Philippe Roingeard
email: roingeard@med.univ-tours.fr

Marion Depla

The birth and life of lipid droplets: learning from the hepatitis C virus

Keywords: Lipid droplet, organelle dynamics, hepatitis C virus DGAT1, diacylglycerol acyltransferase-1, DGAT2, diacylglycerol acyltransferase-2, HCV, hepatitis C virus, LD, lipid droplet, TEM, transmission electron microscopy

Lipid droplets are probably the least well characterised cellular organelles. Having long been considered simple lipid storage depots, they are now considered to be dynamic organelles involved in many biological processes. However, most of the mechanisms driving lipid droplets biogenesis, growth and intracellular movement remain largely unknown. As for other cellular mechanisms deciphered through the study of viral models, hepatitis C virus (HCV) is an original and relevant model for investigations of the birth and life of these organelles. Recent studies in this model have raised the hypothesis that the HCV core protein induces the redistribution of lipid droplets through the regression and regeneration of these organelles in specific intracellular domains.

Introduction

Cytoplasmic lipid droplets (LD) are intracellular structures that store neutral lipids. Until recently, they were classified in the same category as glycogen granules, as simple inert storage sites for energy, increasing and decreasing as a function of metabolic energy requirements. However, considerable interest has recently been focused on LDs as dynamic organelles at the hub of lipid exchanges between intracellular compartments and energy metabolism [START_REF] Martin | Lipid droplets: a unified view of a dynamic organelle[END_REF][START_REF] Murphy | Lipid droplet-organelle interactions; sharing the fats[END_REF]. Major findings highlighting the dynamic nature of LDs include the identification of key proteins involved in LD biology and the discovery of differences in the protein and lipid compositions of LDs in different cell types and physiological states [START_REF] Bickel | PAT proteins, an ancient family of lipid droplet proteins that regulate cellular lipid stores[END_REF]. There is also increasing evidence to suggest that LDs interact dynamically with other membrane-bound organelles, including the endoplasmic reticulum (ER), mitochondria, endosomes, peroxisomes and the plasma membrane, probably as a means of providing these organelles with neutral lipids and phospholipids [START_REF] Goodman | The gregarious lipid droplet[END_REF][START_REF] Murphy | Lipid droplet-organelle interactions; sharing the fats[END_REF]. More intriguingly, LDs have also been shown to have a number of unexpected functions such as constituting a protective reservoir for unfolded proteins or other compounds unrelated to lipids to prevent harmful interactions with other cell components [START_REF] Ohsaki | Cytoplasmic lipid droplets are sites of convergence of proteasomal and autophagic degradation of apolipoprotein B[END_REF][START_REF] Welte | Proteins under new management: lipid droplets deliver[END_REF].

However, despite rapid progress in LD research, the mechanisms underlying the formation and dynamics of LDs remain elusive. Recent studies on hepatitis C virus (HCV), an important human pathogen, have demonstrated that HCV uses LDs as a platform for viral assembly [START_REF] Miyanari | The lipid droplet is an important organelle for hepatitis C virus production[END_REF]. This phenomenon is linked to the ability of the HCV core protein to induce the redistribution of LDs, through the clustering of these organelles in the perinuclear area [START_REF] Boulant | Hepatitis C virus core protein induces lipid droplet redistribution in a microtubule-and dynein-dependent manner[END_REF][START_REF] Depla | Ultrastructural and quantitative analysis of the lipid droplet clustering induced by hepatitis C virus core protein[END_REF]. Many other cellular mechanisms have already been deciphered by studying viruses, and HCV may be a relevant model for elucidating the birth and life of LDs.

LD morphology and composition

Although best known for their role in lipid storage in mammalian adipocytes in adipose tissue, LDs are present in almost all eukaryotic cells, including yeasts, and even in some prokaryotes. Unlike vesicular organelles, the aqueous contents of which are enclosed by a phospholipid bilayer, LDs consist of a highly hydrophobic lipid core surrounded by a phospholipid monolayer [START_REF] Murphy | Mechanisms of lipid-body formation[END_REF][START_REF] Tauchi-Sato | The surface of lipid droplets is a phospholipid monolayer with a unique fatty acid composition[END_REF]. On transmission electron microscopy (TEM) analysis of conventional ultrathin sections, LDs are visible as spherical structures with a highly homogeneous content (Fig. 1A).

LDs store neutral lipids, predominantly triglycerides and sterol esters. These substances are crucial for the cell. Triglycerides are the principle compounds used for energy storage, and both triglycerides and sterol esters serve as reservoirs of membrane lipid components. Adipocytes contain mostly triglycerides whereas macrophages contain mostly sterol esters. Ether-linked glycerolipids also account for 10 to 20% of the lipids in several cultured cell lines (Bartz et al., 2007a). The phospholipids forming the monolayer, with their inward-pointing acyl chains, are essentially very similar to those found in the ER (Bartz et al., 2007a). However, different proteins are present on the surface of LDs. Perilipin, which is found in adipose tissues, is one of the best studied proteins associated with LDs [START_REF] Greenberg | Perilipin, a major hormonally regulated adipocyte-specific phosphoprotein associated with the periphery of lipid storage droplets[END_REF]. Perilipin stabilises the LDs and is also essential for lipolysis, becoming highly phosphorylated upon adrenergic stimulation, thereby attracting hormone-sensitive lipase to the LD [START_REF] Sztalryd | Perilipin A is essential for the translocation of hormone-sensitive lipase during lipolytic activation[END_REF]. However, perilipin belongs to a larger family of animal LDbinding proteins, all containing the PAT domain, named after the three founding members of this family: perilipin, adipophilin (or ADRP, for adipose differentiation-related protein) and TIP 47 (for tail interacting protein of 47 kDa). More recently, a new nomenclature leading to the name of PLIN proteins has been established for the mammalian PAT-proteins [START_REF] Kimmel | Adoption of perilipin as a unifying nomenclature for the mammalian PAT-family of intracellular lipid storage droplet proteins[END_REF]. Each PAT/PLIN protein has unique tissue and subcellular distributions, and LDbinding properties consistent with a unique role in LD content management [START_REF] Goodman | The gregarious lipid droplet[END_REF]. Some of these proteins are exchangeable at the surface of LDs in various conditions and regulate the storage of lipids within the cell [START_REF] Wolins | A proposed model of fat packaging by exchangeable lipid droplet proteins[END_REF][START_REF] Bickel | PAT proteins, an ancient family of lipid droplet proteins that regulate cellular lipid stores[END_REF].

Individual cells may also contain subsets of LDs with different populations of PAT/PLIN proteins, varying with size, age and the level of metabolic activity [START_REF] Wolins | A proposed model of fat packaging by exchangeable lipid droplet proteins[END_REF][START_REF] Brasaemle | The perilipin family of structural lipid droplet proteins: stabilization of lipid droplets and control of lipolysis[END_REF][START_REF] Digel | Lipid droplets lighting up: insights from live microscopy[END_REF].

LDs have been subject to many proteomic studies in recent years (Bartz et al., 2007b ;[START_REF] Hodges | Proteomic insights into an expanded cellular role for cytoplasmic lipid droplets[END_REF]. These studies unexpectedly picked up proteins regulating trafficking pathways, such as members of both the Rab and ADP-ribosylation factor (ARF) families of small GTPases, caveolin, and other proteins thought to be specific for vesicle docking events in exocytosis pathways. Of the potentially LD-associated Rab proteins, only a limited number have been examined in detail in the context of the LD. However, Rab18 has received particular attention because it shows specific regulated localisation to the surface of LDs [START_REF] Ozeki | Rab18 localizes to lipid droplets and induces their close apposition to the endoplasmic reticulum-derived membrane[END_REF][START_REF] Martin | Regulated localization of Rab18 to lipid droplets: effect of lipolytic stimulation and inhibition of lipid droplet catabolism[END_REF]. The identification of these proteins on LDs provides evidence for a role for LDs in communications between organelles (Zehmer et al., 2009a). In addition, motor proteins, such as dynein and kinesin, have been identified in some LDs, suggesting on the possible movement of these structures on microtubules during the transfer of molecules to various organelles (Zehmer et al., 2009a).

LD formation

There is considerable evidence to indicate that LDs are derived from the ER. TEM studies have revealed that LDs are tightly associated with the ER membrane (Fig. 1B), and proteomic studies of LDs isolated from various cell lines have revealed the presence of many ER proteins [START_REF] Liu | Chinese hamster ovary K2 cell lipid droplets appear to be metabolic organelles involved in membrane traffic[END_REF][START_REF] Brasaemle | Proteomic analysis of proteins associated with lipid droplets of basal and lipolytically stimulated 3T3-L1 adipocytes[END_REF][START_REF] Wan | Roles and origins of leukocyte lipid bodies: proteomic and ultrastructural studies[END_REF]. It has been suggested that LDs associated intimately with the ER, with the ER membrane forming a structure resembling an egg cup and holding the LD, which resembles an egg [START_REF] Robenek | Adipophilin-enriched domains in the ER membrane are sites of lipid droplet biogenesis[END_REF].

However, the prevailing model for LD formation involves the emergence of LDs from the ER lipid bilayer as a lens-shaped mass of neutral lipids that then buds off from the cytoplasmic face of the bilayer to form a droplet within the cytoplasm [START_REF] Brasaemle | The perilipin family of structural lipid droplet proteins: stabilization of lipid droplets and control of lipolysis[END_REF][START_REF] Wolins | A proposed model of fat packaging by exchangeable lipid droplet proteins[END_REF]. It has been suggested that exchangeable PAT/PLIN proteins curve the ER membrane to mediate this budding, acting as coatamer-like proteins [START_REF] Wolins | A proposed model of fat packaging by exchangeable lipid droplet proteins[END_REF]. This model is attractive because it accounts for the phospholipid monolayer surrounding LDs and localises the birthplace of LDs to the organelle in which the enzymes mediating neutral lipid synthesis are found on biochemical analysis. Moreover, the diacylglycerol acyltransferase-2 (DGAT2), a key enzyme involved in triglyceride synthesis, is found in areas in which LD are tightly associated with the ER, under conditions promoting LD formation [START_REF] Kuerschner | Imaging of lipid biosynthesis: how a neutral lipid enters lipid droplets[END_REF].

There is some evidence to suggest that LDs never leave the ER, instead constituting specialised regions of the ER. TEM studies have frequently shown continuity between the cytosolic leaflet of the ER and the boundary leaflet of the LDs [START_REF] Blanchette-Mackie | Perilipin is located on the surface layer of intracellular lipid droplets in adipocytes[END_REF]. Moreover, three-dimensional reconstructions of large cellular domains have shown that LDs are invariably intimately linked to the ER compartment (Fig. 1B ; see also the QuickTime movie of a 3D reconstruction of such large microdomain, provided online as supplemental material). This notion that LDs are specialised regions of the ER is attractive because this organisation would provide a simple mechanism for the exchange of lipids and proteins between these two compartments. For example, during metabolic stress requiring the rapid hydrolysis of esterified fatty acids and the release of free fatty acids, the leaflet must rapidly shrink. Continuity with the ER would make it possible for this compartment to act as a sink for these leaflet components [START_REF] Goodman | The gregarious lipid droplet[END_REF]. Alternatively, there is evidence to suggest that the trafficking of membrane-derived vesicles may connect the ER with LDs that have been fully released from the ER membrane [START_REF] Farese | Lipid droplets finally get a little R-E-S-P-E-C-T[END_REF]. However, this model cannot account for the fusion of vesicles surrounded by a bilayer membrane with the monolayer surrounding LDs. In addition, many of the proteins identified in the LD proteome are predicted to have multiple membrane spans and it is difficult to imagine them arranged in a single leaflet surrounding a hydrophobic core of neutral lipids [START_REF] Goodman | Demonstrated and inferred metabolism associated with cytosolic lipid droplets[END_REF]). These observations suggest that these proteins are more likely to be present in specialised ER membranes tightly bound to the LD that could be separated from the bulk ER during fractionation, thus being purified with the LD. However, this model remains speculative and caution should be employed when using it as a basis for other hypotheses.

LD growth and mobilization

LD size varies tremendously, from a diameter of only 50 to 100 nm to a diameter of 100 µm in white adipocytes. LD can also clearly grow in size. It is possible that LDs expand as single organelles, like inflated balloons. If LDs remain physically attached to the ER, proteins and newly synthesised lipids could diffuse laterally into the LDs. If LDs are fully detached from the ER, these proteins and lipids must be transported to the LDs in vesicles, although the topological problems arising from the fusion of a vesicular bilayer membrane with the monolayer membrane at the surface of LD suggest that this is unlikely. Alternatively, the neutral lipids in the LD core may be produced locally by enzymes such as DGAT2, which is present on the surface of LDs [START_REF] Kuerschner | Imaging of lipid biosynthesis: how a neutral lipid enters lipid droplets[END_REF]. However, any such increase in the volume of neutral lipids would need to be matched by a corresponding increase of the synthesis of phospholipids at the surface of LD. The recent demonstration that key enzymes required for phospholipid synthesis are present at the LD surface provides support for this potential mechanism [START_REF] Guo | Functional genomic screen reveals genes involved in lipid-droplet formation and utilization[END_REF].

The fusion of several smaller LDs to form larger LDs may also contribute to LD growth [START_REF] Guo | Functional genomic screen reveals genes involved in lipid-droplet formation and utilization[END_REF], and models in which SNARE proteins and motor proteins are involved in LD fusion have been proposed [START_REF] Andersson | PLD1 and ERK2 regulate cytosolic lipid droplet formation[END_REF][START_REF] Boström | SNARE proteins mediate fusion between cytosolic lipid droplets and are implicated in insulin sensitivity[END_REF][START_REF] Olofsson | Triglyceride containing lipid droplets and lipid droplet-associated proteins[END_REF][START_REF] Ducharme | Lipid droplets in lipogenesis and lipolysis[END_REF]. However, due to the extremely low frequency of this phenomenon in live imaging, LD fusion remains a controversial subject [START_REF] Thiele | Cell biology of lipid droplets[END_REF][START_REF] Farese | Lipid droplets finally get a little R-E-S-P-E-C-T[END_REF][START_REF] Cheng | Quantitative electron microscopy shows uniform incorporation of triglycerides into existing lipid droplets[END_REF][START_REF] Murphy | Quantitative analysis of lipid droplets fusion : innefficient steady state fusion but rapid stimulation by chemical fusogens[END_REF].

Indeed, it has been pointed out that LD fusion is not observed in situations in which LD are densely packed such that there are obvious signs of mechanical strain, with LDs being pressed against each other [START_REF] Thiele | Cell biology of lipid droplets[END_REF]. This is remarkable, given that LDs have only a monolayer membrane, so their fusion would therefore require only one simple step. It has also been argued that the small amount of protein recovered from LD preparations is consistent with the absence of a dense coverage of proteins with anti-fusion activities on the surface of LDs [START_REF] Thiele | Cell biology of lipid droplets[END_REF]. It therefore seems possible that the composition of the LD monolayer may contribute to the inhibition of spontaneous fusion. Moreover, LD fusion would generate a large excess of phospholipids originating from the surface of the small original LDs, and it is unclear how the large LD formed by fusion could simultaneously adjust its phospholipid monolayer [START_REF] Ohsaki | Biogenesis of cytoplasmic lipid droplets: from the lipid ester globule in the membrane to the visible structure[END_REF].

LDs not only grow, they may also shrink through lipolysis induced by the lipases present at the LD surface. The proteins of the PAT/PLIN family play a key role in the organisation and regulation of this process [START_REF] Brasaemle | The perilipin family of structural lipid droplet proteins: stabilization of lipid droplets and control of lipolysis[END_REF]. More recently, it has been shown that autophagy induced by nutrient deprivation [START_REF] Singh | Autophagy regulates lipid metabolism[END_REF] or dengue virus infection [START_REF] Heaton | Dengue virus-induced autophagy regulates lipid metabolism[END_REF] may also regulate the mobilization of lipids from LDs.

In adipocytes, it has been suggested that LDs may undergo fission during lipolysis. This would greatly increase the surface area of LDs, improving the access of lipases to the neutrallipid core [START_REF] Marcinkiewicz | The phosphorylation of serine 492 of perilipin a directs lipid droplet fragmentation and dispersion[END_REF]. However, this increase in surface area would require more surface phospholipids and the mechanism by which this could be achieved remains unclear. It therefore appears most likely that LDs are never completely severed from the ER, instead remaining permanently connected to the outer leaflet of the ER membrane. Pioneer TEM observations have suggested that LDs accumulate or regress within the confines of ER membranes [START_REF] Blanchette-Mackie | Perilipin is located on the surface layer of intracellular lipid droplets in adipocytes[END_REF]. More recent studies have also provided support for this model by demonstrating experimentally that LDs are formed from and regress to the ER as part of a cyclic process that does not involve trafficking through the secretory pathway (Zehmer et al., 2009b).

Intracellular movements of LD

Live imaging has shown that LDs move around the cytoplasm in many cells. In some cases, the distribution of the entire population of LDs in cells may change dramatically within a few hours [START_REF] Welte | Fat on the move: intracellular motion of lipid droplets[END_REF]. This mobility seems to involve mostly microtubule-based transport. The pharmacological disruption of microtubules typically prevents this movement of LDs, whereas the disruption of actin filaments has little effect. Moreover, cytoplasmic dynein, a minus end-directed microtubule motor, is often physically associated with LDs, and the functional inactivation of dynein prevents LDs from moving within the cell in various models [START_REF] Welte | Fat on the move: intracellular motion of lipid droplets[END_REF]. Although it is tempting to speculate that these changes are due to LDs moving along the microtubules from one location in the cell to another, as suggested by some movies, other interpretations have been considered. It has also been suggested [START_REF] Welte | Fat on the move: intracellular motion of lipid droplets[END_REF]) that LDs may not move as a unit, instead regressing and being regenerated at their destination. The requirement of dynein as a co-factor for the formation of a nascent LD is consistent with this hypothesis [START_REF] Andersson | PLD1 and ERK2 regulate cytosolic lipid droplet formation[END_REF]. This process would involve lipids from shrinking LDs diffusing laterally through the expansive ER network to form new LDs elsewhere in the cell [START_REF] Murphy | Lipid droplet-organelle interactions; sharing the fats[END_REF]; Welte 09).

The hepatitis C virus model

HCV infection is rapidly becoming a major global health issue, with more than 130 million people infected worldwide [START_REF] Alter | Epidemiology of hepatitis C virus infection[END_REF]. Of those exposed to HCV, 80% become chronically infected, and at least 30% of carriers go on to develop severe liver diseases such as cirrhosis and liver carcinoma. There is currently no vaccine to prevent new infections and the efficacy of current therapies remains limited. In recent years, the impact of HCV infection on lipid metabolism and in particular the development of a liver steatosis has emerged as a clinically important topic in liver diseases (Roingeard and Hourioux 2008;[START_REF] Piver | The cell biology of hepatitis C virus (HCV) lipid addiction: molecular mechanisms and its potential importance in the clinic[END_REF]. HCV has a positive-sense, single-stranded RNA genome encoding a single polyprotein that is both coand post-translationally cleaved at the ER membrane by host or viral proteases to generate several proteins [START_REF] Moradpour | Replication of hepatitis C virus[END_REF]. The N-terminal component of the polyprotein encodes the structural proteins: the core protein, which forms the viral capsid, and the two envelope proteins that surround the capsid to form the virion. The C-terminal region of the polyprotein contains the non-structural (NS) proteins involved in the formation of replication complexes for the synthesis of viral RNA [START_REF] Moradpour | Replication of hepatitis C virus[END_REF].

Many years before a tissue culture system for producing infectious HCV in vitro had been developed, the HCV core protein was reported to be associated with the surface of LDs [START_REF] Moradpour | of cell lines allowing tightly regulated expression of hepatitis C virus core protein[END_REF][START_REF] Barba | Hepatitis C virus core protein shows a cytoplasmic localization and associates to cellular lipid storage droplets[END_REF]. This association is dependent on the release of the protein from the polyprotein by two different cellular proteases: signal peptidase (SP) and signal peptide peptidase (SPP) [START_REF] Mclauchlan | Intramembrane proteolysis promotes trafficking of hepatitis C virus core protein to lipid droplets[END_REF]. SP cleaves the polyprotein at the Cterminus of a signal peptide between the core and envelope proteins, producing an immature form of the core protein that is unable to associate with LDs. The second cleavage, by SPP, occurs within the signal peptide and generates the mature form of the protein, which is then transported toward the LD surface [START_REF] Mclauchlan | Intramembrane proteolysis promotes trafficking of hepatitis C virus core protein to lipid droplets[END_REF]. During this trafficking step, the HCV core protein remains attached to the ER cytosolic monolayer membrane and then to the monolayer membrane surrounding the LD, through its C-terminal domain, which probably interacts in-plane with these membranes (McLauchlan 2009a). Following the long-awaited successful propagation of an HCV strain in cultured hepatic Huh7 cells, it has recently been shown that LDs are directly involved in the production of infectious HCV particles [START_REF] Miyanari | The lipid droplet is an important organelle for hepatitis C virus production[END_REF]. This study demonstrated that the HCV core protein on LDs recruits nonstructural proteins and replicated RNA to LD-associated membranes, and that this structural arrangement plays a crucial role in the formation of infectious viruses. Disruption of the association of HCV core protein with LDs was found to cause a defect in the localisation of HCV RNA and non-structural proteins to regions surrounding LDs, thereby preventing infectious virus assembly [START_REF] Miyanari | The lipid droplet is an important organelle for hepatitis C virus production[END_REF][START_REF] Boulant | Disrupting the association of hepatitis C virus core protein with lipid droplets correlates with a loss in production of infectious virus[END_REF]. Further investigations with this infectious HCV system demonstrated that HCV core protein initially attached to a discrete site on LDs after processing by SPP, subsequently coating the entire LD [START_REF] Boulant | Disrupting the association of hepatitis C virus core protein with lipid droplets correlates with a loss in production of infectious virus[END_REF]. This observation suggested that there might be a defined loading site for the core protein, probably at points of contacts between LDs and the ER membrane [START_REF] Boulant | Disrupting the association of hepatitis C virus core protein with lipid droplets correlates with a loss in production of infectious virus[END_REF]. More recently, it has been demonstrated that a key enzyme involved in triglyceride synthesis, the diacylglycerol acyltransferase-1 (DGAT1), is involved in the HCV infectious cycle. Both DGAT1 and DGAT2 are ER resident enzymes that catalyze the final step in triglyceride biosynthesis and are essential in LD biogenesis, but only DGAT2 remains associated with the LDs. Recent studies have demonstrated that DGAT1 interacts with the HCV core protein and promotes its traffic to the surface of DGAT1-generated LDs (Herker et al., 2010). It remains unclear why HCV targets LDs, but this targeting may be linked to the contribution of these LDs to the formation of very-low-density lipoproteins (VLDLs) in hepatocytes, as the viruses circulating in chronically infected patients are associated with lipoproteins [START_REF] André | Characterization of low-and very-low-density hepatitis C virus RNA-containing particles[END_REF][START_REF] Icard | Secretion of hepatitis C virus envelope glycoproteins depends on assembly of apolipoprotein B positive lipoproteins[END_REF]McLauchlan 2009b).

Nevertheless, one of the key elements underlying the production of infectious virions is the modification of LD distribution within cells by HCV core protein, such that LDs tend to aggregate in the perinuclear area [START_REF] Boulant | Hepatitis C virus core protein induces lipid droplet redistribution in a microtubule-and dynein-dependent manner[END_REF]Roingeard et al., 2008). This redistribution of LDs may lead to the close apposition of LDs with sites of viral RNA replication containing newly synthesised viral genomes and the non-structural proteins [START_REF] Boulant | Hepatitis C virus core protein induces lipid droplet redistribution in a microtubule-and dynein-dependent manner[END_REF]. HCV RNA is replicated at perinuclear ER-derived membranes known as the membranous web [START_REF] Moradpour | Membrane association of hepatitis C virus nonstructural proteins and identification of the membrane alteration that harbors the viral replication complex[END_REF], and the clustering of LDs around these membranes is thought to increase the likehood of interaction between the HCV core protein and the newly synthesised RNA, thereby promoting genome packaging, the first step in virus assembly. Light microscopy studies demonstrated that the LD clustering induced by the HCV core protein was blocked by disrupting the microtubule network or impairing dynein function [START_REF] Boulant | Hepatitis C virus core protein induces lipid droplet redistribution in a microtubule-and dynein-dependent manner[END_REF][START_REF] Lyn | Dynamics of lipid droplets induced by the hepatitis C virus core protein[END_REF]. The authors naturally interpreted these results as indicating a redistribution of the pre-existing LDs through the trafficking of these organelles along the microtubule network and toward the centrosome. However, analyses of this phenomenon by conventional or three-dimensional TEM have shown that the aggregating LDs are much larger that the pre-existing LDs, and do not preferentially cluster in the centrosome area [START_REF] Depla | Ultrastructural and quantitative analysis of the lipid droplet clustering induced by hepatitis C virus core protein[END_REF]. In addition, aggregated LDs have been shown to emerge from ER membranes rich in HCV core protein [START_REF] Depla | Ultrastructural and quantitative analysis of the lipid droplet clustering induced by hepatitis C virus core protein[END_REF]Fig 2). This suggests that these aggregated LDs surrounded by the HCV core protein budded from specific ER membranes enriched in HCV core protein, consistent with the LD regression/regeneration hypothesis outlined above (Fig 3). Indeed, it seems unlikely that LDs dispersed throughout the cytoplasm would move specifically towards these areas with a core-rich ER membrane. It remains unclear whether the HCV core protein is actively involved in lipid mobilization, membrane curvature and LD budding, as suggested for PAT/PLIN proteins [START_REF] Wolins | A proposed model of fat packaging by exchangeable lipid droplet proteins[END_REF][START_REF] Listenberger | Adipocyte differentiation-related protein reduces the lipid droplet association of adipose triglyceride lipase and slows triacylglycerol turnover[END_REF] However, the HCV core protein has been shown to displace ADRP, like other exchangeable PAT/PLIN proteins [START_REF] Boulant | Hepatitis C virus core protein induces lipid droplet redistribution in a microtubule-and dynein-dependent manner[END_REF]. Although some studies have suggested that the same LD may experience a gradual exchange of PAT/PLIN proteins [START_REF] Wolins | S3-12, adipophilin, and TIP47 package lipid in adipocytes[END_REF], the LD regression/regeneration hypothesis would also provide a comprehensive model accounting for the replacement of ADRP by the HCV core protein in newly synthesised LDs (Fig 3). Interestingly, LD clustering has also been observed in other cellular models, without HCV infection. In some cases, the degree of LD clustering seemed to depend on the metabolic state, with lipolysis counteracting clustering [START_REF] Marcinkiewicz | The phosphorylation of serine 492 of perilipin a directs lipid droplet fragmentation and dispersion[END_REF]. In the yeast model, the absence of seipin, a LD-associated protein, resulted in a LD clustering [START_REF] Szymanski | The lipodystrophy protein seipin is found at endoplasmic reticulum lipid droplet junctions and is important for droplet morphology[END_REF]. In contrary, overexpression of various PAT/PLIN proteins may also lead to LD clustering [START_REF] Targett-Adams | Live cell analysis and targeting of the lipid droplet-binding adipocyte differentiation-related protein[END_REF][START_REF] Listenberger | Adipocyte differentiation-related protein reduces the lipid droplet association of adipose triglyceride lipase and slows triacylglycerol turnover[END_REF]. Altogether, these results suggest that the replacement of a given LD-associated protein by one or others LD-associated proteins could induce this intracellular relocalisation of LDs.

This reinforces the hypothesis that, following their biogenesis, LDs remain tethered to the ER membrane, allowing the exchange of proteins between the LD surface to occur.

Conclusion and perspectives

Intracellular LDs have gone from being largely ignored as static cytoplasmic inclusions to being actively studied as dynamic organelles regulating not only cellular lipid storage, but also lipid exchange with various organelles. However, several fundamental questions about the biology of LDs remain unanswered. In particular, we still know little about the process by which they are formed. The HCV core protein, which seems able to induce the rapid regression and regeneration of cytoplasmic LDs, is a potentially valuable model for the visualisation of LD morphogenesis by correlative fluorescence/electron microscopy during the first few minutes of LD formation. We need to determine whether the regression and regeneration of LDs that seems to be induced by the HCV core protein is a widespread mechanism of LD motion also occurring in other contexts. It should be reminded that movies provided as supplemental material of several published manuscripts have shown that at least some LDs remained intact throughout the period of movement between regions of the cells.

Future investigation should help to understand the highly regulated, integrated and strongly compartmentalised cellular network of metabolism, signalling and trafficking leading to LD formation and degradation. ) cells, and the cellular microdomain was reconstructed with IMOD software, as described elsewhere (Roingeard et al., 2008 ;[START_REF] Depla | Ultrastructural and quantitative analysis of the lipid droplet clustering induced by hepatitis C virus core protein[END_REF]. Scale bar: 1 micrometre. A QuickTime movie of this 3D reconstruction is also provided as supplemental material online.

Figure 1 .

 1 Figure 1. Three-dimensional reconstruction from serial ultrathin sections of a subcellular domain containing lipid droplets (A) Sample of one (central) TEM ultrathin section of this subcellular domain, showing the LDs (yellow), ER (light blue), and mitochondria (brown). (B) View of a full reconstruction, using the same colour code, of this subcellular domain corresponding to 15 serial TEM ultrathin (60-70 nm) sections, showing that all LDs are tightly bound to smooth ER membranes. The LDs shown in these TEM photographs are from baby hamster kidney (BHK-21) cells, and the cellular microdomain was reconstructed with IMOD software, as described

Figure 2 .

 2 Figure 2. HCV core production induces the relocalisation, within a few hours, of lipid droplets to perinuclear areas (A) On conventional TEM, these clustered LDs are connected to the convoluted electrondense ER membrane (arrows). (B) Freeze substitution TEM and immuno-gold labelling with a specific monoclonal antibody shows the presence of large amount of HCV core protein in these convoluted ER membranes linked to LDs (arrows) and the membranes surrounding LDs. The LDs shown on these photomicrographs are from BHK-21 cells (see Depla et al., 2010 for details of the materials and methods). Scale bars: 1 micrometre (A), 0.5 micrometre (B).

Figure 3 .

 3 Figure 3. Possible mechanisms of LD redistribution induced by the HCV core protein LDs that have initially emerged from the ER bilayer as a lens-shape mass of neutral lipids remain attached to the ER membrane to form a round structure surrounded by a phospholipid monolayer containing PAT/PLIN proteins. These LDs dispersed throughout the cell could regress towards ER membranes and regenerate in distant specific ER membranes domains enriched in HCV core protein. The HCV core protein may contribute to curve the ER membrane to mediate the LD budding. The LD regression/regeneration hypothesis provides a comprehensive model accounting for the replacement of a host cell PAT/PLIN protein by the HCV core protein at the surface of newly synthesised LDs. The structures depicted in this model are not drawn to scale.

Acknowledgments

Research on HCV and LD interactions in our laboratory is supported by grants from INSERM-DHOS and Ligue Contre le Cancer (Comité du Loir et Cher & Comité de l'Ille et Vilaine). M.D. was supported by a Ph.D fellowship provided by INSERM, Région Centre, and the Fondation pour la Recherche Médicale (FRM). Our TEM photographs are obtained with the assistance of the RIO EM Facility of François Rabelais University. P. Roingeard and M. Depla -Lipid droplets in HCV infection


Houari Mahfoud
email: .mahfoud@inria.fr

Abdessamad Imine
email: abdessamad.imine@inria.fr

A General Approach for Securely Querying and Updating XML Data

Keywords: XML access control, XML security views, XML updating, Query rewriting, XPath, XQuery, Confidentiality and Integrity

Over the past years several works have proposed access control models for XML data where only read-access rights over non-recursive DTDs are considered. A few amount of works have studied the access rights for updates. In this paper, we present a general model for specifying access control on XML data in the presence of update operations of W3C XQuery Update Facility. Our approach for enforcing such updates specifications is based on the notion of query rewriting where each update operation defined over arbitrary DTD (recursive or not) is rewritten to a safe one in order to be evaluated only over XML data which can be updated by the user. We investigate in the second part of this report the secure of XML updating in the presence of read-access rights specified by a security views. For an XML document, a security view represents for each class of users all and only the parts of the document these users are able to see. We show that an update operation defined over a security view can cause disclosure of sensitive data hidden by this view if it is not thoroughly rewritten with respect to both read and update access rights. Finally, we propose a security view based approach for securely updating XML in order to preserve the confidentiality and integrity of XML data.

Une Approche Générale pour Sécuriser l'Accès et la Mise à jour des Données XML Résumé : Durant ces dernières années, plusieurs travaux ont proposé des modèles de contrôle d'accès pour sécuriser l'accès en lecture aux données XML, basés seulement sur des DTDs non-récursives. Le contrôle d'accès XML considérant les opérations de mise à jour n'a pas reçu suffisamment d'attention. Dans ce papier, nous présentons un modèle général pour spécifier le contrôle d'accès aux données XML moyennant des primitives de mise à jour du W3C XQuery Update Facility. Notre approche pour enforcer ces spécifications de mise à jour est basée sur la notion de réécriture des requêtes (query rewriting en anglais) où chaque opération de mise à jour, définie par rapport à une DTD arbitraire (récursive ou non), est réécrite en une autre opération sûre afin qu'elle soit évaluée seulement sur des données XML modifiables par l'utilisateur qui a soumis l'opération. Nous étudions dans la deuxième partie de ce rapport la sécurisation des opérations de mise à jour XML en présence des droits de lecture spécifiés sous forme d'une vue de sécurité. Pour un document XML, une vue de sécurité permet de repésenter pour chaque classe d'utilisateurs les parties du document dont ils sont autorisés à voir. Nous montrons qu'une opération de mise à jour définie par rapport à une vue de sécurité peut entraîner des divulgations des données confidentielles cachées par cette vue, si elle n'est pas soigneusement réécrite en tenant compte des droits de lecture et de mise à jour. Pour pallier à ce problème, nous décrivons une solution qui permet de préserver la confidentialité et l'intégrité des données XML.

Mots-clés : Contôle d'accès XML, Vues de sécurité XML, Mise à jour XML, Réécriture des requêtes, XPath, XQuery, Confidentialité et Intégrité

Motivation

The XQuery Update Facility language [START_REF] Robie | Xquery update facility 1.0. W3C Recommendation[END_REF] is a recommendation of W3C that provides facility to modify some parts of an XML document and leaving the rest unchanged, and this through different update operations, e.g., insert, replace, or delete some nodes of a given XML document. The security requirement is the main problem when manipulating XML documents. An XML document may be queried and/or updated simultaneously by different users. For each class of users some rules can be defined to specify parts of the document which are accessible to the users and/or updatable by them. A bulk of work has been published in the last decade to secure the XML content, but only read-access rights has been considered over non-recursive DTDs [START_REF] Fan | Secure xml querying with security views[END_REF], [START_REF] Kuper | Generalized xml security views[END_REF], [START_REF] Damiani | A general approach to securely querying xml[END_REF]. Moreover, a few amount of works have considered update rights.

In this paper, we investigate a general approach for securing XML update operations of the XQuery Update Facility language. Abstractly, for any update operation posed over an XML document, we ensure that the operation is performed only on XML nodes updatable by the user and no sensitive information can be deduced via this operation. Addressing such concerns requires first a specification model to define update constraints and a flexible mechanism to enforce these constraints at update time.

We now present our motivating example for controlling update access. Consider the recursive DTD1 of a hospital depicted as a graph in Fig. 1(b) (we refer to this DTD throughout the paper to illustrate our examples). An XML document conforming to this DTD consists of different departments (dept) defined by a name dname and each department includes patients of the hospital and other patients coming from some clinics (patients under clinical element). For each patient (with name pname and category categ), the hospital maintains a medical history of its parents (parent) and a medical folder (medicalFolder ) which includes all treatments done for this patient (treatment can be analysis or diagnosis); descp and result represent the description and the result of the treatment respectively. The treatment data is organized into two groups depending on whether the treatment has been done in some laboratories (analysis treatments) or not (the diagnosis treatments). Each dname, pname, categ, descp, and result has a single text node (PCDATA) as its child. An instance of the hospital DTD is given in Fig. 2. Due to space limitation, this instance is split into Figures 2 (a Suppose that the hospital wants to impose an update policy that allows the doctors to update all treatments data (e.g., add some treatment results) except those of analysis (done outside the hospital). According to this policy, only the nodes treatment 1 and treatment 4 of Fig. 2(b) can be updated. As the nodes treatment 2 and treatment 3 are analysis treatments they cannot be updated.

Problem 1. The existing access control approaches are unable to specify the above policy. The model given in [START_REF] Damiani | A general approach to securely querying xml[END_REF] consists in annotating the schema of the document by different update constraints, like putting attribute @insert=Y in element type treatment of the hospital DTD to specify that some data can be inserted into nodes of type treatment. However, only local annotations (the update concerns only the node and not its descendants) are used which is not sufficient to define some update policies. For instance, to enforce the hospital update policy imposed, the analysis treatment data (i.e., nodes treatment 2 and treatment 3 ) cannot be discarded from doctors's updates by the model introduced in [START_REF] Damiani | A general approach to securely querying xml[END_REF] even by using XPath upward-axes. Specifically, the annotation @insert=[not(ancestor::analysis)] over element type treatment is not the adequate constraint since it makes node treatment 4 not updatable.

In the XACU annot language presented in [START_REF] Fundulaki | Formalizing xml access control for update operations[END_REF], an update annotation over an element type of the DTD is defined with a full path from the DTD root to this element. E.g., the annotation ann(hospital/patients/patient, insert)=Y specifies that some nodes can be inserted under hospital patients. However, the XACU annot language cannot be applied in the presence of recursive DTDs. For instance, due to recursion, the hospital update policy given above cannot be defined since the paths denoting updatable treatment nodes (not done during analysis) stand for an infinite set of paths. As we will see in the next, this set of paths can be expressed using the Kleene star operator (*) which cannot be expressed in the standard XPath as outlined in [START_REF] Cate | The expressivity of xpath with transitive closure[END_REF][START_REF] Cate | The complexity of query containment in expressive fragments of xpath 2.0[END_REF]. To our knowledge, no model exists for specifying update policies over recursive DTDs.

Problem 2. For each update operation, an XPath expression is defined to specify the XML data at which the update is applied. To enforce rights restriction imposed by an update policy, the query rewriting principle can be applied where each update operation (i.e., its XPath expression) is rewritten according to the update rights into a safe one in order to be evaluated only over parts of the XML data updatable by the user. However, this rewriting step is already challenging for a small class of XPath. Consider the downward fragment of XPath which supports child and descendant axes, union and complex predicates. We show that, in case of recursive DTDs, an update operation defined in this fragment cannot be rewritten safely. More specifically, a safe rewriting of the XPath expression of an update operation can stand for an infinite set of paths which cannot be expressed in the downward fragment of XPath. To overcome this rewriting limitation, some solutions have been proposed [START_REF] Fan | Rewriting regular xpath queries on xml views[END_REF][START_REF] Groz | Xml security views revisited[END_REF] based on the Regular XPath to express safe recursive paths. However, these solutions remain a theoretical achievement since no tool exists to evaluate Regular XPath expressions. Thus, no practical solution exists for enforcing update policies in Problem 3. We discuss finally the interaction between read and update privileges. For each class of users, some read-access rights can be defined to prevent access to sensitive data of the XML document. Moreover, update rights can be imposed to specify parts of the document which can be updated by these users. In this case, we show that rewriting an update operation by considering simply the update rights is not sufficient to make XML updates secure. In other words, an update operation can be safe w.r.t update policy; but, evaluating this operation over the XML document can make disclosure of sensitive data. For instance, suppose that the doctors can update all data in the hospital, but they can see only patients of category "A". According to this read-access right, a view can be computed from the instance of Fig. 2(a) by hiding node patient 2 and its children nodes (pname 2 , categ 2 , parent 1 , and medicalF older 2 ). Thus, node patient 3 is shown to the doctors since its category is "A" and it appears as an immediate child of node patients 1 . Consider now the update delete descendant::patients[patient[pname='N athaniel']]/descendant::result that consists in removing all result nodes provided that patient N athaniel exists. This update is safe w.r.t the update policy defined above. However, if the execution of this update succeeds then the user can deduce that patient N athaniel is currently residing in the hospital and his medical data is confidential. Consequently, the interaction between read and update privileges should be thoroughly designed in order to preserve confidentiality and integrity properties.

RR n°7870

We present in the following our main contributions of this work proposed to deal with the previous problems.

Our Contributions. Our first contribution is an expressive model for specifying XML update policies, based on the primitives of XQuery Update Facility, and over arbitrary DTDs (recursive or not). Given a DTD D, we annotate element types of D with different update rights to specify restrictions on updating XML documents conform to D through some update operations (e.g., deny Inria insertion of new nodes of type analysis under treatment nodes). We propose a new model that supports inheritance and overriding of update privileges and overcomes expressivity limitations of existing models (see Problem 1). Our approach for enforcing such update policies is based on the notion of query rewriting. However, to overcome the rewriting limitation presented above as Problem 2, we investigate the extension of the downward fragment of XPath by some axes and operators. Based on this extension, our second contribution is an algorithm that rewrites any update operation defined in the downward fragment of XPath into another one defined in the extended fragment to be safely evaluated over the XML data. We discuss in the second part of this paper our solution to deal with Problem 3. We propose a general approach to secure update operations defined over a (recursive) security view without disclosure of sensitive data hidden by this view (i.e., to preserve confidentiality and integrity of the XML data, each update operation over the view must be rewritten to be safe w.r.t both read and update rights). To our knowledge, this paper presents the first model for specifying and enforcing update policies using the XQuery update operations and in the presence of arbitrary DTDs (resp. arbitrary security views).

Related Work. During the last years, several works have proposed access control models to secure XML content, but only read-access has been considered over non-recursive DTDs [START_REF] Damiani | A general approach to securely querying xml[END_REF][START_REF] Fan | Secure xml querying with security views[END_REF][START_REF] Kuper | Generalized xml security views[END_REF]. There has been a few amount of works on securing XML data by considering the update rights. Damiani et al. [START_REF] Damiani | A general approach to securely querying xml[END_REF] propose an XML access control model for update operations of the XUpdate language. They annotate the XML schema with the read and update privileges, and then the annotated schema is translated into two automatons defining read and update policies respectively, which are used to rewrite any access query (resp. update operation) over the XML document to be safe. However, the update policy is expressed only with local annotations which is not sufficient to specify some update rights (see Problem 1). Additionally, the automaton processing cannot be successful when rewriting access queries (resp. update operations) defined over recursive schema (i.e., recursive DTD).

Authors of [START_REF] Fundulaki | Formalizing xml access control for update operations[END_REF] propose an XML update access control model based on the XQuery update operations. A set of XPath-based rules is used to specify, for each update operation, the XML nodes that can be updated by the user using this operation. These rules are translated into annotations over element types of the DTD (if exists) to present an annotation-based model called XACU annot . However this translation is possible only in case of non-recursive DTDs.

Consider the read-access control models. Unlike the secure of XML querying over non-recursive security views, the problem posed by the recursion (i.e., XPath query rewriting is not always possible under recursive security views) has not received a more attention. To overcome this problem, some authors [START_REF] Fan | Rewriting regular xpath queries on xml views[END_REF][START_REF] Groz | Xml security views revisited[END_REF] propose rewriting approaches based on the non-standard language, "Regular XPath", which is more expressive than XPath and makes rewriting possible under recursion. However, no practical system exists of both proposed approaches2 , and in general, no tool exists to evaluate Regular XPath queries over XML data. Thus, the need of a rewriting system of XPath queries (resp. update operations) over recursive security views remains an open issue.

Outline. The remainder of the paper is organized as follows. Section 2 presents basic notions on DTD, XPath, and XML update operations considered in this paper. We describe in Section 3 our specification model of update. Our approach for securing update operations is detailed in Section 4. We recall the notion of security view in Section 5 and present a view-based approach to secure updating of XML documents over (recursive) security views. Finally, we conclude this paper in Section 6.

Preliminaries

This section briefly reviews some basic notions tackled throughout the paper.

DTDs. Without loss of generality, we represent a DTD D by (Ele, Rg, root), where Ele is a finite set of element types; root is a distinguished type in Ele called the root type; Rg is a function defining element types such that for any A in Ele, Rg(A) is a regular expression α defined as follows:

α := str | ǫ | B | α','α | α'|'α | α*
where str denotes the text type PCDATA, ǫ is the empty word, B is an element type in Ele, and finally α','α, α'|'α, and α* denote concatenation, disjunction, and the Kleene closure respectively. We refer to A → Rg(A) as the production of A. For each element type B occurring in Rg(A), we refer to B as a subelement type (or child type) of A and to A as a superelement type (or parent type) of B. A DTD D is said recursive if some element type A is defined in terms of itself directly or indirectly.

We use graph representation to depict our DTDs. For instance, Fig. 1 represents (a) the productions of the hospital DTD; and (b) its graph representation corresponding.

XML Documents. We model an XML document with an unranked ordered finite node-labeled tree, called XML Tree. Let Σ be a finite set of node labels, an XML tree T over Σ is a structure defined as [START_REF] Cate | The complexity of query containment in expressive fragments of xpath 2.0[END_REF]:

T =(N, R ↓ , R → , L) where N is the set of nodes, R ↓ ⊆ N ×N is a child relation, R → ⊆ N ×N
is a successor relation on (ordered) siblings, and L : N → Σ is a function assigning to every node its label. R ↑ and R ← denote the converse of the relations R ↓ and R → respectively. For instance, R ← ⊆ N × N is a predecessor relation on (ordered) siblings.

An XML document T conforms to a DTD D if the following conditions hold: (i ) the root of T is the unique node labeled with root; (ii ) each node in T is labeled either with an Ele type A, called an A element, or with str, called a text node; (iii ) for each A element with k ordered children n 1 , ..., n k , the word L(n 1 ), ..., L(n k ) belongs to the regular language defined by Rg(A); (iv ) each text node carries a string value (PCDATA) and is the leaf of the tree. We call T an instance of D if T conforms to D.

XPath Queries. We consider a small class of XPath [START_REF] Berglund | Xml path language (xpath) 2.0[END_REF] queries, referred to as X and defined as follows:

p := α::lab | p [q ] | p /p | p ∪ p q := p | p /text() ='c' | q and q | q or q | not (q) α := ε | ↓ | ↓ + | ↓ *

Inria

where p denotes an XPath query and it is the start of the production, lab refers to element type or * (that matches all types), ∪ stands for union, c is a string constant, α is the XPath axis relations, and ε, ↓, ↓ + and ↓ * denote self , child, descendant and descendant-or-self axis respectively. Finally the expression q enclosed in [.] is called a qualifier (predicate or filter ).

Let n be a node in an XML tree T . The evaluation of an XPath query p at node n, called context node n, results in a set of nodes which are reachable via p from n, denoted by n〚p〛. A qualifier q is said valid at context node n, denoted by n q, iff one of the following conditions holds: (i ) q is an atomic predicate and n〚q〛 is nonempty, i.e., there exists a node reachable via q from n; (ii ) q is given by p/text()='c' and n〚p〛 contains a node which has a child text node whose string value is c; (iii ) q is a boolean expression and it is evaluated to true at n, e.g., predicate not(q) is valid at n iff n〚q〛 is empty.

Theoretically, this XPath fragment (called downward fragment) has some interesting decision results [START_REF] Neven | On the complexity of xpath containment in the presence of disjunction, dtds, and variables[END_REF]. Practically, it is commonly used and is is essential to XQuery, XSLT and XML Schema [START_REF] Fan | Rewriting regular xpath queries on xml views[END_REF]. Authors of [START_REF] Fan | Rewriting regular xpath queries on xml views[END_REF] have shown that in case of recursive security views, the fragment X is not closed under query rewriting (i.e., some access queries defined in X cannot be rewritten to be safe). This problem is known as XPath query rewriting problem. We show that the same problem is encountered in controlling update operations and we propose a solution based on the extension of fragment X as follows:

p := α::lab | p [q ] | p /p | p ∪ p | p [n ] q := p | p /text() ='c' | q and q | q or q | not (q) | p =ε::lab α := ε | ↓ | ↓ + | ↓ * | ↑ | ↑ + | ↑ *
we enrich X by the upward-axes parent (↑), ancestor (↑ + ), and ancestor -or -self (↑ * ), the position and the node comparison predicates. The position predicate, defined with [n](n ∈ N), is used to return the n th node from an ordered set of nodes. For instance, since we model an XML document with an ordered tree, the query ↓:: * [1] over a node n returns its first child node. The node comparison predicate [p 1 =p 2 ] is valid at a node n only if the evaluation of the right and left XPath queries at n result in exactly the same single node. For example, the predicate [↑:: * =↑ + :: * [START_REF] Berglund | Xml path language (xpath) 2.0[END_REF]] is valid at any node n having a parent node. We summarize this extension by the following subsets X ⇑ (X with upward-axes), X ⇑

[n] (X ⇑ with position predicate), and

X ⇑ [n,=] (X ⇑ [n]
with node comparison predicate). In our case, fragment X is used only to formulate update operations (resp. access queries) and to define our update policies (resp. access policies), while we will explain later how the augmented fragments of X defined above can be used to avoid the XPath query rewriting problem. XML Update Operations. We review some update operations of the W3C XQuery Update Facility recommendation [START_REF] Robie | Xquery update facility 1.0. W3C Recommendation[END_REF] (abbreviated as XUF). We study the use of the following operations: insert, delete, and replace. In each update operation an XPath target expression is used to specify the set of XML node(s) in which the update is applied. Moreover, a second argument source is required for insert and replace operations which represents a sequence of XML nodes. Note that target may evaluate to an arbitrary sequence of nodes, denoted targetnodes, in case of delete operation. As for other operations, however, target must evaluate to a single node, denoted target-node; otherwise a dynamic error is raised. The XML update operations considered in this paper are detailed as follows:

• insert source into / as first into / as last into / before / after target: Inserts each node in source as child, as first child, as last child, as preceding sibling node, or as following sibling node of target-node respectively. The order defined between nodes of source must be preserved. We abbreviate these kinds of insert operations by insertInto, insertAsFirst, insertAsLast, insertBefore, and insertAfter respectively. In case of insertBefore and insertAfter operations, target-node must have a parent node; otherwise a dynamic error is raised. For insertInto operation, the position of insertion is undetermined and may depend on the XUF implementation. Thus, the effect of executing an insertInto operation on target can be that of insertAsFirst /insertAsLast executed on target or insertBefore /insertAfter executed at any child node of target.

• delete target: This operation is used to delete all nodes in target-nodes along with their descendant nodes.

• replace target with source: Used to replace target-node and its descendants with the sequence of nodes specified in source by preserving their order. Note that target-node must have a parent node; otherwise a dynamic error is raised.

Update Access Control Model

This section describes our access control model for XML update.

Update Specifications

We focus on the security annotation principle presented in [START_REF] Fan | Secure xml querying with security views[END_REF] and on the update access type notion introduced in [START_REF] Bravo | Accon: checking consistency of xml write-access control policies[END_REF] to define our update specifications. Definition 1. Given a DTD D, an update type defined over D is of the form insertInto

[B i ], insertAsFirst [B i ], insertAsLast [B i ], insertBefore [B i ], insertAfter [B i ], delete [B i ] or replace [B i ,B j ],
where B i and B j are element types of D.

Intuitively, an update type ut represents a set of update operations which are defined for specific element types. For example, the update type insertInto [B] represents the update operations "insert source into target" where nodes in source are of type B. Moreover, replace [B i ,B j ] represents the update operations "replace target with source" where target-node is of type B i and nodes in source are of type B j . Definition 2. We define an update specification S up as a pair (D, ann up ), where D is a DTD, and ann up is a partial mapping such that, for each element type A in D and each update type ut, ann up (A, ut), if defined, is an annotation of the form:

ann up (A,ut) := Y | N | [Q] | N h | [Q] h
with Q is a qualifier in our XPath fragment X .

Inria

An update specification S up is an extension of a document DTD D associating update rights with element types of D.

Let n be a node of type A in an instantiation of D. Intuitively, the authorization values Y , N , and [Q] indicate that, the user is authorized, unauthorized, or conditionally authorized respectively to perform update operations of type ut at n (case of insert operations) or over children nodes of n (case of delete and replace operations). For instance, the annotation ann up (A,insertInto [B])=Y specifies that the user can insert nodes of type B as children nodes of n. However, the annotation

ann up (A,replace [B i ,B j ])=[Q] indicates that B i chil- dren of n can be replaced by new nodes of type B j iff: n Q. An anno- tation ann up (A,ut)=value is said valid at node n iff: (i ) value=Y ; or, (ii ) value=[Q]|[Q] h and n Q.
Our model supports inheritance and overriding of update privileges. If ann up (A,ut) is not explicitly defined, then an A element inherits the authorization of its parent node that concerns the same update type ut. On the other hand, if ann up (A,ut) is explicitly defined it may override the inherited authorization of A that concerns the same update type ut. All update operations are not permitted by default.

Example 1. Consider the following annotations defined over the hospital DTD (see the instance given in Fig. 2):

R 1 : ann up (medicalF older,delete [treatment])=Y R 2 : ann up (analysis,delete [treatment])=N R 3 : ann up (diagnosis,delete [treatment])=Y R 1
indicates that the treatment children of medicalF older nodes can be deleted (e.g., node treatment 1 ). R 2 overrides the delete authorization (Y ) inherited from medicalF older and indicates that the treatment children of analysis nodes cannot be deleted, such as treatment 2 and treatment 3 nodes (node treatment 3 inherits the delete authorization (N ) from its parent node treatment 2 since the annotation ann up (treatment,delete [treatment]) is not explicitly defined). Similarly, R 3 overrides the delete authorization (N ) of analysis to allow deletion of the treatment children of diagnosis nodes (case of node treatment 4 ).

Finally, the semantic of the specification values N h and [Q] h is given as follows: The annotation ann up (A,ut)=N h indicates that, for a node n of type A, update operations of type ut cannot be performed at n and no overriding of this authorization value is permitted for descendant nodes of n. For instance, if n ′ is a descendant node of n whose type is A ′ , then an update operation of type ut cannot be performed at n ′ even though ann up (A ′ ,ut)=Y is explicitly defined. While, with the annotation ann up (A,ut)=[Q] h , descendant nodes of an A element can override this authorization value only if Q is valid at this element. For instance, let n and n ′ be two nodes of type A and A ′ respectively, and consider the annotation ann up (A ′ ,ut)=[Q ′ ], then an update operation of type ut can be performed at node n ′ iff: n ′ Q ′ . Moreover, if the annotation ann up (A,ut)=[Q] h is defined and n ′ is a descendant of n, then the annotation ann up (A ′ ,ut)=[Q ′ ] takes effect and an update operation of type ut can be performed at node n ′ iff: n Q and n ′ Q ′ . We call annotation with value N h or [Q] h as downward-closed annotation.

Example 2. Suppose that the hospital wants to impose an update policy that authorizes the doctors to update (insertion, deletion,...) only data of patients having category 'A', which are under department 'cardiology' and not involved by clinical trial. We define formally this policy over an update type ut as follows:

R 1 : ann up (dept,ut)=[↓::dname/text()='cardiology'] h R 2 : ann up (clinical,ut)=N h R 3 : ann up (patient,ut)=[↓::categ/text()='A']
Consider the case where ut=insertInto [treatment]. For a node p of type patient, the annotation R 3 takes effect over data of p only if p is under cardiology department and outside of clinics (p has no ancestor node of type clinical); otherwise no insertion of treatment nodes is permitted under node p regardless its category. For the XML document presented in Fig. 2(a), insertions under nodes patient 3 and patient 4 are permitted (e.g., insert some treatment nodes into medicalF older 3 ).

In [START_REF] Fan | Secure xml querying with security views[END_REF], when an annotation R with qualifier [Q] is evaluated to false, all annotations under R will be discarded regardless their truth values, which is not always necessary: According to our policy in Example 2, insertions under node patient 3 of Fig. 2(a) are permitted by overriding negative authorization inherited from node patient 2 . The principle of downward-closed annotation that we present with the specification values {N h ,[Q] h } can be defined using just the values {Y ,N ,[Q]} but with a large XPath fragment (e.g., the fragment X ⇑ ) as done in [START_REF] Kuper | Generalized xml security views[END_REF]. For instance, the policy of Example 2 can be defined as follows: Observe that, without using the values {N h ,[Q] h }, defining a downward-closed annotation over element type A amounts to propagate its value into all annotations defined under A (values of the two downward-closed annotations R 1 and R 2 of Example 2 are propagated into the annotation R 3 to redefine it with R ′ 3 ). In this case, annotation R ′ 3 depends on R ′ 1 and R ′ 2 and must be redefined each time a modification is made on R ′ 1 and/or R ′ 2 . This propagation leads to verbose annotations. In other words, without the values {N h ,[Q] h }, changing one annotation may require the modification of some annotations defined under it3 which can be complicated and time consuming in case of large DTDs.

DTD Recursion Problems

Recall the problems 1 and 2 explained in Section 1. The first problem states the non-existence of models to specify update policies in case of recursive DTDs. Suppose that the hospital imposes that the doctors can update all treatment data except those which have been done outside the hospital (we suppose that all analysis are done in laboratories). According to this policy, a doctor is permitted to update a treatment node in an XML document (e.g., insert new diagnosis data, delete some result nodes, etc.) only if this node is not attached, directly or by other treatment nodes, to an analysis node. Given the XML document presented in Fig. 2, only nodes treatment 1 and treatment 4 can be updated while it is not the case of nodes treatment 2 and treatment 3 which are data analysis (attached to node analysis 1 ). Such a policy can be defined only by using the notion of inheritance and overriding of update privileges which is not considered in the existing approaches [START_REF] Bravo | Accon: checking consistency of xml write-access control policies[END_REF][START_REF] Damiani | A general approach to securely querying xml[END_REF][START_REF] Duong | An integrated access control for securely querying and updating xml data[END_REF][START_REF] Fundulaki | Formalizing xml access control for update operations[END_REF]. This policy is defined in our model by the following update annotations: The second problem is related to the enforcement of update policies. In case of recursive DTD, an update operation with target defined in fragment X cannot be rewritten into an equivalent one defined in X in order to update only authorized data. This problem is known as the XPath closure problem [START_REF] Fan | Rewriting regular xpath queries on xml views[END_REF]. For instance, according to the previous update annotations, the update operation delete ↓ + ::treatment cannot be rewritten into a safe update expressed in X . Indeed, the paths denoting updatable treatment nodes (not done during analysis) stand for an infinite set. This set of paths can be captured with: delete (↓ + ::medicalF older ∪ ↓ + ::diagnosis)/(↓::treatment)*/↓::treatment. However, the kleene star ( * ) cannot be expressed in XPath [START_REF] Cate | The expressivity of xpath with transitive closure[END_REF][START_REF] Cate | The complexity of query containment in expressive fragments of xpath 2.0[END_REF].

In the next section we explain how the extended fragment X ⇑

[n] , defined in Section 2, can be used to overcome this update operations rewriting problem.

Secure Updating XML

In this section we focus only on update rights and we assume that every node is read-accessible by all users. Given an update specification S up =(D, ann up ), we discuss the enforcement of such update constraints where each update operation posed over an instance T of D must be evaluated only over nodes of T that can be updated by the user w.r.t S up . We assume that the XML document T remains valid after the update operation is performed, otherwise the update is rejected. In the following, we denote by S ut the set of annotations defined in S up over the update type ut and by |S ut | the size of this set. Moreover, for a mapping function ann (such as ann up of an update specification S up =(D, ann up )), we denote by {ann} the set of all annotations defined with ann, and by |ann| the size of this set.

Updatability

Consider the annotation ann up (A,ut)=value and let n be a node of type A. If this annotation is valid at n then update operations of type ut can change either the content of n (i.e., delete/replace children nodes of n, insert new ones) or the information relative to its preceding-sibling (resp. following-sibling) presented by the relation R ← (resp. R → ) in Section 2 (i.e., insert new nodes in preceding/following sibling of n). Thus, we say that a node n is updatable w.r.t update type ut if the user is granted to perform update operations of type ut either at node n (case of insert operations) or over children nodes of n (case of delete and replace operations). For instance, if a node n is updatable w.r.t insertInto [B], then some nodes of type B can be inserted as children of n. Additionally, B i children of n can be replaced with nodes of type B j iff n is updatable w.r.t replace [B i ,B j ]. Definition 3. Let S up =(D, ann up ) be an update specification and ut be an update type. A node n in an instantiation of D is updatable w.r.t ut if the following conditions hold:

i) The node n is concerned by a valid annotation with type ut; or, no annotation of type ut is defined over element type of n and there is an ancestor node n ′ of n such that: n ′ is the first ancestor node of n concerned by an annotation of type ut, and this annotation is valid at n ′ (the inherited annotation).

ii) There is no ancestor node of n concerned by an invalid downward-closed annotation of type ut.

Example 3. We consider the XML instance of Fig. 2 and we define the following update annotations: Given an update specification S up =(D, ann up ), we define two predicates U 1 ut and U 2 ut (expressed in fragment X ⇑

R
[n] ) to satisfy the conditions (i ) and (ii ) of Definition 3 with respect to an update type ut:

U 1 ut := ↑ * :: * [ (annup(A,ut)=Y |N |[Q]|N h |[Q] h )∈Sut ε::A][1] [ (annup(A,ut)=Y )∈Sut ε::A (annup(A,ut)=[Q]|[Q] h )∈Sut ε::A[Q]] U 2 ut := (annup(A,ut)=N h )∈Sut not (↑ + ::A) (annup(A,ut)=[Q] h )∈Sut not (↑ + ::A[not(Q)])
where and denote conjunction and disjunction respectively. The predicate U 1 ut has the form ↑ * ::

* [qual 1 ][1][qual 2 ]
. Applying ↑ * :: * [qual 1 ] on a node n returns an ordered set S of nodes (node n and/or some of its ancestor nodes) such that for each one an annotation of type ut is defined over its element type. The predicate S [START_REF] Berglund | Xml path language (xpath) 2.0[END_REF] returns either node n, if an annotation of type ut is defined over its element type; or the first ancestor node of n concerned by an annotation of type ut. Thus, to satisfy condition (i ) of Definition 3, it amounts to check that Inria the node returned by S [START_REF] Berglund | Xml path language (xpath) 2.0[END_REF] is concerned by a valid annotation of type ut, done by S[1][qual 2 ] (i.e., n U 1 ut ). The second predicate is used to check that all downward-closed annotations of type ut defined over ancestor nodes of n are valid (i.e., n U 2 ut ).

Definition 4. Let S up =(D, ann up ), ut, and T be an update specification, an update type and an instance of DTD D respectively. We define the updatability predicate U ut which refers to an X ⇑

[n] qualifier such that, a node n on T is updatable w.r.t ut iff n U ut , where

U ut := U 1 ut U 2 ut .
For example, the XPath expression ↓ + :: * [U ut ] stands for all nodes which are updatable w.r.t ut. As a special case, if S ut = φ then U ut = f alse. ut is valid at node medicalF older 3 . Also, we can see that medicalF older 3 U 2 ut . Consequently, the node medicalF older 3 is updatable w.r.t ut (i.e., medicalF older 3 U ut ). This means that, in case of ut=insertInto [treatment], the user is granted to insert nodes of type treatment under node medicalF older 3 . However, if ut=delete [treatment], then treatment children of node medicalF older 3 can be deleted (case of node treatment 1 of the instance of Fig. 2).

Update Operations Rewriting

Finally, we detail here our approach for enforcing update policies based on the notion of query rewriting. Given an update specification S up =(D, ann up ). For any update operation with target defined in the XPath fragment X , we translate this operation into a safe one by rewriting its target expression into another one target ′ defined in the XPath fragment X ⇑

[n] , such that evaluating target ′ over any instance of D returns only nodes that can be updated by the user w.r.t S up . We describe in the following the rewriting of each kind of update operation considered in this paper. We refer to DTD D as a pair (Ele, Rg, root), and to source as a sequence of nodes of type B. ). Therefore, the target expression of the replace operation can be rewritten into:

Delete

target[ Ai∈Ele ε::A i [↑:: * [U replace[Ai,B] ]]].
Insert as first into/as last into/before/after Operations. Consider the update operation "insert target as first into source". For any node n referred to by target, the user can insert nodes in source at the first child position of n, regardless the type of n, provided that he holds the insertAsFirst [B] right on this node (i.e., n U insertAsF irst [B] ). To check this, the target expression of the above update operation can be simply rewritten into:

target[U insertAsF irst[B] ].
The same principle is applied for the operations insertAsLast, insertBefore, and insertAfter.

Insert into Operation. In the following we assume that: if a node n is concerned by an annotation of type insertInto [B], then this annotation implies insertAsFirst [B] (resp. insertAsLast [B]) rights for n, and insertBefore [B] (resp. insertAfter [B]) rights for children nodes of n (inspired from [START_REF] Fundulaki | Formalizing xml access control for update operations[END_REF]). In other words, if one can(not) insert children nodes of types B at any child position of some node n as specified by some annotations of type insertInto [B], then one can(not) insert nodes of type B in the first and last child position of n and in preceding and following sibling of children nodes of n (unless if there is some annotations of type insertAsFirst

[B], insertAsLast [B], insertBefore [B],
or insertAfter [B] respectively that specify otherwise). Thus, one can execute the update operation "insert source into target" over an XML tree T iff: (i ) one has the right to execute update operations of type insertInto [B] on the node n (n ∈ T 〚target〛); and (ii ) no annotation explicitly prohibits update operations of type insertAsFirst

[B]/insertAsLast [B] on node n (resp. insertBefore [B]/insertAfter [B] on children nodes of n).
When condition (ii ) does not hold (e.g. update operations of type insertAsFirst is explicitly denied), this leads to situation where there is a conflict between insertInto and other insert operations.

The first condition is checked using the updatability predicate U insertInto[B] (whether or not n U insertInto[B] ). For the second condition, however, we define the predicate U -1 ut over an update type ut such that: for a node n, if n U -1 ut then update operations of type ut are explicitly forbidden on node n. An update operation of type ut is explicitly forbidden at node n iff at least one of the following conditions holds: a) the node n is concerned by an invalid Inria annotation of type ut; b) no annotation of type ut is defined over element type of n and there is an ancestor node n ′ of n such that: n ′ is the first ancestor node of n concerned by an annotation of type ut, and this annotation is invalid at n ′ ; c) there is an ancestor node of n concerned by an invalid downward-closed annotation of type ut.

More formally, for an update specification S up =(D, ann up ), we define the predicate U -1 ut := Cnd a∨b Cnd c over an update type ut with:4

Cnd a∨b := ↑ * :: * [ (annup(A,ut)=Y |N |[Q]|N h |[Q] h )∈Sut ε::A][1] [ (annup(A,ut)=N |N h )∈Sut ε::A (annup(A,ut)=[Q]|[Q] h )∈Sut ε::A[not(Q)]] Cnd c := (annup(A,ut)=N h )∈Sut ↑ + ::A (annup(A,ut)=[Q] h )∈Sut ↑ + ::A[not(Q)]
To resolve the conflict between insertInto operation and other insert types, we define the predicate CRP B ("Conflict Resolution Predicate") over an element type B as:

CRP B := U -1 insertAsF irst[B] U -1 insertAsLast[B] ↓:: * [U -1 insertBef ore[B] ] ↓:: * [U -1 insertAf ter[B] ] For a node n, if n CRP B then at least the update operation insertAsFirst [B] (resp. insertAsLast [B]) is forbidden for node n or insertBefore [B] (resp. insertAfter [B]
) is forbidden for some children nodes of n. Finally, given the update operation "insert source into target" over an XML tree T , one can insert nodes of type B in source to the node n (n ∈ T 〚target〛) if and only if: n U insertInto[B] not(CRP B ). Thus, the target of the insertInto operation can be rewritten into:

target[U insertInto[B] not(CRP B )].
The overall complexity time of our rewriting approach of update operations can be stated as follows:

Theorem 1. For any update specification S up =(D, ann up ) and any update operation op (defined in X ), there exists an algorithm "Rewrite Updates" that translates op into a safe one op ′ (defined in X ⇑

[n] ) in at most O(|ann up |) time.

Proof. Our algorithm "Rewrite Updates " for XML update operations rewriting is given in Fig. 3. As explained in Section 4.2, for any update specification S up =(D, ann up ) with DTD D=(Ele, Rg, root), the securing of an update operation op consists in the rewriting of its target expression (defined in X ) into a safe one target ′ (defined in X ⇑

[n] ) in order to refer only to XML nodes that can be updated by the user w.r.t S up . Proving that target ′ can be defined in O(|ann up |) time is intuitive and based on the proof of Property 1:

• A delete operation can be rewritten by adding the following predicate [ Ai∈Ele ε::A i [↑:: * [U delete [Ai] ]]] to its target expression. For each element type 1 let D=(Ele, Rg, root); 2 let op be defined with target and optional sequence source of nodes which conform to type B;

A i in DTD D, S delete[Ai]
3 case (delete operation) :

4 target ′ := target[ A i ∈Ele ε::A i [↑:: * [U delete[A i ] ]]];
5 case (replace operation) :

6 target ′ := target[ A i ∈Ele ε::A i [↑:: * [U replace[A i ,B] ]]];
7 case (insertAsFirst operation) :

8 target ′ := target[U insertAsF irst[B]
]; //same principle for insertAsLast, insertBefore, and insertAfter operations;

9 case (insertInto operation) :

10 CRP B := U -1 insertAsF irst[B] U -1 insertAsLast[B] ↓:: * [U -1 insertBef ore[B] ] ↓:: * [U -1 insertAf ter[B] ]; 11 target ′ := target[U insertInto[B] not(CRP B )];
12 replace target of op with target ′ ; 13 return op;

Secure Updating XML over Security Views

In the previous section we have supposed that all nodes are read-accessible which is not always the case. An XML document T can be queried simultaneously by different users. For each class of users, some read constraints can be imposed to deny access to sensitive information on T . To enforce such constraints, most of existing works which deal with read-access control are based on the notion of Security Views. Abstractly, for each class of users, we annotate the used DTD Inria D with read-access constraints to specify accessibility conditions for nodes of instances of D. A security view is defined to be a pair (D v , σ) where: (i ) D v is the view of D given to the users to represent the schema of all and only data they are able to see; and (ii ) σ is a function, hidden from the users, and used to extract, for each instance T of D, its virtual view T v showing only accessible nodes. We investigate in this section the secure of update operations defined over (recursive) security views.

Access Control for Recursive Views

Given a security view V =(D v , σ), some works [START_REF] Damiani | A general approach to securely querying xml[END_REF][START_REF] Fan | Secure xml querying with security views[END_REF][START_REF] Kuper | Generalized xml security views[END_REF] have proposed efficient algorithms to rewrite any user query formulated for D v to an equivalent one formulated for the original DTD D to be finally evaluated over any instance of D. This query rewriting principle has to avoid the overhead of view materialization and maintenance. However, only non-recursive views are considered (i.e., D v is non-recursive). Consider the XPath fragment X which is more used in practice, it has been shown in [START_REF] Fan | Rewriting regular xpath queries on xml views[END_REF] that query rewriting is not always possible under X in case of recursive security views.

To overcome this limitation, we presented in [START_REF] Houari | Secure querying of recursive xml views: A standard xpath-based technique[END_REF] a general approach to make XPath query rewriting possible under recursive security views. We briefly discuss here the main principle of our approach.

Given a DTD D=(Ele, Rg, root), we define for each class of users an access specification S=(D, ann) which specifies accessibility of XML nodes in intances of D. Formally, ann is a partial mapping such that, for each production A → Rg(A) and each element type B in Rg(A), ann(A, B), if explicitly defined, is an annotation of the form: ann(A,B)

:= Y |N |[Q]|N h |[Q] h where [Q] is a qualifier in our XPath fragment X .
The specification values Y , N , and [Q] indicate that the B children of A elements in an instance of D are accessible, inaccessible, or conditionally accessible respectively. If ann(A, B) is not explicitly defined, then B inherits the accessibility of A (inheritance). On the other hand, if ann(A, B) is explicitly defined it may override the accessibility inherited from A (overriding).

The same principle of downward-closed annotation defined in Section 3.1 is applied for access annotations. With the annotation ann(A, B)=N h , each B child of an A element is inaccessible and any descendant node of this B element can override this accessibility value (N h ) to be accessible. However, with the annotation ann(A,B)=[Q] h , for any node n of type B child of an A element, descendant nodes of n can override this accessibility value (

[Q] h ) only if n Q.
We define the security view in our approach to be V =(D v , ann) by omitting the function σ since it cannot be defined in case of recursive DTDs as outlined in [START_REF] Fan | Secure xml querying with security views[END_REF][START_REF] Kuper | Generalized xml security views[END_REF].

Finally, we describe our algorithm "Rewrite " for XPath queries rewriting over arbitrary security views (recursive or not). Given an access specification S=(D, ann), we extract first the security view V =(D v , ann) corresponding to S. The user is provided with the DTD view D v which represents the schema of the data he is able to see. For any query Q defined in X over D v , our algorithm "Rewrite " translates it into an equivalent one Q t defined in X ⇑

[n,=]

over the original DTD D such that: for any instance T of D, its virtual view T v conforms to D v , the evaluation of Q on T v yields the same result as the We explain now some notations used in the following. For an access specification S=(D, ann), we define predicates A acc and A + (expressed in fragment X ⇑

[n] ) such that: for any node n in an instance of D, n is accessible w.r.t S if and only if n A acc . While, n/A + returns all accessible ancestor nodes of n. We use algorithm "RW_Pred " to rewrite any predicate p defined in X over DTD view D v to an equivalent one RW_Pred (p) defined in X ⇑

[n,=] over the original DTD D. More details of these predicates, and about the algorithms "Rewrite " and "RW_Pred " can be found in [START_REF] Houari | Secure querying of recursive xml views: A standard xpath-based technique[END_REF].

Securing Update Operations

We present in this section a security view-based approach for securing XML update operations. Given an access specification S=(D, ann), and its corresponding security view V =(D v , ann). The update privileges of each class of users are defined over the DTD view D v =(Ele v , Rg v , root) to be S up =(D v , ann up ) and not over the original DTD D (i.e., for an update type ut, an annotation ann up (A, ut)=value defined over an element type A does not make sense if A / ∈ Ele v ). Each update operation must be rewritten with respect to both V and S up to be safe, since, considering only update privileges (i.e., rewriting update operations only over S up as explained in Section 4.2) is not sufficient to make XML updates secure and can cause leakage of sensitive information hidden by V . We illustrate this problem by the following example.

Example 5. Let S=(D, ann) be an access specification where D is the hospital DTD and the annotations ann are defined as follows:

ann

(hospital, dept)=[Q 1 ] h ; Q 1 is ↓::dname/text()= ′ cardiology ′ ann(dept, clinical)=N h ann(patients, patient)=[Q 2 ]; Q 2 is ↓::categ/text()= ′ A ′ ann(parent, patient)=[Q 2 ]

Inria

These annotations indicate that only the patients which are under department 'cardiology', not involved by clinical trial, and also having category 'A' are accessible to the user. Figure 4 represents the virtual view of the XML instance of 4 where Q is the qualifier "not (↓::patient[↓::pname/text()='M argaret'])". Considering only the update privileges is not sufficient to make this operation safe. The rewritten of this update operation w.r.t the update policy defined above returns op ′ =op[↑:: * [U delete [result] ]]. If the execution of op ′ over the original instance of Fig. 2 deletes the node result 1 , then the qualifier Q is valid at node patients 1 and the user can deduce that some nodes are hidden between nodes patients 1 and patient 3 . By performing the rewritten operation op ′ with Q="↓::patient[↓::pname/text()='N athaniel']", the result 1 node is deleted and the user can deduce that patient N athaniel is currently residing in the hospital and has confidential data. Moreover, the user is able to request these sensitive data simply by changing the predicate Q.

In order to avoid this inference problem, each update operation must be rewritten w.r.t both read and update privileges to be safely executed over any instance. Securely controlling an update operation is then done in two steps:

(1) The XPath target expression of the update operation is rewritten according to the read privileges of the user submitting the update operation. This is done by using our rewriting algorithm "Rewrite " described in Section 5.1.

(2) Let target ′ be the rewriting of target w.r.t the read privileges, the user must hold the update privilege for each node referred to by target ′ . Then, we rewrite target ′ w.r.t the update privileges into a safe one in order to be evaluated only over nodes updatable by the user and without disclosure of sensitive information. We have seen in Example 5 that, by evaluating the predicate Q="not (↓::patient [↓::pname/text()='M argaret'])" over node patients 1 of Fig. 2, some confidential information can be deduced. Using our rewriting algorithm "Rewrite ", we ensure that only accessible nodes can be requested by the update operation. Let Q ′ be the predicate "↓ + ::patient[A acc ][↓ + ::pname[A acc ][ε:: * /text()='M argaret'] /A + [1]=ε::patient]/A + [1]=ε::patients" (i.e., RW_Pred (Q)=not (Q ′ )). Evaluating the predicate Q ′ over a node n in the original instance has to check that there is some accessible nodes of type patient, having name 'M argaret', and which are children of n or separated from it only with inaccessible nodes. Thus, the rewritten predicate RW_Pred (Q) (i.e., not (Q ′ )) is not valid at node patients 1 since the node patient 3 has name 'M argaret' and is separated from patients 1 only with inaccessible nodes. Therefore, the rewritten update operation delete target ′′ has no effect over the original instance of Fig. 2 and no confidential information can be deduced.

Conclusion

We have proposed a general model for specifying XML update policies based on the primitives of XQuery Update Facility. To enforce such policies, we have introduced a rewriting approach to securely updating XML over arbitrary DTDs and for a significant fragment of XPath. In the second part of this work, we have investigated the secure of XML data in the presence of security views. We have reviewed first our previously proposed approach enabling XPath query rewriting over recursive security views. Finally, we have discussed some inference problem that can be caused by combining read and update privileges, and our solution to deal with such a problem. This yields the first XML security model that provides both read and update access control for arbitrary DTDs (resp. security views). We plan first to extend our approach to handle larger fragments of XPath and other XQuery update operations. Moreover, we aim to provide a working system in order to investigate the practicality of our proposed solutions.

  ) and (b), where Fig. 2(b) represents the medical folder of patient 3 .

Figure 1 :

 1 Figure 1: Hospital DTD.

Figure 2 :

 2 Figure 2: Example of XML Document.

R ′ 1 : 2 : 3 :

 123 ann up (dept,ut)=[↓::dname/text()='cardiology'] R ′ ann up (clinical,ut)=N R ′ ann up (patient,ut)=[↓::categ/text()='A' and not(↑ + ::clinical) and ↑ + ::dept[↓::dname/text()='cardiology']]

R 1 :

 1 ann up (medicalF older,ut)=Y R 2 : ann up (diagnosis,ut)=Y R 3 : ann up (analysis,ut)=N where ut can be any update type defined over element types treatment, descp, diagnosis, and result (e.g., delete [result], insertInto [diagnosis]).

Example 4 .

 4 According to the update policy of Example 2, the updatability predicateU ut := U 1 ut U 2ut is defined with:U 1 ut := ↑ * :: * [ε::dept ε::clinical ε::patient][1] [ε::dept[↓::dname/text()='cardiology'] ε::patient[↓::categ/text()='A']]U 2 ut := not (↑ + ::dept[not (↓::dname/text()='cardiology')]) not (↑ + ::clinical) Applying the predicate ↑ * :: * [ε::dept ε::clinical ε::patient] over the node medicalF older 3 of Fig. 2(a) returns the ordered set S={patient 3 , patient 2 , dept 1 } of nodes (each one is concerned by an annotation of type ut); S[1] returns patient 3 ; and the predicate [ε::dept[↓::dname/text()='cardiology'] ε::patient[↓::categ/text()='A']] is valid at patient 3 . Thus U 1

Property 1 .

 1 For an update specification S up =(D, ann up ) and an update type ut, the updatability predicate U ut can be constructed in at most O(|ann up |) time. Proof. Intuitively, for an update type ut, the definition of the set S ut depends on the parsing of all annotations of S up (i.e., the set {ann up }) in O(|ann up |) time. The construction of each predicate U 1 ut and U 2 ut over annotations of S ut takes O(|S ut |) time. Thus, the predicate U ut can be constructed in at most O(|S ut | + |ann up |)=O(|ann up |) time (since |S ut | ≤ |ann up |).

  is a subset of {ann up }, i.e., Ai∈Ele S delete[Ai] ⊆ {ann up }. All these subsets can be computed by parsing only one time the set {ann up }, i.e., in O(|ann up |) time. Next, each sub-predicate U delete[Ai] is defined over the subset S delete[Ai] in O(|S delete[Ai] |) time, and all sub-predicates used in Algorithm: Rewrite Updates input : An update specification Sup=(D, annup) and an update operation op. output: a rewritten of op w.r.t Sup.

Figure 3 :•

 3 Figure 3: XML Update Operations Rewriting Algorithm.

Figure 4 :

 4 Figure 4: View of the XML document of Fig. 2.

Fig. 2

 2 according to these annotations. We define now the following update privileges: ann up (medicalF older, delete[result]) = Y ann up (diagnosis, delete[result]) = Y ann up (analysis, delete[result]) = N Consider now the update operation op = delete ↓ + ::patients[Q]/↓ + ::result defined over the view instance depicted in Fig.

Example 6 .

 6 Consider the read and update privileges of Example 5. The update operation op=delete ↓ + ::patients[Q]/↓ + ::result (where Q is the qualifier "not (↓::patient[↓::pname/text()='M argaret'])") over the view instance of Fig. 4 is rewritten into delete target ′′ to be safely evaluated over the original instance of Fig. 2, where target ′′ is defined with: target := ↓ + ::patients[Q]/↓ + ::result target ′ := Rewrite (target) = ↓ * ::result[A acc ][↑ + ::patients[A acc ][RW_Pred (Q)][↑ + ::hospital]] RW_Pred (Q) := not (↓ + ::patient[A acc ][↓ + ::pname[A acc ] [ε:: * /text()='M argaret']/A + [1]=ε::patient]/A + [1]=ε::patients) target ′′ := target ′ [↑:: * [U delete[result] ]]

  /Replace Operations. According to our model of update, if the user holds the delete [A] right on a node n then he can delete children nodes of n of type A. Thus, given the update operation "delete target", for each node n of type A i referred to by target, parent node n ′ of n must be updatable w.r.t delete [A i ] (i.e., n ′ U delete[Ai] ). To this end, the target expression of delete operations can be rewritten into: target[ Ai∈Ele ε::A i [↑:: * [U delete[Ai] ]]]. Consider now the update operation "replace target with source". A node n of type A i referred to by target can be replaced with nodes in source if its parent node n ′ is updatable w.r.t replace [A i ,B] (i.e., n ′ U replace[Ai,B]

RR n°7870

A DTD is recursive iff at least one of its elements is defined (directly or indirectly) in terms of itself.Inria

According to[START_REF] Rassadko | Query rewriting algorithm evaluation for xml security views[END_REF] the SMOQE system proposed in[START_REF] Fan | Smoqe: A system for providing secure access to xml[END_REF] has been removed because of conduction of future researches.RR n°7870

This is not recommended for some systems like collaborative editing where the update policies are dynamic and each change is propagated to all the users across the network[START_REF] Imine | A flexible access control model for distributed collaborative editors[END_REF].Inria

As a special case, if Sut = φ then U -1 ut = f alse.RR n°7870

rue du Jardin Botanique CS20101 54603 Villers-lès-Nancy Cedex Publisher Inria Domaine de Voluceau -Rocquencourt BP 105 -78153 Le Chesnay Cedex inria.fr ISSN 0249-6399