Andrea Kolberger
email: andrea.kolberger@fh-hagenberg.at

Ingrid Schaumüller-Bichl
email: ingrid.schaumueller-bichl@fh-hagenberg.at

Martin Deutschmann

Risk Analysis of Physically Unclonable Functions

Keywords: Physically Unclonable Function (PUF), Risk Analysis, Vulnerabilities and Threats, Authentication, HW/SW Binding, Key Generation, Error Correction, Fuzzy Extractor, Cryptographic Applications

Physically unclonable functions (PUFs) are an emerging technology that have been proposed as central building blocks in a variety of cryptographic application areas. Keys are not stored permanently anymore, but generated as needed using unique "fingerprints" that are inherent in each device. Since PUFs are "noisy" functions responses generated by a certain PUF instantiation are error-prone and therefore highly sophisticated error correction is required to reliably reconstruct the respective PUF response. To be aware of potential threats and vulnerabilities concerning PUF-based security schemes a risk analysis on different use cases was performed in order to gain requirements for the development and implementation of effective error correction methods as well as requirements regarding the whole operational life cycle of such tokens.

Introduction

PUFs are inherently "noisy" which means that responses of a single PUF instantiation to one and the same challenge always slightly differ. Such responses cannot be directly used in cryptographic applications. Thus error correction processing is required in order to generate a reliable and stable PUF response. Also, the PUF's behaviour depends on environmental conditions like voltage supply, ambient temperature and ageing effects. All of these circumstances need to be taken into account when creating a PUF-based security scheme. Our risk analysis considers in addition to the error correction methods the whole operational life cycle of PUF-based security modules. We analysed different use cases and the related communication protocols. Considering the pre-operational phase (manufacturing, delivery, . . . ) as well as the usage of the token in the field we identified several threats and vulnerabilities due to either active attacks or the noisy, unstable behaviour of a PUF instantiation. The outcome of the analysis provided valuable input for defining requirements on the error correction mechanisms as well as requirements on the environment to ensure a reliable and secure usage of PUF-based devices. Furthermore the results formed the basis for the preparation of a Protection Profile for PUFs according to Common Criteria (CC) [START_REF]Common Criteria for Information Technology Security Evaluation, Part 1: Introduction and General Model[END_REF] that was presented at the IFIP SEC 2014 in Marrakech, Morocco [START_REF] Kolberger | Protection Profile for PUF-based Devices[END_REF].

A Physically Unclonable Function (PUF), i.e. a function embodied in a physical structure, contains random and unique information which originates from uncontrollable process variations during manufacturing in integrated circuits (IC). The basic idea is to use this "fingerprint" to serve as security anchor in various applications. The usage of PUFs enables the design of cryptographic applications without storing sensitive information such as keys in memory at all. For practical usability, PUFs should be easy to evaluate whereas they are considered unclonable because it is extremely difficult to make either a hardware clone, a mathematical model of the behaviour of the structure, or a software program that can compute the response to a challenge in a reasonable amount of time [START_REF] Gassend | Controlled Physical Random Functions[END_REF]. In [START_REF] Maes | Physically Unclonable Functions: A Study on the State of the Art and Future Research Directions[END_REF] Maes and Verbauwhede present an extensive overview of PUFs and PUF-like proposals. One established technique are SRAM PUFs that make use of the fact that SRAM cells tend to have the same state after power up very consistently. Thus, a challenge consists of an address range and the response is the value of the respective SRAM cells after power up. Owing to time, temperature and voltage variations, some bits tend to flip [START_REF] Handschuh | Hardware-Anchored Security Based on SRAM PUFs, Part 1. Security Privacy[END_REF]. Therefore so called fuzzy extractors are put in place, which take care that existing bit flips are corrected (e.g. by means of error correction codes). The basic principle of the so-called Arbiter PUFs [START_REF] Fruhashi | The arbiter-PUF with high uniqueness utilizing novel arbiter circuit with Delay-Time Measurement[END_REF] is to conduct a race on two paths on a chip. Therefore the challenges consist of a vector shaping the path of the "race" and an Arbiter circuit then decides, which path "won" the race, resulting in one bit response (0 or 1). Beside the noisy characteristic of PUFs, also ageing effects have to be taken into account, when developing PUF-based solutions. It is known that the response behaviour of a PUF instantiation is likely to slightly alter in the course of its lifespan. Therefore the noise levels would increase over time in the absence of anti-ageing protocols.

Risk Analysis

Performing the comprehensive risk analysis first different use cases were defined that cover a broad field of applications. Based on these use cases we identified several threats which were assessed in a further step. In doing so threats were not only considered as a malicious activity of an attacker. Even the PUF itself, because of its physical properties and noisy behaviour, might act in an undesired manner and therefore cause damage. The risk of the identified threats was calculated by the parameters "Risk Exposure" and "Impact". The ranges of these parameters were adapted to the specific terms of PUFs.

Use Cases. In the risk analysis we evaluated five different use cases. One-Way Authentication describes a very simple use case. PUF responses are used to authenticate the PUF-based token, but in this communication protocol no cryptographic actions are foreseen. Thus, a PUF-based token is accepted when the generated response is close enough to the reference response. As compared to Mutual Authentication [START_REF] Herrewege | Reverse Fuzzy Extractors: Enabling Lightweight Mutual Authentication for PUF-Enabled RFIDs[END_REF], both entities in a protocol are authenticated using cryptographic algorithms to reliably generate and reconstruct unique responses. Use case Secret Key Generation and Session Key Exchange applies PUF responses as a key to encrypt the session key used for further communication. Both use cases Key Zeroization and Hardware/Software Binding are based on the usage of logically reconfigurable PUFs (LR-PUFs), i.e. the behaviour of a PUF instantiation can be changed by adding some state information [START_REF] Eichhorn | Logically reconfigurable PUFs: memorybased secure key storage[END_REF][START_REF] Katzenbeisser | Recycable PUFs: Logically Reconfigurable PUFs[END_REF].

Results of Risk Analysis. The results of the performed risk analysis and the assessment of threats and vulnerabilities were prioritised with respect to the calculated risk value in order to highlight the most important ones. The analysis showed that the usage of a weak fuzzy extractor and/or weak error correction as well as PUF failures cause the highest risks. This means that the fuzzy extractor as well as the error correction must not reveal any information regarding the PUF-individual response because helper data, generated by the fuzzy extractor, are public information. At the same time these methods have to ensure the reliable reconstruction of secrets/keys from an error-prone response even in case of ageing and variation of environmental conditions. Another security relevant function is the manipulation of state information used for LR-PUFs. State information is public too and it must not be changed by unauthorized entities. Some further risks concern the PUF's environment that cannot be treated by the PUF itself. Therefore requirements and assumptions on the (pre-)operational environment have to be defined considering the underlying PUF technology as well as the intended use case. For example each PUF-based token has to be enrolled with different, unpredictable and random challenges in order to prevent guessing of valid challenges. Further the exchange of the database (comprising challenge-response pairs) between the enrolment facility and the customer has to be performed in a secure way in order to ensure confidentiality and integrity. Also, the analysis showed that model building attacks strongly depend on the PUF type and thus must be discussed separately. Literature already provides numerous papers [START_REF] Gassend | Identification and authentication of integrated circuits[END_REF][START_REF] Majzoobi | Testing Techniques for Hardware Security[END_REF][START_REF] Rührmair | Modeling attacks on physical unclonable functions[END_REF][START_REF] Sölter | Cryptanalysis of Electrical PUFs via Machine Learning Algorithms[END_REF] that might be considered.

Conclusion and Outlook

The results of the risk analysis formed the basis for the preparation of the security problem definition (SPD) and the security solution definition (SSD) in our Protection Profile for PUFs. These parts include potential threats, assumptions that are made on the TOE's environment as well as organizational security policies (OSPs). In order to achieve the security objectives several security functional requirements were derived including some extended components considering PUF specific needs. In the ongoing project the defined requirements are implemented in a prototype comprising PUFs and realizing mutual authentication and key generation. As a next step the prototype will be evaluated against these requirements in order to prove that the identified threats are countered and the security objectives are achieved.

Acknowledgements. This work is co-financed by the Austrian Research Promotion Agency (FFG) in the FIT-IT line within the project CODES (835932): Algorithmic extraction and error correction codes for lightweight security anchors with reconfigurable PUFs. The project partners are Technikon Forschungsund Planungsgesellschaft mbH, Alpen-Adria Universität Klagenfurt and University of Applied Sciences Upper Austria -Campus Hagenberg.


Paulo Mateus

Nikola Paunković

João Rodrigues

André Souto

Enhancing Privacy with Quantum Networks

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Security is the most important factor for building trust and confidence between consumers/population and companies/State; this trust has been severely damaged with many recent events such as the "Snowden crisis" and the Open SSL critical bug, and as such, private companies and state providers are pressured to improve the security of their products. In this paper we discuss how quantum security protocols can be integrated in a classical setting to provide multipartysecure computation.

Two seminal works have driven most of the research in the area quantum security: the quantum polynomial time factorization algorithm proposed by Shor [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF]; and the quantum public key agreement protocol BB84, proposed by Bennett and Brassard [START_REF] Bennett | Quantum Cryptography: Public Key Distribution and Coin Tossing[END_REF]. While Shor's algorithm raises the threat of making widely used cryptographic systems (via classic communication channels) completely obsolete by a breakthrough in quantum hardware, the BB84 protocol shows that quantum communication channels allow public perfect security in the context of an authenticated channel.

Due to Shor's factoring algorithm, research on (asymmetric) cryptography shifted significantly. Presently, one of the most important problems in the area is to find one-way functions robust to quantum attacks. Indeed, Shor's algorithm is able to attack all cryptosystems based on factorization and discrete logarithm, even in the elliptic curve setting, which accounts for essentially everything that is used in practice and is based on asymmetric keys.

On the other hand, BB84 is already commercially available through peer-topeer optical networks. It is worth pointing out that quantum channels sending an arbitrarily amount of quantum information can already be produced using cheap technology. Moreover, much research is being done to develop quantum networks and routers using traditional optical fibers and laser satellite communications. It is expected that quantum networks will be available much sooner than quantum computers and thus, it is fundamental to understand which security and distributed protocols can benefit from quantum technology.

Secure multiparty computation is an abstraction of many security functionalities, including private data mining, e-voting, verifiable secret sharing, verifiable computing, among others. In general terms, the goal of secure multiparty computation among n parties is to compute a function of n secret inputs, one for each party, such that at the end of the computation the output of the function is known to all parties, while keeping the inputs secret.

It is well known that to setup secure multiparty computation it is enough to establish oblivious transfer (OT) protocol between two-parties using Yao's garbled circuits [START_REF] Andrew | How to generate and exchange secrets[END_REF] (see a more modern discussion in [START_REF] Lindell | On the feasibility of extending oblivious transfer[END_REF]). The first OT protocol was presented by Rabin [START_REF] Rabin | How to exchange secrets by oblivious transfer[END_REF] and its security relies on the hardness assumption that factoring large integers is difficult in polynomial time. OT can be seen as a game played by two parties, Alice and Bob. Alice wants to share a number of secret messages with Bob such that, on average, Bob receives half of those messages (the protocol is concealing), while keeping Alice unaware to which messages Bob got (the protocol is oblivious). A protocol achieving these properties is called an OT Protocol. An OT protocol is made out of two parts: the transferring phase and the opening phase. In the former Alice sends the secret message to Bob; in the latter Alice unveil enough information that allows Bob to recover the secret with probability 1/2.

The main contribution of this paper is to propose an OT protocol that can be implemented over quantum optical networks using currently available technology. Such OT protocol can then be used to establish a secure multiparty computation using classical infrastructure. We introduce a quantum oblivious transfer protocol for bit-strings, based on the recently proposed public key crypto-system in [START_REF] Nikolopoulos | Applications of single-qubit rotations in quantum public-key cryptography[END_REF]. Each bit of the string to be transferred is encoded in a qubit (quantum bit), a particular quantum state, in such a way that states corresponding to bit-values 0 and 1, respectively, form an orthonormal basis. The key point of the protocol is that for each qubit, the encoding basis is chosen at random, from some discrete set of bases.

Next section provides a brief survey of quantum information, including basic definitions and important results necessary for understanding our proposal. Section 3 describes our proposal for a bit-string oblivious transfer protocol and discusses its correctness and security. Finally, we summarize the results and discuss future directions of research.

Preliminaries

In this section, we provide notation, necessary definitions and results for defining and reasoning about the security of our proposal.

For a complete study of quantum information we suggest the reading of [START_REF] Nielsen | Quantum Computation and Quantum Information[END_REF]. Here we present some relevant notions. According to the postulates of quantum mechanics, the state of a closed quantum system is represented by a unit vector from a complex Hilbert space H, and its evolution is described by a unitary transformation on H. In this paper we work only with finite-dimensional Hilbert spaces reflecting the realistic examples of systems with finite number degrees of freedom (strings of quantum bits, i.e. qubits).

Contrarily to the classical case where a bit can only have values 0 or 1, in the quantum case, a qubit can be in a unit superposition of 0 or 1 denoted by α |0 + β |1 with complex coefficients α and β such that |α| 2 + |β| 2 = 1. The Dirac notation |0 and |1 denotes vectors forming an orthonormal basis of a 2-dimensional complex vector space. Note that we can define many orthonormal bases for that space, such as

1 √ 2 (|0 + |1 ), 1 √ 2 (|0 -|1
) , but it is common to distinguish the basis {|0 , |1 } from all the others, and call it the computational basis.

The state of two qubits is from the tensor product of single-qubit spaces, that is,

|ψ = α |00 + β |01 + γ |10 + δ |11 with |α| 2 + |β| 2 + |γ| 2 + |δ| 2 = 1. The state |ψ is said to be separable if |ψ = (α |0 + β |1 ) ⊗ (α |0 + β |1 ) = αα |00 + αβ |01 + α β |10 + ββ |11 .
Otherwise, it is called entangled. Although entangled states are particularly important in quantum information, in this paper we only work with separable states. Note that a system with k qubits can be described by a unit vector over a space with dimension 2 k . One of the most important results of quantum information states that the maximal information that can be stored in a qubit is the same as that contained in a bit. This means that we cannot extract more than a bit of information from a qubit, although there is potentially an infinite number of states available to encode in a qubit. The reason for this is that it is impossible to obtain coefficients α and β from a single qubit in a state |ψ = α |0 + β |1 . Indeed, what is possible is to perform a measurement given by an orthogonal decomposition of the Hilbert space H = d i=1 H i , with P i being the projectors onto H i . Then, upon performing such a measurement on a qubit in state |ψ ∈ H, there are d possible outcomes {1, . . . , d}, where the probability of observing i ∈ {1, . . . , d} is given by P i |ψ , and then the state evolves to P i |ψ / P i |ψ . For instance, the outcome of a measurement of a qubit can only take two possible values.

To understand the protocol we need to consider a function that is easy to compute, but, without the help of a secret trapdoor, it is impossible to invert with non-negligible probability according to the laws of quantum physics. One candidate for such a function was proposed in [START_REF] Nikolopoulos | Applications of single-qubit rotations in quantum public-key cryptography[END_REF] which uses sinlge-qubit rotations and is given by

f (s) = R(sθ n ) |0 = cos (sθ n /2) |0 + sin (sθ n /2) |1
where, for some fixed n, s ∈ {0, . . . , 2 n -1}, θ n = π/2 n-1 and {|0 , |1 } is a fixed computational basis (i.e., f is not a function of a quantum state). Moreover, f can be used to construct a quantum trapdoor function F (s, b), where s is the trapdoor information for learning an unknown bit b [5]:

F (s, b) = R(bπ)f (s) = R(bπ)R(sθ n ) |0 = R(sθ n + bπ) |0 .
Note that inverting F (learning both s and b) is at least as hard as inverting f . In [START_REF] Nikolopoulos | Applications of single-qubit rotations in quantum public-key cryptography[END_REF] it was shown that every binary measurement that could be used to infer unknown bit b would outcome a completely random value. Nevertheless, if s is known, by applying the rotation R(-sθ n ) to F (s, b) and measuring the result in the computational basis, one obtains b with certainty.

Using the properties of f and F a secure public key cryptographic protocol was proposed in [START_REF] Nikolopoulos | Applications of single-qubit rotations in quantum public-key cryptography[END_REF]: using the private key s, the public key is generated by computing f (s); the encryption of a secret message corresponds to computing F (s, b); and the decryption of the message corresponds to inversion of F (s, b), using the trapdoor information s.

Finally, in order to guarantee that at the end of the OT protocol Bob knows if he got the message m or not, Alice is required to send both m and h(m), where h is a universal hash function. A hash function maps strings to other strings of smaller size . Bellow, we present a definition of universal hash function and a basic result. Definition 1. Consider two sets A and B of size a and b, respectively, such that a > b, and consider a collection H of hash functions h :

A → B. If Pr h∈H [h(x) = h(y)] ≤ 1 b
then H is called a universal family of hash functions.

Theorem 1. Let H be a collection of hash functions h : A → B, where A and B are sets of size a and b, respectively, such that a > b. The size of a set A x of strings x ∈ A mapped to the same hash value h(x) is at most N/b.

In our particular case we consider A and B as the sets of strings of length and /2 respectively. Hence, there are 2 /2 different strings for each hash value (for an overview see [START_REF] Carter | Universal classes of hash functions[END_REF]).

Having set the required definitions and results, our protocol works as follows:

Protocol 1 (Oblivious transfer)

Message to transfer m = m 1 . . . m k ; Security parameter n, θ n = π/2 n-1 and a hash function h : {0, 1} k → {0, 1} k/2 ;

Secret key s = (s 1 , . . . , s 3k/2 ), where each s i ∈ {0, . . . , 2 n -1}.

Transfer phase:

1. Alice chooses uniformly at random a bit a ∈ {0, 1} and prepares the following state:

|ψ = k i=1 R(m i π + (-1) a × s i θ n ) |0 k/2 i=1 R(h i (m)π + (-1) a × s i+k θ n ) |0
(Note that h i (m) represents the i th bit of the binary string h(m)). 2. Alice sends the state |ψ to Bob.

Opening phase:

3. Alice sends s = (s 1 , . . . , s 3k/2 ) and n to Bob. 4. Bob checks if s is likely to be a possible output of a random process by performing a statistical test. 5. Bob chooses uniformly at random a ∈ {0, 1} and applies R((-1) a s i θ n )

to each qubit of |ψ . 6. Bob applies the measurement operator M = (0×|0 0|+1×|1 1|) ⊗3k/2 . 7. Let m • h be the message that Bob recovers. He checks if h = h(m ).

If that is the case then Bob is almost sure that m = m, otherwise he knows that m is not the correct message.

In the following, we discuss the security of our oblivious transfer protocol, showing that: if both agents are honest, Bob will obtain the message m with probability 1/2 (the protocol is sound); if Alice plays fair, Bob is not able to recover m before the opening phase (the protocol is concealing); if Bob is honest, then Alice is unaware if Bob got m or not (the protocol is oblivious).

To state the results we need the notion of negligible function. ε : N → R, a nonnegative function is called negligible if for every polynomial p and sufficiently large k we have ε(k) ≤ 1/p(k).

First, we provide the reasoning for the soundness of our protocol. Notice that if Alice and Bob are honest then the choice of rotation direction of both will differ with probability 1/2. Only when they are different, i.e., Bob undo Alice's rotation and obtains the states in computational bases, Bob is ensured to recover the message. When Bob rotates in the same direction of Alice, the results of Bob's measurement are random and hence the probability of recovering m in this case is a negligible function on the size of the message m.

We proceed by discussing the concealing property of the protocol.

Theorem 3. If Alice is honest, the probability of Bob recovering Alice's message before the opening phase is negligible. Furthermore, after the opening phase Bob recovers the message, up to a negligible value, with probability 1/2.

The first part of the theorem follows directly from the security of the public key encryption schemes presented in in [START_REF] Nikolopoulos | Applications of single-qubit rotations in quantum public-key cryptography[END_REF]: without knowing the secret key s and the rotation direction a, Bob's description of a message m is given by a completely mixed state. The second part follows from a similar argument to the previous theorem.

To finish the security discussion we argue that the protocol is unconditionally oblivious.

Theorem 4. The Protocol 1 is oblivious, i.e., at the end of the protocol Alice does not know whether Bob received the right message of not.

During the execution of the protocol, there is no information traveling from Bob to Alice. Therefore, in order to increase the probability of learning if Bob received the message m or not, Alice has to perform the following cheating strategy: instead of sending |ψ , Alice sends a cheating state |ψ ch for which Bob will open the desired message with a probability greater than 1/2 (possibly with certainty). This is impossible, unless with negligible increase ε(l), bounded above by 12 1 + cos 2l (π/8) , where l is the number of s i 's for which s i θ n ∈ [π/8; 3π/8]. 1

Conclusions

In this paper we proposed a scheme for oblivious transfer of a bit-string message. Its security is based on laws of quantum physics. We reasoned about its security and showed that the protocol is unconditionally oblivious and concealing. Our protocol can be implemented with today's technology using optical equipment. Moreover, the protocol can be integrated with existing classical networks to achieve secure multiparty computation, and promote an extra level of security on such functionality. Using single-qubit rotations have been proved useful in designing quantum security protocols, such as the presented oblivious transfer and the previously proposed public key cryptographic scheme [START_REF] Nikolopoulos | Applications of single-qubit rotations in quantum public-key cryptography[END_REF]. This opens a number of possible future applications of single-qubit rotations in designing several secure protocols such as quantum bit-string commitment protocol and undeniable signatures.

Theorem 2 .

 2 If both parties are honest, then with probability 1/2 + ε(k) Bob will get the right message, where ε(k) is negligible function on the size of the message m = m 1 . . . m k .

Since the values of si's are required to be random, the expected value of l is k/4, with the standard deviation σ = √ k/4.

Acknowledgments This work was partially supported by FCT projects ComFormCrypt PTDC/EIA-CCO/113033/2009 and PEst-OE/EEI/LA0008/2013, and SQIG's initiative PQDR (Probabilistic, Quantum and Differential Reasoning). João Rodrigues and André Souto also acknowledges respectively the FCT grants SFRH / BD / 75085 / 2010 and SFRH / BPD / 76231 / 2011.


Rui Melo Biscaia
email: rui.biscaia@watchfulsoftware.com

The fundamental principle of breach prevention

Introduction

Information has evolved to become a crucial commodity, requiring just as much security as any other tangible asset. People take it, use it, and 'leak' it out and organizations are challenged to protect a growing quantity of valuable digital information against careless mishandling and malicious use. In addition, a growing list of legislative requirements adds to the ongoing task of protecting digital files and information.

For the past decades, vast amounts of money and countless hours have been invested in breach prevention. The order of the day has been to harden network and server access through the deployment and redeployment of an evolving series of firewalls, anti-spam/anti-virus applications and intrusion detection and prevention systems -all of them, in essence, attempts to 'reinforce the perimeter' to protect what lies within.

While this remains good and necessary IT practise, it takes no account of two very important and inescapable truths: a) users are always inside the perimeter, and b) even those authorised users can cause significant damage. By ignoring these, CI(S)Os fail to address possibly the most fundamental persistent threat, that of a breach orchestrated by one or more of their organisation's own users.

Information leaks are all too often caused by trusted insiders, people with the right and credentials to be behind the firewall, who leak information whether knowingly or unknowingly. The sheer numbers and types of external storage media available make it very easy for information to leak out. Moreover, corporations are increasingly being held legally liable for the safeguarding of information they hold on their own employees as well as on their customers.

1. Disgruntled employee -This is usually the employee who feels personally disrespected, possibly due to a missed pay raise that was expected or a negative encounter with supervisors over benefits, time off, demotions, transfers or other similar issues. In this instance, revenge is the employee's motive. 2. Profit-seeking employee -This is a simple motivation for many people. They work for a wage; however, by stealing information, they can make more money selling the stolen data to organized criminals or modifying the data to steal an identity. The information could be easy to access and steal for the employee, plus the theft can be rationalized because, as a malicious insider might say to himself, "The Company won't even miss it". Motivations in such circumstances could include large financial or drug-related debt. 3. An employee moving to a competitor or starting a business -For someone starting a business in the same field, the theft of customer lists, business plans, and even simple forms or templates can be tempting. Alternatively, imagine the employee leaving to work for a competitor. Perhaps the competitor has hinted that an exchange of information can be made for a better position when the employee comes on board. 4. Believe they own the code or product -In this case, employees feel a sense of ownership over code they wrote or a product they developed. Therefore, they take the code for their future use or even for their next job.

3 Data-centric Security

The way to effectively and efficiently address those concerns seems to be Datacentric Security, whose focus is to classify and encrypt sensitive or confidential information and ensure that only properly authorized people have the key to decrypt it. Thus, even if an intended or unintended breach occurs, whether the information is sent, left on a USB key or stored on a web drive, the data can't be seen or used by anyone beyond the authorized audience. The first step to accomplish Data-centric Security is encrypt confidential and sensitive data. This can be done automatically, without the user being involved in the process. Enterprises should develop dynamic global data policies, so that when information is created (be it an email, document, spreadsheet, presentation, engineering drawing, etc.) it is automatically encrypted using a secure wrapper. This protection lasts throughout the lifecycle of the information, regardless of how many times it is sent, opened, stored, saved or edited. The information will always have this classification and encryption wrapper protecting it, even if it's sent, carried or stored beyond the enterprise's secure IT perimeter.

The next step is to ensure that the keys are centrally stored and managed. Each time an attempt is made to use that protected information (to open, print, forward, etc.) the wrapper 'reaches out' to the central server managing the keys (more accurately, a list of who has the rights to what levels of information). Effectively, the wrapper asks: 'has this person the right to use me?'. If the answer is 'yes', the action is allowed. If the answer is 'no', then the encryption stands firm and the object is useless.

Moreover, in effective Data-centric Security, all interactions with the rights management server (requests to open information, to print it, to forward it, to save it, etc.) will be saved for future forensic, auditing, and tracking purposes. The records of interactions will be useful in cases where the attempted breaches were not unintentional.

Information Security "Rules of Thumb"

As with most approaches to Information Security, layered defenses need to be implemented to reduce insider threats. As there's no silver bullet, a recipe for success starts with following some simple "rules of thumb":

1. Information should be classified. This can be done in one of two ways: either manually, by the author; or dynamically, according to content and context aware policies established by the company. Advanced data-centric security solutions allow information to be classified as it is created (in the case of documents, spreadsheets, presentations, etc.) or as it is sent (in the case of messages and emails); 2. Information should be protected. Quite simply, the best way to protect information is to have it encrypted. There are many different types of encryption, and people employ encryption at different parts of the equation (on the drive, in transit on the network, etc.). Experts today, however, are agreeing that instead of trying to encrypt the physical media where the information might be stored (the drive, the network, etc.) if you simply encrypt the information itself then it's protected regardless of where it is. If it's on a laptop drive, it's encrypted. If it's in transit across the network, it's encrypted. If it's in a cloud based drive, it's encrypted. If it's on a USB key hanging around someone's neck, it's encrypted. What that means is that this information is persistently secure. . . regardless of whether it in inside or outside of network boundaries; 3. Information should be accessed based the user's "need-to-know". Users should be assigned appropriate security clearances and access to data should be granted based on the user need-to-know according to his job description and the classification of the data itself. Hence, enterprises should enforce separation of duties and privilege, thus not allowing access to sensitive information that the employee has no reason to view, obtain or download. In a nutshell, Insider threats can (and probably have) happened to every enterprise. Those organizations that are knowledgeable of the risks and are well prepared for such eventualities will thrive reducing and/or preventing the insider threat.

What is a malicious insider?According to Carnegie Mellon University's CERT Insider Threat Center, which offers comprehensive and authoritative research on insider threats, a definition of a malicious insider is a "current or former employee, contractor, or other business partner who has or had authorized access to an organization's network, system, or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization's information or information systems." Also, according to the CERT Insider Threat Center, the employees that pose the greatest risk for insider threat/theft include:


Arnaud Ristori
email: arnaud.ristori@onera.fr

Christophe Brossard

Axel Vincent-Randonnier

Diagnostics optiques des écoulements supersoniques dans une chambre de combustion de statoréacteur mixte au moyen de la strioscopie à haute cadence couplée à la visualisation de l'émission du radical OH*

come

Introduction

Les statoréacteurs mixtes et super-statoréacteurs font actuellement partie des moteurs aérobies les plus prometteurs pour la propulsion des véhicules hypersoniques du futur [START_REF] Smart | Scramjets", Advances on Propulsion Technology for High-Speed Aircraft[END_REF][START_REF] Bouchez | Statoréacteur -Propulsion aérobie moyenne ou grande vitesse[END_REF] et sont à ce titre un sujet de recherche à l'ONERA depuis les années 60. L'étude dont les résultats sont présentés ici fait suite à celle conduite entre 2008 et 2013 dans le cadre d'un projet Européen dénommé LAPCAT II [START_REF] Steelant | Achievements Obtained for Sustained Hypersonic Flight within the LAPCAT-II Project[END_REF][START_REF] Vincent-Randonnier | Combustion of hydrogen in hot air flows within LAPCAT-II Dual Mode Ramjet combustor at ONERA-LAERTE facility -Experimental and Numerical Investigation[END_REF] dont l'objectif était l'étude de concepts technologiques de propulsion hypersonique pour le transport de passagers sur des longs trajets (Mach = 6-8 ; 18000 km). Le domaine de vol typique d'un statoréacteur (combustion subsonique) se situe pour une altitude de 15 à 30 km à un nombre de Mach compris entre 3 et 5-6, alors que celui du super-statoréacteur (combustion supersonique) se situe pour une altitude de vol comprise entre 20 et 35 km autour d'un nombre de Mach supérieur à 6. Le statoréacteur mixte associe dans la même chambre une combustion subsonique puis supersonique, afin de couvrir l'ensemble du domaine de vol précité.

En régime de combustion supersonique, plusieurs difficultés sont rencontrées, à savoir :

la faible efficacité du mélange entre l'air et le combustible injecté due aux effets de compressibilité, -le faible temps de séjour dans la chambre associé à une cinétique chimique lente à des températures modérées (autour de Mach 5-6),

-les instabilités de combustion.

Cet article présente l'ensemble de l'expérimentation optique mise en place fin 2013 puis en 2015, sur le banc de combustion supersonique du LAERTE (LAboratoire sur les Ecoulements Réactifs et leurs Techniques d'Etudes), ainsi que les principaux résultats obtenus par strioscopie à haute cadence [START_REF] Vincent-Randonnier | Combustion of hydrogen in hot air flows within LAPCAT-II Dual Mode Ramjet combustor at ONERA-LAERTE facility -Experimental and Numerical Investigation[END_REF][START_REF] Scherrer | Research on supersonic combustion and scramjet combustors at ONERA[END_REF] et par visualisation de l'émission du radical OH* couplée à la strioscopie. Ces résultats permettent de mettre en évidence l'aérodynamique autour des jets pariétaux d'injection de combustible, la corrélation entre positions des chocs et du front de flamme, et leur évolution temporelle.

Montage expérimental

Moyen d'essai et chambre de combustion

Le banc de combustion supersonique du LAERTE alimente la chambre de combustion par de l'air chaud vicié ré-oxygéné (air chauffé par une combustion H 2 /air, la fraction volumique d'oxygène étant maintenue à 21% par injection en amont d'oxygène pur). La température génératrice maximale est de 1800 K à 1900 K et la pression génératrice peut atteindre 1,2 MPa. Ce banc (Figure 1) fonctionne en mode rafale et la chambre de combustion se comporte en puits de chaleur. La reproductibilité et la stabilité des tirs en mode rafale sont assurées par les moyens informatiques associés aux organes de régulation. La durée totale d'un tir est d'environ 1 minute, mais la durée exploitable aux conditions stabilisées de pression et température génératrices est comprise entre 5 et 15 secondes, selon les conditions (Figure 1). Injection H2 Chambre de combustion Mesure de P 0 et T 0 La tuyère de Laval et la chambre de combustion sont réalisées à partir d'un alliage de Cuivre (CuCrZr) et protégées par une barrière thermique de 0,3 mm d'épaisseur en zircone stabilisée à l'oxyde d'yttrium déposée sur les parois internes. La largeur de la chambre de combustion est constante et égale à 40 mm. La référence x = 0 mm est positionnée au col de la tuyère de Laval. L'entrée du foyer est positionnée à la sortie de la tuyère à x = 65 mm. La hauteur de l'entrée de la chambre de combustion est de 35.4 mm. Celle-ci est composée de 4 secteurs successifs : le premier a une section constante, les sections suivantes ont des demi-angles de divergence α = 1°, 3° et 1° respectivement. Le plan de sortie du foyer est situé à x = 1257 mm. Pour cette étude, des hublots en silice fondue ont été placés de part et d'autre du foyer (z = ±20 mm) pour réaliser les visualisations par strioscopie. La géométrie détaillée de la tuyère d'alimentation et du foyer est présentée sur la Figure 2. Les deux injecteurs pariétaux sont des orifices de diamètre 2 mm orientés perpendiculairement à la paroi et situés à l'abscisse x = 200 mm.

Strioscopie à haute cadence

La technique de strioscopie permet de mettre en évidence, dans une direction, les gradients d'indice optique et donc les gradients de masse volumique dans l'écoulement, qui sont proportionnels aux gradients d'intensité lumineuse reçus par le capteur de la caméra. Pour plus de détails sur la technique de strioscopie dite aussi de "Schlieren", le lecteur pourra se reporter utilement au journal en ligne « Aerospace Lab » de l'ONERA [START_REF] Desse | Shadow, Schlieren and Color Interferometry[END_REF].

Le système de strioscopie à haute cadence mis en place sur le banc de combustion supersonique du LAERTE, est composé des éléments suivants :

une source au Xénon 300 W Xe OF, Oriel, modèle 6258. Il s'agit d'une source à arc, blanche et continue, utilisée classiquement en strioscopie. Un condenseur de focale 300 mm fixé sur la source permet de la focaliser en aval pour en faire une source ponctuelle stabilisée en intensité ; -un diaphragme, fermé au maximum de façon à réduire le diamètre de la source "ponctuelle" et d'en ajuster par là-même la puissance, situé à 300 mm en aval du collimateur ; -deux lentilles de Clairaut de focale 800 mm situées de part et d'autre de la veine d'essai. Le diaphragme est positionné au point focal de la première lentille afin de générer un faisceau de lumière parallèle traversant la chambre de combustion ; -un couteau strioscopique constitué d'une 1/2 lame de rasoir fixée sur un support déplaçable par des vis micrométriques dans les 3 directions ainsi qu'en rotation dans son plan ; -une caméra 12 bits de type CMOS (modèle Vision Research Phantom V711). La résolution maximale du capteur de cette caméra est de 1280 x 800 pixels, et la cadence maximale d'acquisition pour cette résolution est de 7525 Hz. Dans ces conditions, la mémoire interne de cette caméra permet d'enregistrer 11069 images. La cadence ainsi que le nombre d'images enregistrées peuvent être augmentées au-delà de ces seuils en réduisant la taille des images lors de l'acquisition. Par ailleurs, le temps d'exposition a été fixé à la valeur la plus faible possible, soit 1 µs, ceci afin de figer au maximum les images des gradients visualisés dans l'écoulement ; -un objectif 80-200 mm, qui a été utilisé avec une ouverture de 4 en entrée de la caméra de strioscopie.

Les acquisitions sont réalisées au moyen du logiciel Phantom Camera Control (PCC version 2.12.727.1). L'implémentation du système de strioscopie sur le banc de combustion supersonique du LAERTE est visible sur la Figure 3. -une lame dichroïque avec une réflexion supérieure à 99% autour de 310 nm (bande 290 nm -328 nm) et une transmission supérieure à 80% au-dessus de 350 nm. (PCC version 2.12.727.1). Les caméras sont parfaitement synchronisées, avec une information temporelle plus riche pour la strioscopie comparativement à l'émission OH* (cadencement de la caméra APX-i2 réduit au tiers de la caméra APX-i2 de celui de la caméra V711).

Résultats expérimentaux en strioscopie seule

L'évolution temporelle des paramètres de débit des fluides lors d'une rafale, puis les conditions génératrices et le profil de pression statique le long du foyer, à un instant stabilisé en richesse, sont présentés respectivement sur la Figure 1 et la Figure 5.

L'évolution de la pression statique pour un nombre de Mach = 2.0, avec injection de combustible à la position x = 200 mm, est représentée sur la Figure 5. En l'absence d'injection de combustible, cas représenté sur les courbes en noir (richesse Φ = 0), on peut observer une lente remontée de la pression statique dans le premier secteur de section constante (α = 0°) de la chambre situé en aval de la tuyère de Laval. Ce phénomène est dû à la baisse de la pression totale induite par les frottements aux parois. Dans le second secteur (α = 1°) de la chambre (x > 280 mm), la divergence accélère l'écoulement, ce qui se traduit par une baisse de la pression statique. Dans la troisième partie du foyer (α = 3°), l'écoulement est encore accéléré. Enfin, un train de chocs de désamorçage dû à la pression élevée en aval (P atm ) apparaît aux alentours de x = 800mm. Il s'accompagne d'une remontée de la pression statique. Dans cette configuration, environ 2/3 du foyer est en conditions supersoniques entre x = 0 mm et x = 800 mm. Cette position et les conditions de combustion à travers les chocs de recompression fluctuent en fonction des conditions génératrices (Mach, P 0 , T 0 , Φ), du mélange, du taux de dégagement de chaleur mais aussi de la position du ou des injecteurs dans la chambre de combustion.

Pour une richesse injectée égale à Φ = 0,15, la combustion supersonique débute à x = 250 mm, soit 50 mm en aval des injecteurs. La remontée en pression en amont des injecteurs est due au blocage aérodynamique partiel créé par ceux-ci et se traduit par une transition subsonique locale de l'écoulement qui redevient supersonique par l'effet de l'accélération due au dégagement de chaleur lié à la combustion du mélange air/H 2 et à l'angle de divergence de la veine à partir de x = 280mm. Le taux de dégagement de chaleur important dans cette région est accompagné d'une remontée globale en pression qui indique la présence d'une combustion soutenue. Afin d'éviter le phénomène de blocage thermique qui se traduirait par un désamorçage partiel ou total du foyer supersonique et par une combustion en mode subsonique, la richesse devra donc être maintenue inférieure à un certain seuil, typiquement en dessous de Φ = 0,15 à 0,20 dans le cas présent (dépend de la température de paroi et de température génératrice). En effet, le blocage thermique intervient lorsque le dégagement de chaleur dû à la combustion dépasse un certain seuil fonction du débit total et de la température amont de l'air et du combustible. La transition entre l'écoulement supersonique amont et subsonique aval apparaît aux alentours de l'abscisse x=800 mm en aval de la tuyère de Laval. chocs autour des injecteurs et les chocs en λ, apparaissent sur les profils de pression respectivement à x = 200 mm et à x = 260 mm. Une analyse fréquentielle des fluctuations visualisées de la zone de combustion fait apparaitre une fréquence caractéristique assez nette autour de 800 Hz. Lorsque la richesse passe de 0,15 à 0,2, les zones de mélange et de combustion ne sont plus séparées et la flamme remonte alors au plus près de l'injecteur avec épaississement des chocs en arc ; de plus, vers x = 240-250 mm, un choc en forme de chevron indique une transition de l'écoulement subsonique vers le supersonique et avec un rapprochement vers le blocage thermique avant le désamorçage de la tuyère. L'étude du couplage entre l'aérodynamique et la combustion présentée dans la section suivante a donc été réalisée pour des richesses strictement inférieures à 0,2.

Résultats expérimentaux en strioscopie couplée à l'émission OH*

Les résultats obtenus (Figure 6) pour une richesse de 0,144 (proche de 0,15), montrent sur une image instantanée la position axiale de la flamme supérieure et inférieure attachée au choc en λ. Lorsqu'on baisse la richesse à Φ =0,119, le choc en λ disparaît et les positions des flammes supérieures et inférieures sont différentes et se déplacent sans corrélation nette. La structure des fronts de flammes cohérentes observés est déterminée par les tourbillons de Kelvin-Helmholtz aux interfaces avec les gaz frais. Une analyse des évolutions temporelles des positions de front de flamme dans ces 2 conditions permet de tirer quelques enseignements supplémentaires, à savoir que :

-pour Φ = 0,144 (Figure 8

Conclusions

Les visualisations réalisées en 2013 par strioscopie à haute cadence dans la chambre de combustion supersonique du LAERTE ont permis de mettre en évidence les gradients transverses de l'indice du milieu générés par les phénomènes physiques suivants : les chocs en forme de tonneau issus des injecteurs, les chocs en forme d'arcs générés en amont des obstacles aérodynamiques créés par les injecteurs pariétaux (jets d'hydrogène), les chocs obliques caractéristiques de l'écoulement supersonique, les interactions des chocs avec la couche limite se traduisant par un choc courbe qui adopte une forme caractéristique en lambda (λ), ainsi que le couplage entre la zone de combustion et les chocs obliques. Le caractère instationnaire des écoulements au niveau des injecteurs et des zones réactives (800 Hz pour une richesse de 0,15) a également été mis en évidence à travers l'analyse des images obtenues lors de cette étude.

Les visualisations réalisées en 2015 dans cette même chambre par strioscopie à haute cadence couplée à l'émission du radical OH* ont permis de mettre en évidence les structures cohérentes des flammes, ainsi que le comportement de la combustion en présence de chocs en λ ou en leur absence lors de la diminution de la richesse globale dans le foyer. En particulier, pour les richesses les plus élevées, les flammes supérieures et inférieures se déplacent ensemble autour du choc en λ, alors que les celles-ci se déplacent séparément et sans corrélation apparente lorsque la richesse décroit et que le choc en λ disparaît. Afin d'améliorer encore la compréhension des phénomènes rencontrés dans ce type de foyer et de compléter la base de données expérimentales, il est prévu de réaliser des mesures couplées de PIV/strioscopie en 2016/2017 dans cette chambre de combustion. Les données expérimentales obtenues pourront alors être utilement comparées avec les simulations numériques instationnaires qui seront réalisées avec le code CEDRE [START_REF] Chevalier | CEDRE : development and validation of a mulitphysic computational software[END_REF] de l'ONERA.

Figure 1 :

 1 Figure 1 : Schéma d'implantation du banc de combustion supersonique LAERTE équipé de la chambre de combustion et séquence typique d'une rafale avec visualisation de la flamme.

Figure 2 :

 2 Figure 2 : Géométrie de la chambre précisant les accès optiques et les pressions pariétales.

Figure 3 :

 3 Figure 3 : Montage de strioscopie à haute cadence (2013) sur le banc supersonique du LAERTE.

Figure 4 :

 4 Figure 4 : Montage de strioscopie à haute cadence couplée à la visualisation de l'émission du radical OH* mis en place sur le banc supersonique du LAERTE (2015). Pour ces essais, les cadences retenues sont les suivantes : -visualisation OH* : f= 4000 Hz, résolution = 1024 x 512 pixels, temps d'exposition = 4 µs ; -visualisation strioscopie : f= 12000 Hz, résolution = 1152 x 504 pixels, temps d'exposition = 1 µs ; Les acquisitions OH* sont réalisées au moyen du logiciel Photron Fastcam Viewer (PFV version 2.4.3.0) et les acquisitions d'images de strioscopie au moyen du logiciel Phantom Camera Control(PCC version 2.12.727.1). Les caméras sont parfaitement synchronisées, avec une information temporelle plus riche pour la strioscopie comparativement à l'émission OH* (cadencement de la caméra APX-i2 réduit au tiers de la caméra APX-i2 de celui de la caméra V711).

Figure 5 :

 5 Figure 5 : 3 figures de gauche : injection et allumage (P 0 =0,410 MPa, T 0 =1697 K, Φ=0,15) avec image de strioscopie annotée (1280×504 pixels ; 12 kHz) et zoom sur la zone de l'injection (128×128 pixels ; 210 kHz). 2 figures de droite : injection et allumage (P 0 =0,408 MPa, T 0 =1700 K, Φ=0,20) avec image de strioscopie annotée (1280×504 pixels ; 12 kHz). Les conditions expérimentales correspondent à des essais à Mach 2. Les images sont acquises à cadence élevée (4 kHz à 210 kHz) afin de déterminer les fluctuations de position des chocs au cours d'une rafale. Les traînées longitudinales visibles sur la Figure 5 sont des dépôts sur les hublots et ne correspondent donc pas à des gradients de strioscopie dans l'écoulement. La zone étudiée pour l'imagerie de strioscopie est située entre x = 190 mm et x = 270 mm, à proximité des 2 injecteurs pariétaux de diamètre 2 mm situés à x = 200 mm, comme indiqué sur la Figure 5.L'injection réalisée dans cet écoulement chaud à Mach 2 montre une pénétration des jets sur une hauteur de 5 mm de part et d'autre de la paroi à l'abscisse x = 220mm. Ainsi, près de 30% de l'écoulement principal (10mm sur une hauteur de veine de 35,4mm à x=200 mm) est pénétré par les jets d'hydrogène. La visualisation par strioscopie fournie des informations sur l'injection, le mélange et la combustion. L'injection est caractérisée par un choc en forme de « tonneau » visible en haut à gauche de la Figure5, en amont duquel se détache un choc en arc. En aval de l'injecteur, une zone de mélange est mise en évidence. Pour une richesse de 0,15, en aval de cette zone de mélange, la combustion est accrochée autour d'un choc en forme de λ dont la position oscille entre 50mm et 80mm en aval des injecteurs. Les pics de pression induits par les

  ), les flammes supérieures et inférieures se déplacent sur 50 mm pour 245 mm < x < 295 mm, et la vitesse maximale de déplacement du front de flamme est inférieure à 70 m/s ; -pour Φ = 0,119 (Figure 8), les flammes supérieures et inférieures se déplacent respectivement sur 75 mm à 90 mm pour (260 mm ou 245 mm) < x < 335 mm, et la vitesse maximale de déplacement du front de flamme est inférieure à 140 m/s (doublée par rapport au cas précédent).

Figure 6 :

 6 Figure 6 : images de strioscopie (en haut), d'émission (au milieu) et leur superposition (en bas) ; OH* en rouge) ; P 0 ≈ 0,405 MPa, T 0 ≈ 1705 K, Φ = 0,144 (à gauche) et 0,119 (à droite).

Figure 7 :

 7 Figure 7 : Evolution temporelle des positions de flammes supérieures et inférieures (et vitesses déduites) ; P 0 = 0,403 MPa, T 0 = 1704 K, Φ = 0,144.

Figure 8 :

 8 Figure 8 : Evolution temporelle des positions de flammes supérieures et inférieures (et vitesses déduites) ; P 0 = 0,406 MPa, T 0 = 1707 K, Φ = 0,119.

Séquence typique d'une rafale

	Air Air Air	H 2 O 2 H 2 O 2 H 2 O 2	H 2 H 2 H 2	Fuel Fuel Fuel

Les paramètres de contrôle permanents associés au moyen d'essai et à la maquette comprennent des mesures de pression et de température totale (3 thermocouples à différentes positions radiales) et 124 mesures de pression pariétales acquises à 10 Hz et réparties le long du foyer.

Séquence typique d'une rafale

		1er foyer H 2 2 ème foyer H 2	Tuyère de Laval	Injection H2	Brûleur de sécurité
	Air	O 2

Remerciements

Les auteurs tiennent à remercier la Direction Scientifique Générale de l'ONERA pour le financement de cette étude. Des remerciements tout particuliers sont également adressés à David Carru, Patrick Roux, Bruno Rouxel pour leur soutien technique.