Michael Hamwi
email: m.hamwi@estia.fr

Iban Lizarralde

Jérémy Legardeur

Energy Product Service Systems as core element of energy transition in the household sector: The Greenplay project

Keywords: Product-Service System, Energy, Business models, Households, Energy transition

This paper focuses on Business Model innovation practices within the specific field of energy transition in the household sector. In recent years the value chain between the stakeholders involved in this field has been modified due to recent technological changes, which poses a threat for current companies and an opportunity for insiders. This research work has been carried out within the Greenplay project, which is an EU funded Horizon H2020 project. This project aims to develop new business models that reduce energy consumption in the household sector and can be successfully implemented. In this paper, we present a framework based on intersection of two group of categories. The first one is issued from energy transition presented by consumer behaviour, energy efficiency and renewable energy and the second is abstracted from Product-Service System (PSS). The methodology is based on defining the characteristics of a Product Service System in general followed by Smart PSS (integrated smart product and e-service) qualities and the current ESCo (Energy Service Company) business model characteristics. Finally based on aforementioned analysis on energy transition and Product-Service System, we discuss a set of Servicizing energy business models for energy transition in household sector. The main objective is to shed light on the ability of designing new business models (BMs), in household sector, as a result of integrating PSS with the emerging trends for sustainable energy. In this study, a systematic literature review is conducted related to energy business models. Furthermore, the proposed framework is a crossing classification based on criteria concerning PSS and various energy production and consumption BM. Finally the characteristics of an innovative business model for energy transition in household sector can be transposed to other sectors, mainly those who deal with Product Service System. In the second phase of the Greenplay project the authors will apply the proposed framework to the use cases identified in the project: households that are able to fine-tune their energy use thanks to smart meters that provide free access to data in real-time. The goal is to get feedback from researchers that have already implement innovative Business Models in this or other sector, as well as to discuss with researchers and practitioners that have analysed firms that have successfully innovated their business models. This feedback will allow us to adjust the framework before the experiment with the companies of the Greenplay project.

Introduction

In the midst of the critical changes such as climate change, unstable oil prices, energy security and the rapid changes in energy technologies [START_REF] Awerbuch | Portfolio-Based Electricity Generation Planning: Policy Implications For Renewables And Energy Security[END_REF][START_REF] Kilian | Not all oil price shocks are alike: Disentangling demand and supply shocks in the crude oil market[END_REF][START_REF] Manabe | On the distribution of climate change resulting from an increase in CO2 content of the atmosphere[END_REF][START_REF] Popp | Technology and the diffusion of renewable energy[END_REF] a more sustainable use of energy through renewable energy and energy efficiency is expected to play a crucial role. The business model of centralised energy production utility is questionable nowadays. Recently the "utilities spiral death" [START_REF] Costello | Electric Utilities' "Death Spiral": Hyperbole or Reality?[END_REF][START_REF] Felder | The Life and Death of the Utility Death Spiral[END_REF] which is the reduction of utility revenues due to the decreasing of consumer numbers, was addressed since the market share of utilities has shrunk, while new insiders have appeared in the energy market mainly due to the rise of the distributed generation (DG) [START_REF] Costello | Electric Utilities' "Death Spiral": Hyperbole or Reality?[END_REF][START_REF] Felder | The Life and Death of the Utility Death Spiral[END_REF]. Recent studies indicate that electric utilities in the U.S consider that issues like energy storage, energy efficiency, utility-side renewable, response demand and distributed solar installations are key elements to be considered by utilities in order to keep the current electricity market share (Norbert, 2015;Utility Dive, 2015). In this context, the role of the consumers might be a key element for the future electricity system transition as the participation of the customer in the production [START_REF] Engelken | Comparing drivers, barriers, and opportunities of business models for renewable energies: A review[END_REF], the load management [START_REF] Laicane | Reducing Household Electricity Consumption through Demand Side Management: The Role of Home Appliance Scheduling and Peak Load Reduction[END_REF] and energy efficiency [START_REF] Caird | Improving the energy performance of UK households: Results from surveys of consumer adoption and use of low-and zero-carbon technologies[END_REF] is increasing each year [START_REF] Morris | German Energy Transition[END_REF]Utility DIVE, n.d.).

New value propositions for the energy sector might be based on providing new services in this context. Indeed, Product Service Systems (PSS) have been discussed as sustainable alternatives of selling a product as it offers the possibility of decoupling consumption from the used product [START_REF] Heiskanen | Can services lead to radical eco-efficiency improvements?-a review of the debate and evidence[END_REF]. Servicizing, which is about selling functionality instead of product, starts to emerge in the markets [START_REF] Plepys | European policy approaches to promote servicizing[END_REF] despite that, little academic work has handled the servicizing process of utilities business model [START_REF] Hannon | The co-evolutionary relationship between Energy Service Companies and the UK energy system: Implications for a low-carbon transition[END_REF][START_REF] Helms | Asset transformation and the challenges to servitize a utility business model[END_REF]. Furthermore, integrating product and service, in order to create and deliver new value, usually causes less environmental impact [START_REF] Baines | State-of-the-art in product-service systems[END_REF].Providing energy as a service towards sustainability has been addressed in industrial, commercial and public sector as the "economies of scale" is more prominent [START_REF] Irrek | ESCOs for residential buildings: market situation in the European Union and policy recommendations[END_REF]). Yet, few academic works have investigated energy services in the household sector.

The objectives of this paper is an attempt to link product-service system with energy consumption in household sector by identifying the potential business models (BMs) that could be used to reduce household consumption. The paper is structured as follows. Section 2 reviews the main characteristics of the new transformation in the energy sector. Besides, this section introduces the PSS concept. Section 3 introduces a framework based on a PSS classification and three energy transition criteria: consumer's behaviour, efficiency and renewable energy. This framework is used to classify the review of the literature about the energy transition. Section 4 introduces the case study of the Greenplay European project and poses the scope and the research questions of the PhD work of the main author. Finally section 5 draws the conclusions.

Methods:

Our approach to define new business models in the given context is summarized as follows:

 Determine the emerging business models in three energy transition areas which are inspired by French initiative for energy transition Négawatt ("The négaWatt energy scenario," n.d.).  Presenting Product-Service System and defining its three categories.  Allocating and mapping the different energy business models into two axes' framework.

The first one is the energy transition areas and the second is the PSS categories.

The energy transition and PSS concept:

Characteristics of the energy transition:

The traditional electricity value chains are represented by production, distribution, and consumption subdivisions. This paper analyses the different perspectives of Servicizing energy's BM along this value chain in the PSS framework by analysing the articles that tackled energy business models.

Recently, the rapid changes in technologies related to energy efficiency, energy storage and renewable technologies have tackled the "business as usual" practice of traditional electricity utilities (Norbert, 2015). With the new paradigm proposed by the "Smart Grid", the producer of renewable energy has become the consumer itself, or a supplier for local consumers. The active role of the consumer makes the energy issue become more dynamic, evolving from a one direction flow to a two directions flow between utilities and consumers. For utilities, mitigating the risk behind energy demand reduction requires changing its traditional BM (Utility Dive, 2015). For the new entrants, servicizing may hold the market opportunity that enables them to put a feet in the market.

Different approaches are emerging that facilitate energy transition. Top down forces like regulations have put pressure on the utilities and have facilitated the emergence of Energy Service Companies ESCos [START_REF] Hannon | Demand pull" government policies to support Product-Service System activity: the case of Energy Service Companies (ESCos) in the UK[END_REF]. In other cases, utilities have found a new market opportunity. This is the case for example of the two major energy utilities in Hawaii who were driven to innovate and overcome landlord and tenant split incentive to implement energy efficiency and renewable programs for households [START_REF] Johnson | Lessons learned from the field: key strategies for implementing successful on-the-bill financing programs[END_REF]. Bottom up approaches have also been considered as a key actors in the energy transition; as an example the number of energy cooperatives in Germany have raised from 136 utilities in 2008 to 888 in 2013 [START_REF] Morris | German Energy Transition[END_REF]. Since the industrial revolution, five transformational technologies have deeply reformed the energy sector: water-powered machine, steam power, electrification, combustion engine and computerization [START_REF] Hargroves | Innovation and Governance in the 21st Century[END_REF]. The new energy transition is considered by some authors as the sixth innovation wave platform [START_REF] Nair | Emergence of green business models: The case of algae biofuel for aviation[END_REF].

Some academic papers have discussed that servicizing energy BM towards cleaner and more efficient usage of energy, could structure the new BM for current utilities and new entrants [START_REF] Hannon | The co-evolutionary relationship between Energy Service Companies and the UK energy system: Implications for a low-carbon transition[END_REF][START_REF] Helms | Asset transformation and the challenges to servitize a utility business model[END_REF]Norbert, 2015;[START_REF] Richter | Business model innovation for sustainable energy: German utilities and renewable energy[END_REF][START_REF] Richter | Utilities' business models for renewable energy: A review[END_REF][START_REF] Shomali | The consequences of smart grids for the business model of electricity firms[END_REF]. Servicizing energy's BMs has different approaches, (1) it can refer to providing technological devices and associated services for energy efficiency or for micro generation. In this case there is a reduction of energy consumption or the generation of renewable energy. Or (2) can refer to the Demand Side Management (DSM) towards the optimization of the energy use. In this case, beyond the technological aspects, a consumer behaviour modification is explored. The result can be a reduction of the energy consumption or the modification of this consumption: in some cases the consumed energy amount can be constant but the time window of the consuming period may vary.

Product Service Systems

The Product-Service System (PSS) concept emerged in 1999 [START_REF] Goedkoop | Product Service systems , Ecological and Economic Basics[END_REF]. Mont et al. define PSS as "a system of product, services, supporting networks and infrastructure that is designed to be competitive, satisfy customer needs and have a lower environmental impact than traditional business models" [START_REF] Mont | Clarifying the concept of productservice system[END_REF].

In general PSS has been classified in three major categories (Tukker and Tischner, 2006a):  Product-oriented: the provider selling the product with additional services.  Use-oriented: the provider keep the ownership of the product and sell the availability or use.  Result-oriented: the provider guarantee specific result to satisfy consumer need. In general, the PSS goes beyond the physical product and provides a solution to a function or to the final need of the consumer. It combines the physical product with intangible services [START_REF] Heiskanen | Can services lead to radical eco-efficiency improvements?-a review of the debate and evidence[END_REF]. Thus the value behind PSS is providing functionality which allows the provider to have the necessary freedom and a wide spectrum of variation of PSS in a single value that makes the PSS more flexible and capable to tackle the possible changes in the market, consumer's trends and stakeholders' expectations. Flexibility is essential for implementing successful PSS that brings out higher revenue [START_REF] Rese | What Makes a PSS Supplier Successful -An Analysis of the Drivers[END_REF]. PSS can bring together sustainability and competitiveness [START_REF] Baines | State-of-the-art in product-service systems[END_REF]Tukker and Tischner, 2006b). integrating service with product has the potential to decouple the materials from consumption that assigns to the motion from material product to immaterial service which, in its turn, will push companies to reduce cost through increasing energy efficiency and reducing the used material [START_REF] Heiskanen | Can services lead to radical eco-efficiency improvements?-a review of the debate and evidence[END_REF][START_REF] Peruzzini | Investigating the Sustainability of Product and Product-Service Systems in the B2C Industry[END_REF].

The contextual factors (existing organization, institutions and networks that share practices, rules and interests) that control the value chain hinder obtaining the desired changes, so that a broader system approach is required rather than business-consumer approach (Tukker & Tischner 2006). [START_REF] Ceschin | Critical factors for implementing and diffusing sustainable product-Service systems: insights from innovation studies and companies' experiences[END_REF] stressed that there is a need for companies to Focus on the contextual conditions that may facilitate or hamper the societal embeding of the PSS. Furthermore, the value in PSS is more related to the components in the context which includes not just the delivered product but also the ad-on service and the associated activities with consumers rather than the components themselves [START_REF] Wallin | Developing PSS Concepts from Traditional Product Sales Situation: The Use of Business Model Canvas[END_REF].

In general the relationship between the consumer and suppler in the traditional selling process, is terminated after selling the product, while in PSS it is extended with major focus on usage phase to guarantee the desired results. Thus, more trust is required when dealing with PSS, indeed, a clear understanding of consumer expectations, his/her capability to deal with new technologies and division of responsibilities should be addressed [START_REF] Francisco Kurak | Challenges for PSS Implementation: Identification and Classification[END_REF].

PSS in the energy sector

Criteria for energy PSS classification:

The major reason behind changing the energy production and consumption patterns is the need for more sustainable and cleaner source of energy. Many academic papers have focused on renewables, energy efficiency and distributed energy. In the same line, PSS has been considered a way of delivering value with less environmental impact by decoupling material and energy from consumption.

Conflict of interest between current regulatory policies which push towards reduce end-user consumption and the current BM of utility which profits from the amount of sold energy [START_REF] Sousa | Dealing with the paradox of energy efficiency promotion by electric utilities[END_REF]. So that decoupling utility revenue from energy consumption would encourage utilities to participate more in energy efficiency, renewable energy technologies and demand side management. This split of utility revenue from consumption could be done by delivering more services than product.

Energy transition characterised by three aspects: changing the consumer behaviour, integrating new technologies for energy efficiency and developing renewable energies. ("The négaWatt energy scenario," n.d.).

Changing consumers' behaviour can be fostered by two different perspectives. On one hand the reduction of the energy consumption can be stimulated by modifying the way the consumers performs the actions to obtain a function. On the other hand, the consumer might be induced to modify the periods of energy consumption, for example from day time to night period in order to balance the electrical load management.

Changing the rooted patterns of energy consumption can occur through different incentives. It can be voluntary behaviour change through information and knowledge, or could be obtained by changing the contextual factors (e.g. energy prices) [START_REF] Abrahamse | A review of intervention studies aimed at household energy conservation[END_REF]. [START_REF] Laicane | Reducing Household Electricity Consumption through Demand Side Management: The Role of Home Appliance Scheduling and Peak Load Reduction[END_REF] have showed a significant amount of peak reduction that has been obtained by altering consumers behaviour through useful information and feedback about their consumption obtained by smart meters.

Energy efficiency has contributed effectively to reduce CO2 emissions by 10.2 billion tonnes of CO2 since 1990(International Energy Agency, 2015). It strengthens the energy security and aids in flattening the consumption load curve. It is a way of managing and limiting energy growth consumption (IEA, n.d.). Integrating new technologies for energy efficiency means delivering the same services by less energy or more services by using the same energy. Common examples include replacing incandescent bulb by LEDs that uses less energy and produces the same amount of light.

Finally, renewable energy has been considered a more sustainable source of energy that enables energy security due to its diversity. Its increasing share is expected to change the energy sector structure (Boston Consulting Group, 2010). A new trend for energy utility is expected to be developed which could be decentralized and small-size [START_REF] Alanne | Distributed energy generation and sustainable development[END_REF]. The role of energy utilities and how they could exploit RE technologies is not yet clear [START_REF] Richter | Utilities' business models for renewable energy: A review[END_REF].

In the next section, new product-service systems in the energy sector will be described and classified following two criteria. On one hand the category of PSS regarding the servicitation level (product-oriented, use-oriented or result-oriented). On the other hand associating the PSS to a consumer behaviour modification, to a technology for energy efficiency or to a renewable energy.

A review of new Product-Service Systems for the energy transition

In this section, we classify the business models that aim to change consumer behaviour, and then we indicate the PSS category in these BMs. Many strategies can lead to change the consumer behaviour: "antecedent strategies" (e.g. commitment, target setting, information), "consequence strategies" (e.g. feedback, incentives and rewards) [START_REF] Abrahamse | A review of intervention studies aimed at household energy conservation[END_REF]. However, we will focus on models that can be included into the PSS framework the results are proposed in the Table 1 hereafter.

Table 1. The intersection between energy transition criteria and PSS categories

Energy transition criteria

PSS Classification

Product-oriented Use-oriented Result-oriented

Changing consumer Behaviour [START_REF] Valencia | The Design of Smart Product-Service Systems (PSSs): An Exploration of Design Characteristics[END_REF], [START_REF] Laicane | Reducing Household Electricity Consumption through Demand Side Management: The Role of Home Appliance Scheduling and Peak Load Reduction[END_REF], [START_REF] Behrangrad | A review of demand side management business models in the electricity market[END_REF], [START_REF] Bell | On-Bill Financing for Energy Efficiency Improvements: A Review of Current Program Challenges, Opportunities, and Best Practices[END_REF] (Behrangrad, 2015) [START_REF] Knol | EnerCities-A serious game to stimulate sustainability and energy conservation: Preliminary results[END_REF] Efficiency [START_REF] Bell | On-Bill Financing for Energy Efficiency Improvements: A Review of Current Program Challenges, Opportunities, and Best Practices[END_REF], [START_REF] Kobus | A real-life assessment on the effect of smart appliances for shifting households' electricity demand[END_REF], [START_REF] Bertoldi | Tradable white certificate schemes: fundamental concepts[END_REF]) [START_REF] Sorrell | The contribution of energy service contracting to a low carbon economy[END_REF], [START_REF] Bertoldi | Liberating the power of energy services and ESCOs in a liberalised energy market[END_REF]) [START_REF] Sorrell | The contribution of energy service contracting to a low carbon economy[END_REF], [START_REF] Bertoldi | Liberating the power of energy services and ESCOs in a liberalised energy market[END_REF], [START_REF] Apajalahti | From demand side management (DSM) to energy efficiency services: A Finnish case study[END_REF] Renewable energy [START_REF] Richter | Utilities' business models for renewable energy: A review[END_REF], [START_REF] Gsodam | The renewable energy debate: how Austrian electric utilities are changing their business models[END_REF] (Richter, 2012), [START_REF] Gsodam | The renewable energy debate: how Austrian electric utilities are changing their business models[END_REF], [START_REF] Liu | Purchasing vs. leasing: A benefit-cost analysis of residential solar PV panel use in California[END_REF]) [START_REF] Kroposki | Renewable systems interconnection: Executive summary[END_REF], [START_REF] Schoettl | Photovoltaic business models: threat or opportunity for utilities[END_REF] Previous works [START_REF] Laicane | Reducing Household Electricity Consumption through Demand Side Management: The Role of Home Appliance Scheduling and Peak Load Reduction[END_REF] indicates that smart meters provide useful information about appliance's consumption in households, and can lead to significant changes in load consumption, thus the load peak could be avoided. In the line with smart meters, the integration of smart product with e-service has been introduced as Smart Product-service System. An example about Smart PSS for energy efficiency is Wattcher (www.wattcher.nl) which is a sensor measures and displays energy consumption and enables consumers, through a web portal, to communicate and compare energy consumption [START_REF] Valencia | The Design of Smart Product-Service Systems (PSSs): An Exploration of Design Characteristics[END_REF]. We can describe these business models as Product-oriented PSS as these meters should be supported by other services like data process and supplemental services like comparing consumption with others as mentioned before.

Gamification is powerful way to educate people and influence the energy consumption.

EnerCities is serious game that has some preliminary results that led to increase user awareness and more positive attitude towards some every-day energy related behaviours. Gamification for energy transition can be classified as result-oriented PSS as the game is more than the tangible product and the intangible information [START_REF] Knol | EnerCities-A serious game to stimulate sustainability and energy conservation: Preliminary results[END_REF].

On-bill financing is an innovative financing method that allows consumers to overcome upfront payment of implementing energy efficiency measures by providing the necessary loan and dividing it to small monthly payments that are cut from the amount of monthly bill savings. On-bill financing can lead to win-win situation and permits the energy companies to diffuse efficiency measures and renewable energy technologies [START_REF] Johnson | Lessons learned from the field: key strategies for implementing successful on-the-bill financing programs[END_REF]. this solution is a financial product served by utility which is coupled with energy efficiency services that lead to energy efficient improvements [START_REF] Bell | On-Bill Financing for Energy Efficiency Improvements: A Review of Current Program Challenges, Opportunities, and Best Practices[END_REF]. Thus it could be classified as productoriented PSS. Similarly White Certificate has been considered as a market mechanism for stimulating energy efficiency actions, it confirms that an specific amount of energy savings have been achieved by market actor as a results of energy efficiency improvement measures [START_REF] Bertoldi | Tradable white certificate schemes: fundamental concepts[END_REF]. White certificates are tradable in the market, so that it is considered as a cost recovery mechanism. An positive relationship between providing energy services and white certificate in France has been noticed and tested [START_REF] Duplessis | An empirical typology of energy services based on a well-developed market: France[END_REF]. Thus White Certificate can be classified: a financial service for the user who can acquire a new energy efficient equipment.

Demand Side Management (DSM) has been introduced as a way of flatten the load curve of consumption, Two main services have become the major elements of the DSM [START_REF] Behrangrad | A review of demand side management business models in the electricity market[END_REF] Energy efficiency and Demand response (DS). The former is a model for incentivize customer to change their consumption pattern in order to reduce the electricity consumption.

The former is a model for incentivize customer to change their consumption pattern in order to reduce the peak of the consumption in the load curve. "Business model involving load" includes both price incentives and consumption awareness that consumer needs in order to reduce the electricity cost of the load. This BM offers infrastructure to the consumer to receive price information at a suitable time and format. In other words it is about selling infrastructure, visualization devices and software [START_REF] Behrangrad | A review of demand side management business models in the electricity market[END_REF]. This BM could be product-oriented PSS, when selling the infrastructure with the supporting software services or could be useoriented PSS when the infrastructure is rented.

Energy Service Company (ESCo) is defined as "a company that offers energy services which should include implementing energy efficiency projects (and other sustainable energy projects)" [START_REF] Bertodli | ESCO market report 2013[END_REF]. (Sorrel, 2005) has introduced two concepts "useful energy" and "final energy service" based on the analysis of ESCos activities. The idea behind "Useful energy" is to implement more efficient form of energy generation like Combined Heat and Power (CHP) so that the output is hot water, coolant or heat. The consumer will be charged by the unit of useful energy. That will make lower cost for consumer and enable ESCo from profiting from energy savings. The useful energy is a use-oriented PSS as it is obtained by primary conversion tool (e.g. CHP) [START_REF] Sorrell | The contribution of energy service contracting to a low carbon economy[END_REF].

Final energy service is about guaranteeing a specific results like room temperature or degree of lighting by conversion, control and distribution of the necessary technologies. That can be categorized as result-oriented PSS as the stream of services (lighting, heating) is obtained by secondary conversion tool (e.g. radiator or fluorescent) and can be consumed directly by the consumer [START_REF] Sorrell | The contribution of energy service contracting to a low carbon economy[END_REF].

( [START_REF] Bertoldi | Liberating the power of energy services and ESCOs in a liberalised energy market[END_REF] presents Mini-ESCos as a business model that can propose energy efficiency measures to households as alternative for ESCo. Mini-ESCo could be the small facilities that used to provide maintenances and breakdown repair for households. Many reasons are behind this proposal, the lack of awareness of ESCo business, the cost comparing with savings [START_REF] Pätäri | Enabling and hindering factors of diffusion of energy service companies in Finland-results of a Delphi study[END_REF]. In addition, there is a the lack of trust towards large energy utilities [START_REF] Holt | The Treatment of Renewable Energy Certificates, Emissions Allowances, and Green Power Programs in State Renewables Portfolio Standards[END_REF][START_REF] Richter | Utilities' business models for renewable energy: A review[END_REF] and scepticism about the real motivation for utility to engage in households energy efficiency [START_REF] Apajalahti | From demand side management (DSM) to energy efficiency services: A Finnish case study[END_REF]. Households can shift their energy consumption to period when there is abundant of electricity that generated by solar panels by using smart appliances that can schedule their working hours to fit with weather and the sunny days [START_REF] Kobus | A real-life assessment on the effect of smart appliances for shifting households' electricity demand[END_REF]. This business model depends on efficient technologies and supporting services such energy management system and energy prices changes and it can be use-oriented PSS or product-oriented depending on the ownership.

Finally, some papers have tackled the energy transition and analyse the business model where the value can be shifted from selling energy as commodity to selling services. [START_REF] Apajalahti | From demand side management (DSM) to energy efficiency services: A Finnish case study[END_REF] suggests that " energy service-based business solution" such as light and heat can be an alternative model that grasps the efficiency benefits.

Among of the three different renewable energy BMs; lowest price, best technology and customer intimacy, the Investors prefer to select "customer intimacy" business model which is a service-dominated and service-centralised BM rather than an upstream productiondominated BM [START_REF] Loock | Going beyond best technology and lowest price: on renewable energy investors' preference for service-driven business models[END_REF]. The services attached to customer-side renewables may range from simple consulting services to a full services package including financing, ownership, operation and maintenance of the assets [START_REF] Gsodam | The renewable energy debate: how Austrian electric utilities are changing their business models[END_REF][START_REF] Richter | Utilities' business models for renewable energy: A review[END_REF]. Between purchasing and leasing of solar photovoltaic cell micro-generation, the leasing has become more popular option as the supporting service like regularly scheduled maintenances are often handled by the lessor. In addition, this kind of BM avoiding the up-front cost [START_REF] Liu | Purchasing vs. leasing: A benefit-cost analysis of residential solar PV panel use in California[END_REF]. "1 st Generation PV business models" are more attractive BMs that overcome the market barriers and reach broader markets. The model is driven by third party rather than utility and own the PV systems, thus it reduces hassle and complexity for the consumer [START_REF] Kroposki | Renewable systems interconnection: Executive summary[END_REF]. While the ownership is linked to third party who controls the whole system, This BM is rather results-oriented PSS. Another result-oriented BM "Turnkey project provider" which is a more pure service BM. Consumer doesn't own the PV and doesn't want to be bothered by selecting and installing the PV. They just want reliable sources of energy, competitive prices and assurance of rapid-response service and supporting maintenance [START_REF] Schoettl | Photovoltaic business models: threat or opportunity for utilities[END_REF].

Also utility may move from selling a commodity to providing energy services [START_REF] Helms | Asset transformation and the challenges to servitize a utility business model[END_REF][START_REF] Richter | Business model innovation for sustainable energy: German utilities and renewable energy[END_REF] and change their business model [START_REF] Loock | Going beyond best technology and lowest price: on renewable energy investors' preference for service-driven business models[END_REF]. Changing utility BM is confronted with many obstacles such as managing intangible assets like services, the lack of demand and willingness to pay for innovative services and the difficulty associated with simultaneously managing utility and service business [START_REF] Helms | Asset transformation and the challenges to servitize a utility business model[END_REF]. The "conflicting institutional demands" are sending confusing signals to utilities and consumer similarly [START_REF] Apajalahti | From demand side management (DSM) to energy efficiency services: A Finnish case study[END_REF]. Moreover, there is the lack of understanding of the importance of changing the business model in order to successfully exploit the new technologies "cognitive barriers to business model innovation". Also the inability to allocate resources to new technologies or developing new BM for these technologies [START_REF] Richter | Business model innovation for sustainable energy: German utilities and renewable energy[END_REF].

Discussion

This research work is developed in the framework of a European Union's Horizon 2020 project called GreenPlay. This project seeks to reduce by 30% the electricity consumption in the household sector and will be validated through a large scale experiment based on 200 households situated in France and Spain.

The Greenplay system is composed by sensors, a smart monitoring platform and a game. The sensors installed at the user's home measure global electricity, heating, water heating and temperature. The sensors are linked to GreenPlay system. The core of this system is a pervasive game i.e. eco-gestures in real life and thus electricity consumption reduction allows to earn points and evolve in the game.

The system allows to monitor real behaviour and possible long-term changes in the context of the participation of the customer in the load management [START_REF] Apajalahti | From demand side management (DSM) to energy efficiency services: A Finnish case study[END_REF] and energy efficiency [START_REF] Helms | Asset transformation and the challenges to servitize a utility business model[END_REF].

The use of game principles or "gamification" is an efficient tool to deal with behavioural modifications [START_REF] Nieuwdrop | Presented at the EcoSD ATA[END_REF], (Germaud, 2013).

(ABI [START_REF] Akle | Game as measurements tool of the real uses in dwellings to reduce energy consumption[END_REF] have identified nine projects working on pervasive and persuasive gaming for energy conservation.

The main research objective of the Greenplay project is to study the potential of combining game elements and instructional advices for modifying energy consumption. The combination of these two elements within a serious games offers some possibilities to encourage the immersion in context, the empowerment and the learning appetence of users.

Through this approach, the system identifies the use of energy and users' behavior in the private sphere. This information can be used to identify decision variable for product design processes (building, home appliances, etc.), as well as an input for the development of innovative business models that rely the product and services associated to the building ecosystem.

Greenplay is a User-centred project. Consumer is more literate than before and there is emerging tendency to surpass price issue in order to consume green energy. The digital technology offers momentary channels of two side interactions which enable personalize energy experience and determine the specific needs of consumers, and gathering feedback and suggestion from consumers. Furthermore, automation of appliances and integrating energy with different household's products and services would encourage consumer to engage and go further to become prosumer selling and buying energy.

All the consumer characteristics that mentioned above are confronted with the traditional business model of energy utilities which is still confined to the one way flow of power and information, dependency on economies of scale as cost structure, weak and broken relationship with consumers and reliance on fossil fuel as unlimited and inexpensive source of power.

Between the two ends, consumer expectations and utilities perspectives, the paper puts spotlight on PSS as a new business model that can match the two ends for more sustainable energy value chain. Thus, some supporting emerging concepts based on PSS framework are presented which support this hypothesis.

Channing consumer behaviour can be reached through PSS by offering real time devices (meters, sensors, etc.) coupled with supporting services (communication, sharing, advices etc.) that help consumer to change their aptitudes, become more active and reduce their energy consumption.

In the same line, these infrastructure and services can be used for avoiding the peak load of household electricity, by use-oriented or product-oriented PSS business models depending on the ownership. This paper could be considered as the cornerstone of the PhD launched within the Greenplay project which aims to define energy business models that respond to the changes in the energy value chain. It poses questions related to the degree of sercivizing, interested stakeholders, user expectations, capability of utilities to take major role, possibility of new players as facilitators. In addition, it tackles the role of incentives factors and barriers such as dynamic prices and hampering factors like regulations and lack of trust of utilities. It addresses the issues related to up-front cost and the role of citizens and cooperatives.

Conclusions

We notice that there are emerging trends to servicizing energy utility's BM and to design BM for new entrants of energy markets. So that, we discussed the ability of PSS to embrace the upcoming changes in the energy system. Furthermore, based on academic review we point out to few BMs that underpin our proposal and map them according to their PSS categories (product-oriented, use-oriented and result-oriented) and their energy transition type (consumer behavior, efficiency and renewable energy). The new technological advancement, the literate consumer and tendency towards green energy, would bring out new form of product and services that need new PSS business model.

nd International Sustainable Development Research Society Conference, School of Science and Technology, Universidade Nova de Lisboa, Lisbon, Portugal, 13 -15 July 2016

Acknowledgement

Authors would like to thank the GreenPlay project (www.greenplay-project.eu) that has received funding from the European Union's Horizon 2020 research and innovation program under grant agreement No. 649621.


Dalia Khader
email: daliakhader@googlemail.com

Charlie Alice

D-Shuffle for Prêt à Voter

Keywords: E-voting, Verifiable Shuffle, Zero knowledge proofs. Echo Bravo Delta

Prêt à Voter is an end-to-end verifiable voting scheme, that uses paper based ballot forms that are turned into encrypted receipts. The scheme was designed to be flexible, secure and to offer voters a familiar and easy voting experience. Secrecy of the vote in Prêt à Voter relies on encoding the vote using a randomized candidate list in the ballots. In a few variants of Prêt à Voter a verifiable shuffle was used in the ballot generation phase in order to randomize the candidates. Verifiable shuffles are cryptographic primitives that re-encrypt and permute a list of ciphertexts. They provide proofs of correctness of the shuffle and preserve secrecy of the permutation. This paper proposes a new verifiable shuffle "D-Shuffle" that is efficient. We provide a security proof for the D-Shuffle. Furthermore, we show that using the D-shuffle for generating ballots in Prêt à Voter scheme ensures its security against: "Authority Knowledge Attack" and "Chain of Custody Attack".

Introduction

A shuffle is a permutation and re-randomization of a set of ciphertexts. Shuffling itself is relatively easy; the challenge is to provide a proof of correctness of a shuffle that anyone can verify without revealing the permutation. A mix-net is a series of chained servers each of which applies a shuffle to some input ciphertexts, before passing the output to the next server. Mix-nets were used widely in evoting schemes. The main motivation in using them is to submit encrypted votes into a mix-net where every mix-server shuffles the votes. The output of the mixnet is then decrypted providing anonymity to the voters. Using verifiable shuffles prevents mix-servers from cheating. In this paper we focus on one of the well known end-to-end verifiable schemes: Prêt à Voter . The Prêt à Voter approach to verifiable voting, randomizing candidate order on ballot to encode votes, was first proposed by Ryan in [START_REF] Ryan | A variant of the chaum voter-verifiable scheme[END_REF]. Since then several papers were introduced to add extra interesting properties to the original scheme [START_REF] Ryan | A variant of the chaum voter-verifiable scheme[END_REF][START_REF] Ryan | Prêt à voter: a voter-verifiable voting system[END_REF][START_REF] Xia | Versatile Prêt à Voter : Handling Multiple Election Methods with a Unified Interface[END_REF]. Verifiable shuffles were used in Prêt à Voter either to mix the encrypted receipts before publishing them on a public bulletin board, and/or to randomize the candidates on the ballot. The shuffle we propose in this paper is focused on the latter case.

Prêt à Voter Overview

In "Prêt à Voter " ballots are given to voters via a confidential channel. The ballot has a left hand side (LHS) with a randomly permuted list of candidates, and a right hand side (RHS) which carries an encryption of the order of the candidates in the LHS, usually referred to as the onion for historical reasons. Each ballot has a unique serial number (which could be a hash of the onion), (SN ), for administrative purposes such as searching for the ballot on the bulletin board, etc (See Figure 3, Original scheme). The voting takes place in the polling station. In the booth, the voter places a mark next to the name of the candidate she wants to vote for. She separates the RHS from LHS, shreds the LHS and takes the RHS to an official who scans and sends it to the tallying authority. A signed copy of the RHS is given to the voter to keep. The onions are used in the tabulation to interpret the voter's mark on the scanned RHS, enabling the tallying authorities to count the votes. The voter can verify that her vote has been received by checking the onion, serial number and choice of index, against the published results on the bulletin board. The details of the procedure of tabulation, randomization of ballots, tallying, distributing the ballots, etc, varies in the different versions of Prêt à Voter [START_REF] Ryan | A variant of the chaum voter-verifiable scheme[END_REF][START_REF] Ryan | Prêt à voter: a voter-verifiable voting system[END_REF][START_REF] Xia | Versatile Prêt à Voter : Handling Multiple Election Methods with a Unified Interface[END_REF]. On a conceptual level the procedure is the same. Random auditing of the ballots is used in all versions of Prêt à Voter to ensure the well-formedness of ballot forms. The auditing procedure involves decrypting onions on selected ballot forms and checking that they correspond to the LHS order. Given that the authorities responsible of creating the ballots can not predict which ballots will be chosen for auditing, it is hard to cheat without a high possibility of getting caught.

Motivation and Contribution

The Victorian State elections [START_REF] Burton | Using prêt à voter in victorian state elections[END_REF][START_REF] Burton | A supervised verifiable voting protocol for the victorian electoral commission[END_REF][START_REF] Buckland | The future of e-voting in australia[END_REF] considered developing the first state government-level universally verifiable public e-voting system in the world, based on Prêt à Voter . The proposed mechanism of constructing the ballot was adopted from [START_REF] Xia | Versatile Prêt à Voter : Handling Multiple Election Methods with a Unified Interface[END_REF] and is based on using a verifiable shuffle to permute the candidates on the ballot. The proof of shuffle is used as proof of well formness of the ballot. The scheme in [START_REF] Xia | Versatile Prêt à Voter : Handling Multiple Election Methods with a Unified Interface[END_REF] had two vulnerabilities:

-Authority knowledge attack: All ballots are generated by one authority.

Therefore this authority is trusted to maintain both privacy and receiptfreeness. Generating the ballots in a distributed fashion is desirable, because it ensures that no one but the voter ever learns the candidate ordering. However, there are three major obstacles preventing from that in [START_REF] Xia | Versatile Prêt à Voter : Handling Multiple Election Methods with a Unified Interface[END_REF]:

• Proving the ballot is well-formed in the distributed fashion.

• Printing the ballot without the printer(s) learning the order.

• Ensuring robustness so that the scheme can be run even in the presence of some dishonest election officials. -Chain of Custody: The ballot secrecy in Prêt à Voter relies on the fact that no one can know the order of the candidates unless they own the decryption key of the onion. However, the ballot form LHS contains the candidate order as plaintext. This means that the chain of custody between the ballot generation and until the ballot reaches the voter should be trusted. Ryan and Peacock have discussed an alternative approach [START_REF] Ryan | Threat analysis of cryptographic election schemes[END_REF] referred to as Print-on-Demand. The idea is to print ballot forms at the point they are needed. The ballot will have two onions-the LHS one which can be decrypted in the polling station, and RHS one which can be decrypted by the Prêt à Voter tellers as in the original scheme.

The verifiable shuffle needs to be efficient to cope with the number of ballots generated and verified in the election time. In this paper we propose an efficient and secure verifiable shuffle for that purpose referred to as the D-shuffle (it uses disjunctive proofs for verifying the shuffle hence the name). The D-shuffle can also provide a distributed way of creating the ballot and can provide parallel shuffling that enables Print-on-Demand with minimum computational cost.

The Design of the Verifiable D-Shuffle

In the design of the D-Shuffle we require an encryption scheme with Homomorphism and Re-encryption properties. Assume we have an encryption scheme E = (KeyGen, Enc, Dec). Let the key pair generated be (pk, sk). Let r 1 , r 2 be the randomization factors used in encrypting. Let M, M 1 , M 2 be plaintext messages. The properties we require in this paper are:

-Homomorphism: Multiplying two ciphertexts results with a third ciphertext such that:

Enc(pk, M 1 , r 1 ).Enc(pk, M 2 , r 2 ) = Enc(pk, M 1 + M 2 , r 1 + r 2 ); -Re-encryption: An encryption CT = Enc(pk, M, r 1 ) can be re-encrypted such that ReEnc(CT, r 2 ) = Enc(pk, M, r 1 + r 2 ).
The general idea behind our shuffle is derived from Theorem 1. We explain the Theorem using Definition 1 and prove it as follows;

Definition 1. Sequence M = (m 1 , . . . , m n ) is a super-increasing sequence if every element of the sequence is positive integers and is greater than the sum of all previous elements in the sequence (i.e.

m k > k-1 i=1 m i ). Theorem 1. Let M = (m 1 , . . . , m n ) be a super-increasing sequence and S = n i=1 m i . If X = (x 1 , . . . , x n ) is a solution of S = n i=1
x i such that ∀j ∈ {1, . . . , n} :

x j ∈ M , then (x 1 , . . . , x n ) is a permutation of M .
Proof. Recall the subset sum problem: a sequence of integers M and an integer S, find any non-empty subset X that sums to S. This problem is proven to have either one unique solution or none [START_REF] Koblitz | A course in number theory and cryptography[END_REF] over super-increasing sequences.

Given Theorem 1 assumes the existence of the subset X ⊆ M and assumes that

S = n i=1
x n then by the uniqueness property X is a permutation of M .

Intuition Behind the Design

We explain the intuition behind our design of the D-Shuffle using Theorem 1.

The general idea is to assume all elements of Theorem 1 are encrypted and we prove the theorem holds using zero knowledge proofs. Let M be a superincreasing sequence that is encrypted and fed to the D-Shuffle as input. Assume the output is the encrypted version of X = (x 1 , . . . , x n ). According to Theorem 1 the output is a permutation if the following two conditions hold:

1. The Belonging Condition:∀j ∈ {1, . . . , n} : x j ∈ M .

In the D-Shuffle this is equivalent to saying "All output ciphertexts belong to the list of all input ciphertexts". We require the disjunctive re-encryption proof shown in Figure 1.

The Summation Condition

: S = n i=1 m i = n i=1 x k .
In the D-Shuffle this is equivalent to saying that the homomorphic summation of the input ciphertexts and the homomorphic summation of the output ciphertexts are encryptions of the same plaintext value (i.e. the output sum is just a re-encryption of the input sum). We require the re-encryption proof shown in Figure 2.

The Construction of the D-Shuffle

Let the plaintext we intend to encrypt and shuffle be the super-increasing sequence M = (m 1 , . . . , m n ). We start with creating a list {c 1 , . . . , c n } such that c k = Enc(pk, m k , 1). Note that we can verify correctness of the encryption easily since the randomization is 1.

The Shuffling Procedure:

1. Choose r 1 . . . r n random values. One can have a mix-net where each mix-server i runs the D-shuffle on the output of the server i -1.

Verifying the Shuffle: 3. For all j s.t. j ∈ {1, . . . , n}; Check DRE.V erif y({c 1 , . . . , c n }, cj , pk, π j ) = 1. 4. Check RE.V erif y(C, C, π) = 1.

Security of the D-Shuffle

There are three properties that a verifiable shuffle should achieve: secrecy of the permutation, soundness of the proofs, and correctness of the proofs.

-Correctness of the verification of the shuffle implies that an honest prover (shuffler) has to be able to create the re-encryption and zero knowledge proofs such that they verify correctly. This is achieved by assuming correctness of the zero knowledge proofs used in Figure 1 and Figure 2. -Soundness of the verification of shuffle implies that no dishonest prover (shuffler) can produce a proof of shuffle that verifies correctly. This is guaranteed with the soundness of the proofs and the uniqueness property in Theorem 1. -Secrecy of the permutation depends on two security notions, the zero knowledge property of the proofs and on the security of the encryption scheme (see appendix, IND-V-CPA,IND-V-CCA1, or IND-V-CCA2).

On Instantiations of the D-shuffle

The D-Shuffle requires homomorphic properties to verify the sums. Exponential ElGamal and Paillier were heavily used for voting applications for their homomorphic properties. In the Victorian State elections [START_REF] Burton | Using prêt à voter in victorian state elections[END_REF][START_REF] Burton | A supervised verifiable voting protocol for the victorian electoral commission[END_REF][START_REF] Buckland | The future of e-voting in australia[END_REF] the suggestion was to use Exponential ElGamal. In this paper we focus on having general constructions of the D-shuffle and Prêt à Voter . Recent security analysis showed that using IND-CCA2 encryptions for creating ballots [START_REF] Bernhard | Adapting helios for provable ballot privacy[END_REF][START_REF] Bernhard | How not to prove yourself: Pitfalls of the fiat-shamir heuristic and applications to helios[END_REF][START_REF] Khader | Receipt freeness of prêt à voter provably secure[END_REF] is sufficient to guarantee secrecy of vote. If we require both homomorphic properties and IND-CCA2 security then we can use Naor-Yung encryptions [START_REF] Bernhard | Adapting helios for provable ballot privacy[END_REF][START_REF] Bernhard | How not to prove yourself: Pitfalls of the fiat-shamir heuristic and applications to helios[END_REF][START_REF] Khader | Receipt freeness of prêt à voter provably secure[END_REF] or Cramer-Shoup encryption [START_REF] Loftus | On cca-secure somewhat homomorphic encryption[END_REF][START_REF] Wikström | A universally composable mix-net[END_REF]. The two mentioned encryption schemes have an extractable part of the cipher that is homomorphic.

On the Efficiency of D-Shuffle

The main advantage of the D-Shuffle is the fact that it is non-interactive. The first non-interactive verifiable shuffle was proposed in [START_REF] Groth | A non-interactive shuffle with pairing based verifiability[END_REF], however, the proofs were extremely large 15n + 120, where n is the number of ciphertexts being shuffled. In a more recent result by Lipmaa and Zhang [START_REF] Lipmaa | A more efficient computationally sound non-interactive zero-knowledge shuffle argument[END_REF], the size of the proof dropped to 6n + 11. In the D-shuffle assuming we use ElGamal Exponential, the disjunctive zero knowledge proof for an ElGamal encryption is 2n and the zero knowledge proof of Re-Encryption for ElGamal is two more elements, causing the total to drop to 2n + 2. Jakobsson et al [START_REF] Jakobsson | Making mix nets robust for electronic voting by randomized partial checking[END_REF] proposed a technique for making mix nets robust and efficient, called randomized partial checking. The general idea is to ask each server to reveal a pseudo-randomly selected subset of its input/output relations, therefore providing strong evidence of correctness. The secrecy of the permutation also gets compromised using such a technique to a certain level [START_REF] Khazaei | Randomized partial checking revisited[END_REF]. The D-shuffle allows the verifier to choose the balance between "correctness proofs vs efficiency" as they require without compromising secrecy.

The verifier can choose randomly the number of disjunctive proofs he would like to obtain since the proofs are independent and given the disjunctive proofs do not reveal any input/output relations, the permutation remains secret.

The D-Shuffle used for Prêt à Voter

The ceremony of the voting, tabulation and verification of the vote remain unchanged as described in §1.1. Each candidate is presented in a code m i such that the set (m 1 , . . . , m n ) is super-increasing and is publicly announced. The onion contains an encrypted list of the different candidates i.e. a permutation of {Enc(pk, m 1 , r 1 ), Enc(pk, m 2 , r 2 ), . . . , Enc(pk, m k , r k )} that corresponds to the order of the candidates on the LHS. The ballot creation uses the D-Shuffle such that each mix-server i verifies the zero knowledge proofs of server i -1, shuffles the outputs of i -1 and publishes the new zero knowledge proofs on a bulletin board. The initial ciphertexts input to mix-net, i.e. server i = 1, is {Enc(pk, m 1 , 1), . . . , Enc(pk, m k , 1)} which is verifiable by everyone since the randomization factors are 1 and the candidate codes is public information. The final list of ciphertexts is printed as the onion on the ballot. The auditing of the ballot and checking its well formness can be done in three ways depending on level:

-Extreme Auditing: Verifying all the zero knowledge proofs on the bulletin board. This can be done by any entity that has the means and computational powers. Partial checking of the proofs can be applied here. -Basic Auditing: Checking the onion on the ballots against the Serial Number SN on the bulletin board. This can be by any entity that is willing to act as an observer to the elections and no computational power or cryptographic knowledge is required. -Voter Auditing: Decrypting the RHS and checking it against the LHS. This is the traditional Prêt à Voter technique used by the voters to audit the ballots if they want too.

Among the three techniques, the voter auditing technique is the most user friendly for the voters. However, ballots used for auditing using that technique should not be used for voting. This can be enforced because the only way to audit is to ask the authorities with the decryption key to reveal the candidates order in the onion and at that point the SN is flagged as unusable for election.

Multi-Authority Ballot Generation Each mix-server in the mix-net can be considered an independent authority such that the values that correspond to the ciphertexts published on the final ballot are unknown to any of them. Therefore the privacy and receipt-freeness can not be broken by any of the mix-servers or any number of them. To break privacy and receipt-freeness all mix-servers have to collude. This partially solves "Authority knowledge attack":

-Proving the ballot is well-formed in the distributed fashion. Each mix-server publishes enough zero knowledge proofs to verify that the shuffling is correct and honest. Therefore the final printed ballot is proven well formed given all the proofs published verify correctly. -Ensuring robustness so that the scheme can be run even in the presence of some dishonest election officials. This is done using the three auditing techniques mentioned earlier.

Print-On-Demand vs Preprinted Ballots In Prêt à Voter secrecy of the ballot relies on the assumption that the LHS was not revealed to any entity other than the voter. This means that the chain of custody between the creation of a ballot form and its use in a polling station needs to be trusted. Alternatively, the ballot can be printed in the polling station at the time of the vote [START_REF] Ryan | Prêt à voter: a systems perspective[END_REF]. This is what is referred to as print-on-demand scenario. The ballot given to the voter will have two onions one that can be decrypted in the booth in private and printed out to resemble the LHS and the other is the traditional Prêt à Voter onion existing on the RHS (See Figure 3) which is decrypted in the tallying phase. This avoids the chain of custody issues. Ballot forms can be audited in the same way as previously, by printing the RHS first, and then checking that it matches the LHS. The voting experience with the exception of printing the LHS remains the same too. To achieve print-on-demand one can provide a double Print-on-Demand Original Fig. 3: Prêt à Voter : The Ceremony Statement: Given the pair of ciphertext ( c 1,j , c 2,j ) and list of pair of ciphertexts {(c1,1, c2,1), . . . , (c1,n, c2,n)} prove the knowledge of r1, r2 such that the following is true: [ c 1,j = ReEnc(c1,i, r1)] ∧ [ c 2,j = ReEnc(c2,i, r2)] ∧ [(c1,i, c2,i) ∈ {(c1,1, c2,1), . . . , (c1,n, c2,n)}] Creating the proof: πj = DDRE.P roof ({(c1,1, c2,1), . . . , (c1,n, c2,n)}, ( c 1,j , c 2,j ), pk, r1, r2) Verifying: {0, 1} = DDRE.V erif y({(c1,1, c2,1),. . . ,(c1,n, c2,n)}, ( c 1,j , c 2,j ), pk, πj) -Chain of Custody: The ballots are generated such that parallel shuffling takes place and no mix server knows the final order. The ballot generated does not contain any plaintext and the LHS is encrypted from the point the ballot is generated and until it reaches the polling station. -Authority knowledge attack regarding printers: The double ciphered mixnet can be implemented such that we have multiple printers in the booth. Assume we have three printers in each booth, then we can replace the key pair(pk L , sk L ) with (pk p1 , sk p1 ), (pk p2 , sk p2 ) and (pk p3 , sk p3 ). Each printer outputs part of the LHS and none of the printers will fully know the ballot.

Conclusion

We propose a new verifiable shuffle referred to as the D-Shuffle. The new shuffle is efficient, sound, complete, and ofcourse reserves the secrecy of the permutation. The D-shuffle when used for creating ballots in a Prêt à Voter scheme, it prevents "Authority Knowledge Attack" and "Chain of Custody Attack".

Statement:Fig. 1 :Fig. 2 :

 12 Fig. 1: Disjunctive Re-Encryption (DRE) Statement: Given two ciphertexts c, c prove knowledge of r such that: c = ReEnc(c, r) Creating the proof: π = RE.P roof (c, c, r) Verifying: {0, 1} = RE.V erif y(c, c, π) Fig. 2: Re-Encryption Zero Knowledge Proof (RE)

2 .

 2 Create the output list { c1 , . . . , cn } of ciphertexts by re-encrypting and permuting such that cj = ReEnc(c k , r k ) for some c k ∈ {c 1 , . . . , c n }. 3. Create π j = DRE.P roof ({c 1 , . . . , c n }, cj , pk, r).

5 .

 5 Let C = Enc(pk, S, n + 1) = n k=1 c k . Note that the randomization factor equals n + 1 since the randomization factors of the c k is all equal to 1. 6. Let C = n k=1 ck = Enc(pk, S, n + 1 + R) = ReEnc(C, R).

7 .

 7 Create Re-Encryption Zero Knowledge Proof π = RE.P roof (C, C, R).

1 .

 1 Compute from the input ciphertexts C =

Fig. 4 :

 4 Fig. 4: Disjunctive Double Re-Encryption ciphertext disjunctive zero knowledge proof as shown in the Figure 4 in place of the disjunctive proofs used earlier. The print-on-demand solves the remaining two problems:

A Secrecy of the D-Shuffle

We recall the definition of IND-CCA2, given a public-key encryption scheme that consists of the three algorithms (KeyGen, Enc, Dec). 1. Setup. The challenger takes the security parameter λ as input, and runs KeyGen to generate (pk, sk). 2. Phase 1. The attacker is given pk and can issue a polynomial number of decryption queries with any input: Given C, the challenger returns Dec(C, sk). At some point, the attacker chooses M0, M1 of equal length and sends them to the challenger for a challenge.

A.1 Indistinguishable Vectors of Ciphertexts

To facilitate our security analysis of the D-Shuffle, we proposed a different security model (i.e. IND-V-CCA2 security) for public key encryption schemes. We show that this new security model is equivalent to the standard IND-CCA2.

Definition 3. A public-key encryption scheme achieves IND-V-CCA2 security if any polynomial time attacker only has negligible advantage in the attack game, shown in Fig. 6.

In the model in Figure 6, if we remove Phase 2 in the attack game then it becomes the definition for IND-V-CCA1 (equivalent to IND-CCA1). Furthermore, if we completely disallow the attacker to access the decryption oracle then it becomes the standard IND-V-CPA (equivalent to IND-CPA) security. We proof the following theorem:

Theorem 2. If there exist an Adversary A † that breaks the IND-V-CCA2 then their exist an Adversary A that can break the IND-CCA2 (See Figure 7)

Note that if b = 1 the simulation is unfaithful, however the probability of guessing the right b remains. Adding up the probability of winning when b = 0 leads to 4 + 1 4 and probability of winning when b = 1 is 1 4 . Advantage of winning is:

This advantage is non-negligible when is non-negligible.

Setup. The challenger takes the security parameter λ as input, and runs

KeyGen to generate (pk, sk). 2. Phase 1. The attacker is given pk and can issue a polynomial number of decryption queries with any input: Given C, the challenger returns Dec(C, sk). At some point, the attacker chooses a list M1, . . . , Mn of equal length and two permutation P0, P1 and sends them to the challenger for a challenge. The two properties of correctness and soundness derive directly from the Zero Knowledge proofs. In this section we elaborate more on the secrecy of the permutation. Imagine their exist an adversary A that can guess the permutation of the verifiable D-Shuffle. This adversary can be used as a subroutine for A † for breaking the IND-V-(CPA,CCA1,CCA2) as follows:

-In the challenge, the adversary A † chooses M 1 , . . . , M n , P 0 , and P 1 sends them to C. -He receives back E b back. Note that E b has two permuted lists.

-A † chooses the first list and simulates the zero knowledge proofs.

-A † sends the list and the simulated proofs to A.

-A should return either P 0 or P 1 . If P 0 is returned then A † answers back his guess as b = 0 otherwise b = 1

Furthermore, the same adversary A can be used as a sub-routine for A ‡ to break the zero knowledge properties as follows:

-A ‡ encrypts a list of M 1 . . . , M n to obtain c 1 , . . . , c n , -It permutes them to c1 , . . . , cn .

-It queries the zero knowledge oracle for the disjunctive proofs of each cipher.

-Computes the Zero knowledge of the sum as done in Figure 2.

-Sends the proofs together with c1 , . . . , cn to A.

-If the proofs are real then A should return back the expected permutation, otherwise A gives a guess which is unlikely to be the permutation (probability is n!) and implies the zero knowledge proofs were a simulation only.

B Non-interactive Zero knowledge proofs

Equality between discrete logs: Proving knowledge of the discrete logarithm x to bases f, g ∈ Z * p , given h, k where h ≡ f x mod p and k ≡ g x mod p [START_REF] Pedersen | A Threshold Cryptosystem without a Trusted Party[END_REF][START_REF] Chaum | Wallet Databases with Observers[END_REF].

Sign. Given f, g, x, select a random nonce w ∈ R Z * q . Compute Witnesses f = f w mod p and g = g w mod p, Challenge c = H(f , g ) mod q and Response s = w + c • x mod q. Output signature as (f , g , s) Verify. Given f, g, h, k and signature (f , g , s, c), check f s ≡ f • h c (mod p) and g s ≡ g • k c (mod p), where c = H(f , g ) mod q.

A valid proof asserts log f h = log g k; that is, there exists x, such that h ≡ f x mod p and k ≡ g x mod p. Re-Encryption proofs for Exponential ElGamal Imagine you have two Exponential ElGamal ciphertexts for the key-pairs(y = g x , x):

In other words c = ReEnc(c, r 2 ). A zero knowledge proof of Re-Encryption is simply done by the prover providing a zero knowledge proof of the equality between discrete logs between u 2 /u 1 and v 2 /v 1 to the bases g, y respectively. A valid proof asserts that (u i , v i ) ∈ {(u 1 , v 1 ), . . . , (u n , v n )}. Disjunctive Double Re-Encryption Proofs for Exponential ElGamal Given the following:

Disjunctive Re-encryption Proof for Exponential ElGamal

-Let h = g y . Let (CT, CT ) be a pair of ElGamal Encryption for the same message m.

Sign. Select random values d 1 , . . . , d n , r 1 , . . . , r n , R 1 , . . . , R n ∈ Z * p . For t ∈ {1, . . . , i -1, i + 1, . . . , n}, compute:

Choose randomly the nounces ω 1 , ω

If true accept the signature of knowledge otherwise reject it. A valid proof asserts that (u i , v i ) ∈ {(u 1 , v 1 ), . . . , (u n , v n )}.


Dmitry Chernyavskiy

Natalia Miloslavskaya
email: ngmiloslavskaya@mephi.ru

An Approach to Information Security Policy Modeling for Enterprise Networks

Keywords: Information Security Policy, Policy Management Process, Network Security System, Finite Automaton, Algebra

Network security management is one of the most topical concerns of information security (IS) in modern enterprises. Due to great variety and increasing complexity of network security systems (NSSs) there is a challenge to manage them in accordance with IS policies. Incorrect configurations of NSSs lead to outages and appearance of vulnerabilities in networks. Moreover, policy management is a time and resource consuming process, which takes significant amount of manual work. The paper discusses issues of policy management process in its application for NSSs and describes a policy model aimed to facilitate the process by means of specification of IS policies independently on platforms of NSSs, selection of the most effective NSSs aligned with the policies, and implementation of the policies in configurations of the NSSs.

Introduction

Network security in most enterprises relies on such network security systems (NSSs) as firewalls and intrusion detection/prevention systems (IDS/IPS) [1]. However, management of NSSs faces challenges tied with time-consuming manual processes, lack of visibility in information security (IS) policies and configuration errors, which lead to network outages and appearance of vulnerabilities [START_REF]The State of Network Security 2013: Attitudes and Opinions[END_REF]. For instance, a policy (hereafter "policy" means "IS policy") for Check Point or Cisco firewalls may consist of thousands of rules and such complexity of policies is the main cause of configuration errors [START_REF] Chappell | An Analysis of Firewall Rulebase (Mis)Management Practices[END_REF][START_REF] Wool | Trends in Firewall Configuration Errors: Measuring the Holes in Swiss Cheese[END_REF].

Thus, on the one hand, increasing number of NSSs and their increasing functionality allow to counter more threats and reduce IS risks as a result. On the other hand, complexity of NSSs' management leads to new risks and time-consuming processes, which reduce overall efficiency of NSSs utilization. Therefore, policy management process for NSSs needs simplification in order to reduce probability of errors and efforts on time-consuming tasks.

A formal approach to policy modeling presented in the paper is aimed to facilitate the process by means of specification of policies independently on platforms of NSSs, selection of the most effective NSSs, and translation of the specified policies into configurations of the NSSs. The contributions of the paper are (a) a policy model for NSSs based on a finite automaton representation of an NSS, (b) an approach to classification of NSSs and selection of the most effective NSS, and (c) a policy algebra based on the model.

The paper is organized as follows. Section 2 overviews policy management process for NSSs and discusses related work on policy modeling. Basic notions of the policy model for NSSs and the approach for selection of the most effective NSS are presented in Section 3. Section 4 introduces the policy algebra for NSSs. Finally, Section 5 concludes the paper.

Related Work

Models of policy management process are presented in [START_REF] Rees | PFIRES: a Policy Framework for Information Security[END_REF][START_REF] Wahsheh | Security Policy Development: Towards a Life-Cycle and Logic-Based Verification Model[END_REF][START_REF] Knapp | Information security policy: An Organizational-level Process Model[END_REF][START_REF] Tuyikeze | An Information Security Policy Development Life Cycle[END_REF]. All the models consider policy management as iterative process and include similar operations. The most detailed description of policy management process is presented in [START_REF] Rees | PFIRES: a Policy Framework for Information Security[END_REF] and from the standpoint of NSSs management the following operations of the process are important. During Policy Assessment step a request for initial policy creation or update of the existing one is evaluated in order to identify policy conflicts and effects. The requested change should be made in the framework of existing IS maintenance system (ISMS includes IS management system and security tools and measures). Identification of IS threats for assets and a list of appropriate options of NSSs that counter the threats, payroll and non-payroll cost of the options as well as determination of options priority are included in Risk Assessment step. Creation of new policies or update of existing ones proceeds during Policy Development step. Requirements for ISMS are derived upon Requirements Definition step in order to assure that it is aligned with new policies. In the course of Controls Definition step the requirements to ISMS are transformed into a selection of the best options of NSSs and requirements to them. Upon Controls Implementation step the NSSs are installed and configured in accordance with the policies. Compliance and audit checks carried out during Monitor Operations step in order to ensure that ISMS functions in alignment with the policies. Review Trends and Manage Events step includes identification of events and trends (internal and external in relation to an enterprise) that may indicate a need to make changes in the policies. Further, during the step possible changes are evaluated against any appropriate criteria in order to make sure that the changes are essential and escalated to the beginning of the process [START_REF] Rees | PFIRES: a Policy Framework for Information Security[END_REF]. In addition, if during Policy Assessment, Risk Assessment or Policy Development steps it is identified that some policies are not needed any more, then they must be retired [START_REF] Knapp | Information security policy: An Organizational-level Process Model[END_REF]. Note that policy management process is iterative due to continuous changes in technologies, business environment and legal requirements [START_REF] Tuyikeze | An Information Security Policy Development Life Cycle[END_REF].

Thus, in the scope of the process there are the following significant groups of tasks: (a) development and update of policies, (b) selection of the best options of NSSs that are in line with the policies, (c) translation of the policies into configurations of the selected NSSs, and (d) detection and resolution of conflicts in the policies. Formal policy models can be applied to the process in order to automate the tasks and as a result reduce time-consuming efforts and probability of errors. Policy modeling approaches are extensively discussed in literature, some of them are presented in [START_REF] Labored | Implementation of a Formal Security Policy Refinement Process in WBEM Architecture[END_REF][START_REF] Cuppens | A Formal Approach to Specify and Deploy a Network Security Policy[END_REF][START_REF] Preda | Model-Driven Security Policy Deployment: Property Oriented Approach[END_REF][START_REF] Preda | Architecture-Aware Adaptive Deployment of Contextual Security Policies[END_REF][START_REF] Garcia-Alfaro | MIRAGE: A Management Tool for the Analysis and Deployment of Network Security Policies[END_REF].

The modeling method [START_REF] Labored | Implementation of a Formal Security Policy Refinement Process in WBEM Architecture[END_REF] is based on four independent atomic functionalities (endflow, channel, transform, and filter functionalities) and a formal language that allows specification and validation of policies for the functionalities. However, such functionalities as logging and alerting are not presented in the model. The model also lacks means for selection of the best options of functionalities.

An access-control language based on XML syntax and Organization-Based Access Control (OrBAC) model, which is an extension of Role-Based Access Control (RBAC), is given in [START_REF] Preda | Model-Driven Security Policy Deployment: Property Oriented Approach[END_REF] and intended to specify firewall policies. While OrBAC supports definition of obligation policies and contexts, the language, however, does not include these capabilities and deals only with authorization policies. Another limitation is consideration only of IP addresses, protocols and ports as filtering parameters in the policies, which does not allow specification of more sophisticated filtering policies that inspect other parameters of network packets.

Another method based on OrBAC is described in [START_REF] Preda | Model-Driven Security Policy Deployment: Property Oriented Approach[END_REF]. The method supports definition of different contexts and obligations within relevant contexts. However, when a policy cannot be implemented by the existing security architecture, the method does not provide means to select appropriate security functionalities for the policy.

An approach [START_REF] Preda | Architecture-Aware Adaptive Deployment of Contextual Security Policies[END_REF][START_REF] Garcia-Alfaro | MIRAGE: A Management Tool for the Analysis and Deployment of Network Security Policies[END_REF] provides specification of OrBAC policies and contexts as well as derivation of configurations for security functionalities. It also allows selection of the best options of functionalities in terms of their cost. For this purpose the approach introduces a notion of "closely equivalent" functionalities but lacks any formal criterion to identify such functionalities.

A formal framework presented in [START_REF] Rahman | A Formal Framework for Network Security Design Synthesis[END_REF] provides means for synthesizing secure network configurations. The framework utilizes a network topology, security requirements and business constraints such as usability and budget limits as inputs in order to derive a cost-effective placement of NSSs in the topology. The framework uses policy requirements only as inputs, but does not include capabilities for specification of policies and their transplantation into configurations of NSSs. Functionalities of NSSs within the framework are considered as "primitive isolation patterns", which can be composed into "composite isolation patterns"; however, a formal classification criterion of the functionalities is not presented.

Hence, the considered approaches either do not support specification of all types of policies for NSSs or do not provide means for selection of the best options of NSSs.

A Policy Model

A system is called an NSS if it is intended to directly or indirectly secure information transferable through an enterprise's network. Assume that function of an NSS is to form any output in accordance with a policy by means of processing of network traffic that comes to its input. In the general case an output of an NSS is network traffic or messages such as log entries and alerts that sent to other systems or IS administrator's console.

Let 𝑃 be a set of all possible policies that NSSs can implement. Actually, 𝑃 consists of sequences of symbols that form commands for different NSSs. If any NSS uses GUI instead of CLI, its policy can be expressed as a text string. For instance, the first rule of Check Point firewall policy shown on Fig. 1 can be written as "N=1 Source=Any Des-tination=Web-Server Service=Any …" or in any other way that reflects semantics of the rule. Also, the set 𝑃 includes the empty sequence 𝜀. Let 𝑇 be a set of network traffic, where 𝑡 ∈ 𝑇 is a network packet (i.e., a sequence of bits), or the empty sequence 𝜀, which means absence of traffic. Consider an NSS as a finite automaton:

𝐹 =< 𝑇 × 𝑃, 𝑆, 𝑇 × 𝑀, 𝛿, 𝑓 >,
where 𝑇 × 𝑃 is an input alphabet, 𝑆 is a finite set of internal states of NSS, 𝑇 × 𝑀 is an output alphabet, 𝛿: 𝑇 × 𝑃 × 𝑆 → 𝑆 is a state-transformation function and 𝑓: 𝑇 × 𝑃 × 𝑆 → 𝑇 × 𝑀 is an output function, 𝑀 is a set of output messages, which also includes 𝜀 (similar to the case of the set 𝑇). An NSS functions in discrete time 𝜏 and transforms an input traffic 𝑡(𝜏) ∈ 𝑇 into an output traffic 𝑡′(𝜏) ∈ 𝑇 in accordance with a policy 𝑝(𝜏) ∈ 𝑃. An NSS changes its internal state 𝑠(𝜏) ∈ 𝑆 into state 𝑠(𝜏 + 1) ∈ 𝑆 while it functions (Fig. 2). The set 𝑆 can include such parameters as time, number and sequence of packets in a session and other parameters essential to model stateful analysis of a network traffic. Such NSS as a stateless packet filter can be considered as an NSS with one state, i.e., |𝑆| = 1.

Fig. 1. An example of Check Point firewall policy

Fig. 2. A finite automaton model of an NSS

Assume that every policy 𝑝 ∈ 𝑃 is represented as a triple of the following finite vectors:

 𝑥 ⃗ = (𝑥 1 , 𝑥 2 , … ) is an input vector, describing an input traffic of an NSS, where 𝑥 𝑖 ∈ 𝑋 𝑖 , while 𝑋 𝑖 is a set of parameters of any homogenous nature (for instance, 𝑋 𝑖 can be a set of IP addresses, protocols, port numbers or any other attribute of a network traffic);  𝑦 ⃗ = (𝑦 1 , 𝑦 2 , … ) is an output vector, describing an output traffic and/or messages generated by an NSS, were 𝑦 𝑖 ∈ 𝑌 𝑖 while 𝑌 𝑖 is a set of parameters of output network traffic of any homogenous nature (similar to the case of the input vector) or a set of parameters of the messages;  𝑧 ⃗ = (𝑧 1 , 𝑧 2 , … ) is a state vector, describing an internal state of an NSS. For instance, 𝑧 𝑖 ∈ 𝑍 𝑖 can be a system time of an NSS.

Any policy 𝑝 ∈ 𝑃 is said to be definite if the triple of the policy consists of explicitly defined parameters (concrete protocols, IP addresses, ports, messages, etc.). Any policy that consists of parameters expressed in general view without concretization of elements of corresponding sets (IP address, protocol or port in general, etc.) it is called a generalized policy. Note that all policies from the set 𝑃 are definite policies, since only definite policies are implementable by NSSs. By 𝑃 𝑔𝑒𝑛 denote a set of generalized policies. For instance, vector 𝑥 ⃗ = (192.168.1.1, 𝑇𝐶𝑃, 80) belongs to a definite policy, while 𝑥 ⃗ 𝑔𝑒𝑛 = (𝑆𝑜𝑢𝑟𝑐𝑒 𝐼𝑃, 𝑃𝑟𝑜𝑡𝑜𝑐𝑜𝑙, 𝑃𝑜𝑟𝑡) is the vector of corresponding generalized policy, where Source IP is the set of source IP addresses, Protocol is the set of protocols, Port number is the set of ports. For any generalized policy 𝑝 𝑔𝑒𝑛 ∈ 𝑃 𝑔𝑒𝑛 there is a corresponding subset 𝑃 ′ of definite policies from the set 𝑃, this subset is denoted by 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛 ). Let 𝑃 𝑠𝑢𝑏 be the set of subsets of 𝑃, then 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛 ) is the injective map 𝐷𝑒𝑓: 𝑃 𝑔𝑒𝑛 → 𝑃 𝑠𝑢𝑏 .

The input, output, and state vectors of any generalized policy 𝑝 are denoted by 𝑋(𝑝), 𝑌(𝑝), and 𝑍(𝑝), respectively. Let ≤ be the partial order relation on 𝑃 𝑔𝑒𝑛 such that 𝑝 ≤ 𝑝′ if and only if all parameters of the vectors of the generalized policy 𝑝 are included in the respective vectors of the generalized policy 𝑝′: 𝑝 ≤ 𝑝′ ↔ 𝑋(𝑝 ) ⊆ 𝑋(𝑝′), 𝑌(𝑝) ⊆ 𝑌(𝑝′), 𝑍(𝑝) ⊆ 𝑍(𝑝′).

Let ℱ be a set of all existing NSSs. The fact that an NSS 𝐹 ∈ ℱ is capable to implement a policy 𝑝 ∈ 𝑃 or a subset of policies 𝑃′ ⊆ 𝑃, i.e., 𝑝 or 𝑃′ is included to definitional domain of the state-transformation function 𝛿 and the output function 𝑓 of 𝐹, is denoted by 𝐹(𝑝) and 𝐹(𝑃′) in the case of a policy and a subset of policies respectively. Any 𝐹 ∈ ℱ is defined on the entire set 𝑇 and in the general case on some subset 𝑃′ ⊆ 𝑃, where 𝑃′ can be expressed as the finite union:

𝑃′ = 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛1 ) ∪ 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛2 ) ∪ … ∪ 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛𝑘 ).
An NSS 𝐹(𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛 )) ∈ ℱ is said to be simple if there does not exist an NSS 𝐹′ ∈ ℱ that implements any policy with excluded parameters:

𝐹(𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛 )) ∈ ℱ 𝑠 ↔ ∄ 𝐹 ′(𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛 ′ )) ∈ ℱ: 𝑝 𝑔𝑒𝑛 ′ ≤ 𝑝 𝑔𝑒𝑛 ∧ 𝑝 𝑔𝑒𝑛 ′ ≠ 𝑝 𝑔𝑒𝑛 ,
where ℱ 𝑠 is the set of simple NSSs. In other words, if exclusion of any subset of parameters from a policy leads to meaningless policy that cannot be implemented by any NSS, then the NSS is simple. Let 𝑃 𝑠 = {𝑝 𝑔𝑒𝑛 ∈ 𝑃 𝑔𝑒𝑛 : ∃𝐹(𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛 )) ∈ ℱ 𝑠 } be the set of generalized policies that corresponding definite policies can be implemented by simple NSSs. If an NSS is not simple, it is called composite. Simple NSSs can be combined parallel or sequentially with the purpose of constructing a composite NSS. For example, when considering Check Point firewall policy (Fig. 1) and network address translation (NAT) policy (Fig. 3), the NSSs can be decomposed to simple NSSs that implement single rules. Fig. 4 shows an example of the composite NSS that implements mentioned firewall and NAT policies. Note that the latter rule of the firewall policy in Fig. 1 is not presented in Fig. 4 because each simple NSS 𝐹 𝑓𝑤 blocks by default any traffic that does not match its policy (i.e., it outputs the empty sequence 𝜀). In contrast with firewall policies, NAT policy accepts any traffic by default, therefore an additional simple NSS 𝐹 𝑛𝑎𝑡 with the default policy (which accepts all traffic that does not match the other NAT rules) is introduced into the model in Fig. 4. Note also that state blocks 𝑆 (shown in Fig. 2) of each simple NSS are not depicted in Fig. 4 for the sake of compactness.

Two simple NSSs 𝐹 1 (𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛1 )), 𝐹 2 (𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛2 )) ∈ ℱ 𝑠 are called equivalent if and only if they produce equal outputs for equal inputs while implementing policies:

𝐹 1 (𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛1 )) ≅ 𝐹 2 (𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛2 )) ↔ ∀𝑝 1 ∈ 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛1 ) ∃𝑝 2 ∈ 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛2 ): 𝑓 1 * (𝑡, 𝑝 1 , 𝑠 1 ) = 𝑓 2 * (𝑡, 𝑝 2 , 𝑠 2 ) ∀𝑡 ∈ 𝑇 * ∧ ∀𝑝 2 ∈ 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛2 ) ∃𝑝 1 ∈ 𝐷𝑒𝑓(𝑝 𝑔𝑒𝑛1 ): 𝑓 2 * (𝑡, 𝑝 2 , 𝑠 2 ) = 𝑓 1 * (𝑡, 𝑝 1 , 𝑠 1 ) ∀𝑡 ∈ 𝑇 *
where 𝑠 1 and 𝑠 2 are initial states of 𝐹 1 and 𝐹 2 respectively, 𝑇 * is a set of finite sequences of network packets, 𝑓 1 * and 𝑓 2 * are extensions of 𝑓 1 and 𝑓 2 to 𝑇 * . By this equivalence relation the set of simple NSSs partitioned to equivalence classes. All simple NSSs inside any equivalence class produce equal outputs while implementing respective policies and processing network traffic. However, their policies from the syntax point of view can be different.

In order to demonstrate the equivalence of NSSs consider Check Point and Cisco firewalls along with the following policy: "Hosts from the network 192.168.1.0/24 are allowed to establish connections to 80 TCP-port on server 10.1.1.10. Connection attempts must be logged". Note that the policy consists of two parts: authorization (allows connections to the server) and obligation (requires logging of connection attempts). Each of two selected NSSs are able to implement the policy. It can be represented in Check Point as shown in Fig. 5. In order to implement the policy in Cisco it is necessary to add one rule to an access-list (for instance, access-list 101): The input vectors of generalized policies for Check Point and Cisco are equal: (Source Address, Destination Address, Protocol, Destination Port). Note that the field "service" in Check Point policy (Fig. 5) implies protocol and destination port. Output traffic is the same as an input and it is expressed with keywords accept and permit in the case of Check Point and Cisco respectively. In addition, a log message must be generated that is expressed with keyword log in both cases. Thus, the output vectors are equal for both NSSs: (Accept, Log). State vectors of Check Point and Cisco policies are (VPN, Time, Comment) and (Access-list Number) respectively. However, the parameters of Check Point's state vector are not initialized and consequently do not affect the policy. Access-list number of Cisco is not essential in this case either. Semantics of these two rules are equal and hence the NSSs are equivalent. Undoubtedly, Check Point and Cisco firewalls are not equivalent in general, but abstractions of them (i.e., simple NSSs) that implement the considered policies are equivalent.

The approach to classification of NSSs consists of the following high-level steps:

 decomposition of an NSS to simple NSSs;  sorting out the triple of vectors of the generalized policy for each simple NSS;  search for an equivalence class for each simple NSS:

─ if there exists a class such that a simple NSS is equivalent to, then it must be added to the class; ─ if there is no appropriate equivalence class for a simple NSS, then it forms its own class.

The classification facilitates evaluation of an NSS 𝐹 ∈ ℱ by means of assigning the following rating 𝑅 𝐹 :

𝑅 𝐹 = ∑ 𝑊 𝐹 𝑖 𝑖 𝐼 𝐹 𝑖 𝐹 ,
where 𝑊 𝐹 𝑖 > 0 is a weight of a simple NSS 𝐹 𝑖 (for instance, the number of IS threats that the NSS counters), which can be calculated by an expert evaluation, and

𝐼 𝐹 𝑖 𝐹 ∈ {0,1}
is an indicator that shows whether an NSS 𝐹 is included into equivalence class 𝐹 𝑖 . The classification of NSSs built in terms of the described equivalence helps to find NSSs with required functions. For instance, if it is necessary to use functions 𝐹 𝑎 , 𝐹 𝑏 and 𝐹 𝑐 in some node of an enterprise's network in order to implement particular policy, then an NSS that is simultaneously included in equivalence classes 𝐹 𝑎 , 𝐹 𝑏 , and 𝐹 𝑐 can be selected for this purpose. If there are more than one NSS with required functions then the most effective solution among them is the one that has maximum rating-cost ratio:

𝑅 𝐹 𝐶 𝐹 → 𝑚𝑎𝑥,
where 𝐶 𝐹 is sum of payroll and non-payroll cost of an NSS 𝐹. In addition, if there does not exist an NSS that is included in all required classes, then combinations of NSSs that cover the classes can be considered taking into account cumulative rating-cost ratio for each appropriate combination:

∑ 𝑅 𝐹 𝑗 𝐶 𝐹 𝑗 𝑗 → 𝑚𝑎𝑥
where 𝑗 ∈ {𝑗 1 , 𝑗 2 , … , 𝑗 𝑘 }, {𝐹 𝑗 1 , 𝐹 𝑗 2 , … , 𝐹 𝑗 𝑘 } is the set of NSSs in the combination.

A Policy Algebra

All NSSs inside any equivalence class produce equal outputs while implementing policies. However, in the general case their policies from the syntax point of view are different. As can be seen from the above examples, Check Point does not use CLI and it is not possible to compare its policy with the analogue in Cisco from the syntax point of view; however, the policies have equal semantics. Thus, in the general case there are multiple policies that describe the same simple NSS inside an equivalence class. In order to reduce redundancy of policies for NSSs the set of simple policies 𝑃 𝑠 needs to be substituted for a set of simple unified policies 𝑃 𝑢 and |𝑃 𝑢 | must be minimal. Consequently, only one generalized policy needs to be assigned for every single equivalence class. In other words, if the set ℱ 𝑠 consists of 𝑁 classes then it is required to have 𝑁 generalized policies in order to specify policies for all NSSs.

Let 𝛺 = {𝑆, 𝛷, 𝜎} be a many-sorted signature, where 𝑆 = {𝑠 𝑡 , 𝑠 𝑚 , 𝑠 1 , 𝑠 2 , … , 𝑠 𝑙 } is a set of sorts while 𝑠 𝑡 and 𝑠 𝑚 are sorts of network traffic and messages respectively, 𝛷 = {+, 𝜑 1 , … , 𝜑 𝑁 } is a set of functional symbols, 𝜎(𝜑 𝑖 ) =< 𝑠 𝑡 , 𝑠 𝑖1 , … , 𝑠 𝑖𝑘 , 𝑠 𝑚 , 𝑠 𝑡 > is a sort function that defines sorts of arguments 𝑠 𝑡 , 𝑠 𝑖1 , 𝑠 𝑖2 , … , 𝑠 𝑖𝑘 and sorts of values 𝑠 𝑚 , 𝑠 𝑡 for every functional symbol 𝜑 𝑖 ∈ 𝛷. In addition, suppose that 𝜎(+) =< 𝑠 𝑡 , 𝑠 𝑡 , 𝑠 𝑡 >, i.e., function "+" has two arguments of the sort of network traffic and a value of the same sort (two examples of the function are shown in Fig. 4).

Let 𝑉 = 𝑉 𝑠 𝑡 ∪ 𝑉 𝑠 𝑚 ∪ 𝑉 𝑠 1 ∪ … ∪ 𝑉 𝑠 𝑙 be a set of variables, where 𝑉 𝑠 𝑖 is a set of variables of a certain sort 𝑠 𝑖 ∈ 𝑆. Suppose that 𝛩 is the set of 𝛺-terms that is recursively defined as follows: Let (𝐴, 𝐼) be a many-sorted algebra, where 𝐴 is a carrier set of the algebra and 𝐼 is an interpretation of the signature 𝛺. For every sort 𝑠 𝑖 ∈ 𝑆 the interpretation associates a subset 𝐴 𝑠 𝑖 ⊆ 𝐴 and for every functional symbol 𝜑 𝑖 ∈ 𝛷 it associates the function 𝑓 𝑖 : 𝐴 𝑠 𝑡 × 𝐴 𝑠 𝑖1 × 𝐴 𝑠 𝑖2 × 𝐴 𝑠 𝑖𝑘 → 𝐴 𝑠 𝑚 × 𝐴 𝑠 𝑡 that defines the output function of an NSS of the respective equivalence class 𝐹 𝑖 . Thus, the algebra models all definite policies for simple NSSs of each equivalence class as well as definite policies for composite NSSs.


In order to translate the policies into the native policy formats of concrete NSSs' platforms described many-sorted algebra can be represented as a formal language with a generative grammar 𝐺 = (𝒯, 𝒩, 𝒮, 𝑅), where 𝒯 is a terminal vocabulary that reflects carrier set 𝐴, 𝒩 is a non-terminal vocabulary that includes terms, 𝒮 ∈ 𝒩 is a starting non-terminal symbol of every policy, and 𝑅 is a set productions. Representation of the policies in the form of a formal language allows application of the existing parsing algorithms.

Conclusion

The approach to policy modeling presented in the paper is based on finite automaton model of an NSS. Decomposition of an NSS to simple NSSs and their classification facilitates composition of policies and selection of the most effective NSSs aligned with them. Policies are considered independently on platforms of NSSs and can be specified identically for equivalent NSSs. Application of translation methods for unified policies allows implementation of policies in concrete NSSs platforms.

The future challenge for the approach is development of derivation method from RBAC policies into described NSSs policies and building of conflict resolution methods. Construction of an algorithm for classification of NSSs is also a future work.

Fig. 3 .Fig. 4 .Fig. 5 .

 345 Fig. 3. An example of Check Point NAT policy

  any variable 𝑉 𝑠 𝑖 is a 𝛺-term 𝜃 𝑠 𝑖 of the sort 𝑠 𝑖 ;  any finite expression 𝜑 𝑖 (𝜃 𝑠 𝑡 , 𝜃 𝑠 𝑖1 , 𝜃 𝑠 𝑖2 , … , 𝜃 𝑠 𝑖𝑘 , 𝜃 𝑠 𝑚 , 𝜃 𝑠 𝑡 ) such that 𝜎(𝜑 𝑖 ) =< 𝑠 𝑡 , 𝑠 𝑖1 , 𝑠 𝑖2 , … , 𝑠 𝑖𝑘 , 𝑠 𝑚 , 𝑠 𝑡 > is a 𝛺-term of the sort 𝑠 𝑡 , where 𝜃 𝑠 𝑡 , 𝜃 𝑠 𝑚 and 𝜃 𝑠 𝑖𝑗 are any variables of corresponding sorts 𝑠 𝑡 , 𝑠 𝑚 and 𝑠 𝑖𝑗 .Suppose that any 𝑠 𝑖 ∈ 𝑆 is a name of a certain parameter of generalized policy, any 𝜑 𝑖 ∈ 𝛷 is a designation of a certain equivalence class of NSSs, then 𝜑 𝑖 (𝜃 𝑠 𝑡 , 𝜃 𝑠 𝑖1 , 𝜃 𝑠 𝑖2 , … , 𝜃 𝑠 𝑖𝑘 , 𝜃 𝑠 𝑚 , 𝜃 𝑠 𝑡 ) is a representation of the output function of an NSS from equivalence class designated by 𝜑 𝑖 that includes representation of respective simple policy. By construction, 𝛩 includes representations of all generalized policies for simple and composite NSSs. For instance, the NSS shown in Fig.4can be represented as follows:{ 𝐹 𝑓𝑤 (𝑡, 𝑝 1 , 𝑠) + 𝐹 𝑓𝑤 (𝑡, 𝑝 2 , 𝑠) + 𝐹 𝑓𝑤 (𝑡, 𝑝 3 , 𝑠) = 𝑡′ 𝐹 𝑛𝑎𝑡 (𝑡′, 𝑛𝑎𝑡 1 , 𝑠) + 𝐹 𝑛𝑎𝑡 (𝑡′, 𝑛𝑎𝑡 2 , 𝑠) + 𝐹 𝑛𝑎𝑡 (𝑡′, 𝑑𝑒𝑓𝑎𝑢𝑙𝑡, 𝑠) = 𝑡′′ where 𝐹 𝑓𝑤 and 𝐹 𝑛𝑎𝑡 are designations of equivalence classes; 𝑝 𝑖 , 𝑛𝑎𝑡 𝑗 , 𝑑𝑒𝑓𝑎𝑢𝑙𝑡, and 𝑠 are collections of parameters of respective policies and states (parameters of policies consist of input, output and state vectors). Note that notations +(𝜃 𝑠 𝑡 , 𝜃 𝑠 𝑡 ) and 𝜃 𝑠 𝑡 + 𝜃 𝑠 𝑡 are equivalent.