George Kousiouris

George Vafiadis

Marcelo Corrales
email: corrales@iri.uni-hannover.de

A Cloud provider description schema for meeting legal requirements in cloud federation scenarios

Keywords: Cloud computing, legal issues, personal data, data management, Cloud federation

The advent of Cloud computing has created numerous significant challenges with regard to manipulation of data and especially personal data in cases of Clouds and federated Clouds. Existing legislation currently creates constraints and boundaries in the free usage of external Cloud providers. The aim of this paper is to provide a schema definition and usage mechanism (CPDS) that includes various levels of legal information that is necessary for automating the process of Cloud provider selection and data outsourcing. Thus the aforementioned constraints may be checked in an automated and machine understandable fashion and fully harvest the potential that is created by advances in Cloud computing like dynamic federation. In this direction, legal gaps and necessary actions are identified so that the automation avoids manual and bureaucratic steps that are necessary at the moment.

Introduction

With the advent of Cloud computing, new challenges have arisen with regard to the handling of personal data in infrastructures that are not under the direct control of either the end users or the application service providers, when using externalized infrastructure services from the IaaS/PaaS layer. This lack of control creates threats with regard to data accountability and legal action, especially with regard to current legislation [1].

On the other hand, the significant advantages of Cloud computing, like high availability, seemingly infinite resources, federation capabilities for exploiting multiple IaaS providers and pay-per-use business models are very intriguing for the business aspects of applications dealing with personal data. However, the "iron curtain" that lays in front of these providers with regard to how they manage their infrastructures (and is dictated by their business needs and confidentiality) hinders the available in-formation that may be exposed and could alleviate the legal fears when it comes to personal data management.

For this reason, an intermediate solution should be found, that can expose critical legal information of the IaaS provider capabilities in order to meet legal constraints, while on the other hand not force the latter to share sensitive information regarding their infrastructure. This information should then be used in order to automate the negotiation process between the SP (Service Provider-the entity that is responsible for finding a suitable cloud resource and deploying the application service) and the IaaS provider (IP), or between IaaS providers in the case of dynamic cloud federation (case of resource sharing between IaaS providers). The aim of this paper is to provide such an XML-based definition of needed information and its usage in a dynamic multicloud utilization scenario, in order to bridge the gap between legal compliance and dynamic business models. The main triggering factor for this work is the OPTIMIS project's deployment and usage scenarios [START_REF] Ferrer | OPTIMIS: A holistic approach to cloud service provisioning[END_REF], that include federated and multi-cloud operations that may encounter legal boundaries and constraints [START_REF]2.1.3 "Cloud Legal Guidelines: Technical Implementation of Legal Requirements, Exploitation of the Toolkit in Use Cases and Component Licenses[END_REF].

The paper proceeds with introducing related work in Chapter 2. In Chapter 3, the main OPTIMIS deployment scenario is portrayed along with the legal constraints that prohibit its full potential. The structure of the necessary XML schema and mechanism is presented in Chapter 4 while its usage in an automated environment is portrayed in Chapter 5. The identified legal gaps that are necessary to complete the automation of the process in the mentioned scenarios are described in Chapter 6 while Chapter 7 concludes the paper.

Related Work

Legal implications and fears from the usage of Cloud computing have been highlighted in numerous research efforts. For example, the issue of losing control over data and the risks or concerns that this involves is highlighted in [START_REF] Chow | Controlling data in the cloud: outsourcing computation without outsourcing control[END_REF], as an aspect that is or will slow down the proliferation of Cloud usage. Jurisdictional issues, accountability and compliance are also critical in [START_REF] Pearson | Accountability as a Way Forward for Privacy Protection in the Cloud[END_REF], and the usage of XML-based descriptions for legal text and rules has been taken under consideration, mainly in the SLA creation but not IP selection. In this interesting work, also the role of an intermediate third party trusted instance is considered, for the validation of auditing processes for example. LegalXML is an interesting attempt towards machine understandable contracts and terms, from which the following more interesting initiateves may be identified. LegalDocML [START_REF]OASIS LegalDocumentML[END_REF] is a modeling language aiming at overcoming differences in XML-defined legal terms between different standards. LegalRuleML [START_REF] Oasis Legalruleml | [END_REF] is an ongoing effort to standardize legal rules and reasoning, while LegalXML eContracts is a recommendation towards standardized contract structures from a legal point of view. The latter may be used in conjunction to our work for describing for example the Standard Contractual Clauses. This family of recommendations may be valuable from an expression point of view, however it does not focus on provider selection.

On the other hand, IT scientists have devoted a lot of time and effort in order to enable from a technical point of view flexible and dynamic management [START_REF] Rochwerger | The Reservoir model and architecture for open federated cloud computing[END_REF] and sharing of resources between different Cloud providers in order to meet demand peaks, minimize cost [START_REF] Toosi | Resource Provisioning Policies to Increase IaaS Provider's Profit in a Federated Cloud Environment[END_REF] or achieve higher availability (through multi-site placement) [START_REF] Toosi | Resource Provisioning Policies to Increase IaaS Provider's Profit in a Federated Cloud Environment[END_REF]. The federated aspects of Cloud computing model are considered capable to create immense potential as they offer significant performance gains as regards to response time and cost saving under dynamic workload scenarios [START_REF] Buyya | InterCloud: Utility-oriented federation of cloud computing environments for scaling of application services[END_REF].

OPTIMIS federation scenarios and legal constraints

In the OPTIMIS ecosystem [START_REF] Ferrer | OPTIMIS: A holistic approach to cloud service provisioning[END_REF], the Service Provider (SP) is an entity that needs to find a suitable Infrastructure Provider (IP) in order to deploy the application developer's service. In this operation, it must also meet the constraints set by the latter in the service level agreement that relate to the legal issues [START_REF] Barnitzke | Legal Restraints and Security Requirements on Personal Data and Their Technical Implementation in Clouds[END_REF]. Furthermore, during operation, the IP may use external resources from other IPs in federated cloud scenarios, for various reasons such as cost minimization, risk management and avoidance of Service Level Agreement (SLA) failures due to overprovisioning. However, in that case the initial IP is assigned the role of assuring the legal aspects of data management by the federated resources. One of the most critical outcomes [START_REF]OPTIMIS Project Deliverable 7.2.1.1 Cloud Legal Guidelines[END_REF] is the determination of data location. The one who determines where the data are stored (in general this role is described as the Data Controller) is responsible in the end for meeting the legal requirements for data management manipulation. If the Data Controller decides to move the data to another provider, it must ensure that the proper agreements are in place prior to the federation. These agreements in the legal plane are summarized in the following cases:

-Binding Corporate Rules[7]: these refer to intra-company procedures (so in our case they apply to the case of a company located in Europe that wants to federate to its affiliate data center in e.g. Asia) for reassuring proper technical measures when it comes to data manipulation.

-Standard Contractual Clauses: these refer to inter-company agreements, with regard to how data are treated during the manipulation by the target federated provider. While these clauses have been formalized by the EU [14], their final form (that dictates the agreement between the home European IP and the target foreign IP) is subject to the agreement and/or possible modification from the involved IP parties.

-Intellectual Property rights: these refer to the ownership of the produced data from the utilization of a service offered by the IP.

The aforementioned documents (mainly the BCR and SCC) in order to be valid must be certified by the Data Protection Authority of the EU country of the originating (or home) IP. At the moment there is no automated way for performing the necessary legal checks so that the EU IP can on the fly check the legal compliance of the federated (external) IP. These checks may include the location of the federated IP, its security protocols and certifications, its main legal documents compatibility, such as the BCR, SCC and IPR declarations, with the EU law. If the target provider is located in the EU/EEA or the compatible countries [START_REF]Commission Decisions on the Adequacy of the Protection of Personal Data in Third Countries[END_REF], then the federation may be performed with minimal interventions. However if the IP is located in countries outside this list, then the federation cannot proceed if these legal checks are not in place. Thus it is limiting the applicability of the federated scenarios to providers from the "white list" or includes the need for manual bureaucratic procedures prior to the federation.

Other requirements include the security from data loss, which is mainly reflected in data replication or multi-site placement techniques, and data encryption both at rest and during transfer. However these aspects are generally met in current technical solutions anyhow, due to well-established and pre-existing non-functional requirements of IT systems.

The complete scenario of this process appears in Fig. 1. In the OPTIMIS case, with different roles in different scenarios, we can predict that this role will be spread around multiple levels (SPs, IPs, federated IPs). However the main responsible is regarded the IP, since it receives the legal constraints and must act according to them. The home IP located in the UK may select from a variety of providers located in the EU/EEA and compatible countries. However they cannot exploit offerings from third countries, before the legal documents are certified by the respective DPA of the originating EU country. This certification process depends on each DPA and in many cases needs manual submission of the legal texts and validation.

Cloud Provider Description Schema Structure

In order to mitigate this effect and be able to have increased flexibility with regard to federation decisions, a suitable declaration procedure must be in place in order to implement this legal framework. In our case, this was decided to be implemented through a suitable XML schema structure, namely the Cloud Provider Description Schema (CPDS), that an IP should complete with its own information and make public, in order to be used during the selection process. Then the SP (or the IP when it is acting as an SP in the federated scenario) at every interaction should request this information, in order to filter the ones that do not meet the requirements. The information that needs to be included in such a description is detailed in the following paragraphs.

As a first step, the IPs must implement a way of declaring the locations of their data centers in terms of country of establishment. This location information may be the most critical, but it is only a part of the information that may be exposed by an IP regarding either legal information or in general capabilities information that is not confidential. These data must be suitably formatted in a machine understandable way so that they can be automatically processed and taken under consideration during a provider selection/ranking. The variety of information may include legal information (location of data, terms of service, legal notices etc.), security information (supported protocols, security services etc.), ecological information (percentage of renewable energy used, energy management certifications), resource and data management support (in terms of SLA guarantees, affinity rules support, available setting of replication etc.).

Not all of the above information is necessary in the legal context, but it was decided to be also included in order to explore also other aspects of IP selection (e.g. ecoefficiency, which indirectly may be linked to legal obligations deriving from the Kyo-to Protocol [9]). The higher levels of this schema appear in Fig. 2. The top level of the structure is the IaaSProviderType. The main type consists of a number of elements of more elaborate types.. The main subtypes are the following Fig. 1. OPTIMIS federation scenario: the home IP located in the UK may automatically select from a variety of providers located in the EU/EEA and compatible countries but not third countries even if the target IP is compliant but not adequately certified

• LegalRequirementsType: this element must be defined by an IP (Fig. 3), in order for the SP to be able to validate the legal adequacy of the former. In detail, the provider needs to insert the legal descriptions that govern its policies with regard to the SCCs, the BCR and the IPR with regard to added value from the services. For these textual descriptions it has been foreseen that they will be certified by an independent third party authority with expertise in the legal aspects of cloud computing (either public or private sector, similar to Verisign certification for website security).

Another key characteristic refers to the ability of the provider to receive and fulfill requests regarding geographic location of service placement, which is another critical legal requirement, since the location of the data dictates the governing law. The security capabilities that are also critical from a legal point of view have been defined in the SecurityCapabilitiesType, given that they have also a strong technical aspect.

• SecurityCapabilitiesType: the provider must specify one element of this type, that contains information regarding its security features. These may include (Fig. 3) for example VPN support between the service VMs, Denial of Service attack detection capabilities, different authentication techniques (enumerated list with Boolean values that may be extended), encryption during data transfer or storage with a variety of strength options (bits used for the encryption) and/or a security certification by an external entity that has validated the security strategy of the company. This does not mean that the provider should publish the strategy itself, but just the ability, in order not to reveal sensitive information. Access control refers only to the IaaS level resources. In case of PaaS offerings, a similar field may be in the respective level.

• DataManagementType: the provider must specify one element of this type, that contains information regarding its data management features. These may include (Fig. 5) for example an element of DataReplicationType, stating the replication strategy of the provider for data redundancy. These features may include a maximum replication factor, a configurable replication factor capability according to the client demands or a multi-site placement feature, which can lead in more reliable data storage. This is mainly dictated by the legal requirement for protection against data loss [START_REF] Djemame | Legal issues in clouds: towards a risk inventory[END_REF].

Fig. 2. Overall Structure of CPDS •

GreenManagementType: the provider must specify at least one element of this type, that contains information regarding its green management features per data center. The provider may declare different capabilities per data center (Fig. 6), given that not all of its infrastructures may be subject to green management, for example be equipped with energy generation from renewable sources. The basic subtype (Fig. 7) is the DCEcoInfoType, which contains information per DC, regarding the location (country, area and ID), the available green certificates (enumerated type consisting of the various available certificates) and the percentage of renewable energy produced (possibly on an annual average basis). The available certificates (as in all certificate types) may be signed by a CertificateAuthorityType, which is a generic type consisting of the authority's name and digital signature.

• ResourceManagementType: the provider must specify one element of this type, that contains information regarding its resource provision features per data cen-ter. These may include the possibility to have affinity rules (a feature that leads to optimized placement of interacting VMs), elasticity rules (a feature that leads to better self management capabilities) and the type of SLA guarantees (e.g. minimum availability)

Fig. 3. Legal Requirements Type

Fig. 4. Security Capabilities Type •

DCLocations: this element is used by the provider to declare at least one location of their data centers. This information is also used at the SP level, for the SP to filter out non-eligible locations (legal requirement). This type may include for example different locations for each DC, others in legal locations and others not. The final selection may take this under consideration, given that providers APIs usually offer a way of specifying desired target locations.

Usage during runtime and selection

The XML description of a provider following the aforementioned template is offered in the OPTIMIS platform through a restful GET interface of the Data Manager [11] component (getCPdescription). The description can be retrieved by any interested party (e.g. SP in initial deployment or the home IP in a federated scenario). Then the content of the XML may be directly checked through the checkLegal method in the OPTIMIS platform. This method compares the published information with the user requirements coming from the OPTIMIS SLA instance (e.g. location of provider, encryption capability and strength, eco-efficiency etc.) and concludes if the specific provider is eligible for the specific service.

In order to ensure that the level of information is valid, each field that requires an external verification from a certification authority needs to be digitally signed by the specific entity. Furthermore, the XML description itself should also be digitally signed, so that the requester of the document (in our case the SP or the home IP) may validate the content of the description. Furthermore, the caller should also validate that the digital signatures internally in the XML refer to the same entity as the provider that declares these capabilities and that the text itself is not altered and it is the same as the one submitted offline for validation in the DPA. This process appears in Fig. 8 and is identical in concept to the validation process of websites through certification authorities such as Verisign etc. Identified Legal Gaps and Automation steps

Validation of arbitrary terms and conditions

Besides the improved selection of a provider based on this schema, the most important part is the legal section. In this, specific sections have been included like the BCR and SCC. These documents are arbitrary for each target company/provider and their conditions must be certified by the respective authority of each individual country (Data Protection Authority for the case of BCR and SCC) before a provider of this country federates to the target provider. This process is also manual in many countries, implying that before each federation decision for example, an employee of the home provider must go through a bureaucratic certification procedure of the target provider, bringing the text to the DPA and waiting for the resulting decision, that may be issued days afterwards. This of course creates an unrealistic legal framework for dynamic on the fly federation scenarios.

Automation step

Thus a necessary automation step is that an EU country's DPA should act also as a certification authority for external providers that wish to be included in such federation operations. The process of certifying that an external (to EU) provider's BCR, and SCC framework is compatible to EU law should be handled offline between the this provider and the DPA and the latter should then act as a digital certification authority (similar to Verisign) and digitally sign the textual descriptions. This key then may be included in the specific provider's CPDI (Cloud Provider Description Instance). A provider interested in using the specific target provider for federation may then acquire the description and key, validate the key's correctness and thus acknowledge automatically that this provider is certified with relation to its policies.

Variability of IPR strategies

The IPR strategies of each IP (or even at higher levels such as PaaS and SaaS) are determined by their strategy and potential exploitation/business schemes. However, for the SP and the end user this is a very significant issue, if it affects their own ex-ploitation or legal framework of operation, when choosing the Cloud provider. An example of this is the Google Docs Terms of Service, which specifies that: "When you upload or otherwise submit content to our Services, you give Google (and those we work with) a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our Services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our Services, and to develop new ones." [16].. This may be against an exploitation scheme by the end user (and document producer) that includes confidentiality (such as a product design/documentation) and/or royalties for the material (e.g. book). Given that the terms and conditions for using services is in many cases arbitrary and based on company policy, their compliance validation in an automated framework means that they must be somehow grouped in classes and categories.

Automation Step

The categorization of IPR policies in predefined classes and the standardization of the latter create a suitable framework for automating the compatibility process between an end user and the provider. This would in essence be similar to the licensing schemes for software (GPL, BSD, Apache etc. licenses) and could also be accompanied with a rule-based decision framework that may examine cases of different classes compatibility (like in the case of [START_REF] Barnitzke | Legal Restraints and Security Requirements on Personal Data and Their Technical Implementation in Clouds[END_REF] for licensing or even simpler approaches like an inter-license compatibility list) instead of strict "same class" comparison .

Conclusions

Dynamic business strategies (like Cloud federation, combination of private/public Clouds etc) that have emerged during the last years due to the technological breakthroughs in Cloud computing have created a number of issues with regard to the legal implications of data management for the application services.

In this paper, an effort to model these requirements in the form of a suitable description schema that the Cloud providers must complete and publish is portrayed, that may be used in an automated fashion during a legal check prior to the selection of a specific Cloud provider. The type of content regards information that normally is publicly available and/or can be found through relevant documentation. The content Towards this direction, relevant legal and procedural gaps have been identified and corrective actions have been proposed (DPAs as certification authorities, IPR classes standardization need) in order to mitigate this problem and thus enable the usage of Cloud computing even in cases that involve personal data manipulation in dynamic and complex federation scenarios. DPAs acting as CAs may seem difficult, however this is a standard practice when it comes to internet certification and security.

For the future, we aim at enriching the XML schema with more details (e.g. by incorporating it in existing modeling approaches covering functional characteristics of providers like PIM4CLOUD [START_REF] Brandtzg | Towards a Domain-Specic Language to Deploy Applications in the Clouds[END_REF]) but also extending the legal checks implementation with the digital signature validation process.

Fig. 5 .Fig. 6 .Fig. 7 .

 567 Fig. 5. Data Management Type

Fig. 8 .

 8 Fig. 8. Runtime Validation of An Infrastructure Provider's Description Schema

6

 6

ACKNOWLEDGEMENT

This work has been supported by the OPTIMIS project and has been partly funded by the European Commission's IST activity of the 7th Framework Programme under contract number 257115.


Antonios Gouglidis

Ioannis Mavridis
email: mavridis@uom.gr

A Methodology for the Development and Verification of Access Control Systems in Cloud Computing

Keywords: Security, Inter-organizational systems, Cloud business, Verification

Cloud computing is an emergent technology that has generated significant interest in the marketplace and is forecasted for high growth. Moreover, Cloud computing has a great impact on different type of users from individual consumers and businesses to small and medium size (SMBs) and enterprise businesses. Although there are many benefits to adopting Cloud computing, there are significant barriers to adoption, viz. security and privacy. In this paper, we focus on carefully planning security aspects regarding access control of Cloud computing solutions before implementing them and, furthermore, on ensuring they satisfy particular organizational security requirements. Specifically, we propose a methodology for the development of access control systems. The methodology is capable of utilizing existing security requirements engineering approaches for the definition and evaluation of access control models, and verification of access control systems against organizational security requirements using techniques that are based on formal methods. A proof of concept example is provided that demonstrates the application of the proposed methodology on Cloud computing systems.

Introduction

Cloud computing is an emergent technology that has generated significant interest in the marketplace and is forecasted for high growth. Specifically, Cloud computing is expected to be a significant growth driver in global IT spending. In fact, by 2013, about 82% of all net-new software firms coming to market will be operationalized on service based software versus a packaged product. By 2016, approximately 25% of all new business software purchases will be of service-enabled software. Software-as-a-Service (SaaS) delivery models will constitute about 14.9% of worldwide software spending across all primary markets and 18% of applications spending, according to IDC [START_REF] Mahowald | Market Analysis Perspective: Worldwide SaaS and Cloud Services, 2012 -New Models for Delivering Software[END_REF]. Furthermore, according to the latest research reports, the global computing market is expected to grow at a 30% CAGR reaching $270 billion in 2020 [START_REF] Media | Global Cloud Computing Market Forecast[END_REF]. Therefore, Cloud system should be carefully designed to be secure since otherwise, the existence of security flaws may lead to a decrement in income of an organization.

In this paper, we are concerned with the development of access control (AC) systems for distributed and collaborative systems, as Cloud systems. Since AC systems are highly complex and of great significance, their right definition, design and development are mandatory for the production of an AC system that corresponds to the initial requirements. To manage the increased complexity of AC systems, system engineering processes are applied. Nevertheless, generic approaches can be enhanced to facilitate the definition of access control requirements in Cloud environments as presented in [START_REF] Gouglidis | On the definition of access control requirements for grid and cloud computing systems[END_REF]. Additionally, a common stage in the development of a system is its verification, where a system can be verified for its correctness. Several papers have examined the automated verification of AC systems, and a number of techniques have been proposed to verify them as presented in [START_REF] Hansen | Conformance checking of RBAC policy and its implementation[END_REF], [START_REF] Jayaraman | Automatic error finding in access-control policies[END_REF], [START_REF] Vincent | Model checking for verification of mandatory access control models and properties[END_REF], and [START_REF] Fisler | Verification and change-impact analysis of access-control policies[END_REF].

The structure of the remainder of this paper is: Section 2 provides preliminary information regarding AC in the Cloud and systems engineering stages. Section 3 describes our proposed methodology. A use case is given in Section 4. Finally, we conclude this paper in Section 5.

Preliminaries

In this section we provide basic preliminary information regarding AC and its role in Cloud systems. Moreover, we briefly refer to two important stages met in any development approach, viz. requirements engineering and verification in the context of AC.

Access Control

AC in modern distributed systems has become even more challenging since they are complicated and require the collaboration among domains. A domain can be defined as a protected computing environment, consisted of users and resources under a same AC policy. AC is an essential process in all systems. The role of an AC system is to control and limit the actions or operations in a system that are performed by a user on a set of resources. Nevertheless, an AC system is considered of three abstractions of control, namely AC policies, AC models, and AC mechanisms. A policy can be defined as a high-level requirement that specifies how a user may access a specific resource and when. AC policies can be enforced in a system through an AC mechanism that is responsible for permitting or denying a user access upon a resource. An AC model can be defined as an abstract container of a collection of AC mechanism implementations, which are capable of preserving support for the reasoning of the system policies through a conceptual framework. Consequently, the AC model is capable of bridging the existing abstraction gap between the mechanism and the policy in a system [START_REF] Di Vimercati | Authorization and Access Control, in Security, Privacy, and Trust in Modern Data Management[END_REF], [START_REF] Ravi | Access Control: Principles and Practice[END_REF]. The Cloud is a fairly new and emergent technology and its definition is a topic for discussion in several research papers [START_REF] Foster | Cloud computing and grid computing 360-degree compared[END_REF]. Nevertheless, Cloud computing is defined in [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF] using five attributes viz. multitenancy, massive scalability, elasticity, pay as you go and self-provisioning of resources. These attributes successfully imprint the distinctive characteristics of the Cloud and differentiate it from similar technologies, as the Grid computing paradigm. Multitenancy refers to the business model implemented by the Cloud, where a single shared resource can be used from multiple users.

Massive scalability refers to the potential of the system to scale (i.e. increase or decrease) in resources. The on-demand and rapid increment or decrement of computing resources is translated as elasticity of the Cloud. Thus, more storage space or bandwidth can be allocated when required, and vice versa. Pay as you go is the process of paying for the resources that are used. Lastly, the users are provided with the ability to self-provision resources, namely storage space, processing power, network resources and so on. An additional characteristic defined in [START_REF] Mell | The NIST definition of cloud computing[END_REF] by the National Institute of Standards and Technology (NIST) is Broad Network Access, which states that available capabilities can be accessed using standard mechanisms over the network, and promote their use by heterogeneous clients.

The service model of Cloud computing is based on the SPI framework [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF], [START_REF] Mell | The NIST definition of cloud computing[END_REF]. SPI stands for Software-as-a-service (SaaS), Platform-as-a-service (PaaS) and Infrastructure-as-a-service (IaaS). Specifically, the SaaS provides software that is used under a business model, namely the usage-based pricing. The PaaS offers the platform for the development of the applications, and lastly, the IaaS handles the provision of the required hardware, software and equipment, in order to deliver a resource usagebased pricing model.

Moreover, the aforementioned service models are provided under three deployment models viz. public, private and hybrid Cloud [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF]. The public Cloud provision resources over the Internet and are accessible via a web application. A third-party operates as the host and performs all the required operations (e.g. management, security). The private Cloud provides the same functionality as the public deployment model within internal and private networks. This model requires the acquisition of the appropriate hardware and software. The hybrid model refers to the combination of the public and private deployment models. Usually, the latter model is used to keep sensitive data in the private network and deploy non-core applications to the public. An additional service model proposed by NIST is the community Cloud [START_REF] Mell | The NIST definition of cloud computing[END_REF], which refers to infrastructure exclusive used by a specific community of consumers from organizations that have shared concerns.

In Cloud systems, the main objective of AC is to grant authorized users the right to use a service, and at the same time to prevent access to non-authorized users. Similarly to the Grid paradigm, a Cloud AC policy can be defined as a Cloud security requirement that specifies how a user may access a specific resource and when. Such a policy can be enforced in a Cloud system through an AC mechanism, which is enforced by a Cloud Service Provider (CSP). The latter is responsible for granting or denying a user access upon a service. Therefore, AC in Cloud systems is similar to the Grid. The main difference is mostly subject of the service delivery model that is applied on the Cloud system (SaaS, PaaS, IaaS) [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF]. Hence, in the SaaS delivery model, the CSP is responsible for managing all aspects of the network, server and application infrastructure. In the PaaS delivery model, the customer is responsible for AC to the applications deployed in the PaaS platform. Lastly, in the IaaS delivery model, the customers are entirely responsible for managing all aspects of AC. In gen-eral, AC in the Cloud is not standardized across CSPs, and user AC to Cloud resources is generally weak because of coarse user access management [START_REF] Mather | Cloud Security and Privacy: An Enterprise Perspective on Risks and Compliance[END_REF].

Requirements Engineering

This section is intended as an overview of requirements engineering, which is being increasingly recognized as the most critical phase of the systems development process. If the requirements for a system are not right, there will inevitable be problems after the system is delivered. There are immense variations in what is generally understood as a requirement. The term requirement might be used to refer to statements that are clearly at totally different levels of detail. These variations in the statement of requirements arise because of the different ways requirements are used in different organizations. Therefore, a statement of a requirement can range from a high-level abstract statement of a service to be provided or of a system constraint to a detailed mathematical functional specification of a system component [START_REF] Sommerville | Requirements engineering: processes and techniques[END_REF].

Requirements can be identified into four types: Functional requirements, where define some functionality to be provided by the system (i.e. what the system will do). Non-functional requirements, where define some operational constraints on the behaviour of the system (i.e. how the system should behave). Design requirements, where define constraints on the system design or implementation. Process requirements, where define constraints on the system development process.

Although it is convenient to classify requirements into different classes, there is not really a strict distinction between these. Specifically, non-functional requirements at one level of abstraction are translated into more detailed functional requirements.

Regarding requirements there is a need for specifications at different levels of detail. The principal reason for this is that these different specifications are designed for different purposes and readers. Requirements definition or specifications can be classified into three types viz., user requirements definition, system requirements specification, and software or hardware specifications.

User requirements definition has to be understandable by potential end-users of the system and their managers as well as the developers of the system. The system requirements specification is a more detailed document that is usually part of the contract for the system. Lastly, software or hardware specifications include a detailed description that can serve as a basis for a design or implementation.

Figure 1 illustrates the activities of the requirements engineering process. Despite the fact that there is a clear division between process activities, in practice, the process is iterative with the activities interleaved and with very blurred boundaries between them. Specifically, analysis definitions and specification may be seen as a single activity. In more detail, the feasibility study activity is clearly related to the feasibility study activity that takes place during the conceptual design. Requirement analysis is the process of finding out the requirements and requirement's definitions are intended to be a high-level description of the system requirements. Lastly, system requirement's specifications define the requirements in detail as a basis for the contract for the system procurement and for the system developers.

System Verification

Verification is a critical process well separated from the previous stages of requirements engineering and system's design, and concerned with building the system right. Verification is used in the comparison of the initial conceptual system based on defined requirements to the computer representation that implements that conception. Specifically, it must ensure that the system does what it should, does it only the way it should and does not do what is should not do [START_REF] Baier | [END_REF].

The principal methods for the verification of complex systems are four [START_REF] Heljanko | Model Checking based Software Verification[END_REF]:

• Testing: Testing is performed on the system itself. However, testing of distributed systems is not always a cost effective process since it can be performed when an implementation of the system is available. Furthermore, it can only prove the existence of bugs, but not their absence. • Simulation: Simulation-based approaches ensure that a finite number of userdefined system trajectories meet the desired specification. Even though computationally inexpensive simulation is ubiquitous in system design, it suffers from completeness as it is impossible or impractical to test all system trajectories. Furthermore, simulation-based testing is semi-automatic since the user must provide a large number of test cases [START_REF] Girard | Verification using simulation[END_REF].

• Deductive verification: Deductive verification is based on manual mathematical proof of correctness of a model of a system. It is a very highly cost process and, furthermore, requires highly skilled personnel.

• Model checking: Model checking performs exhaustive testing of all behaviours of a model of the system. It is not vulnerable to the like-hood that an error is exposed; this contrasts with testing and simulation that are aimed at tracing the most probable defects. Additionally, it provides diagnostic information in case a property is invalidated, which is very useful for debugging purposes. In principle, model checking is an automated process and its use requires neither a high degree of user interaction nor complex test data [START_REF] Baier | [END_REF].

Proposed Methodology

In this section, we provide information regarding our proposed methodology for the development of AC systems. The methodology is independent of the applied development model of a system since the stages of requirements engineering and verifica-tion exist in most of them (e.g. sequential, spiral). Figure 2 illustrates the proposed methodology in a system development process that consists of the stages of requirements engineering, systems' design and verification. We propose for the stage of requirements engineering to apply the Conceptual Categorization (CC) [START_REF] Gouglidis | On the definition of access control requirements for grid and cloud computing systems[END_REF] and during verification to apply model checking techniques. CC is capable of tailoring the requirements engineering through a re-engineering process. Furthermore, CC operates as an input for the verification stage by defining security requirements. The security requirements are transformed into security properties in temporal logic (e.g. LTL, CTL). The set of defined security properties can be verified on the systems' transition system (TS) using model checking techniques.

In our proposed methodology, we are mostly concerned in performing security requirements engineering and verification of the system to be developed. Therefore, we are not concerned with other stages of the development process, as the design and implementation of the system. However, we depict in Figure 2 their interaction with our defined stages. Thus, the proposed stages can be used transparently in any development model without breaking it.

Access Control Requirements

Concerning the requirements engineering stage, we choose to apply the CC that is proposed in [START_REF] Gouglidis | On the definition of access control requirements for grid and cloud computing systems[END_REF], which is a layered approach for the definition and evaluation of security requirements for modern collaborative systems, as the Cloud. In brief, CC is based on four abstraction layers. These are the entropy, assets, management and logic layers. The differentiation from generic security engineering approaches is that, in CC, factors that affect the security of the systems are mainly considered in their categorization. CC is able to identify and group security requirements into discrete layers of different abstraction level. The abstraction level refers to the ability of a layer to identify requirements in different breadth and depth. The entropy layer identifies requirements from the dispersion of the objects in a system and the assets layer from the type of shared objects within the boundaries of the entropy layer. The next layer defines requirements from policy management and the logic layer incorporates requirements that are not handled by the former layers.

In addition to the simple, sequential development process, the CC approach can enhance and be used for tailoring the process of requirements engineering. This is required since in practice new requirements always emerge that inevitably leads to implementation changes. CC can be used for re-engineering existing systems. Therefore, it can be applied on old systems, which usually have a considerable amount of intelligence and experience encapsulated within them. Figure 3 depicts the basic steps that help to re-engineer existing systems using an evolutionary life cycle. The process can be seen as a spiral where cycling through the different processes leads to the desired outcome. Specifically, the evolutionary life cycle includes the definition of requirements in CC layers. In turn, an evaluation of the examined system is performed. This second process, checks the compliance of the already defined requirements. If expectations from the examined systems are low, then new requirements are identified and defined, which when applied will potentially lead to a new system. New requirements are redefined in CC layers and the process is repeated. This evolutionary life cycle helps for faults to be found more quickly and provides the opportunity to include updated technology, and at the same time it facilitates the whole process of delivering a fully functional system [START_REF] Stevens | Systems engineering: coping with complexity[END_REF].

System Verification

As presented in section 2.3, verification is a process of significant importance. Nevertheless, there are several approaches to perform it, each having its pros and cons. However, in our methodology we choose to apply a model checking technique to verify AC systems for reasons of automation, diagnostic information, integration in existing development cycles and its sound and mathematical underpinning. Model checking requires the definition of a system's model. These models are characterized as transition systems (TS) and are defined to describe their behaviour.

Formally, a TS is a tuple ( , , , , , )

S Act I AP L →

where [START_REF] Baier | [END_REF]:

• S is a set of states, • Act is a set of actions, • S Act S →⊆ ×
× is a transition relation,

• I S ⊆ is a set of initial states, • AP is a set of atomic propositions, and

• : 2 AP L S → is a labelling function.
We consider the TS to be a finite system. TS is called finite if S, Act and AP are finite. Additionally, given that Φ is a propositional logic formula then s S ∈ satisfies the formula Φ if the evaluation induced by L(s) makes the formula Φ true. After defining a TS, the model of the system can be verified against a number of security properties stated in the initial requirements definition stage. The majority of security requirements regarding AC can be expressed as security properties. Security ties are invariants that are given by a condition Φ for the states and requires that Φ holds for all reachable states [START_REF] Baier | [END_REF].

Use Case

In this section, we demonstrate the proposed methodology by recalling the application of CC on a generic Cloud environment to evaluate and enhance the Role-Based Access Control (RBAC) model [START_REF] Gouglidis | On the definition of access control requirements for grid and cloud computing systems[END_REF]. A new produced AC model entitled domRBAC [START_REF] Gouglidis | domRBAC: An access control model for modern collaborative systems[END_REF] is evaluated in the context of CC. Also, selected requirements were verified in domRBAC using a model checking approach by NIST. The operational environment is illustrated in Figure 4. The Cloud environment is composed of individually administered domains, which can dynamically join in or quit the collaboration. Users from the participating domains can request on demand usage of services. Specifically, the environment is composed of companies A and B, represented by domains A and B, respectively. An Application Service Provider (ASP) is a corporate organization that can share a number of pay-per-use services. A complementary entity provides a computational computing infrastructure (CCI). Users from companies A and B can request capabilities from their local domain, collaborate with other users, manage their data and request on demand the use of services. The application of CC concludes to the following [START_REF] Gouglidis | On the definition of access control requirements for grid and cloud computing systems[END_REF]:

Entropy requirements: The virtual distribution level of the system is low since there is only one formatted organization. The geographic distribution level that depends on the number of the participating domains can be high and entails heterogeneity issues. In order for the AC system to limit access to participating objects, it must be able to successfully authenticate them since domains might make use of different authentication protocols. Furthermore, since the organization's formation is not static, the AC system must continually observe all kinds of modifications. Assets requirements: AC must be enforced on different types of assets. The scenario considers fine-grained AC on data since it requires sending for computation only segments of users' data. The ASP provides a number of services and the CCI a number of hardware resources. AC for both service and hardware level can be characterized as coarse-grained. The AC system must be able to enforce fine-grained AC on data and coarse-grained on services and hardware resources, respectively.

Management requirements: A number of services uses segments of users' data and submits them at the CCI. This requires a delegation mechanism. Thus, the AC system must be able to support delegation of access rights from domain users to the ASP and CCI. A security issue is that of delegated rights revocation. We assume that delegated rights must be revoked after the completion of a job or on demand by the user. The former requirement demands from the AC system an automation level and the latter to apply changes dynamically. Furthermore, trust relationships must exist between the involving parties. Furthermore, policy conflict resolution must also be examined when composite services exist.

Logic requirements: During user collaboration, their access at the CCI might be restricted by the owner of the resource. This requires an AC system that should support dynamic collaborations. Furthermore, support of stateful sessions because of long lived transactions and decomposition of composed services are required.

Based on the aforementioned requirements, we further proceed with the evaluation of the RBAC model in the context of CC. RBAC handles better centralized architectures where participants are known a priori. Additionally, RBAC is rather coarsegrained approach when it comes to assets definition. Assets, in RBAC, are grouped under roles and to become more granular, the assignments must be split into more. However, the use of context variables in known RBAC variations [START_REF] Tolone | Access control in collaborative systems[END_REF] overcomes such limitations. Delegation of rights and trust relationships are supported, and policy conflict resolution can be tackled in RBAC. Revocation of user assignments, hierarchies and temporal constraints are some of RBAC's. However, RBAC cannot support interactive environments, and also lacks an obligation mechanism, which usually corresponds to business requirements. Therefore, after evaluating RBAC, we proceeded with the design of a new access control model entitled domRBAC [START_REF] Gouglidis | domRBAC: An access control model for modern collaborative systems[END_REF] that is suitable for modern collaborative environments. Table 1 illustrates the evaluation of domRBAC compared to RBAC, where it is shown that domRBAC strengthens the RBAC approach in all layers. Specifically, the features in domRBAC that strengthens RBAC are: i) In entropy layer, domRBAC is capable of supporting secure inter-operation and has the ability to scale well. ii) In assets layer, we identify that domRBAC is able to support basic usage control and therefore usage restrictions can be introduced. Moreover, it is possible to define resources that are being shared by multiple stakeholders. iii) In management layer, using a small administrative overhead it is able to automate the management of policies in an easy and efficient way. iv) In logic layer, domRBAC strengthens RBAC since it provides features such as autonomy and security.

We further refer to the verification technique for the requirements of autonomy and security, which are identified in the logic layer of CC and supported in domRBAC. Secure inter-operation in collaborative systems is required for secure collaboration among participating parties such that the principles of autonomy and security can be guaranteed [START_REF] Gong | Computational issues in secure interoperation[END_REF]. The principle of autonomy states that if an access is permitted by an individual system, it must also be permitted under secure inter-operation. The principle of security states that if an access is denied by an individual system, it must also be denied under secure inter-operation. Both principles can be characterized as security properties of a system, which should be preserved during collaborations since their enforcement means that something bad never happens [START_REF] Baier | [END_REF].

For the verification of secure inter-operation properties, we applied the technique proposed in [START_REF] Hu | Property verification for generic access control models[END_REF], which focuses on the verification of generic properties for AC models. The technique is able to cope with various types of AC properties including static, dynamic and historical. It also supports the generation of test cases to check the conformance between models and policy rules through combinatorial test array [START_REF] Kuhn | Practical combinatorial testing: Beyond pairwise[END_REF], and optionally generate the verified AC policies in eXtensible Access Control Markup Language (XACML) version 2.0 or 3.0, which is becoming the de facto language for the specification of policy rules in modern collaborative systems such as the Cloud. We adopt the finite state machine to describe the transitions of the authorization states, and the usage of static constraints so to adequately cover the verification of secure inter-operation properties in RBAC. The technique is to verify specified AC properties against AC models using a black-box model checking method [START_REF] Vincent | Model checking for verification of mandatory access control models and properties[END_REF]. An implementation --Access Control Policy Tool (ACPT) [START_REF] Hwang | ACPT: A tool for modeling and verifying access control policies[END_REF] is developed by NIST Computer Security Division in corporation of North Carolina State University.

ACPT provides graphical user interface templates for composing AC policies and properties. Checking for conformance of AC properties and models is through the SMV (Symbolic Model Verification) model checker. In addition, ACPT provides a complete test suite generated by NIST's combinatorial testing tool ACTS [START_REF] Kuhn | Practical combinatorial testing: Beyond pairwise[END_REF] and an XACML policy output for the verified model. Through these four major functions, ACPT performs syntactic and semantic verifications as well as the interfacing for composing and combining AC policies. ACPT assures the efficiency of specified AC policies, and detects policy faults that leak or prohibit legitimate access privileges.

Conclusions

In this paper, we proposed a methodology for the development and verification of AC systems. The development stage is based on CC and the verification stage on a sound and mathematical underpinning technique (i.e. model checking). The latter is feasible via the definition of the system's TS and security properties, which have to be verified. The proposed methodology can be applied on any existing development process since it does not break the development model. Through an example, we demonstrated the proposed methodology, which resulted in a critique of existing AC approaches in [START_REF] Gouglidis | On the definition of access control requirements for grid and cloud computing systems[END_REF] and the development of a new AC model for collaborative systems (e.g. Cloud environments) in [START_REF] Gouglidis | domRBAC: An access control model for modern collaborative systems[END_REF]. Furthermore, we referred to the application of a model checking approach proposed by NIST, which resulted in the verification of the principles of security and autonomy in our defined AC model.

Fig. 1 .

 1 Fig. 1. Requirements engineering process.

Fig. 2 .

 2 Fig. 2. System development process.

Fig. 3 .

 3 Fig. 3. Re-engineering in Conceptual Categorization

Fig. 4 .

 4 Fig. 4. Operational environment.

Table 1

 1 summarizes the evaluation of RBAC in the context of CC based on[START_REF] Gouglidis | On the definition of access control requirements for grid and cloud computing systems[END_REF].

	AC		CC Layers
	Model	Entropy	Assets	Management	Logic
	RBAC	Low / Medium Low / Medium Medium / High	Medium
	domRBAC	High	Medium	High	Medium/ High

Table 1 . Comparison of AC models.

 1

Acknowledgement

This work has been (partially) funded by the Research Committee of the University of Macedonia, Greece.


Ruey Komulainen

Waqar Nadeem
email: waqar.nadeem@oulu.fi

Saara Satokangas
email: saarasat@mail.student.oulu.fi

Jari Salo
email: jari.salo@oulu.fi

Martti Ahtisaari

Rewarding In-Game Banner Ad Clicks with Tangible Incentives

Keywords: Mobile Advertising, Game Advertising, Ad Clicks, Rewards, Tangible Incentives

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Mobile technology has increased the possibilities to reach and serve consumers in multiple ways anytime, anywhere relatively easily and cheaply in a highly targeted, interactive way [START_REF] Persaud | Innovative mobile marketing via smartphones: Are consumers ready?[END_REF], [START_REF] Salo | Digital Advertising in Mobile Games: A Conceptualization and Description of Mobile In-Game Advertising[END_REF]. The increasing popularity of mobile gaming [START_REF] Newzoo | Mobile Games Trend Report[END_REF] has enhanced the appeal of using mobile games as a marketing medium which requires more attention from researchers as well as practitioners. Growth in mobile gamers was 35% year-on-year in US totaling 100 million, whilst in EU the growth was 15% year on year totaling 70 million calculated based on five countries including Finland in 2012 [START_REF] Newzoo | Mobile Games Trend Report[END_REF]. Engaging nature of games, and long exposure to the advertisements are seen as major benefits of advertising through games compared to traditional media [START_REF] Chaney | The Effect of Billboards within the Gaming Environment[END_REF], [START_REF] Nelson | Advertainment of Adcreep Game Players' Attitudes Toward Advertising and Product Placements in Compuet Games[END_REF], [START_REF] Salo | TOWARDS A NEW RESEARCH AGENDA[END_REF], [START_REF] Wise | Enjoyment of Advergames and Brand Attitudes: The Impact of Thematic Relevance[END_REF]. According to [START_REF] Newzoo | Mobile Games Trend Report[END_REF], gaming took 13% of all time spent on games worldwide, totaling more than 130 million hours a day and 9% total money spent on games, grossing USD 5.8 billion. According to [START_REF] Nielsen | [END_REF], the usage of mobile web has been growing massively in the past years. Almost half of under 45-year-olds use internet weekly on their mobile phones outside their homes [START_REF]Official Statistics of Finland : Two-thirds of Finns are online shoppers[END_REF]. In short, mobile games offer a pertinent way to reach and engage with consumers, especially young adults [START_REF]Official Statistics of Finland :Televisio ylitti miljardin euron rajanennakkotiedot joukkoviestintämarkkinoista 2011[END_REF].

The research in mobile marketing itself is still in its early stages [START_REF] Persaud | Innovative mobile marketing via smartphones: Are consumers ready?[END_REF], and there is even less research on mobile games as an advertising medium. The literature on mobile in-game advertising is at embryonic stage. Hence, the literature on mobile ingame advertising effectiveness is very scarce although there are researches on mobile advertising effectiveness in other formats such as text messages [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF], [START_REF] Barnes | Mobile marketing: the role of permission and acceptance[END_REF]. As such, this research aims to close part of this observed gap by studying the consumers' attitudes towards mobile in-game banner advertising as an advertising format and how effective is location-based reward incentives affects the game players' attitude towards banner advertisements and what are their intentions to take action in the mobile game context. This research reviews existing literature which is used to build the theoretical framework. Afterwards, methodology and the empirical analysis are presented. Finally, the results are discussed, including the limitations of the existing research along with discussion and conclusion

2

Literature Review

In-games advertising (IGA) refers to the incorporation of brands into existing games [START_REF] Yang | The Effectiveness of "in-Game" Advertising: Comparing College Students' Explicit and Implicit Memory for Brand Names[END_REF]. Mobile advertising itself, is not a new innovation but the formats of doing mobile advertising keep evolving at a fast pace. Before the wide adoption of smart phones, PDAs and tablets, SMS and MMS messaging were the primary advertising formats in the mobile medium [START_REF] Barnes | Mobile marketing: the role of permission and acceptance[END_REF], [START_REF] Persaud | Innovative mobile marketing via smartphones: Are consumers ready?[END_REF], [START_REF] Xu | The Influence of Personalization in Affecting Consumer Attitudes Toward Mobile Advertising in China[END_REF]. Much of the research on acceptance and attitudes towards mobile marketing is made based on the basic mobile phone [START_REF] Persaud | Innovative mobile marketing via smartphones: Are consumers ready?[END_REF]. Previous studies look at acceptance of different messaging formats, when the advertiser sends either a solicited or unsolicited message to a consumer [START_REF] Barnes | Mobile marketing: the role of permission and acceptance[END_REF], [START_REF] Choi | Customer Satisfaction Factors of Mobile Commerce in Korea[END_REF], [START_REF] Gao | Perception of Interactivity: Affects of Four Key Variables in Mobile Advertising[END_REF], [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF], [START_REF] Xu | The Influence of Personalization in Affecting Consumer Attitudes Toward Mobile Advertising in China[END_REF]. However, today high-tech mobile devices along with new mobile technologies provide increasingly multisided medium with various m-commerce, marketing and advertising possibilities [19], [START_REF] Persaud | Innovative mobile marketing via smartphones: Are consumers ready?[END_REF]. There is now a wide range of formats that are unique to the mobile medium such as location-based advertising, display advertising inside different mobile applications and mobile coupons [START_REF] Persaud | Innovative mobile marketing via smartphones: Are consumers ready?[END_REF]. This is why further research is needed on how consumers perceive them.

2.1

Attitudes towards advertising in different media

As banner advertisements are widely used in internet advertising, there is quite significant amount of research looking at the effectiveness and consumers' attitudes towards them. [START_REF] Burns | The function of format: Consumer Responses to Six On-line Advertising Formats[END_REF] states that consumers perceived banner advertisements more favorably than other online ad formats because they perceived banners as less intrusive ad formats. On the contrary, [START_REF] Cho | Why Do People Avoid Advertising on the Internet[END_REF] identifies past negative experience with banners causes people to avoid the source in the future. The phenomenon is sometimes referred as "banner blindness" [START_REF] Cho | Why Do People Avoid Advertising on the Internet[END_REF]. Also, [START_REF] Rosenkrans | Maximizing User Interactivity through Banner Ad Design[END_REF] states that consumers are often engaged in selective perception resulting in limited information exposure. However, in mobile games context, the screen size is relatively small and the game players are engaged in gaming activities, thusly, the attitude towards banner format is unclear.

Due to the advanced technology and wide adoption of mobile devices, mobile medium provides new possibilities for delivering up-to-date, relevant, customized data easily and inexpensively. However, this does not mean that consumers want to receive it. Mobile devices are seen as highly personal and intimate devices, and advertisements send without permission are easily seen intrusive and annoying, [START_REF] Dickinger | Coupons going wireless: Determinants of consumer intentions to redeem mobile coupons[END_REF], [START_REF] Gao | Factors Influencing Chinese Youth Consumers' Acceptance of Mobile Marketing[END_REF], [START_REF] Persaud | Innovative mobile marketing via smartphones: Are consumers ready?[END_REF], [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF]. When permission is given, the consumer attitudes are more positive than with advertising without permission [START_REF] Altuna | Understanding Consumer Attitudes Toward Mobile Advertising and Its Impact on Consumers' Behavioral Intentions: A Cross-Market Comparison of Unites States and Turkish Consumers[END_REF], [START_REF] Barutçu | Attitudes towards mobile marketing tools: A study of Turkish consumers[END_REF], [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF]. In this research, the permission is acquired when the gamer plays the game. However, a gamer's primary concern is to 'play a game', not to receive advertisements. Similarly, consumers involuntarily face banner advertisements when they go on a website to perform other tasks [START_REF] Cho | The Effectiveness of Banner Advertisements: Involvement and Click-through[END_REF].

Moreover, in-game advertisements are seen as positive, but these positive attitudes are generated only when some relatively strict conditions are filled/ satisfied. According to earlier studies, the in-game advertisements usually have to be congruent with the game theme to be seen positively [START_REF] Huang | The Effectiveness of In-Game Advertising: The Impacts of Ad Type and Game/Ad Relevance[END_REF], [START_REF] Lee | Effects of Product Placement in On-Line Games on Brand Memory: A Perspective of the Limited-Capacity Model of Attention[END_REF], [START_REF] Tangmanee | Product Placement in Online Games: An Exploration into Thai Gamers' Attitude[END_REF]. [START_REF] Lee | Effects of Product Placement in On-Line Games on Brand Memory: A Perspective of the Limited-Capacity Model of Attention[END_REF] states that incongruent advertisements have been perceived as "odd", "surprising", "inappropriate" and "confusing". Even if these conditions are met, the advertisements are not been perceived positively by everyone. Also, game players' comments noted that the world is already filled with commercials and hoped that their game-world would be left alone [START_REF] Nelson | Advertainment of Adcreep Game Players' Attitudes Toward Advertising and Product Placements in Compuet Games[END_REF]. Due to banner advertisements rather disconnected nature, they thus might be seen negatively. As such, we hypothesized that: H1: Attitudes of game players towards banner advertisements in mobile games are negative.

Incentives

For the purpose of this research, mobile coupons refer to digital coupons on a mobile device such as a mobile phone, smart phone, or personal digital assistant. People carry their mobile phones almost always with them, along with the mobile coupons [START_REF] Dickinger | Coupons going wireless: Determinants of consumer intentions to redeem mobile coupons[END_REF]. This medium also reduces costs to businesses related to database creation and maintenance, printing, physical distribution, measurement and tracking. Digital coupons have amplified outreach allowing businesses to obtain immediate quantitative information, thus enable to adapt target their consumers' preferences quickly [START_REF] Jung | Online vs. Offline Coupon Redemption Behaviors[END_REF]. Promotional offers, such as discount coupons, free samples or lucky draws, have been used

to enhance consumer attitudes towards mobile marketing, and to increase the effectiveness and acceptance of mobile marketing [START_REF] Altuna | Understanding Consumer Attitudes Toward Mobile Advertising and Its Impact on Consumers' Behavioral Intentions: A Cross-Market Comparison of Unites States and Turkish Consumers[END_REF], [START_REF] Barutçu | Attitudes towards mobile marketing tools: A study of Turkish consumers[END_REF], [START_REF] Choi | Customer Satisfaction Factors of Mobile Commerce in Korea[END_REF], [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF]. Thus, they could be used to enhance the effectiveness of mobile in-game banner advertising as well.

Interactive properties of games can also be applied to game playing such that gamers can make choices or get rewarded through involvement with the brand [START_REF] Kureshi | Indian gamers' recall, recognition and perceptions of in-game placements[END_REF]. [START_REF] Gao | Factors Influencing Chinese Youth Consumers' Acceptance of Mobile Marketing[END_REF] studies rewards based on gamer's participation in the game play as well as achievements in the game. They found that when consumers are voluntarily connected to the campaign via the offered prizes, it will lead to more responses and more affective attitude toward the brand and the company. Similarly, the positive feeling of challenge and accomplishing a goal may be transferrable to a real life brand. Rewarding consumers for their achievements is not only beneficial in terms of increased redeeming of company's offers, but it might translate into increased amount of playing. The overall high interest in mobile coupons, the even higher interest in mobile coupons as rewards in the game and the extending exposure time to advertisements; all are advantages of this new promotion format [START_REF] Chang | Online In-game Advertising Effect: Examining the Influence of a Match Between Games and Advertising[END_REF], [START_REF]Company web pages[END_REF], [START_REF]Marketing Weekly News : Kiip; New Consumer-Facing Kiip App Makes Storing and Redeeming Kiip Rewards Easier Than Ever[END_REF], [START_REF] Inc | Company web pages[END_REF], [START_REF] Wise | Enjoyment of Advergames and Brand Attitudes: The Impact of Thematic Relevance[END_REF].

2.3

Factors affecting effectiveness of incentives

Location based incentives

Location-based mobile services are services in which the location of a person or an object is used to determine the application or service [START_REF] Barutçu | Attitudes towards mobile marketing tools: A study of Turkish consumers[END_REF]. Location-based mobile services include mobile marketing based on consumer's location [START_REF] Unni | Perceived Effectiveness of Push vs. Pull Mobile Location-Based Advertising[END_REF]. Commercial and promotional messages are not the only thing that can be tied to the location of the mobile device but also the game playing. Integrating player's location into the game experience is one factor that makes mobile games special compared to traditional video games [START_REF]Mobile Gaming: Casual Games Sector Report[END_REF]. Similarly, integrating player's location into the in-game advertising could make mobile IGA special compared to traditional IGA as well.

However, the very idea that game players can be tracked creates sense of loss of privacy [START_REF] Unni | Perceived Effectiveness of Push vs. Pull Mobile Location-Based Advertising[END_REF]. In Finland, the consumers seem to somewhat perceive the benefits greater than the possible negative effects. According to a study reported by [19], in the EU area, 48% of smart phone users are interested in location-based vouchers. And the same number for Finland is 57%. This shows that there is an interest in new marketing innovations such as location-based promotions which has been enabled by advanced technology.

Redemption options for mobile coupons

There are few options for companies to organize the actual redemption of the incentives offered within mobile games. The first one presented here is when consumers store the coupon on their mobile device and show it at the cashier to the store clerk [START_REF]Mobile Marketing Association :Mobile Coupons Gaining Wider Acceptance Across Age Groups And Geography (Cellfire)[END_REF]. The other ways could be through e-commerce or m-commerce. It is important to know how consumers perceive these different options, so that marketers can plan their mobile incentive redemption taking consumer preferences into account.

[12] study shows that redemption effort is the main determinant of attitude towards mobile coupons where consumers are concerned about the complication and cost to redeem such coupons. When looking at mobile games, the players are familiar with the technology. Thus the fear of technological difficulty might not be as severe in this context.

Redemption can also be done via online computer or mobile webstore. According to a report issued in November 2012 by [START_REF]Official Statistics of Finland : Two-thirds of Finns are online shoppers[END_REF] already two thirds of the Finnish people had purchased something online during the past year and the number has been steadily rising. Consumers are thus already relatively comfortable buying online. Again, young adults are the main age group who has adopted this behavior [START_REF]Flurry Analytics : Mobile Freemium Games: Gen Y Plays, but X Pays[END_REF]. However, there are no conclusive answers from earlier studies in mobile context, thus our next set of hypotheses are:

H2a: Tangible rewards in physical world affect mobile gamers' attitude towards mobile IGBAs.

H2b: Flexible reward schemes affect mobile gamers' attitude towards mobile IGBAs.

H2c: Location based rewards affect mobile gamers' attitude towards mobile IGBAs.

Research Framework

Based on the existing literature about attitudes toward advertising and consumer behavior models, a research framework is constructed using the Theory of Reasoned Action (TRA) proposed by Fishbein and Ajzen in early 1970s. There are three major constructs -Attitude, intention and behavior. The model describes the relations between attitude and behavior by linking individual beliefs, attitudes, intentions and behavior. Attitude toward the behavior is defined as the individual's positive or negative feelings about performing a behavior. It is an assessment of one's beliefs regarding the consequences arising from a behavior [START_REF] Fishbein | Belief, attitude, intention and behavior: An introduction to theory and research[END_REF]. This model has been used quite widely in previous studies to explain the advertising effectiveness for other formats [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF], [START_REF] Ducoffe | Advertising value and advertising on the Web[END_REF], [START_REF] Altuna | Understanding Consumer Attitudes Toward Mobile Advertising and Its Impact on Consumers' Behavioral Intentions: A Cross-Market Comparison of Unites States and Turkish Consumers[END_REF], [START_REF] Choi | Customer Satisfaction Factors of Mobile Commerce in Korea[END_REF].

Fig. 1. Conceptual Framework: Adapted from [START_REF] Fishbein | Belief, attitude, intention and behavior: An introduction to theory and research[END_REF] and [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF] 4 Methodology

This research is conducted with quantitative methods, which is typical for a deductive approach [START_REF] Bryman | Business Research Methods[END_REF] employed here. The data gathering in quantitative social studies is done from a group people who represent a certain population via a questionnaire designed for the purpose [START_REF] Bryman | Business Research Methods[END_REF]. Questionnaires are used to ensure an orderly and structured approach to data gathering [START_REF] Mcdaniel | Marketing Research[END_REF]. Thus, in this research the data were collected using an online questionnaire and analyzed with SPSS programs.

Attitudes and intentions towards advertisements have already been widely researched, the survey questions in this area were formulated based on the earlier research. There are valid measures for attitudes and intentions in both online and mobile advertising [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF], [START_REF] Ducoffe | Advertising value and advertising on the Web[END_REF], [START_REF] Altuna | Understanding Consumer Attitudes Toward Mobile Advertising and Its Impact on Consumers' Behavioral Intentions: A Cross-Market Comparison of Unites States and Turkish Consumers[END_REF], [START_REF] Choi | Customer Satisfaction Factors of Mobile Commerce in Korea[END_REF]. The questions regarding mobile game specificfactors and features of incentive systems were self-formulated basis on the earlier research [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF], [START_REF] Tangmanee | Product Placement in Online Games: An Exploration into Thai Gamers' Attitude[END_REF] and [START_REF] Dickinger | Coupons going wireless: Determinants of consumer intentions to redeem mobile coupons[END_REF] as well as the interview data.

The survey consisted of a total of 18 questions for those who play mobile games and who had noticed banner advertising in them. A screenshot of a banner ad in mobile game was displayed when asked if the respondents notice similar type of ad when they play mobile games to ensure the respondents' full apprehension of research topic. The questions were mainly closed multiple choice questions but also multiple choice questions with an optional open-ended space were provided to gain more explicit information on how consumers view this new advertising medium [START_REF] Bryman | Business Research Methods[END_REF]. The questions were measured on a Likert scale from 1 to 7 where 1 as 'Strongly Disagree' and 7 as 'Strongly Agree'

Of the different sampling techniques, convenience sampling was incorporated to gather the data for this study. This method is very common in the field of business and management and more prominent than samples gathered based on probability sampling [START_REF] Bryman | Business Research Methods[END_REF]. Although convenience sampling was employed in this research, some procedures were done to ensure the representativeness of the sample and thus reliability of the results. Firstly, the questionnaire was sent mainly to university students, who are mainly of the right age group considering mobile game playing. They also have relatively high skills in English in consideration that the electronic survey is written in English. Secondly, the questionnaire was run by thesis supervisors, coresearchers and piloted with few university students to ensure that respondents understood the questions correctly. This resulted in revision of some parts of the language used. Thirdly, the questionnaire included watershed questions regarding game playing and noticing of the advertisements, to get the opinions of those who play mobile games as well as see the advertisements. In a similar manner, those who had never seen advertisements in mobile games were directed to the questions regarding attitude and intentions if they were to see one. Therefore the responses used in the analysis are from people who play mobile games and have encountered advertisements in this medium.

The survey was conducted in October 2012 through researchers' Facebook pages, Master's thesis group on the internet, via e-mails to all student members of Finanssi, the history, geography and language students in the University of Oulu, students in Oulun Lyseo high school; students from Finnish degree programs and staff in the Kajaani University of Applied Sciences. An incentive was used to increase the response rate: lucky draw of gift cards to S-group stores (one of the biggest retailers in Finland). The survey generated 497 responses in total. After removing incomplete responses and excluding responses from non-Finnish origins, the final sample consists of 426 unique responses.

5

Data Analysis and Findings

Reliability Analysis

Before reporting findings, we present here the evidence that the data collected are of acceptable quality. Table 1 displays the reliability statistics of each construct. These statistics reveal that Cronbach's alpha of all the variables is over 60%. There are total 26 items and alpha for overall scale is 0.700. This value meets the threshold of 0.700, indicating the acceptable reliability of these scales [START_REF] Nunally | Psychometric theory[END_REF].

Demographics of Finnish Mobile Gamers

In this survey, there are 63% male respondents and 37% female respondents. 58.4% of the male respondents and 72% of the female respondents play mobile games. This suggests that there may be more females than males playing mobile games. 75.8% of the respondents are 20 to 29 years of age, which is the right age group for our research context. 61.5% of our respondents are earning between 201 to 1000 euros. Unlike earlier research [START_REF] Tangmanee | Product Placement in Online Games: An Exploration into Thai Gamers' Attitude[END_REF] where the gamers spend 2-9 hours a day playing video games, our respondents in mobile games play short sessions. Majority of them (76.7%) plays between 1-15 minutes per session and the main reason for playing mobile game is to kill time while waiting for something to happen. Table 2 provides the summary of regression analysis the rewards affecting the attitude of the respondents to mobile IGBA's. The results exhibit the substantial contribution of independent variable to the dependent variable (R -Square = .069 and Fvalue = 11.941). In addition to this the model is also significant (P < 0.05). Individually, the impact of each variable, on dependent variable, is significant (P < 0.05). Hypothesis 2, 3 and 4 states the positive influence of rewards on the attitude. It is also evident from the overall impact of rewards/ incentives (including Tangible, Flexible and Location Based Rewards) results as it is having positive influence (0.262) on the dependent variable (Attitude). This means, individuals who are more interested in rewards tend to show a positive attitude towards the IGBAs. As seen from Table 3, the individual variables tangible rewards, flexible rewards, and location-based rewards show that their impact tends to be positive on the attitude of the mobile gamers to receive IGBA's having regression coefficient 0.079, 0.033 and 0.062 respectively. In table 4 our hypothesis in present study hypothesized the impact of attitude on the intentions of the gamers as consumers. It is also evident form the regression analysis of the present study that attitude affects the intention positively (0.290) and significantly. Table 5 portrays the descriptive statistic of the seventeen dimensions of Attitude towards In-Game Advertising in terms of mean and standard deviation with a view to answer Hypothesis 1 which states that game players attitude toward banner advertisements in mobile games are generally negative. The findings show that most influencing factor of the negative attitude towards in-game banner advertising (IGBAs) tends to be with the mean of 5.54 "IGBAs are irritating in games that require deep concentration" followed by "I feel IGBAs are irritating". Specifically the results in the Table 5 demonstrate that our hypothesis that suggests that the mean values of majority of the questions asked for the attitude reveal that, the attitude is generally negative towards IGBAs. The IGBA doesn't seem to be quite entreating for the respondents with the mean value of 1.92. Almost, all the means signify a value less than 5 except the reverse coded questions; which reveal that the attitude towards the ad is generally negative. Overall results suggest that mainstream of respondents are irritated with the IGBA.

Conclusion and Discussion

The main aim of this research is to study the consumers' attitudes towards mobile ingame banner advertising as an advertising format, and whether reward incentives affects the game players' attitude towards banner advertisements (IGBAs) and consequent action in the mobile game context. Our research questions are answered via four-folded ways:

1. The attitude of game players to IGBAs in mobile game is observed to be generally negative 2. The most influencing negative factors being irritations and annoyances caused by IGBAs on mobile games that require deep concentration. 3. Incentives in form of tangible, flexible and location based rewards have positive and significant impact on gamers' attitude towards IGBAs 4. Positive attitude towards IGBAs increase their behavioral intention to click or redeem the rewards.

The research also confirms that there is positive influence of rewards on the attitude as evident from the results showing a positive influence (0.262) on the dependent variable (Attitude). This means, individuals who are more interested in rewards tend to show a positive attitude towards the IGBAs. The research results also show that attitude affects the intention positively (0.290) and significantly. Also, the results show that tangible and flexible reward scheme with a link to location based rewards where mobile gamers can redeem physically by converting the points achieved from their game play, is effective to positively affect their attitudes and intention to take actions.

Theoretically, this study deepens and enriches our understanding of Finnish mobile game players' attitude towards IGBAs and the consequent actions. Practically, our research provides valuable suggestions to marketers and business managers to help them reduce uncertainty when building a marketing plan targeting Finnish mobile gamers. This research helps them gain more knowledge about their demographic profiles as a consumer -young adults earning some amount of income and they play mobile games to kill time. It is evident from our analysis that the mobile gamers' attitude towards IGBAs is negative. However, there is positive impact of incentives to their behavioral intention that ultimately increase the likelihood to click on IGBAs. The individual variables -tangible, flexible and location-based rewards have shown positive influence to the gamers' attitude towards IGBAs thus increasing their behavioral intention positively and significantly. In other words, they are motivated by mobile coupons with a flexible scheme where they can use in stores nearby. The results from this study are in accordance to previous researches regarding attitudes of consumers to advertising [START_REF] Tsang | Consumer Attitudes Toward Mobile Advertising: An Empirical Study[END_REF], [START_REF] Cho | Why Do People Avoid Advertising on the Internet[END_REF], [START_REF] Gao | Perception of Interactivity: Affects of Four Key Variables in Mobile Advertising[END_REF] and the factors affecting effectiveness of incentives [START_REF] Unni | Perceived Effectiveness of Push vs. Pull Mobile Location-Based Advertising[END_REF], [START_REF] Barutçu | Attitudes towards mobile marketing tools: A study of Turkish consumers[END_REF], [START_REF] Dickinger | Coupons going wireless: Determinants of consumer intentions to redeem mobile coupons[END_REF].

While the results have contributed to the body of knowledge about mobile gamers in Finland, we are unable to discuss similar implications to non-Finnish mobile gamers. Consequently, we propose that other researchers should undertake similar study in other countries. Secondly, the research results point to the positive impact of flexible, tangible and location-based rewards to mobile gamers' attitude towards IGBAs, thus it is important that future research follow through deeper understanding of the type of consumer products and services that are most suited for such reward schemes.

Table 1 .

 1 Reliability of Instruments

	Variable	Items	Cronbach Alpha
	Tangible Rewards	2	0.749
	Flexible Rewards	3	0.832
	Location Based Rewards	2	0.741
	Attitude towards IGBAs	17	0.609
	Intention	2	0.618
	Total	26

Table 2 .

 2 Impact of Incentives on Attitude

	Variables	Regression	T -Sta-	Standard	P
		Coefficients	tistics	Errors	Values
	(Constant)	2.777	19.743	.141	.000
	Incentives	.262	3.456	.030	.001
	R -Square	.069
	F -Statistics	11.941
	Overall P Value	.001

Table 3 .

 3 Impact of Flexible, Location and tangible incentive on Attitude

	Independent	R 2	SE of the	Beta	T	Sig.
	variable		estimate
	Tangible	0.079	0.026	0.280	3.716	0.00
	Flexible	0.033	0.027	0.181	2.360	0.019
	Location	0.062	0.026	0.250	3.302	0.010

Table 4 .

 4 Impact of Attitude on Intentions

	Variables	Regression	T -Sta-	Standard	P
		Coefficients	tistics	Errors	Values
	(Constant)	.412	.917	.449	.360
	Attitude	.290	4.290	.137	.000
	R -Square	.084
	F -Statistics	18.403
	Overall P Value	.000

Table 5 .

 5 Items of Attitude

	Items of Attitude