kept intact since its resistance is important in flexion. For distraction injuries without dislocation, the disruption can propagate through the disc space or through the facet joints (Vaccaro et al. 2007). A numerical study also showed no CL rupture prior to segment failure during a flexion loading (DeWit and Cronin 2012). [Figure 2 near here] For each configuration, a pure moment of 2 Nm was applied on C2 while T1 was fixed. Stepwise reduction (injury #1 to 4) was performed on one spinal level at a time: at C2-C3, then C4-C5 and then C6-C7. This created three different injury sets, each starting with the intact model as baseline. Flexion loading was performed since the posterior elements are mainly solicited in flexion (White and Panjabi 1990)

Results

Calibration and Validation

Following calibration of the ligaments "toe region", the ROM around the coronal axis (flexion and extension) of each FSU was within one standard deviation of the average experimental measurements except for C5-C6 at 2 Nm flexion which was within two standard deviations (Fig. 3). In flexion, C2-T1 ROM was within one standard deviation and only 14 % smaller than experimental average at 2 Nm (Fig. 4). [Figures 3 and4 near here] In extension, the ROM was within two standard deviations. As one standard deviation only includes 66 % of the experimental values, the simulated motion fitted well inside the experimental corridors. C3-C4 and C5-C6 IDP at flexion of 0.5 Nm were inside the experimental range (Fig. 5). [Figure 5 near here]

Effect of Posterior Ligamentous Complex and Intervertebral Disc Injury

Changes in the FSU ROM following the injuries are displayed in Fig. 6. PLC rupture increased the ROM at the injured level by 24.3%, 77.2% and 190.7% at C2-C3, C4-C5 and C6-C7 respectively. Complete disc rupture caused an increase in ROM at the injured level of 181.4%, 120.4% and 284.9% at C2-C3, C4-C5 and C6-C7 respectively.

The changes in ROM at the uninjured levels were under 2 degrees in absolute values for every injury scenario. [Figure 6 near here] The vertebrae centroids position in the sagittal plane (Fig. 7) showed no specific rearrangement for injuries at C4-C5 and C6-C7. For PLC disruption at C2-C3, the antero-posterior gap between C2 and C3 was 9 mm greater compared to baseline and 4 mm greater for complete disc rupture. This is considerable since the antero-posterior diameter of the spinal canal is between 11 and 17 mm in the model. Also, a facets subluxation was visible for complete disc rupture at C2-C3: C2 inferior facets were translated 3 mm more anteriorly onto C3 superior facets at 2 Nm flexion compared to the baseline (Fig. 8). [Figures 7 and8 near here]

Discussion

The objective of this study was to evaluate the relative impact of PLC rupture and progressive transversal disc rupture on cervical spine stability in flexion. A FE model [START_REF] Taso | Anteroposterior compression of the spinal cord leading to cervical myelopathy: a finite element analysis[END_REF] was adapted by implementing detailed experimental stress-strain curves to represent the ligaments behavior. The ligaments "toe-regions" were calibrated to adjust the ROM of each FSU with experimental corridors. Nucleus properties were also calibrated to adjust the IDP in reference to in vitro data.

The PLC and disc injuries modeled increased the local ROM at the injured FSU but had little impact on the other levels. [START_REF] Goel | An in-vitro study of the kinematics of the normal, injured and stabilized cervical spine[END_REF], observed an average increase of 2 degrees on the C4-C5 flexion ROM for a resection of the NL and LF at C5-C6 which is higher but similar to our results. PLC disruption at C4-C5 and C6-C7 had an important impact on local ROM at the injured level, but not at C2-C3. [START_REF] Panjabi | Cervical spine mechanics as a function of transection of components[END_REF] reported an increase of 21.2 % at C2-C3 after disruption of the PLC which matches closely the 24.3% increase obtained in our FE analysis. Spine instability created by PLC disruption increased from the cranial to the caudal end of the segment. Another numerical study similarly concluded that ISL removal at C4-C5 creates important instability during flexion [START_REF] Erbulut | Application of an asymmetric finite element model of the C2-T1 cervical spine for evaluating the role of soft tissues in stability[END_REF] while [START_REF] Goel | An in-vitro study of the kinematics of the normal, injured and stabilized cervical spine[END_REF] showed that removal of LF following reduction of NL and ISL at C5-C6 had a statistically significant impact on local ROM in flexion. Cervical injuries cranial to C4 are often described as life threatening [START_REF] Fujimura | Prognosis of neurological deficits associated with upper cervical spine injuries[END_REF], but caudal injuries should also receive extra care due to their higher spinal instability in flexion.

Disc rupture increased local ROM at the injured FSU for all levels but had more impact at C2-C3 in comparison to PLC disruption. This could be caused by the proximity of C2-C3 to the moment application point (C2) or by its specific morphology.

However, flexion-distraction injuries without bone fracture are not common at C2-C3 [START_REF] Jubert | Complications of upper cervical spine trauma in elderly subjects. A systematic review of the literature[END_REF]. A clinical study reported a few cases of "flexion sprain" at C2-C3 in adolescents causing important post-traumatic dynamic instability: antero-posterior translation of 4 to 4.5 mm and C2-C3 rotation flexion of 13 to 15 degrees measured on dynamic flexion-extension X-Rays [START_REF] Mcloughlin | Severe sprains of the sub-axial cervical spine in adolescents: a diagnostic and therapeutic challenge[END_REF]. These results are similar to what we observed at C2-C3 (antero-posterior translations of 4 and 9 mm and local ROM ranging from 8.6 to 19.4). A non-linear effect on local ROM increase at the injured level was seen from C2-C3 to C4-C5 to C6-C7 for disc disruption. This could be caused by morphological differences (i.e. vertebral shape and facet orientation) between the subaxial and upper cervical spine. [START_REF] Pitzen | Anterior cervical plate fixation: biomechanical effectiveness as a function of posterior element injury[END_REF] produced a discectomy at C5-C6 in vitro and observed a ROM increase of 126 % which is close to our results at the injured level for complete disc rupture at C4-C5 (120 %) but lower than the difference at C6-C7 (285 %).

Another numerical study concluded that the disc is less important than the ligaments in resisting sagittal moments [START_REF] Ng | Nonlinear finite-element analysis of the lower cervical spine (C4-C6) under axial loading[END_REF] which is what we observed for injuries at C4-C5 and C6-C7, but not at C2-C3. Their study was performed on the C4-C6 segment only. A FE study concluded that the absence of nucleus affected the model only at loads lower than 2 Nm [START_REF] Erbulut | Application of an asymmetric finite element model of the C2-T1 cervical spine for evaluating the role of soft tissues in stability[END_REF]). However, our study proposed a rupture through the entire disc since AF rupture is more frequent than disc avulsion at the cervical spine [START_REF] Crowell | Cervical injuries under flexion and compression loading[END_REF][START_REF] Taylor | Acute injuries to cervical joints. An autopsy study of neck sprain[END_REF]). An experimental study performed an anterior incision into the C5-C6 IVD which had a statistically significant impact on flexion and extension ROM [START_REF] Richter | Load-displacement properties of the normal and injured lower cervical spine in vitro[END_REF].

However, they modeled their disco-ligamentous sequential resection from anterior to posterior.

A study reproducing unilateral facet injuries on C4-C5 and C6-C7 spinal segments demonstrated that both the nucleus and AF are important stabilizing structures at the cervical spine [START_REF] Nadeau | A biomechanical assessment of soft-tissue damage in the cervical spine following a unilateral facet injury[END_REF]). However, their specimens only comprised one FSU. In our study, a difference was seen in local ROM at the injury between 1/3 disc rupture and 2/3 disc rupture at C2-C3 and C6-C7, but not at C4-C5. Therefore, both the nucleus and AF are stabilizing structures in flexion, but to a different extent depending on the spinal level.

Vertebrae's centroid's position showed no rearrangement of the spinal curvature and no subluxation for injuries at C4-C5 and C6-C7 which could be explained by the pure flexion loading used. For injuries at C2-C3 however, the vertebrae position pattern in flexion varied depending on the IVD rupture state. The disc seems to have an important impact on the rotational axis of C2-C3. At two injury states (PLC rupture and complete disc rupture), C2 moved significantly more anteriorly than C3 in comparison to the baseline. This suggests a post-traumatic spinal cord impingement. At complete disc rupture, this high anterior displacement combined with high local rotation lead to an important change in the antero-posterior position of the C2-C3 facets. This could lead to luxation and compression of the spinal cord [START_REF] Mcloughlin | Severe sprains of the sub-axial cervical spine in adolescents: a diagnostic and therapeutic challenge[END_REF]). This phenomenon was observed for a non-traumatic flexion moment (2 Nm) which shows the importance of post-traumatic immobilization in comparison. Since this happened at 51 degrees of C2-T1 flexion, it shows that the mobility permitted by cervical collars is not sufficiently restrictive: 40.8 degrees of maximal head flexion measured on voluntary subjects [START_REF] Lebel | Quantitative Approach Based on Wearable Inertial Sensors to Assess and Identify Motion and Errors in Techniques Used during Training of Transfers of Simulated c-Spine-Injured Patients[END_REF]) and 30 degrees of neck flexion measured on cadavers with a cervical instability [START_REF] Horodyski | Cervical collars are insufficient for immobilizing an unstable cervical spine injury[END_REF].

Some limitations of this study should be listed. Flexion only was performed since the PLC is mostly solicited in flexion and current cervical collars do not restrict neck flexion efficiently. Furthermore, excessive flexion of an unstable spine could lead to subluxation and dislocation. However, having a complete overview of PLC and disc injuries effect on spinal stability would require studying all three anatomical planes. Also, loading was done in pure flexion which is a simplification of the multidirectional physiological loads present in the spine. The contact at the facet joints was simplified as a frictionless interface which could have facilitated the facet subluxation that was observed for injury at C2-C3. Future works could integrate a sensitivity analysis on the facets interface type. Muscles were not modeled while it has been shown that muscles activation can restrict movements with voluntary subjects [START_REF] Eckner | Effect of neck muscle strength and anticipatory cervical muscle activation on the kinematic response of the head to impulsive loads[END_REF]. Furthermore, gravity was not taken into account. The addition of a pre-load to represent the gravitational forces would pre-constrain the spine but would only minimally increase the mobility of the cervical spine in flexion [START_REF] Barrey | Relevance of using compressive preload in the cervical spine: an experimental and numerical simulating investigation[END_REF].

Disc rupture was simplified by creating a gap in the middle of the disc. The anterior AF is thicker than the lateral and posterior AF in the cervical spine [START_REF] Tonetti | Morphological cervical disc analysis applied to traumatic and degenerative lesions[END_REF]. During traumatic flexion, the core and posterior AF are likely to be ruptured as the injury grows. The anterior AF is more firmly attached to the bone and tends to remain intact in flexion injuries which represents our 2/3 rupture scenario. In cervical spine flexion injuries, disc rupture happens often between the disc and the endplate [START_REF] Taylor | Acute injuries to cervical joints. An autopsy study of neck sprain[END_REF][START_REF] Tonetti | Morphological cervical disc analysis applied to traumatic and degenerative lesions[END_REF]. Here the rupture was modeled into the disc, but we assume that the spinal instability created is similar. Different models of disc rupture could be tested in a future analysis by varying the gap location. Future studies should investigate the effect of PLC and disc injuries on the spinal cord integrity to assess their potential functional impact. The impact of different cervical collar designs on spinal instability should also be studied. Personalization of the model to represent real-life traumatic cases from clinical data could also be performed.

To our knowledge, this study is the first to evaluate the effect of a posterior transversal disc rupture on stability. This FE analysis highlighted the importance of the PLC and IVD in stabilizing the cervical spine in flexion. The PLC is particularly important for spinal stability of the middle and lower cervical spine while the disc has more influence on the upper cervical spine. This study suggests that disco-ligamentous injuries should be handled with great care as sagittal motion may lead to cervical spinal instability. Trauma patients' manipulation and care should always be conducted with neck flexion kept to a minimum. Furthermore, pre-hospital cervical collars should be designed to restrict flexion of the cervical spine efficiently.

  and flexion could lead to dislocation and spinal cord injury. Post-traumatic ROM and the vertebrae centroids position at 2 Nm flexion, in the global coordinate system, were compared to the intact model. These results were chosen to evaluate instability and potential spinal canal reduction. The finite element model was developed on the HyperWorks 2017 software platform (Altair Engineering, Troy MI, USA). The simulations were run on Radioss Solver (Altair Engineering and the analyses performed were non-linear.

  Vaccaro A, Hulbert R, Patel A, Fisher C, Dvorak M, Lehman R, Anderson P, Harrop J, Oner F, Arnold P. 2007. The subaxial cervical spine injury classification system: a novel approach to recognize the importance of morphology, neurology, and integrity of the disco-ligamentous complex. Spine. 32:2365-2374.Wagnac E, Arnoux P-J, GaroA, Aubin C-E. 2012. Finite element analysis of the influence of loading rate on a model of the full lumbar spine under dynamic loading conditions. Medical & biological engineering & computing. 50(9):903-915. Wheeldon JA, Pintar FA, Knowles S, Yoganandan N. 2006. Experimental flexion/extension data corridors for validation of finite element models of the young, normal cervical spine. Journal of biomechanics. 39(2):375-380. White A, Johnson R, Panjabi M, Southwick W. 1975. Biomechanical analysis of clinical stability in the cervical spine. Clinical orthopaedics and related research.(109):85-96. White A, Panjabi M. 1990. Clinical biomechanics of the spine. 2nd ed. Philadelphia: J. B. Lippincott Company.

Figure 1 .

 1 Figure 1. Finite element model of the cervical spine: a) complete C2-T1 model and b) C5 vertebra with ligaments and intervertebral disc

Table 1 .

 1 Material Properties of Intervertebral Disc (Moonley-Rivlin Model)

	Material properties	IVD		Collagen
					Reference
		Nucleus	Annulus	fibers
	Density
		1	1.2	-
	(E-6kg/mm3)
	Poisson Coeff., ν	0.495	0.45	-	(Schmidt et al. 2006)
	E	-	1.36		f = calibration factor
	C10	0.12*(f=2)	0.18	-
	C01	0.09*(f=2)	0.045	-
	Force/Displacement Curves	-	-	Non-linear	(Shirazi-Adl et al. 1986)
		Anterior		1.2
		region
				1.03
	Calibration Factor for Collagen
		Lateral
	Fibers Force/Displacement				(Schmidt et al. 2006)
		Region
	Curves			0.85
		Posterior
		Region

Acknowledgements

This work was supported by the Canada research chair in biomechanics of head and spine injuries under Grant number 231815; the foundation J.A. DeSeve; and the Fonds de recherche du Quebec under Grant number 271503.

Conflict of interest

The authors declare that they have no conflict of interest.


Maurice Quach

Giuseppe Valenzise

Frédéric Dufaux

A DEEP POINT CLOUD GEOMETRY CODING TOOLBOX

This short paper describes a TensorFlow toolbox for point cloud geometry coding based on deep neural networks. This coding method employs a deep auto-encoder trained with a focal loss to learn good representations for voxel occupancy. The software provides several coding parameters to achieve different rate-distortion trade-offs, and comes with pre-trained models to reproduce the results of the published paper. It also offers a number of utility functions for evaluating and comparing the codec. To our knowledge, this is the first publicly available open-source toolbox for deeplearning-based point cloud coding.

DESCRIPTION AND OVERVIEW

Deep point cloud compression (PCC) is an emerging topic in multimedia coding, in particular for what concerns the coding of voxelized point clouds geometry [START_REF] Quach | Learning Convolutional Transforms for Lossy Point Cloud Geometry Compression[END_REF][START_REF] Guarda | Point Cloud Coding: Adopting a Deep Learning-based Approach[END_REF][START_REF] Wang | Learned Point Cloud Geometry Compression[END_REF]. As in other research fields, reproducing the results of existing approaches is of paramount importance to conceive new coding algorithms, especially when using deep neural networks, where the large number of variables involved makes it difficult to compare methods. This open source package offers a toolbox to compress point cloud geometry using deep neural networks. It implements all the contributions and experiments in our previous work [START_REF] Quach | Improved Deep Point Cloud Geometry Compression[END_REF]. The point cloud is partitioned into blocks and each block is compressed with a convolutional neural network, optimized with respect to a focal loss. In order to achieve different rate-distortion points, we train a network for each desired rate-distortion trade-off. At the decoder side, several parameters can be modified to adapt to the local point cloud density (balancing weight in the focal loss, optimal thresholding). Details on the choice of these parameters are reported in [START_REF] Quach | Improved Deep Point Cloud Geometry Compression[END_REF]. We complete the toolbox with a number of utility functions for evaluating and comparing the performance with other methods; we also provide pre-trained models and the datasets used to obtain them. We also provide instructions for users that want to retrain the networks on their own datasets.

We make the entire source code available at https:// github.com/mauriceqch/pcc geo cnn v2 under the MIT Funded by the ANR ReVeRy national fund (REVERY ANR-17-CE23-0020). ICME2021 "Point cloud capture and compression" track. This open source package is intended for researchers and engineers working on PCC. It has two main purposes: i) facilitating the reproduction and comparison with the family of codecs in [START_REF] Quach | Improved Deep Point Cloud Geometry Compression[END_REF]; ii) providing the tools and a starting point to foster new research on deep PCC. In particular, the adopted licensing scheme allows the use of this software as a base for implementation in an industrial context.

EXAMPLE OF UTILIZATION

The package provides tools for each step of PCC. In particular, tools are provided to train the compression models, en-Fig. 2. Qualitative evaluation on "soldier vox10 0690". For our method and G-PCC Trisoup (baseline), we show the decompressed point cloud and its D1 squared errors. The errors are displayed according to the color scale on the right and are truncated to the 99th percentile (3.0). In parentheses, we specify the D1 PSNR along with the number of bits per input point (bpp). code and decode PCs and evaluate them. Note that the package works with voxelized point clouds.

Training

In order to train a compression model, we need a model architecture and training parameters. Model architectures are defined in model configs.py and are identified by a unique name. The training parameters include the training dataset, the rate-distortion tradeoff parameter (--lmbda), the focal loss parameters (--alpha and --gamma), the batch size and the model architecture (--model config). Usually, multiple compression models are trained for a single architecture with different rate-distortion trade-offs. Below is a sample training command: python tr_train.py \ 'ModelNet40_200_pc512_oct3_4k/**/*.ply' \ model \ --resolution 64 --lmbda 1.00e-04 --alpha 0.75 --gamma 2.0 --batch_size 32 --model_config c3p

Coding a point cloud

Then, we can compress and decompress a point cloud using the previously trained model. Coding parameters include the model architecture, the octree level used for block partitioning and the optimal thresholding target metrics (--opt metrics).

In the following example, the software encodes and decodes a PC, employing the point-to-point metric (D1) to optimize the thresholding at the decoder:

python compress_octree.py \ --input_files soldier_vox10_0690.ply \ --output_files soldier_vox10_0690_d1.ply.bin \ --checkpoint_dir model \ --opt_metrics d1_mse --resolution 1024 --model_config c3p --octree_level 4 \ --dec_files soldier_vox10_0690_d1.ply.bin.ply

Visualization and evaluation

For visualization, we can transfer the colors from the original to the decompressed point cloud with the following command: A sample compressed point cloud is shown in Figure 2; it is compared with the original and the same point cloud compressed with G-PCC. More details are available on Github.

Fig. 1 .

 1 Fig. 1. System overview for the open source package. CPC stands for compressed PC and DPC for decompressed PC.

  python map_color.py \ soldier_vox10_0690.ply \ soldier_vox10_0690_d1.ply.bin.ply \ soldier_vox10_0690_d1.ply.bin.ply.color.ply Then, we can use the mpeg-pcc-dmetric to compute distortion metrics: ˜/code/MPEG/mpeg-pcc-dmetric/test/pc_error_d \ -a soldier_vox10_0690.ply \ -b soldier_vox10_0690_d1.ply.bin.ply \ --resolution 1023 --dropdups 2 --neighborsProc 1


Tanja Pavleska

Helder Aranha
email: atanja@e5.ijs.si

Massimiliano Masi
email: massimiliano.masi@tiani-spirit.com

Eric Grandry
email: eric.grandry@tr.etat.lu

Giovanni Paolo Sellitto
email: g.sellitto@anticorruzione.it

Cybersecurity Evaluation of Enterprise Architectures: The e-SENS Case

Keywords: Cybersecurity, Enterprise Architecture, e-SENS, Evaluation methodology, Framework

Technology management through enterprise architectures has already become a widespread practice across large enterprises. Modeling and evaluating the cybersecurity aspect of it, however, has just begun to get the needed attention. This paper presents а cybersecurity evaluation methodology developed for the reference architecture of the e-SENS project and derives a generic framework for cybersecurity evaluation of an enterprise architecture. The evaluation addresses both the high-level design artefacts (the reference architecture) and operational solutions. Therefore, both a conceptual and an empirical framework are developed as part of the methodology. The former extends a goal-based security model with a threat-view incorporating standardized guidelines on security measures, whereas the latter captures and systematizes implemented project-specific security practices. The resulting methodology effectively supports the evaluation and is easy to grasp by non-technical people. Moreover, it is lendable to formalization, supporting a semi-automatic process of solution architecture design.

Introduction

Supporting the management of technology by enterprise architectures, while essential and useful, poses additional requirements for effectiveness and efficiency, such as: accounting for the life cycle of the different aspects and attributes of the architecture (interoperability, (cyber)security, change management, variability, etc.). Various models to address these requirements have been proposed [START_REF] Korman | Technology management through architecture reference models: A smart metering case[END_REF]- [START_REF] Holm | P 2 CySeMoL: Predictive, Probabilistic Cyber Security Modeling Language[END_REF]. However, they mainly address small-scale solutions, lack an account of a standardized process of technology management or require fully manual work on the issue under consideration. In this paper, we present а cybersecurity evaluation methodology developed for the reference architecture of the e-SENS project. 1 The aim is to derive a generic framework for cybersecurity evaluation of enterprise architectures that would be interoperable, applicable to both small and large-scale scenarios, understandable by non-technical people, but also technically sound to the extent that it is fully automatable and reusable. The Electronic Simple European Networked Services (e-SENS) project aimed at delivering reusable architecture Building Blocks (BBs throughout this paper) for the implementation of cross-border and cross-sector digital services. In addition to developing BBs as elementary parts of the e-SENS Reference Architecture (e-SENS RA), corresponding implementations in several domains were piloted (eHealth/ePrescription, eProcurement, eJustice, Business LifeCycle and eAgriculture), providing a proof of the architecture feasibility and effectiveness. The e-SENS approach adopts the TOGAF9 concept of a building block [START_REF] Korman | Technology management through architecture reference models: A smart metering case[END_REF]. The BBs are combined and consolidated into Solution Architecture Templates (SATs), as used by the European Interoperability Reference Architecture 2 , and address specific real-world use-case. The BBs are described along common dimensions, captured by the e-SENS Metamodel [START_REF]Grandry and e-SENS Architecture team, "D6.7 e-SENS European Interoperability Reference Architecture[END_REF]. The availability of solution templates not only facilitates the use of the BBs, but guides developers in the realization of custom solution architectures. In doing so, significant challenges appear due to the requirements for architecture solutions and the standards and security solutions. Thus, an evaluation methodology is needed that is applicable at architectural level, but which also presents the various features in a uniform way for all of the BBs.

The evaluation presented in this paper includes model-based assessments at SATlevel from the aspect of (cyber)security. Although designed for e-SENS, the methodology has been generalized and proven applicable for other contexts as well [START_REF] Masi | Automating Smart Grid Solution Architecture Design[END_REF]. It combines two complementary evaluation frameworks: conceptual and empirical. The former builds on a standard goal-based security model known as the Reference Model for Information Assurance & Security (RMIAS) [START_REF] Cherdantseva | A Reference Model of Information Assurance & Security[END_REF]. This model was augmented by a threat-view incorporating the ENISA guidelines on security measures [START_REF] Enisa | Technical Guideline on Minimum Security Measures -ENISA[END_REF] to provide a holistic account of the security properties of the reference architecture. The empirical framework, on the other hand, is an evaluation tool for the pilots, designed according to the conceptual framework. It captures and systematizes the security practices deployed in the solutions based on the reference architecture and provides recommendations on how the BBs' specifications can be fine-tuned to meet the security goals. 3This paper is structured as follows: the next section introduces the two parts of the evaluation methodologythe conceptual and empirical evaluation frameworks. Each is supported by a relevant discussion or recommendations related to the obtained results. Then, our work is placed among the state of the art approaches. Finally, we conclude and point to some future work plans.

Methodology: The Conceptual Framework

The conceptual framework aims at assessing how the technical specifications contribute to meet the security goals. Two approaches are usually followed in the practice of information assurance and security: a goal-based and a threat-based approach [START_REF] Röhrig | Using Process Models to Analyse IT Security Requirements[END_REF]. The former defines the security goals, and then selects the countermeasures to reach these goals [START_REF] Anton | Analyzing Website privacy requirements using a privacy goal taxonomy[END_REF]. The latter analyzes the threats and vulnerabilities of the system to be secured, and then selects countermeasures mitigating the threats and vulnerabilities [START_REF] Pfleeger | Security in Computing (4th Edition)[END_REF]. In a cybersecurity evaluation at architecture level, a goal-based approach is usually taken, as a threat-based requires detailed analysis of all system vulnerabilities, and a detailed knowledge of the system behavior history. Such data is not available at system design.

The objective of the proposed methodology is twofold: 1) the core security goals must be general enough to address all of the domain needs; and 2) they should be applicable to any architecture derived from the BBs. Therefore, both a goal-based and a threat-based approach are combined in this work in a coherent manner.

Fig. 1 depicts the application of the conceptual framework to the e-SENS System, which is represented in the core diagram with all its assets: Network, Hardware, People, Information, etc.  Security Goals contain a broadly applicable list of eight security goals: Confidentiality; Integrity; Availability; Accountability; Authentication (and Trustworthiness); Non-repudiation; Privacy and Auditability.  Countermeasures categorize the countermeasures available for information protection.

To address the threats and vulnerabilities of the system, the goal-based model is complemented by a threat-view, which is represented by the purple blocks in Fig. 1.

RMIAS and the goal-based view

The evaluation is preceded by goal-based modeling, performed along each of the RMIAS dimensions. Information classification helps to understand the relevant security goals associated with the system under evaluation. Information is classified by: ─ Form: in e-SENS information is exclusively manipulated in electronic form; ─ State: in e-SENS it can be in one of the following states: Creation, Transmission, Storage, Processing, Destruction; ─ Sensitivity: in e-SENS it can be either confidential, or non-confidential; ─ Location: in e-SENS it is always at controlled locations.

The e-SENS System can be described through different views; in this evaluation, we concentrate on the architecture description relevant to the various eServices. The evaluation includes the cross-border SATs that were most employed by the pilots while carrying the bulk of the security mechanisms: eID, eDelivery, Non-repudiation, Trust Establishment, eDocuments, and Semantics [START_REF] Dg Connect | Introduction to the Connecting Europe Facility eDelivery building block[END_REF]- [START_REF]What is eID[END_REF].

The goal-based assessment is performed as follows:

1. The architecture of the system to be protected is described, and the various stages of information manipulation are identified; 2. For each stage, the information is categorized according to the information view of the security model. The associated security goals are deduced by the security expert performing the evaluation (See Table 1 for example);

… … … … Auditability … … … … Privacy … … … …

ENISA guidelines on security measures and threat-based view

The ENISA guidelines on security measures sublime an extensive list of national and international EU electronic communications standards into a set of security objectives divided by domain [START_REF] Enisa | Technical Guideline on Minimum Security Measures -ENISA[END_REF]. They outline 25 security objectives, each analyzed through various security measures and supported by evidence testifying that an objective was met.

The security measures are grouped in 3 sophistication levels, whereas the security objectives are divided in 7 domains of application. This provided a suitable framework of complementary views to the goal-based security evaluation.

Fig. 2. Relevance of the ENISA guidelines in the context of e-SENS

As information is the main security asset in e-SENS, many of the ENISA security measures and objectives were not addressed by the evaluation. To determine those that

S E C U R I T Y G O A L
are relevant for e-SENS, a mapping of the contextual and security traits between the e-SENS security needs and the ENISA provisions is performed, as presented in Fig. 2 showing the whole set of ENISA security objectives divided by domains. To represent the relevance for the e-SENS context the boxes are colored and assigned the following semantics: red denotes the relevance of that particular security objective (SO) for the evaluation in the concrete domain (Dx); green represents the SOs for which e-SENS can provide recommendations to future adopters of e-SENS building blocks; and transparent (white) boxes denote that the SO is not relevant for the evaluation purposes. Mapping the contextual and the security traits of RMIAS to the ENISA framework provides sufficient practical and scientific rigor in accomplishing the task of a holistic cybersecurity evaluation. Moreover, it enables the extraction of specific guidelines and recommendations for the security measures that must be adopted to meet the objectives.

Integrating RMIAS dimensions and ENISA objectives

Mapping RMIAS to the ENISA technical guidelines establishes correspondence between each of the RMIAS dimensions and the ENISA Security objectives by domain.

It is represented as a matrix: each entry that lays at the intersection of an RMIAS rowentry and an ENISA column-entry contains the information about the reciprocal relevance of the two. The same matrix can also contain the results of the assessing of relevance in the specific context. Such results are denoted by red-green-white coloring the particular entry, with the same meaning as presented in the previous section.

As Information is the main asset to be protected by the security mechanisms specified by the e-SENS RA and implemented by the pilots, the mapping of Information Taxonomy is granulated into: Creation, Processing, Storage, Transmission, and Destruction. The result is a 25x25 matrix (see Table 3) with one additional dimension for Relevance represented by a particular color, as explained previously. This additional dimension can be further fine-grained, for example by giving it numerical weights. It enables a threat-view by domain for each goal-based dimension and its sub-dimensions. Providing a threat-view starts as a subjective assessment, as the decision to denote a particular table entry as relevant or not depends on the analyst's expertise and experience. This is also one of the inherent drawbacks of a threat-based method. To ensure the least bias possible, the evaluation has been reviewed by more experts who were involved in both the design of specifications and in pilot implementations. The most important result from this cybersecurity evaluation, however, is the methodology itself, which not only is it not subjective, but is based on rigorous standards and scientific approaches.

To give an example, we can refer to the goal-based analysis of the pilots (presented in Section 3.2). There, we show that the security goal Availability requires proper account. In Table 3, there are 19 security objectives that provide a threat-view of Availability relevant for e-SENS across all 7 domains. Eight are mandatory (in red) for specification and implementation, whereas for 11 (in green) e-SENS provides recommendations to future adopters. Depending on the domain, a catalogue of security objectives can be designed to guide the specification and implementation of relevant security measures. Governance and risk management can be similarly addressed.

Table 2. Mapping RMIAS to ENISA guidelines by relevance for e-SENS security mechanisms

Finally, it is worth noting that this table can further be checked for compliance with international standards by comparing it against the mapping of ENISA's domains and security objectives to international standards in Section 6 of the ENISA report [START_REF] Enisa | Technical Guideline on Minimum Security Measures -ENISA[END_REF].

Discussion

The evaluation of the e-SENS SATs demonstrated that the specifications are grounded on well-established security standards and solutions. Furthermore, all security goals can be addressed by adopting one or a composition of BBs. Information in all its states and locations can be adequately accounted for, depending on its sensitivity, in order to devise a certain security goal. One of the most important traits of the e-SENS RA is that its BBs are fully interoperable. This implies that by interconnecting the relevant BBs, a certain security property can be leveraged to meet a desired security goal. By presenting a high-level overview of the architecture to which a security mechanism applies, and by providing a catalogue of the security goals addressed by each of the SATs, a non-technical person is able to grasp the potential of a certain solution to satisfy given security requirements. Moreover, by providing a detailed elaboration of the technical processes behind a solution and reference to the standards on which it is based, a technical person gets the support to build a conceptual evaluation model to satisfy the desired security goals. Hence, the analysis performed here provides a common ground for understanding between various levels of experts in a given organization. It also helps to organize the security policies spread over multiple domains. Furthermore, it not only permits tracing contradictory security policy statements, but also facilitates the identification of weak or omitted security policies. Complemented with the more domain-specific security measures offered by the threat-based analysis, it may contribute to more cost-effective and efficient solutions for both public administrations and private organizations. Finally, the modularity of the analysis by security domain, objective, goal and countermeasures allows to detect opportunities for further improvement of both the system/architecture and the implemented security mechanisms.

Methodology: The Empirical framework

To provide a holistic view of the cybersecurity evaluation of the architecture and validate the conceptual framework as a generic methodological tool, an empirical framework was devised. This framework aims to close the gap between concept and realization. A questionnaire 4 was deemed as the most effective method to gather information, given the time-frame available. It was designed to extract expert knowledge and experience from the implementation of security mechanisms in the pilots. In addition to the security aspects, some general system properties were also investigated. The results obtained with the empirical evaluation framework directly answer to the objectives of this work, while providing insights into the interdependencies between the BBs' specifications and their implementations.

Questionnaire design

The questionnaire design follows the RMIAS premises. It contains five sections: four focus on the RMIAS dimensions (Security goals, Countermeasures, Information Taxonomy and System Security Lifecycle), and one obtains information about Trust models implemented by the pilots. The results from the questionnaire in turn fed the threatview analysis of the architecture, providing the needed knowledge about the system behavior and establishing a feedback loop between the design specifications and the architecture implementation. Moreover, they provided valuable insights into how the SATs address the same security objectives as the architecture building blocks they are composed of.

Results and analysis

The questionnaire was filled in by the relevant experts of all piloting domains. Following are the comparative and qualitative analysis of their feedback, divided by sections.

Security goals. The first section investigated the employment of security mechanisms to address the desired security goals. As shown in Fig. 3, all security goals set to be addressed by the specifications have been a requirement that was also addressed by one or more of the pilots. One of the pilots, (eTendering) employed mechanisms for addressing almost all security goals, which was to some extent expected, considering that it was structurally the most complex and had to cope with all information states during its lifecycle.

Fig. 3. Security goals addressed by the pilots

Confidentiality and Integrity were addressed by almost all of pilots, whereas the results for Availability reveal that further considerations are needed in this direction. On the one hand, assuring Availability of all resources and hardware, fault-tolerance and redundancy is country-dependent. However, considering the fact that Hardware, Software and Networks are among the security assets stated by the pilots, Availability is expected to be among the top security goals to be addressed. The fact that no pilot has reported consideration of Redundancy and Fault-tolerance, is thus of no surprise. At the same time, it reveals a need for better consideration and proper accounting for Availability as one of the major security goals.

Information taxonomy.

Information in e-SENS is tackled in all states in its lifecycle: Creation, Transmission, Storage, Processing and Destruction. Some pilots did not employ mechanisms to handle information securely in every state (see Fig. 4a), but all pilots ensure secure transmission of information. However, dealing with information in a particular state is highly context-dependent. Thus, no claim can be made on whether some security mechanisms are lacking or if information is not handled securely. Secure processing and creation of information were addressed to a greater or lesser extent. 4b). Software, Networks, Pro-cesses and People are also major security assets, whereas Hardware is only rarely addressed. However, the number of security assets and the frequency of implementation of certain security mechanism are of less importance; the impact of the particular asset for the overall system and the impact of the failure of a certain security mechanism are crucial. The choice of entities to be addressed by the security goals is both context-and mechanism-dependent. However, as humans are at the core of all systems, it can be observed that the human-factor is poorly addressed by the security mechanisms. This is especially important if one considers that countermeasures can be legal, organizational and purely human-oriented. Next, broader analysis of this issue are presented.

Countermeasures. Regardless of whether a certain pilot implemented security mechanisms with a concrete threat-model in mind, countermeasures could still be in place due to mere operational system requirements. The countermeasures' types investigated here are: i) Technical; ii) Legal; iii) Organizational; and iv) Human-oriented. Technical countermeasures that are widely employed by the pilots are encryption and authentication. They are complemented with legal countermeasures in the form of agreements/contracts, whose type depends on the pilot's needs. Policies are the organizational countermeasures implemented, whereas audit was reported by only one of the pilots (eConfirmation). Human-oriented countermeasures are largely lacking, with 'Motivation' and 'Operational guidelines' being the only ones considered. The implementation of countermeasures is highly context-dependent. Not every pilot has the same assets to secure or deals with the same risks. For e.g., whereas most pilots employ only encryption and authentication as technical countermeasures, the eHealth pilot also implements policy-based access control for authorization, and patient-informed consent to address Privacy. However, starting from the lowest level possible, training of both public administration, citizens and workers must be enforced, since user knowledge and behavior are the first line of defense against cyber-threats. 5Trust. Trust mechanisms facilitate the accomplishment of Integrity and Accountability. Confidentiality, although mainly addressed through encryption, is also strengthened by trust in the underlying infrastructure. All pilots employ one or more types of trust mechanisms, depending on the needs of the intra-domain or the cross-domain trust establishment. Although the Trust Network PKI 6 is the most widely employed BB, all of the Trust Establishment BBs are used by some of the pilots. One trust issue reported by the pilots is that self-signed certificates are still widely used. Although they may decrease the overall security risk of a transaction in some situations, self-signed certificates cannot be revoked, allowing an attacker with authorized access to monitor and inject data into a connection, or spoof an identity if a private key was compromised. This points to the need for adequate risk analysis, which was not done by any of the pilots.

Trust analysis does not only help in the consolidation of security policies across a system architecture, but it points to the fact that trust in the overall architecture is as important as securing the information that flows through that architecture. The presented methodology enables this kind of trust reasoning and can be used to assure the adopters of any of the architectural solutions of their desired trust properties.

Security system lifecycle. This section explored the general lines of development of the security mechanisms. In a way, it extracts the bigger picture of the security design and management of the system.

Most e-SENS pilots base the choice for employing trust and security mechanisms on an inherited infrastructure (from previous Large Scale Pilots 7 ). The results are to a certain extent a testimony of the ability to adapt novel security mechanisms to earlier security infrastructures. This adaptability of security solutions is also an argument for the architecture sustainability with respect to the BBs' security capabilities. Therefore, the fact that all pilots claim low expectations for frequent mechanism updates comes as no surprise. In terms of stability of the security mechanisms, all security experts responded that small changes in the security mechanisms would not have a big impact on the remainder of the system. However, most of the pilots reported no redundancy considerations in the security mechanism design. This again points to the need for risk-modelling and analysis, and introduction to proper countermeasures during system design.

Overall evaluation of the e-SENS security measures. After performing the cybersecurity evaluation of all SATs, the overall e-SENS security measures have been evaluated and assigned a sophistication level according to ENISA guidelines. The security measures are grouped in three sophistication levels as shown in Table 4.

Each level corresponds to some criteria judging of its attainment. The results are backed by evidence gathered in support of the judgement. The levels are cumulative, so the evidence for attaining level 2 applies to level 1 as well.

Table 4. Evaluation of sophistication level of e-SENS security measures according to ENISA descriptions ENISA description of sophistication levels

Assessment of the e-SENS security measures

Level Attained

Evidence

Level 1 (basic):

-Basic security measures that could be implemented to reach the security objective.

-Evidence for that.

Yes

Basic security measures are in placethe arguments were detailed in the BB's security evaluation and the pilots security evaluation

Level 2 (industry standard):

-Industry standard security measures to reach the objective and an ad-hoc review of the implementation, following changes or incidents.

-Evidence for that. -Evidence for that.

Yes

Not Yet

Not all e-SENS BBs have reached full technical maturity and scalability readiness; no comprehensive documentation is provided to claim accounting for changes, incidents and tests to improve the implementation of the security measures. However, solid basis for reaching level 3 can be provided: the current analysis is a form of a structural review and a proactive step towards recommendations to improve the security measures implementation.

The possibility of e-SENS RA to be adapted to the domain needs and to evolve with the system speaks of its flexibility to retain the reached sophistication level. This wraps up the complementary view on the goal-based approach and provides the cybersecurity evaluation with operational recommendations for securing the e-SENS RA solutions.

Discussion

While not all pilots address all security goals or employ countermeasures, the fact that all security goals were addressed, information has been accounted for in all of its states, all entities were tackled by some of the security mechanisms and technical, legal, human and organizational countermeasures are in place, testifies that the e-SENS RA satisfies the cybersecurity requirements by the pilots. However, not all recommendations for a secure system operation and maintenance can and should be addressed by a single project; imposing technical, legal, and organizational requirements is dealt with on national or domain level. While desirable good practices may be part of its recommendations, mandatory security measures are not. Complementing a reference architecture with a methodology to encompass the security goals from design time with tools to support the cybersecurity assessment is of paramount importance for meeting the regulatory requirements as well. Clearly, the mechanisms employed depend on the particular context and use case and cannot be joined by a universal security mechanism. The results from the questionnaire demonstrate that the generic security properties provided by the e-SENS RA are also reflected in the pilot implementations.

To validate the adoption of e-SENS building blocks, special events named connecta-thons were organized within the eHealth pilot, where conformance and interoperability tests were performed assisted by tools8 and skilled personnel [START_REF] Ehdsi | Non-repudiation mechanism -eHealth DSI Operations -CEF Digital[END_REF]. The secure and successful cross-border exchange of patient summaries and ePrescriptions was simulated among at least 4 countries. It is the first attempt to reuse this testing methodology for architectural assets created outside the eHealth domain.

This cybersecurity analysis joins the benefits of a goal-based approach with the systemic nature of a threat-view on security management. It also helps to organize the security policies spread over multiple domains. Furthermore, it not only permits tracing possible contradictory security policy statements, but facilitates the identification of weak or omitted security policies as well.

Related work

The EU is making significant steps toward cross-border eServices interoperability and implementation. The 2018 edition of eGovernment summarizes related policies and activities in 34 countries and enlists cybersecurity as an emerging topic [START_REF]Digital Government Factsheets -2018[END_REF]. The NIS Directive aims at ensuring a high level of network and information security across Europe [START_REF]The Directive on security of network and information systems (NIS Directive)[END_REF]. As a response to the directive requirements, ENISA, national governments and National Regulatory Authorities engaged in joint work in order to achieve harmonized implementation. Three non-binding technical documents were provided as guidance to the NRAs across EU member states [START_REF] Enisa | Technical Guideline on Minimum Security Measures -ENISA[END_REF], [START_REF] Enisa | Technical Guideline on Threats and Assets -ENISA[END_REF], [START_REF] Enisa | Technical Guideline on Incident Reporting -ENISA[END_REF]. The presented analysis is a contribution in similar direction and an effort to bridge technical solutions with regulatory policies and standardization. There are approaches that cover one or more aspects addressed by our work [18], [START_REF] Bowen | SP 800-100. Information Security Handbook: A Guide for Managers[END_REF]. In addition, [START_REF]CSA Singapore Security-by-Design Framework v1.0[END_REF] describes a thorough process to include and evaluate security aspects in all stages of the Information System lifecycle: requirement elicitation, acquisition, design and implementation, operation and maintenance, and disposal. Although security evaluation is included in the process, it follows a threat-based approach and offers no evaluation framework or any reference or enterprise architecture the systems might conform to. Evaluating certain cybersecurity attributes of enterprise architectures was approached in [START_REF] Sommestad | The Cyber Security Modeling Language: A Tool for Assessing the Vulnerability of Enterprise System Architectures[END_REF], [START_REF] Holm | P 2 CySeMoL: Predictive, Probabilistic Cyber Security Modeling Language[END_REF], which mainly rely on human effort. The same stands for addressing interoperability in enterprise architectures [START_REF] Ullberg | A language for interoperability modeling and prediction[END_REF]. Zuccato et al. [START_REF] Zuccato | Report: Modular Safeguards to Create Holistic Security Requirement Specifications for System of Systems[END_REF] provide a holistic account of "security requirements profiles" in an organization by assembling a set of "modular security safeguards". However, they are concerned only with the technical aspects and mainly serve the solution developers.

There is criticism about security design frameworks deemed to be too focused on the technical aspects and falling short in detecting and addressing potential design conflicts [START_REF] Mercuri | Uncommon Criteria[END_REF]. An example of this is a system that should implement both anonymity and auditability. By joining the goal-based approach with a threat-view, the issue of contradictory requirements in technology management through enterprise architectures is addressed from design time. Finally, the generic framework presented here is easy to understand by a non-technical person, while offering sufficient technical guidance for the (cyber)security experts.

Conclusion and Future Work

Secure information exchange platforms are crucial to the correct functioning of the services they support. The methodology presented here can be successfully applied for a model-based evaluation in a practical setting. It bridges technical and business solutions with the latest regulatory policies and frameworks. The employment of RMIAS in practice has led to a goal-based security analysis of each architecture construct, identifying how the technical specifications associated with them contribute to meeting the security goals. The empirical security evaluation showed that although the implementations were able to address the security goals, additional availability measures, proper risk analysis, and provision of human-oriented countermeasures require refinement of the architecture to provide further tools to reach the security objectives. Designing a methodology to analyze security measures provided by the implemented security mechanisms and integrating the outcomes of such analysis into the specifications allows for a technical person to cope more easily with the dynamics of security changes that a system may require. Furthermore, by enabling a non-technical person to understand the needs for implementing a certain security measures and the implications of not addressing it adds value in terms of usability of the system itself and for aligning the managerial requirements with the technical possibilities that an architecture offers.

Although each e-SENS pilot performed the evaluation of the architecture via domain-specific methodologies (e.g., connect-a-thons in eHealth), we pursue two independent approaches for the security assessment of the building blocks. Firstly, we plan to evaluate the eHealth pilot architecture with a tool such as securiCAD 9 . Secondly, we will formalize the conceptual framework of the methodology in order to enable a semi-automatic solution architecture design and help the architect deal with the variability and optionality of the design choices. An immediate step towards the automation of solution architecture design is thus the automation of the quality-attributes check. One way to do that is by employing denotational semantics as the formal apparatus, but other possibilities will also be tested. Therefore, an open-access implementation tool will be created to allow reusability and testing of the methodology, and moreover, implementation into real-world setting.

Fig. 1 .

 1 Fig. 1. The conceptual framework of the cybersecurity evaluation

Fig. 3 .

 3 Fig. 3. a) The state in which Information is being dealt with; b) Entities concerned by the security mechanisms implemented in the pilots

Table 1 .

 1 Information Classification template for the SATs; an example.

	Information	Sensitivity	Location	State	Security Goal
	Authentication	Non-Confi-	Controlled	Transit	Integrity
	Request	dential
	Secure message	Confidential Controlled	Transmis-	Authentication,
	transfer			sion, Storage	Non-Repudiation
	...	...	...	...	...
	3. The security goals devised are then analyzed and classified in relation to the relevant
	architecture (as shown in Table 2). The most generic description for each column is
	Node_X -Node_Y; this refers to information exchange in three general cases: (a)
	National infrastructure (b) Cross border infrastructure and (c) Direct end-to-end.

Table 2 .

 2 Template for goal-based end-to-end analysis of each SAT

Name of the SAT being evaluated Point of assessment End-point 1 Node_A … Node_X End-point Y

	Access Control	Yes	Yes	...	Yes
	Authentication	Yes	Yes	…	Yes
	Confidentiality	No	Yes	…	No
	Integrity	Yes	Yes	…	Yes
	Non-repudiation	No	No	…	…
	Accountability

https://www.esens.eu/

https://ec.europa.eu/isa2/solutions/eira_en

Note that the terms "security" and "cybersecurity" are used interchangeably throughout the paper: while the RMIAS addresses information security (& assurance) in general, the evaluation described here focuses on cybersecurity, as information in e-SENS is mainly in electronic form.

http://tiny.cc/yjwfaz

ENISA guidelines (SO6) in D2: Human resources security

PKI stands for Public Key Infrastructure

EPSOS (eHealth), PEPPOL (eProcurement), E-CODEX (eJustice), to name a few

The Gazelle test suite, http://gazelle.ihe.net

https://www.foreseeti.com/community/