Aude Plateaux
email: aude.plateaux@ensicaen.fr

Patrick Lacharme
email: patrick.lacharme@ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Kumar Murty
email: murty@math.toronto.edu

Online user's registration respecting privacy

Keywords: privacy, online recording, user centric architectures I

The explosion of Internet concerns a lot of domains from e-commerce to social networks. Various data, including personal data, are exchanged and stored in large databases or possibly in cloud storage, by numerous websites or online merchants. However, these service providers do not necessarily propose a clear policy on their personal data collection and storage. At the same time, users of the Internet need to understand how these recordings are being carried out. In this paper, a new solution is proposed for the registration to a website which helps the user to control his/her data. This solution is easy to use, user centric and privacy compliant.

INTRODUCTION

In 10 years, the number of computers connected has increased by 10,000 to reach 10 million. Today, the Dot-com bubble exploded represents over 37 million users. Internet offers more and more possibilities and services for various applications, from social networks to e-commerce. In most of cases, Internet users must provide various personal data in order to access a service of a web site. These latter are possibly stored without real control or time limitation. Moreover, most requested information is only used for market research or advertising purposes. The proliferation of personal data gives even greater importance to the issue of privacy on the Internet.

Each country has its own legislation in terms of privacy protection. The United States protects young Internet users by COPPA [8], consumers with the Gramm-Leach-Bliley act [START_REF] Cuaresma | The Gramm-Leach-Bliley act[END_REF] and medical information by HIPAA [START_REF] Act | Health insurance portability and accountability act of 1996[END_REF]. The European Union has the Directive 95/46 Data Protection [START_REF]Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data[END_REF]. Finally, Canada uses PIPEDA act for the protection of personal data [START_REF]PIPEDA -The Personal Information Protection and Electronic Documents Act[END_REF].

Resolution 45/95 [START_REF]Guidelines for the regulation of computerized personal data files[END_REF] adopted by the General Assembly of the United Nations provides, among other things, the principle of data security. This principle ensures that appropriate measures must be taken to protect computerized data against natural and human risks. These risks can be unauthorized access, misuse of data and computer viruses. However, we must add to the data security the requirements in terms of privacy. Three principles for this protection are developed:

-Data sensitivity principle: Handled personal data are considered as sensitive, requiring a de-centralized structure for data storage.

-Data sovereignty principle: Personal data belong to an individual, with a control and consent on how these data are used and for what purpose.

-Data minimization principle: Personal data disclosure should be limited to adequate, relevant and nonexcessive data. It includes anonymity and unlinkability of data.

These two last principles are detailed in the paper and Deswarte Gambs concerning the French national identity card [START_REF] Deswarte | Towards a privacypreserving national identity card[END_REF], and the PRIME project [START_REF]Privacy and Identity Management for Europe[END_REF]. This latter attempts to develop a framework for identity management in order to protect the privacy. In addition, in November, 2011, the European Commission examined ways to strengthen the data minimization principle. In addition, the European Commission has started the PrimeLife project [START_REF] Vimercati | Primelife policy language[END_REF]. Its purpose is to allow users to identify web sites which do not respect the users' personal information. Consequently, in contrast to Mark Zuckerberg's comments, privacy is not an outdated concept.

The access to web service begins by a first phase of registration. Users should provide various information to the service provider, SP. These access conditions generally begin by a valid email address, a user name and a password, associated with the web site. Additional personal information are often expected or required, including personal address, phone number, date of birth and favorite occupations and leisures. In addition, the user usually needs to answer to a question at the end of the questionnaire. He/She must check or uncheck the invisible box: "I agree to receive email with offers selected for me by the SP and its partner." However, to enable the SP and its partners to select user's preferences, these providers use client's personal information and follow the user's comings and goings on the site. Moreover, in many cases, the user's consent is not explicitly requested. For example, French sites automatically uncheck this box (opt-in consent), whereas English sites prefer opt-out consent. Thus, if the user does not refuse these offers by unchecking the box, advertising e-mails are automatically sent to him.

After the enrollment, the second step is the client's authentication with the couple login-password previously chosen. This phase is also invasive in terms of privacy protection. Indeed, the client authenticates in first, without proof of the SP authenticity and without conviction to deal with this SP. Thus, the SP registers the client personal information in its database and can follow the client's navigation for each connection.

Use of personal data for promotional offers or other various advertising messages is a strong problem for privacy. Moreover, users are rarely aware of the issues in terms of privacy when they disclose personal information. Personal data are "information relating to a natural person who is or can be identified, directly or indirectly" [5] and must be protected. It is therefore necessary to modify the recording protocols for existing websites. The sensitivity and the scores of authorized information to be disclosed must be limited, and users should be alerted on the use of these data.

Contribution. Most of publications focus on authentication protocols on Internet or on a specific technology improving privacy. This paper proposes a new enrollment solution with a service provider on Internet. The architecture provides an ease of recording using a form and an analyzer of access conditions, enhancing users' privacy. This approach respects the data sovereignty, minimization and sensitivity principles.

Organization. This paper begins with a brief state of the art concerning authentication, anonymity protocols and specific web technologies. The new architecture is presented in Section III and Section IV. This solution is analyzed in Section V.

II. PRIVACY ENHANCING TECHNOLOGIES

In this section, we review some privacy concepts, used in our architecture. To our knowledge, very few enrollment architectures have been proposed to date. The known architectures generally allow to assure one privacy property but never all important principles.

A. Specific web technologies

Web-specific technologies exist to protect users' personal data. The P3P platform [START_REF]The platform for privacy preferences specification[END_REF], for instance, allows websites to express their practices in terms of privacy. The advantage is this format can be quickly obtained and interpreted by user agents. These latter give the possibility to be informed of site practices to clients. Users avoid the difficult task of knowledge concerning the privacy policies of all visited sites. Unfortunately, although the P3P is consistent with the laws and self-regulatory program, it does not provide a mechanism to check site compliance with its policies. Similarly, in order to help consumers, IBM offers a risk and security management infrastructure [13]. It allows users to manage their personal information and control the privacy policies of online sites.

Numerous existing technologies concern social networks. Diaspora [START_REF][END_REF], Peerson [START_REF] Buchegger | Peerson: P2P social network-ing: early experiences and insights[END_REF] and Safebook [START_REF] Cutillo | Safebook: Feasibility of transitive cooperation for privacy on a decentralized social network[END_REF] are examples of these architectures which allow to protect user's data. Diaspora allows users to set up their own servers to host data without need to bounce communications. However, Diaspora provides no support for encryption. Peerson is a peer-to-peer infrastructure including encryption protocol in order to users keep control of their data. Moreover, the users can use this social network without Internet access. Finally, Safebook does not precise enough its policies. Jahid et al. in [START_REF] Jahid | Decent -a decentralized architecture for enforcing privacy in online social networks[END_REF] make a critical study concerning privacy performance of these infrastructures. Thus, they propose a new decentralized architecture for social networks. Unfortunately, these architectures are often complex for ordinary persons. Moreover, to our knowledge, no online registration architecture enables to protect clients' personal information by disclosing a minimum amount and respecting the data sensibility. Thus, in the two following subsections, we describe the necessary and existing knowledge for our architecture.

B. Identity and authentication

An online service generally begins with an authentication and a secure connection between the client and the SP website, using a protocol such as SSL/TLS [START_REF] Freier | RFC 6101: The Secure Sockets Layer (SSL) protocol version 3[END_REF][START_REF] Dierks | RFC 5246: The Transport Layer Security (TLS) protocol version 1[END_REF]. This protocol involves the client trusting in the SP and is aware of known published browser attacks [START_REF] Wagner | Analysis of the ssl 3.0 protocol[END_REF][START_REF] Gabrilovich | The homograph attack[END_REF][START_REF] Aciicmez | Improving Brumley and Boneh timing attack on unprotected ssl implementations[END_REF]. In the proposed architecture, the authentication is ensured by strong authentication or zero knowledge authentication, whereas data access control is based on the entity's identity, a list of access rights and the sensitivity of the protected information. Multifactors authentication generally uses a password and a smart card. In some cases, an additional factor is added. This may be a biometric factor, as in [START_REF] Krawczyk | Securing electronic medical records using biometric authentication[END_REF]. However, zero-knowledge authentication is easy to realize on a standard computer. These protocols can prove a given value, for example the identity, without revealing it. The ISO/IEC 97/98 gives explicit mechanisms using the zero-knowledge principle [START_REF]Information technology -Security techniques -Entity authentication -Part 5: Mechanisms using Zero-knowledge techniques[END_REF]. Classical zero knowledge authentication protocols are the Fiat-Shamir protocol [START_REF] Fiat | How to prove yourself: Practical solutions to identification and signature problems[END_REF] and the Schnorr protocol [START_REF] Schnorr | Efficient signature generation by smart cards[END_REF].

C. Anonymity and pseudonymity

Anonymity and pseudonymity preserve the users' privacy during a connection to commercial sites. The FPR class (Privacy) of the Common Criteria establishes security criteria for information systems [START_REF] Infrastructure | Common criteria for information technology security evaluation[END_REF]. This class is composed of four requirements: anonymity, pseudonymity, unlinkability and non-observability. These two first services, as well as the data minimization principle are also discussed by Pfitzmann and Hansen [START_REF] Pfitzmann | Anonymity, unlinkability, unobservability, pseudonymity, and identity management -a consolidated proposal for terminology[END_REF] and by Cameron [START_REF] Cameron | The laws of identity[END_REF]. These requirements can be used for identity management preserving privacy. The anonymity ensures the user can access to information without revealing his/her identity, whereas the pseudonymity requires the user is responsible for such use. There is a persistent assumed identity, namely the pseudonym. A single person may have many pseudonyms.

Consequently, in exceptional cases, the identity can be retrieved by authorized persons. Many anonymity and pseudonymity systems exist. For example, the German act [START_REF] Bygrave | Germanys teleservices data protection Act[END_REF] requires their service providers to offer anonymous or pseudonymous payment services for their users. Another famous example of anonymity system is the onion rounting for anonymous communications [START_REF] Reed | Anonymous connections and onion routing. Selected Areas in Communications[END_REF][START_REF] Goldschlag | Onion routing[END_REF].

III. ENROLLMENT ARCHITECTURE BETWEEN CLIENT AND SP

A. Overview

The proposed architecture for registration online service provider is centered on user privacy. In using this solution, the users could easily enroll in revealing a minimum of personal and sensitive data. The architecture ensures the client does not provide personal information if he/she has not obtained the SP authentication. Thus, the client reveals neither his/her data, nor his/her desires. The client only provides the necessary, relevant and adequate information for the transaction in order to assure the minimization, sensibility and sovereignty principles. The architecture is summarized in Fig. 1. This new online registration architecture involves four main actors: the user or client, the service provider SP, the client's bank and an advice part or counselor, directly connected to the user. The SP has a key pair whose public key is certified by the payment scheme(s) it has contractualized with. This certificate contains the following compulsory parameters:

• Its name which proves to the client that there is a SP with a valid certificate authority; • Parameters describing the payment scheme recognizing the SP and allowing to secure the future payment (AmEx, VISA, MasterCard...); • Specific certificates parameters:

-Designation of the certification authority; -Validation period; -Name of the public key holder; -Identification of the signature algorithm ; -Identification of the encryption algorithm; -Identification of the encryption and signature algorithms; • A public key of an asymmetric keys pair: K public (SP); • The name of certification authority; • The digital signature value. In our case, it is the signature of a challenge sent by the Client.

As far as the counselor is concerned, it helps the user to be aware about dangers of the data disclosure and provides tools to protect the personal information. Thus, this actor is directly related to the user, facilitates the client's process and helps him to bring into focus of the data sensitivity. The client can decide to use these available options. The counselor can play different roles: analyzer of access conditions, analyzer of conditions of usage, provider of proof of knowledge, identity manager or electronic strong-box. The counselor is software installed on the client's computer.

B. The enrollment architecture

Enrollment takes place in different ways with more or less options. Thus, the more options are used, the more client's privacy protection is assured. This section explains the main transactions between the SP and the client. The various and optional possibilities given by the counselor are detailed in the next section. Firstly, the client browses on the website and asks the SP to be authenticated, using a traditional challenge/response protocol. The client sends a random challenge to the SP. The SP signs the challenge using its private key in order to prove ownership of the certificate and this signed challenge is sent to the client. The client verifies the SP signature using the SP public key.

After the SP authentication, the client takes into consideration services and access conditions. If he/she accepts them, he/she sends the fulfilled access conditions to the SP, with a couple of login/password for futures connections. If sensitive or personal data are required, a mathematical proof of knowledge is only delivered for the SP. These data include the date of birth and the card number.

In case the client does not know the balance of his/her account, or if he/she prefers to have a confirmation from his/her bank, he/she may request a pre-authorization. In a single operation, the client authenticates to his/her bank and requests a pre-authorization for a given amount. The authentication can be done by a traditional login/password or through a CAP reader [START_REF] Mastercard | Chip authentication program functional architecture[END_REF]. If the authentication is successful, the bank positively responds to the request by checking the client's account balance for a given amount. Thus, in case the client is not creditworthy, the client avoids providing information to SP.

As the next step, after having the SP authentication and being sure to deal with the SP and to be solvent, the client authenticates to the SP thanks to his/her login/password. However, if the SP does not expect specific access conditions and simply the authentication without disclosure, the client can use a zero-knownledge authentication protocol. We do not detail this possibility in the article. Indeed, actually the SP gives advantage to client records for statistics and adverts. However, in order to respect the data sovereignty principle, the client is the one to decide on sending of the access conditions. Finally, if the client agrees, he/she sends the access conditions to the SP. This latter verifies this document and his/her proof of knowledge replacing the disclosure of date of birth. If the access data are correct, the payment phase between actors can process.

IV. ENHANCING PRIVACY WITH THE COUNSELOR

The counselor is an application on the client's computer, managing and analyzing personal data exchange. The client decides to use the available options of the counselor, as summarized in Fig. 2.

Firstly, the counselor can play the role of signature verifier. In this case, the client easily sends the challenge to the SP for its authentication. Then, the counselor checks the SP signature of this challenge.

In the same way, as described previously, the client provides a proof of knowledge of personal data, as the date of birth. The counselor takes responsibility for this proof.

Secondly, the client can request an analysis of the conditions of usage. The counselor simply read and highlights important terms of the contract in terms of privacy protection. This actor may also analyze access requirements. The counselor then adds to each required information one levels of intrusion in terms of privacy. These two actions allow the client to manage personal information and to minimize their disclosures.

Moreover, the client can pre-fill a form containing data which can be revealed. If this form exists, the counselor uses it to pre-fill the access conditions. The padding of this form has been guided by the counselor in order to know the level of data sensitivity. With the knowledge of the data sensitivity and authorized conditions, the choice is left to the client to include other information. For instance, the form can contain information with conditions such as:

• An email address can be useful in the case of password loss; • The mailing address is only relevant in the case of home delivery. This requirement is that this address must be provided at the end of the process; • The card number is stored only if the client requires.

Otherwise, it is a real sensitive data; • The client's age if the access requires a minimum age.

The date of birth is not provided except when the client requires. Otherwise, we prefer use a proof of knowledge; • An option is checked if the client accepts to receive advertisements or "newsletters".

Thus, in the case where the SP requests a condition present in this form, it is not necessary to ask the client's consent. This method simplifies the connection to the website for the client. However, if a requirement is not contained in the form, or if it contains a requirement (as in the mailing address), the client's consent is automatically requested.

One solution is to create a common form for all SP with adequate, relevant and non-sensitive information. Moreover, it is possible to ensure the authenticity of the information containing in the form. This latter must be signed by a certification authority. The client may, at any time, update this document and return for signature to the certification authority. This form is stored by the counselor in an electronic strongbox. Thus, once the access conditions pre-filled by the counselor, the client checks these conditions (and eventually completes them).

Finally, in order to avoid the problem of forgotten passwords, it is common to use the same couple. However, the multiple uses of the same couple cause trouble for associability of data and identity theft. Thus, the client can also use the counselor as an identity manager. This actor generates one such pair for each SP. Then, in the same way as the form, these couples are stored in a secure digital strong-box. Obviously, in a future connection to the SP, the couple allows the client not to register again.

V. ANALYSIS OF THE PROPOSED PROTOCOL

The security of this architecture is linked to the possession of a certificate by the SP, the different authentication algorithm, as well as secure channels used for each transaction. The counselor is able to securely generate and store different couples of login/password for each SP. Thus, the user avoids the data correlation problem in the case of a corrupted database, as well as theft of identity.

In addition, the proposed solution is entirely focused on the client. The access conditions and conditions of use are analyzed by the counselor. Then, a form can be completed by the client with the help of the counselor. A degree of intrusion in terms of privacy is also indicated during the analysis and the padding of the form. Thus, the data sensitivity principle is respected.

The principle of minimization is also assured. The data are only disclosed after the SP authentication and proof of creditworthiness. In addition, only relevant and adequate data are disclosed and a proof of knowledge is provided instead of the date of birth.

Finally, the client's consent is required at all steps. He/She has the last word concerning his/her data. Consequently, the data sovereignty principle is also respected.

VI. CONCLUSION

The large amount of personal information stored by service providers in their databases requires protection with particular attention given to privacy issues. The users' data are possibly re-used for statistics and adverts and rarely considered in terms of privacy protection. This new architecture uses a pre-filled form, a reorganization of transactions and known cryptographic tools, such as certificates, proof of knowledge and authentication protocols. Furthermore, the counselor is able to play several roles: signature verifier, analyzer of conditions, provider of proof of knowledge, identity manager or manager of electronic strong-box. These options help users in their approach and make them aware of the data sensitivity. Thus, the proposition offers a secure and easy-to-use solution respecting the fundamental principles in terms of user's privacy.

Figure 1 .

 1 Figure 1. The new enrollment architecture when the client is not registered.

Figure 2 .

 2 Figure 2. The available transactions with the counselor.

The authors would like to thank Vincent MARIE for his participation during the implementation, as well as the BULL company and the ANRT association for their financial support.


Syed Zulkarnain
email: syed-zulkarnain.syed-idrus@ensicaen.fr

Syed Idrus

Estelle Cherrier
email: estelle.cherrier@ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Patrick Bours
email: patrick.bours@hig.no

Soft Biometrics Database: A Benchmark For Keystroke Dynamics Biometric Systems

Among all the existing biometric modalities, authentication systems based on keystroke dynamics are particularly interesting for usability reasons. Many researchers proposed in the last decades some algorithms to increase the efficiency of this biometric modality. Propose in this paper: a benchmark testing suite composed of a database containing multiple data (keystroke dynamics templates, soft biometric traits . . . ), which will be made available for the research community and a software that is already available for the scientific community for the evaluation of keystroke dynamics based systems. We also built the proposed biometric database on soft biometric traits for keystroke dynamics to suit the experiment. 110 people had voluntarily participated and gave their soft biometric data i.e. the way of typing, gender, age and handedness.

Introduction

Soft biometrics traits are physical, behavioural or biological human characteristics, classifiable in pre-defined human compliant categories, which have been derived from the way human beings normally distinguish their peers (e.g. height, gender, hair color etc . . . ). Those attributes have a low discriminating power, thus not capable of identification performance. Additionally, they are fully available to everyone which makes them privacy-safe. Keystroke dynamics is a viable and practical way as an addition to security for identity verification. It can be combined with passphrases authentication resulting in a more secure verification system. Soft biometrics allows a refinement of the search of the genuine user in the database, resulting in a computing time reduction. For example, if the capture corresponds to a male according to a soft biometric module, then the standard biometric authentication system can restrict its research area to male users, without considering female ones. Since this work of Jain et al. [START_REF] Jain | Soft biometric traits for personal recognition systems[END_REF], there have been several other articles dedicated to soft biometrics can be found in the literature, some of which, can be mentioned here. The paper [AVL + 06], focusing on body weight and fat measurements to enhance a fingerprint based biometric system. An overview can be found in the paper [START_REF] Dantcheva | Bag of soft biometrics for person identification : New trends and challenges[END_REF] about soft biometrics, under the form of a "Bag of Soft Biometrics": the authors make a comparison with the pioneering work of Alphonse Bertillon, whose anthropometric criteria gave rise to soft biometrics, see [START_REF] Rhodes | Alphonse Bertillon: Father of scientific detection[END_REF]. This paper proposes some facial soft biometrics and also body soft biometrics, namely weight and clothes color detection.

Keystroke dynamics is an interesting and a low cost biometric modality as it enables the biometric system to authenticate or identify an individual based on a person's way of typing a password or a passphrase on a keyboard [START_REF] Giot | GREYC Keystroke: a Benchmark for Keystroke Dynamics Biometric Systems[END_REF]. An original approach is presented in the work of Epp et al. [START_REF] Epp | Identifying emotional states using keystroke dynamics[END_REF], strongly linked with the behavioral feature of keystroke dynamics. The authors show that it is possible to detect the emotional state of an individual through a person's way of typing. In this case, detecting anger and excitation is possible in 84% of the cases. Gender recognition is dealt in the work of Giot et al. in [START_REF] Giot | A New Soft Biometric Approach For Keystroke Dynamics Based On Gender Recognition[END_REF]: they show that it is possible to detect the gender of an individual through the typing of a fixed text. The gender recognition rate is more than 90% and the use of this information in association to the keystroke dynamics authentication reduces the Equal Error Rate (EER) by 20%. We also did an experiment in [START_REF] Syed Idrus | Soft Biometrics For Keystroke Dynamics[END_REF] and obtained some interesting and promising results. Our results show that given at least 10 keystroke dynamics templates of users, it is possible to detect their way of typing (using one/two hand(s)), gender, age category and handedness between 65% to 96% correct recognition accuracy performed on a dataset with five passphrases.

The objective of this paper is to present a new data collection of 110 users, both from France and Norway. This new benchmark will be released to the scientific community. We are interested in the criteria that can influence the way of typing of the users. We test if it is possible to predict if the user:

1. types with one or two hands 2. is a male or a female 3. belongs to a particular age category 4. is right-or left-handed

The aim of this paper is threefold. Section 2 deals with the state-of-the-art and the existing keystroke databases. In Section 3, it is devoted to the description of the creation of the database and its main features. The results of the analysis from the database created are discuss in Section 4.

State-of-the-art: Public Keystroke Dynamics Dataset

In most studies, researchers use their own dataset which, most of the time, suffers from lack of number of users and sessions. Some keystroke dynamics databases are publicly available in the literature [GEAR09, [START_REF] Killourhy | Comparing anomaly-detection algorithms for keystroke dynamics[END_REF][START_REF] Giot | Web-Based Benchmark for Keystroke Dynamics Biometric Systems: A Statistical Analysis[END_REF]. In [START_REF] Giot | GREYC Keystroke: a Benchmark for Keystroke Dynamics Biometric Systems[END_REF], several users typed the passphrase "greyc laboratory" on two different keyboards on the same computer during several sessions. 100 users have provided at least 60 samples each on 5 different sessions spaced of one week (most of the time). In [START_REF] Killourhy | Comparing anomaly-detection algorithms for keystroke dynamics[END_REF], several users have typed the password ".tie5Roanl" on a single computer during several sessions. 51 users have provided 400 samples each on 8 different sessions spaced of, at least, one day. This database contains a huge number of samples, but the time interval may be too small to track variability on a long period. These two databases are the only ones containing enough samples and users to give statistically significant results. In [START_REF] Giot | Web-Based Benchmark for Keystroke Dynamics Biometric Systems: A Statistical Analysis[END_REF], each user was asked to key-in different logins and passwords. This is the most realistic scenario for keystroke dynamics as real users use different logins and passwords. 83 users have provided 5185 genuine samples (pair of password typed by its owner); 5754 impostor samples (pair of login, password typed by a user different of its owner); and 5439 imposed samples (pair of imposed login and password). This database is not the largest in terms of number of users involved, however, it is the only public keystroke dynamics providing different logins and passwords per users. Table 1 summarises this information. 3 Benchmark Features: Biometric Database

Requirements

Hardware devices was pre-prepared such as a laptop with two external keyboards (French keyboard for users in France and Norwegian keyboard for users in Norway) i.e. AZERTY and QWERTY, respectively -the layouts are shown in Figures 1(a) and 1(b). An application to collect the keystroke dynamics data was also available. The location and position of the hardware are in a fixed position and immoveable throughout the session for the authenticity of the outcomes.

Acquisition Protocol

An experiment has been performed in two locations: France and Norway, but in fact the subjects originate from 24 different countries who are either studying or residing in one of the concerned countries. A total of 110 individuals had volunteered to participate in this According to experts, the best password is a sentence [START_REF] Durgahee | The best password is a sentence: says expert[END_REF]. Having said that, since our study takes place both in France and Norway, we have chosen passphrases instead of sentences, well-known in both countries. Hence, for the purpose of our study for keystroke dynamics in [START_REF] Syed Idrus | Soft Biometrics For Keystroke Dynamics[END_REF], we present 5 passphrases as shown in Table 3, which are between 17 and 24 characters (including spaces) long, chosen from some of the wellknown or popular names, denoted P 1 to P 5 . All the participants are asked to type these 5 different passphrases 20 times. Thanks to GREYC Keystroke software developed at GREYC Laboratory (downloadable at the following address: http://www.ecole. ensicaen.fr/ ˜rosenber/keystroke.html), we are able to capture biometric data. In [START_REF] Giot | GREYC Keystroke: a Benchmark for Keystroke Dynamics Biometric Systems[END_REF], the authors describe the GREYC-Keystroke, which is a software developed for allowing the creation of a keystroke dynamics database and highlighted its functionalities. The keystroke application allows to add users to the application; capture the keystroke dynamics of one user several times; change the attended password; and verify the user authentication (when he/she has at least 5 captures in order to define his/her reference). Here, we define two classes of the way of typing; gender category; age category; and handedness category denoted C 1 and C 2 , respectively as follows:

• Way of typing: C 1 = One Hand: only one hand is used (right/left depends if the user is right/left-handed person); C 2 = Two Hands: both hands are used.

• Gender: C 1 = Male; C 2 = Female.

• Age: C 1 = < 30 years old; C 2 = ≥ 30 years old.

• Handedness: C 1 = Right-handed; C 2 = Left-handed.

Keystroke Data Capture

For any keystroke capture, the captured data are the (i) code of the key, (ii) the type of event (press or release), and (iii) the time of the event. All this information is stored in united states of america 24-char the keystroke datas table in the fields rawPress and rawRelease, for respectively press and release events, for each keystroke typing of an entire and correctly typed password. The data are saved following this scheme: code of the key, followed by a space, followed by the times-tamp of the event, followed by a new line and so on, for each events. The interest of storing these raw data, is to permit other researchers to create their own feature extracted data if our data does not fit their requirements. The extracted data features stored in the database are the timing differences between two events of these kinds: press/press, release/release, press/release and release/press, an additional vector resulting of the concatenation of the previous ones and the total typing timing of the password. They are stored in the fields ppTime, rrTime, prTime, rpTime and vector of the table keystroke datas and time to type of the table keystroke typing. The following are keystroke dynamics data consist of information containing the timing values of keystrokes [START_REF] Giot | GREYC Keystroke: a Benchmark for Keystroke Dynamics Biometric Systems[END_REF], (see Figure 2):

• ppTime (PP): the latencies of when the two buttons (keys) are pressed;

• rrTime (RR): the latencies of when the two buttons (keys) are released;

• prTime (PR): the durations of when one button (key) is pressed and the other is released;

• rpTime (RP): the latencies of when one button (key) is released and the other is pressed;

• vector (V): the concatenation of the four previous timing values.

The keystroke template V was used here for the analysis, which is the concatenation of the four mentioned timing values to perform the data analysis by classifying two classes for each category. Hence, five different features/patterns or timing vectors are extracted from each typing sample i.e. PP, RR, PR, RP, V. Since these extracted features are already available in the database, we can re-use them directly without having to compute it again.

Data Collection Process

To begin the process of data acquisition, firstly, meta-information such as gender, age, handedness, and country of origin were collected. Note that also information on the keyboard is available (AZERTY or QWERTY), although that was not explicitly asked. Then, after all those information have been obtained, each user has to type each passphrase P j , j = 1..5 for each hand class C i (i = the way of typing: one/two hands), i = 1, 2 (1 = one hand, 2 = two hands), 10 times without errors. If there are typing errors, the current entry has to be cancelled and the user have to resume until 10 successful entries for both classes of hand have been recorded into the system. If the user is a right-handed person, he/she only need to use the right hand to key-in the passphrases in a normal typing pace, and similarly for the left-handed people. At the end of the data collection, a total of 11000 data samples (= 5 passphrases x 2 classes of hand x 110 users x 10 entries) are in the proposed biometric database. For each user, 7 out of 10 samples are used for both training and test data. The first three entries for each user are not taken into account because leeway was given to the users to allow them to train themselves for each of the given passphrases.

Results

Several simulations have been performed with SVM (Support Vector Machine) for computations on several different aspects of the data namely hand recognition, gender recog-nition, age category recognition, and handedness recognition, where the results have been published in [START_REF] Syed Idrus | Soft Biometrics For Keystroke Dynamics[END_REF]. However, we further analyse the two countries separately, both users in France and Norway, to see if there are any differences in term of their performances. Here, with substantial amount of data, we only analysed two soft biometrics information namely Hand Recognition and Gender Recognition. From the previous results, notice that the performances differ between the two soft categories because of the different criteria involved in the analysis mentioned earlier in the article. Generally, the recognition performances for all soft categories have the same trend: at the initial learning ratio, the recognition rates are quite low but then gradually increase after the learning ratios become greater i.e having more data for the learning.

Figure 1 :

 1 Figure 1: Keyboards layouts

Figure 2 :

 2 Figure 2: Keystroke typing features

Figure 3

 3 Figure3(a) and Figure3(c) illustrate the results of the recognition rates for France and Norway, respectively on different learning ratios with one hand (C 1 ) and two hands (C 2 ) for five different passphrases P 1 to P 5 . In this experiments, the results are promising, since from the ratio of 50% of total data used for training the SVM, the recognition rate for France is between 89% and 96%, and over 90% for Norway. Figure3(b) and Figure3(d) illustrate the results of the recognition rates for France and Norway, respectively on different learning ratios with males (C 1 ) and females (C 2 ) for passphrases P 1 to P 5 . The recognition rate, depending on the considered passphrase, is between 66.4% and 68% for France, and between 76.5% and 78.2% for Norway for a ratio over or equal to 50%.

Figure 3 :

 3 Figure 3: Average recognition rates

Table 1 :

 1 Summary of the keystroke dynamics database.

			Size
	Study	# users	# samples
	[GEAR09]	100	60,000
	[KM09]	51	20,400
	[GEAR12]	83	5185 + 5754 / 5439
	Proposed	110	11,000

Table 2 :

 2 Repartition of samples

	User	70 (France); 40 (Norway)
	Gender	78 males (47 from France, 31 from Norway); 32 females (23 from France, 9 from Norway)
	Age Category	< 30 years old (37 men, 14 women);
	(between 15 and 65 years old) ≥ 30 years old (41 men, 18 women)
	Handedness	98 right-handed (70 men, 28 women); 12 left-handed (8 men, 4 women)
		Table 3: Passphrases
	Password	Description	Size
	P 1	leonardo dicaprio	17-char
	P 2	the rolling stones	18-char
	P 3	michael schumacher	18-char
	P 4	red hot chilli peppers	22-char
	P 5

Conclusions and Perspectives

Presented here is a new dataset for keystroke dynamics, which will soon be publicly available. This dataset is composed of several soft biometrics information of users. It consists of information on the user's way of typing by defining the number of hands used to type (one or two), gender, age and handedness. This work is however, the creation of a substantial database, with 110 users, from France and Norway, with 100 samples per user. This information could be useful and used as a reference model to assist the biometric system to better recognise a user by a way he/she types on a keyboard.


Tomas Ménard
email: tomas.menard@unicaen.fr

Giorgio Grioli
email: gio.grioli@centropiaggio.unipi.it

Antonio Bicchi
email: bicchi@ing.unipi.it

A Stiffness Estimator for Agonistic-Antagonistic Variable-Stiffness-Actuator Devices

Safe Physical Human Robot Interaction, conservation of energy and adaptability are just the main robotic applications that prompted the development of a number of Variable Stiffness Actuators (VSA). Implemented in a variety of ways, they use various technologies, and feature the most diverse mechanical solutions, all of which share a fundamentally unavoidable nonlinear behavior. The control schemes proposed for these actuators typically aim at independent control of the position of the link, and its stiffness. Although effective feedback control schemes using position and force sensors are commonplace in robotics, control of stiffness is at present completely open-loop: the stiffness is inferred from the mathematical model of the actuator. We consider here the problem of estimating the nonlinear stiffness of Variable Stiffness Actuator in Agonistic-Antagonistic configuration. We propose an algorithm based on modulating functions which allow to avoid the need of numerical derivative and for which the tunning is then very simple. An analysis of the error demonstrates the convergence. Simulations are provided and the algorithm is validated on experimental data.

I. INTRODUCTION

T HE control of flexibility in actuators is a topic that gained in importance during the last decades, when the possibility to take advantage of the flexibility has become a possible option, rather than minimizing it [START_REF] Pratt | Series elastic actuators[END_REF]. Among the resulting applications, one of the most important is safety of physical Human Robot Interaction (phHRI) [START_REF] Bicchi | Safety for physical humanrobot interaction[END_REF], [START_REF] Bicchi | Fast and soft arm tactics: Dealing with the safety-performance trade-off in robots arms design and control[END_REF], [START_REF] Ikuta | Safety evaluation method of design and control for human-care robots[END_REF]. In case of accidental collision between a human and a robot, a compliant actuator can reduce the risk of injuries, while the actuator can be made more rigid for precise tasks. Others applications have been developed such as mechanism preservation [START_REF] Haddadin | Kick it like a safe robot: requirements for 2050[END_REF], energy saving [START_REF] Uemura | Resonance-based motion control method for multi-joint robot through combining stiffness adaptation and iterative learning control[END_REF], energy storing to release it at particular time [START_REF] Garabini | Optimality principles in variable stiffness control: The vsa hammer[END_REF], [START_REF] Haddadin | Kick it with elasticity: safety and performance in human robot soccer[END_REF] or rehabilitation [START_REF] Ikegami | Design of redundant drive joint with adjustable stiffness and damping mechanism to improve joint admittance[END_REF], [START_REF] Wang | Avse -active variable stiffness exoskeleton robot system: Design and application for safe active-passive elbow rehabilitation[END_REF].

In order to control both position and stiffness, specialized devices have been designed which are made up of two actuators and flexible transmissions presenting nonlinear characteristics [START_REF] Van Ham | Review of actuators with passive adjustable compliance/controllable stiffness for robotic apllications[END_REF]. Most existing devices can be classified into two categories, as shown on figure 1. The first approach is bio-inspired and consists in setting the two motors in an Agonistic-Antagonistic configuration, connected to the link via nonlinear spring, similarly to antagonist muscles actuating an arm [START_REF] Migliore | Biologically inspired joint stiffness control[END_REF], [START_REF] Schiavi | Vsa-II: A novel prototype of variable stiffness actuator for safe and performing interacting with humans[END_REF], [START_REF] Nam | Compliant actuation of parallel-type variable stiffness actuator based on antagonistic actuation[END_REF], [START_REF] Cho | A variable stiffness joint using leaf springs for robot manipulators[END_REF]. In the second approach, called serialconfiguration, the dynamics of the two motors are almost decoupled. A first motor is dedicated to controlling the link motion, while a second smaller motor is dedicated to the setting of the stiffness [START_REF] Choi | Design of a robot joint with variable stiffness[END_REF], [START_REF] Jafari | A novel actuator with adjustable stiffness (awas)[END_REF], [START_REF] Van Ham | Maccepa, the mechanical adjustable compliance and controllable equilibrium position actuator: Design and implementation in a biped robot[END_REF], [START_REF] Kim | Hybrid dual actuator unit: A design of a variable stiffness actuator based on an adjustable moment arm mechanism[END_REF], [START_REF] Hurst | An actuator with physically variable stiffness for highly dynamic legged locomotion[END_REF].

After the problem of finding a suitable architecture for VSA, comes the problem of controlling both the position and the stiffness, as illustrated in the example of figure 2. While for the serial configuration the dynamics of the positions and the stiffness are almost decoupled, it is not the case for the Agonistic-Antagonistic configuration, where the dynamics are coupled and nonlinear. Several control laws have hence been proposed in the last decade. For the regulation of the stiffness and the position to constant values, a feedback control has been proposed in [START_REF] De Luca | Dynamic gravity cancellation in robots with flexible transmissions[END_REF] and a port Hamiltonian approach, which allow the regulation while keeping the stored energy constant, in [START_REF] Visser | Energy efficient variables stiffness actuators[END_REF]. Control law for tracking smooth trajectory have also been proposed in [START_REF] De Luca | Nonlinear decoupled motion-stiffness control and collision detection/reaction for the vsa-ii variable stiffness device[END_REF], [START_REF] Palli | On the feedback linearization of robots with variable joint stiffness[END_REF], [START_REF] Wimbock | Impedance control for variable stiffness mechanisms with nonlinear joint coupling[END_REF] using a feedback linearization strategy for single DOF and multi DOF actuators and in [START_REF] Sardellitti | A position and stiffness control strategy for variable stiffness actuators[END_REF] following a gain scheduling method and LQR for robustness.

All the above control scheme have the same issue, a precise knowledge of the stiffness is required, but there is no sensor for the stiffness. Hence it has to be reconstructed either by a mathematical model, but it is prone to error since the model is usually complex and subject to high imprecision, or with an online estimator. The latter method is far preferable and has been investigated in several papers. A first method has been proposed in [START_REF] Grioli | A non-invasive real-time method for measuring variable stiffness[END_REF] where the error estimation was shown to be uniformly ultimately bounded. An improved algorithm has been proposed in [START_REF] Grioli | A real-time parametric stiffness observer for vsa devices[END_REF], where the observer is derived from a parametric approach coupled with an analytic differentiation. Both these methods have been operating on the link side and require several numerical differentiation. In order to alleviate this issue, other algorithms have been developed, working on the motor side. The problem can then be stated as follows, the equation representing the movement of the motor angle q is given by: τ = Jq (2) + bq (1) -f (φ)

where τ is the torque of the motor, J and b are the motor inertia and damping and φ = q -qL is the displacement angle with qL the link angle, all these parameters and signals are known or measured.

The problem is to estimate σ(φ) = ∂f ∂φ , the stiffness. The main issue is that we need the derivatives of the measured signals which is a difficult problem for noisy signals. To the best of our knowledge, two algorithms have been proposed for the estimation of σ, following this way.

Firstly, in [START_REF] Flacco | On-line estimation of variable stiffness in flexible robot joints[END_REF], where the idea is to obtain first an estimation of f (φ) by combining a modified kinematic Kalman filter for the estimation of the first derivative of q and a first order filter. Then f is approximated by a Taylor expansion and its parameters are estimated by a least square algorithm. Finally, σ is obtained by analytically differentiating the Taylor expansion. The main drawback of this method is that the convergence required for this type of algorithm cannot be ensured. These restrictions have been partially alleviated in [START_REF] Ménard | A real time observer for an agonistantagonist variable stiffness actuator[END_REF] where an algorithm has been proposed based on operational calculus and differential algebra. The idea is to first obtain a relation involving σ by differentiating equation [START_REF] Bicchi | Safety for physical humanrobot interaction[END_REF], then, by doing some calculus in the Laplace domain, a relation between filtered versions of the measured signals and σ is obtained. Replacing σ by a Taylor expansion approximation, a Least Square Algorithm can be used, involving filtered versions of the different measured signals in order to estimate the parameters of the Taylor expansion. The fact that no numerical derivative is needed, makes this algorithm very easy to tune, and hence practically interesting, indeed, there are only three parameters to set: the length of the integration window, the initial value of the covariance matrix for the recursive least square algorithm and the order of the Taylor expansion.

We propose here an improved version of [START_REF] Ménard | A real time observer for an agonistantagonist variable stiffness actuator[END_REF]. First, the algorithm Fig. 2. A possible control system for a Variable Stiffness Actuator, organized in two layers: On the lowest layer a position and stiffness controller tracks the references generated by the higher level trajectory planner. Both control loops rely on knowledge on the stiffness of the actuator: the instantaneous value of the stiffness is used to close the inner loop, while the shape of the stiffness function is used by the trajectory planning algorithm.

is simplified, while in [START_REF] Ménard | A real time observer for an agonistantagonist variable stiffness actuator[END_REF] it has been derived using operational calculus and differential algebra, we utilize here modulating functions, which allow to obtain the filters, needed for the algorithm, clearly and easily. In addition, we analyze the effect of the measurement noise and the truncation error on the estimation of the stiffness, and provide a guideline for the tunning of the different parameters and ensure the convergence of the algorithm when there is noise on the torques measurements. The paper is organized as follow. In section II, we present the class of systems considered in this paper and the definition of stiffness. The main development is done in section III, where the methodology is presented for a VSA in Agonistic-Antagonistic configuration. An analysis of the error on the measured data is given next. The performance of the observer is illustrated on simulations in section IV. The observer is then used on real experimental data, for an AA-VSA in section V. Finally, section VI presents our conclusions.

II. PROBLEM STATEMENT

We focus our analysis on the Agonistic-Antagonistic VSA devices, which scheme is that of figure 1(a). We recall here the model presented in [START_REF] Schiavi | Vsa-II: A novel prototype of variable stiffness actuator for safe and performing interacting with humans[END_REF]. We denote τ1 and τ2 the torques of the motors, f1 and f2 the elastic torques of the variable stiffness, q1, q2 and qL the positions of the two motors and the link, respectively. The gravity term is given by g. The parameters of the two motors and the link are J1, J2, JL the inertias and b1, b2, bL the dampings, respectively.

The dynamical model is given by: τ1 = J1 q

(2)

1 + b1 q

(1)

1 -f1(qL -q1), (2)
τ2 = J2 q (2) 2 + b2 q (1) 2 -f2(qL -q2), (3)
τL = JL q

(2)

L + bL q

(1)

L + g(qL) +f1(qL -q1) + f2(qL -q2), (4)
and the total flexibility torque is

f (φ) = f1(φ1) + f2(φ2). (5)
where φ = (φ1, φ2) with φi = qL -qi, i = 1, 2, correspond to the deformation of each motor-transmission. The total device stiffness is derived from the total flexibility torque and is equal to

σ(φ) = σ1(φ1) + σ2(φ2), (6)
where

σi(φi) = ∂fi ∂φi (φi), i = 1, 2. (7)

III. OBSERVER DESIGN FOR STIFFNESS ESTIMATION

In this section, we first present the modulating functions and give some useful properties. These properties are further used to define the stiffness estimator. Afterward, the effects of the measurement noise and the truncation error are analyzed.

A. Modulating functions

The following definitions and proposition come from [START_REF] Preising | Theory and application of the modulating function method i: Review and theory of the method of the splinetype modulating functions[END_REF], and have been slightly modified for our need.

Definition 1. A modulating function of order k on [a, b] (a, b ∈ R) is a function ψ : [a, b] → R, k-times differentiable such that: ψ (i) (a) = 0 = ψ (i) (b), i = 0, . . . , k -1, (8)
where ψ (i) represents the i-th order derivative of ψ.

(i) f (i) 1 , ψ = (-1) i f1, ψ (i) , i = 0, . . . , k -1, (ii) Cf1 + f2, ψ = C f1, ψ + f2, ψ .
Property 1 is very important, because it allows to replace the derivative on a function f , which is usually unknown (for example, we only have access to a measured signal), by the derivative on the modulating function for which the derivative is known and can be computed analytically.

Example 1. Let us define the following function:

wi,j(u) = (1 -u) i u j , u ∈ R, i, j ∈ N. ( 10
)
Then, w k,k , for k ∈ N, is a modulating function of order k + 1 on [0, 1].

B. Algorithm

The estimation of the stiffness is derived from equations ( 2)-( 3), that is, we look at the system on the motor side. The algorithm is split into two parts. Firstly, the equations are differentiated to make the stiffness appear explicitly, the stiffness is then approximated by a Taylor expansion and the resulting equations are transformed, using modulating functions, so that only filtered versions of the measured signals are needed. Secondly, a least square algorithm is used to estimate the parameters of the Taylor expansion and thus the stiffness itself.

Computation of the filters: We start from equations ( 2)-( 3), that is:

τi = Jiq (2) i + biq (1) i -fi(φi), i = 1, 2. (11)
Differentiating with respect to time yields:

τ (1) i = Jiq (3) i + biq (2) i -φ (1)
i σi(φi),

we take the following Taylor expansion approximation:

σi(φi) ≈ N j=0 α i j (φi) j j! , (13)
which gives the relation:

N j=0 α i j φ (1) i (φi) j j! = Jiq (3) i + biq (2) i -τ (1)
i .

The maximum derivative order is 3, then we need to take an order 4 modulating function ψ, which will be defined later. Modulating equation ( 14) with ψ, one obtain:

N j=0 α i j φ (1) i (φi) j j! , ψ = Jiq (3) i + biq (2) i -τ (1)
i , ψ ,( 15)

N j=0 α i j (φi) j+1 (j + 1)! (1)
, ψ = Ji q

(3) i , ψ + bi q (2) i , ψ (16)
τ

i , ψ ,

N j=0 α i j (φi) j+1 (j + 1)! , ψ (1)
= Ji qi, ψ

bi qi, ψ

(2) (17)

τi, ψ (1) .

We get a relation between the stiffness and the measured signals, where the only source of error is the Taylor approximation. We want to estimate the parameters αi with a least square algorithm, then we need a relation changing with time t. For this purpose, we take a = t-T and b = t, where T > 0 is the length of the integration window and the modulating function is taken as ψ(u) = (u-t+T ) 3 (t-u) 3 . We have the following relation:

N j=0 α i j t t-T (φi) j+1 (j + 1)! (u)ψ (1) (u)du = Ji t t-T qi(u)ψ (3) (u)du (18)
-bi t t-T qi(u)ψ (2) (u)du

-t t-T τi(u)ψ (1) (u)du.
Doing the change of variables u = T ν + t -T and dividing by T 3 yields

N j=0 α i j T 2 1 0 (φ i ) j+1 (j+1)! (t + T (ν -1))w (1) 3,3 (ν)dν = +Ji 1 0 qi(t + T (ν -1))w (3) 3,3 (ν)dν -biT 1 0 qi(t + T (ν -1))w (2) 3,3 (ν)dν -T 2 1 0 τi(t + T (ν -1))w (1)
3,3 (ν)dν, the function w3,3 is defined by equation [START_REF] Grioli | A real-time parametric stiffness observer for vsa devices[END_REF]. The last thing to do is to obtain a discrete version of this relation. We assume that the sampling period is Ts and that T = M Ts, where M ∈ N. We take an approximation of the integral with the trapezoidal method, that is:

1 0 f (u)du ≈ M m=0 Wmf (tm), (19)
with tm = mTs, W0 = WM = Ts/2 and Wm = Ts, m = 1, . . . , M -1.

We finally obtain the following relation, at discrete-time k (corresponding to the continuous time t = kTs):

Ci(k) = N j=0 α i j b i j (k), (20)
△ = A T i Bi(k), (21)
with Ai = [α i 0 , . . . , α i N ] T , Bi(k) = [b i 0 , . . . , b i N ] T , Ci(k) = M m=0 qi ((k -m)Ts) × (22)
i j (k) = M m=0 φ j+1 i (j + 1)! ((k -m)Ts) T 2 Wmw (1)
3,3 (m/M ) .

(23) For k ≤ M , measured values at negative time (k -m)Ts, i.e. (km) < 0, are set to zero. The derivatives of w3,3 are given by:

w (1) 3,3 (u) = -3w2,3 + 3w3,2, (24)
w (2) 3,3 (u) = 6w1,3(u) -18w2,2(u) + 6w3,1(u), (25)
w (3) 3,3 (u) = -6w0,3(u) + 54w1,2(u) -54w2,1(u) + 6w3,0(u). (26)
Note that the definition of Bi and Ci can be seen as filtering by a Finite Impulse Response Digital Filter.

Recursive least square algorithm: Now that a relation has been obtained between the stiffness parameters in the Taylor expansion and the measured signals, we further use it into a discrete least square algorithm in order to obtain an approximation Âi of Ai.

           Âi(k) = Âi(k -1) + Γ(k) Ci(k/k -1), Ci(k/k -1) = Ci(k) -Bi(k) Âi(k -1), Γ(k) = F (k-1)B i (k) 1+B T i (k)F (k-1)B i (k) , F (k) = (IN+1 -Γ(k)Bi(k) T )F (k -1). ( 27
)
The notation IN+1 stands for the identity matrix of dimension N +1.

N = 2 N = 2 N = 2 N = 4 N =

C. Error analysis

The algorithm presented here is made up of two parts, first, a relation between filtered versions of the measured data and the coefficients of the Taylor expansion of the stiffness is derived. It is then used in a least square algorithm. In this scheme, there are three sources of errors: a noise on the measurements, an error due to the truncation of the Taylor expansion and an error due to the numerical integration. The noise on the measured data is assumed to be an additional stochastic white noise with zero mean and finite variance and the numerical integration error is assumed to be negligible. The attenuation of the error is only done by the first step, that is we will see how to set the parameters to reduce sufficiently the noise so that it does not affect the second step. We shall treat here measurements noise only for the torque. High noise on the positions measurements would be a critical issue for the algorithm presented here, but, since sensors for positions are far more accurate than for torque measurement, assuming small noise on the positions measurements is a realistic assumption. Furthermore, the effect of a small noise on the positions will be studied on simulations only. Note that the input of the RLS at time t is a filtered version of the measured signals and then depend on the evolution of the measured signals between t -T and t, but since the parameters to be estimated are assumed to be constant, it does not induce further problems. This could, however, be the case for non constant parameters.

Taking errors into account, equation [START_REF] Ménard | A real time observer for an agonistantagonist variable stiffness actuator[END_REF], can be rewritten as follows:

A T i Bi(k) = Ci(k) + e i R N (k) + e i ω (k), (28)
where eR n (k) is the error due to the truncation and eω(k) is the error due to the measurement noise. Three different parameters can be used to reduce the error: the length of the integration window T , the order of the Taylor expansion N and the sampling period Ts. Analysis of eR N We start from equation ( 14), replacing the approximation of the stiffness by its true expression and following the same computations as for the algorithm, we obtain:

e i R N (k) = M m=0 (σi -σ N i ) • (φi)((k -m)Ts)T 2 Wmw (1)
3,3 (m/M ), [START_REF] Van Ham | Review of actuators with passive adjustable compliance/controllable stiffness for robotic apllications[END_REF] where σ N i is the Taylor expansion of σi up to order N . We see, from the expression of the truncation error, that in order to get a bound, the transmission deformation φi has to be bounded. Hence, we assume that there exist

ε i 1 , ε i 2 such that φi(k) ∈ [ε i 1 , ε i 2 ]
for all k ≥ 0, then, overvaluating (σi -σ N i ) • (φi) and applying Proposition 2, one obtains

|e i R N (k)| ≤ T 3 3 √ 5 125 sup φ i ∈[ε i 1 ,ε i 2 ] |σi(φi) -σ N i (φi)|. ( 30
)
Analysis of eω We assume here that ω is a white noise with zero mean and finite variance. Similarly to the truncation error, we obtain that the noise error contribution is equal to

eω(k) = M m=0 ω((k -m)Ts)T 2 Wmw (1) 3,3 (m/M ). (31)
Note that the error due to the noise on the torques does not depend on the subscript i (the error is the same for both torques).

Applying proposition 3, we obtain that for each k ∈ N, eω(k) converges to zero in mean square as M goes to infinity.

Parameters settings

The effect of the parameters on the different errors is summarized in the table II. From the previous analysis, we can derive some indications for the tuning of the parameters. First, the sampling period Ts should be taken, as small as possible in order to reduce the effect of the noise. The length of the integration window should be taken large enough to filter the noise, depending on the expected Signal to Noise Ratio which itself depends on the sensors. Even if increasing T will increase the truncation error, we can see from equation [START_REF] Van Ham | Maccepa, the mechanical adjustable compliance and controllable equilibrium position actuator: Design and implementation in a biped robot[END_REF], that this relation is cubic, and since, typically, values of T belong to [0.1, 2], the setting of T and N can be done independently. Finally, the value of N will highly depend on the range of the motor/link deformations φi and the spring.

Convergence of the RLS We have shown until now that the error contribution can be made arbitrarily small, uniformly with respect to time, by tuning the parameters. According to lemma 1, if the input of the RLS is persistently exciting, then a small error due to the truncation of the Taylor expansion leads to a small error on the estimated coefficients. Similarly, if the error due to the noise converges to zero in mean square, then the estimated parameters will converge in mean square toward the real one. We thus have to be sure that the persistent excitation condition is fulfilled. The inputs of the RLS are filtered versions of the measured signals. Basically, this filter corresponds to integrating the measured signal over a finite horizon window, and then acts as a low pass filter whose cut-of frequency is proportional to 1/T [START_REF] Preising | Theory and application of the modulating function method i: Review and theory of the method of the splinetype modulating functions[END_REF]. We can see from this analysis that if the movements of the link were too fast compared to the cut-of frequency, then, the persistent excitation could be compromised. In this case, it would be necessary to reduce the length T of the integration window. If we want to continue filtering the error due to the noise we need to take a Ts smaller (which is natural if the movements become faster). Finally, we conclude that we can ensure arbitrary small error on the stiffness by tunning the algorithms parameters.

Truncated term error

Noise error contribution

N ↑ ց -→ Ts ↑ -→ ց T ↑ ր ց
Position [cm] q 1 -q L q 2 -q L (b) displacements

IV. SIMULATIONS

We consider an Agonistic-Antagonistic VSA mechanism realized with two identical cubic springs whose force displacement characteristic are described by:

fi = 10(qL -qi) 3 , i = 1, 2. ( 32
)
The parameters of the motors in the equations ( 2)-( 3)-( 4) are given by, J1 = J2 = 10 -4 kg/m 2 , JL = 0.0179 kg/m 2 , b1 = b2 = 1.27 Nms/rad and bL = 0.0127 Nms/rad. We consider the case without gravity, that is g = 0.

We provide in this section the result of several simulations with the algorithm proposed here, all the simulations are done for the same set of data, which are reported on figure 3.

In order to precisely evaluate the effects of noise on the reconstruction of the stiffness, three different cases are compared in simulation: without noise, with a white noise affecting the torques and finally with a white noise affecting both the torques and the positions. The importance of the noise is quantified by the Signal to Noise Ratio (SNR) which is given by the formula SN R = 20 log 10 (V ar(Signal without noise)/V ar(N oise)), the lower it is, the more significant the noise is. The noise on the torques is taken large, corresponding to a SNR of 9, while the noise on the positions is low corresponding to a SNR of 140, noisy signals are depicted on figure 4. In addition, we compare the effect of N in equation ( 13), for the estimation. The best value for N is 2 for our algorithm, because the springs are cubics. But, since the springs might be not polynomials (we can consider exponential springs for example), we then test our algorithm for non exact values of N , that is, with N = 2 and N = 4.

Position [cm] q 1 -q L q 2 -q L (b) displacements

set-up for the algorithm

The parameters of the observer are set as follow, the length of the time window for the integral is T = 0.5 s and the covariance matrix for the RLS is initialized at F (0) = 10 8 IN+1. The sampling time is taken as Ts = 1/1000 s.

results of simulations

The results of the reconstruction of the stiffness are given on figure 5. In addition, an average of the Mean Square Error (MSE) and the Mean Square Relative Error Percentage (MSREP) have been computed, over 100 simulations, after the algorithm has converged, that is between t = 2s and t = 10s and are given in table I. The formula for MSE and MSREP between sample k1 and k2 (k2 > k1), are given by:

M SE = 1 k2 -k1 + 1 k 2 k=k 1 σ(k) -σ(k) 2 , M SREP = 1 k2 -k1 + 1 k 2 k=k 1 σ(k) -σ(k) σ(k) 2 .
We can see, that in every cases and with the same settings, the algorithm performs satisfactorily.

V. EXPERIMENTAL RESULTS

In this section, we test the algorithm presented here on the Agonistic-Antagonistic VSA experimental device with exponential springs shown in figure 6, which is fully described in [START_REF] Grioli | A real-time parametric stiffness observer for vsa devices[END_REF] (some details are also reported in appendix for convenience). The system measures are, by nature, translational (see appendix for detail) and the model can be described with the model in figure 7. Please note that this choice of translational Lagrangian coordinates, yields that displacements are measured in mm, generalized torques in N and stiffness in N/mm.

The results of the estimations are depicted on figure 9. The comparison model is not exact due to uncertainties in the model Fig. 6. The experimental setup consists of an Agonistic-Antagonistic VSA system with exponential springs, realized using a linear spring forced to move on a suitable cam profile. Force sensors (strain gauges) are mounted on the tendons connecting the springs to the link. Position sensors (encoders) are mounted on the link and on two tendon pulleys coupled with the input levers. of the actuator and especially in the model parameters. Then, we consider that the knowledge of the true stiffness is reliable up to an error about 25 % (see appendix, in particular figure 10 for details), represented by an horizontal line on figure 9.b).

The order of the Taylor expansion has been set to N = 9. The covariance matrix for the RLS has been set to F (0) = 10 5 I10 and the length of the time window for the integral is T = 0.5s. The MSE and MSREP, after the convergence (that is after t = 2s) are equal to 21.43 and 2.07 respectively.

VI. CONCLUSION

In this paper, we have presented a new algorithm for estimating the nonlinear stiffness of Agonistic-Antagonistic Variable Stiffness Actuator. The advantages of the proposed method are twofold, firstly, the tuning is simple, secondly, the algorithm is proven to converge. The effect of the noise on the resulting estimation has been studied and a methodology to tune the parameters has been provided. Furthermore, the algorithm has been validated on experimental data which prove its practical efficiency. The proposed algorithm assumes a good knowledge of the damping and inertia on the link side for proper functioning: while a good knowledge of the inertial details of a robot is something that can be easily extracted from the combined information of components datasheets, CAD files and kinematics of the robot, a good knowledge of the damping coefficient is not always easily available. Moreover, damping is often a time-varying quantity, dependent on the age of the system, the temperature and other issues. This aspect opens a really interesting research direction, that is the combined estimation of stiffness and damping, which is demanded to future work.

APPENDIX

A. Technical results

The two propositions given here can be seen as specific cases (but slightly different) of Proposition 2 and corollary 2 in [START_REF] Liu | Error analysis of a class of derivative estimators for noisy signals[END_REF]. The lemma presents a classical result for RLS and is presented with more details in [START_REF] Ljung | System identification[END_REF].

3,3 is given by [START_REF] Pratt | Series elastic actuators[END_REF].

Proof of proposition 2. One has: The third inequality is obtained by noticing that the function w

3,3 (u) is a polynomial function and vanish at u = 0 and u = 1. Then the maximum of |w Proposition 3. Consider {ω(t), t > 0}, a continuous parameter stochastic process, such that for every t > 0:

E[ω(t)] = 0, (33) Cov[ω(t)ω(s)] = 0, t = s, (34) V ar[ω(t)] = µ 2 . ( 35
)
Let M ∈ N, and T > 0, then, for every k ∈ N, k ≥ M :

lim M →+∞ eω(k) m.s. = 0, (36)
where m.s. stands for mean square convergence, and

eω(k) = M m=0 Wmω (k -m) T M w3,3 m M ,
where W0 = WM = T /(2M ), Wm = T /M , m = 1, . . . , M -1 and w

(1)

3,3 is given by [START_REF] Pratt | Series elastic actuators[END_REF].

Proof of proposition 3. Mean square convergence to zero for a stochastic process means that its second-order moment converges towards zero. That is, we have to prove here that limM→+∞ E[(e i ω (k)) 2 ] = 0. For this purpose, we will use the wellknown formula:

E[(eω(k)) 2 ] = V ar[eω(k)] + (E[eω(k)]) 2 .
(37)

One has:

E[eω(k)] = T 2 M m=0 Wmw (1) 3,3 (1) 3,3 2 µ 2
M The last term goes to zero when M goes to infinity since T is fixed and w

(1) 3,3 is a continuous function on [0, 1]. This ends the proof. Lemma 1 ([19] p.177). If the vector Bi is persistently excited, then the solution of the RLS algorithm [START_REF] Schiavi | Vsa-II: A novel prototype of variable stiffness actuator for safe and performing interacting with humans[END_REF] is given by:

Âi(k) = Ai + [Ri(k)] -1 1 k k j=1 Bi(j)(e i R N (j) + e i ω (j)), with
Ri(k) = 1 k k j=1
Bi(j)Bi(j) T .

B. Details on the Experimental Setup

This appendix briefly recalls some details of the experimental setup shown in figure 6, and thoroughly described in [START_REF] Grioli | A non-invasive real-time method for measuring variable stiffness[END_REF].

The experimental device implements the antagonistic VSA concept, 1(a). The springs used in the device are designed (using a cam mechanism) to have an exponential characteristic, such that, given the spring deformation δ and the spring force f , the relationship between the two can be summarised as

f = aie b i δ , (38)
where the subscript i can be 1 or 2, for the two springs. A pair of strain-gauge load cells measures the tendon tensions. The three position corresponding to the link position and to the two movement sources were measured using three HEDS-5540 encoders with a resolution of 2000 CPRs. A National Instruments PCI6251 ADC board acuired the strain gauges data, and an USB-PCI4e acquired the encoders data, both with a sampling rate Ts = 0.015s. A second-order filter with time constant of 0.02s was used to clear the signal from the (rather small) noise. Sources of noise were quantization for the encoders and electro-magnetic noise interferences in the strain gauges.

It is important to notice that, although the device is designed as the actuator of a rotary link, part of the measurements acquired are in the rotary domain (the link and prime movers position), while the other part is in the translational domain (the spring forces). To apply the proposed estimation algorithm, all measurements need to be reported in the same domain. The authors of [START_REF] Grioli | A non-invasive real-time method for measuring variable stiffness[END_REF] chose to adopt the translational domain, and we kept the same decision to allow easier comparison between the results. This leads to all results presented in figures 8, 9, and 10, that expressed in terms of displacements (mm) and forces (N ), rather than angles (rad) and torques (N m). This does not hinder the validity of reported results in any way, given the substantial equivalence of the rotational and translational domains when limited a system as simple as that used.

To keep the system simple, the motion of the two prime movers was input directly by hand, with the aid of two handles (not shown in figure 6).

To compare the estimation of the stiffness derived from the proposed method with the ground-truth data, the force functions of the two springs need to be experimentally evaluated through careful preliminary calibration experiments. The calibration procedure consists in the collection of a large number of force-displacement pairs (x, f ) and then in a subsequent fitting of the pairs with the model 38.

Figure 10, resumes the results of such calibration procedure. It is possible to notice how, notwithstanding the fact that the springs were explicitly designed to show an exponential characteristic, the ground-truth data shows some deviation with respect to the intended model, yielding a relative error (during the regression) of roughly 25% (precisely a relative error of 22% and 29% for the left and right spring, respectively). This relative error sets the reliability of our model, thus yielding the threshold of error within which an estimate can be considered good.

Fig. 1 .

 1 Fig. 1. Two common categories of Variable Stiffness Actuators.

Definition 2 . 9 ) 1 .

 291 A function f : [a, b] → R integrable on [a, b] is modulated by taking the inner product with a modulating function ψ: f, ψ = b a f (u)ψ(u)du. (Proposition Let f1, f2 be integrable real valued functions on [a, b], ψ an order k modulating function on [a, b] and C ∈ R a constant, then we have the following properties:

JiWmw

  τi ((km)Ts) -T 2 Wmw (1) 3,3 (m/M ) , and b

Fig. 3 .

 3 Fig. 3. Data used for the simulations Agonistic-Antagonistic VSA.

Fig. 4 .

 4 Fig. 4. Noisy signals used for the simulations.

4 Fig. 5 .

 45 Fig. 5. Reconstruction of the stiffness in simulation.

Fig. 7 .

 7 Fig. 7. Translational model of a VSA, as the one used in the experimental setup.

Fig. 8 .

 8 Fig. 8. Experimental data: position, displacement and torque data.

Fig. 9 .

 9 Fig.9. Results of experiment: performance of the observer tracking the stiffness of an Agonist-Antagonist VSA.

Proposition 2 .

 2 Let M ∈ N, and T > 0 then the following inequality holds true W0 = WM = T /(2M ), Wm = T /M , m = 1, . . . , M -1 and w

5 10 , 1 .

 51 (u)| is attained at a point, belonging to [0, 1], where the derivative of w (1) 3,3 (u) vanish. Direct computations gives that w Hence one can directly conclude that the maximum is equal to3

  Fig. 10. Experimental characterization of the two exponential springs. Force and displacement pairs recorded during a calibration experiment, and regression curve are shown for each of the two springs of the experimental VSA system.

TABLE I EVALUATION

 I OF SIMULATION RESULTS.

TABLE II EFFECT

 II OF PARAMETERS ON THE DIFFERENT TYPES OF ERROR..