Thierry Lubin

Hubert Razik

Abderrezak Rezzoug

On-line efficiency optimization of a synchronous reluctance motor

Keywords: Efficiency optimization, Fibonacci search method, search controller, synchronous reluctance motor

This paper deals with an on-line optimum-efficiency control of a synchronous reluctance motor drive. The input power minimization control is implemented with a search controller using Fibonacci search algorithm. It searches the optimal reference value of the d-axis stator current for which the input power is minimum. The input power is calculated from the measured dc-bus current and dc-bus voltage of the inverter. A rotor-oriented vector control of the synchronous reluctance machine with the optimization efficiency controller is achieved with a DSP board (TMS302C31). Experimental results are presented to validate the proposed control methods. It is shown that stability problems can appear during the search process.

Introduction

In the field of servo-drive applications, the Synchronous Reluctance Motors (SynRM) represents an alternative to other types of AC motors, such as induction motor or permanent magnet synchronous one [START_REF] Lipo | Synchronous reluctance machines -A viable alternative for AC drives?[END_REF], [START_REF] Vagati | The synchronous reluctance solution: a new alternative in AC drives[END_REF]. The SynRM presents a simple, robust and cheaper rotor structure and has simpler field oriented control compared to that of induction motor drives. The absence of magnets allows controlling the machine in the field-weakening region (constant power operation) and makes the torque insensitive to temperature variations. The main drawback of SynRM is the presence of torque ripples which cause undesirable acoustic noise and vibrations.

The SynRM has recently attracted the efforts of a number of researchers. The last developments concern three different topics. The first one is the design improvement of the rotor structure to maximize the saliency ratio Ld/Lq and improve the electromagnetic torque [START_REF] Kamper | Direct finite element design optimisation of the cageless synchronous machine[END_REF]- [START_REF] Vagati | Design refinement of synchronous reluctance motors through finiteelement analysis[END_REF]. The second one concerns the development of theoretical models which take into account magnetic saturation (crossed-magnetization) and space Corresponding author: T. Lubin e-mail: thierry.lubin@green.uhp-nancy.fr. Tel.: +33 (0)3 83 68 41 27 Fax: +33 (0)3 83 68 41 33 harmonics effects [START_REF] Chiba | Inductances of Cageless Reluctance-Synchronous Machines Having Nonsinusoidal Space Distributions[END_REF]- [START_REF] Levi | State-space d-q axis models of saturated salient pole synchronous machines[END_REF]. The last topic concerns the development of control strategies to improve both dynamic and steady state performances like the maximum torque per ampere control (MTA) [START_REF] Jovanovic | Optimal torque controller for synchronous reluctance motors[END_REF]- [START_REF] Lubin | Magnetic saturation effects on the control of a synchronous reluctance machine[END_REF] or the maximum efficiency control [START_REF] Kioskeridis | Energy efficiency optimisation in synchronous reluctance motor drives[END_REF], [START_REF] Matsuo | A new control strategy for optimum-efficiency operation of a synchronous reluctance motor[END_REF].

The efficiency of a variable frequency drive can be improved by the flux control [START_REF] Kusko | Control means for minimization of losses in ac and dc motor drives[END_REF]. The flux level (usually control by the stator d-axis current Isd) is adjusted by the optimum-efficiency controller in relation to the load torque and to the rotor speed of the machine. The rated flux is imposed for the nominal operating condition and is decreased at light loads or at non rated speeds. A number of methods for efficiency improvement have been proposed in the literature for induction motors and synchronous reluctance motors. In general, two major approaches can be identified.

The first one is based on a loss model of the motor (copper and iron losses) and is called Loss Model Controller (LMC) [START_REF] Kusko | Control means for minimization of losses in ac and dc motor drives[END_REF]- [START_REF] Kioskeridis | Energy efficiency optimisation in synchronous reluctance motor drives[END_REF]. The method consists of computing the losses and selecting the flux level that minimizes these losses. This approach requires a good knowledge of the motor parameters, including the influence of variable frequency and flux level on the core losses and the effect of magnetic saturation on the inductance values. The second approach uses a search algorithm and is called SC method (Search Controller) [START_REF] Kirschen | On-line efficiency optimization of a variable frequency induction motor drive[END_REF]- [START_REF] Ta | Convergence improvement of efficiencyoptimized control of induction motor drives[END_REF]. The electrical input power is measured and is minimized by different algorithms. The implementation of a search controller is simpler and does not require the knowledge of the motor loss model. It can be universally applied to AC machines. The main drawback of this method is the need of additional sensors to measure the input power and its relatively low speed due to the search process compare to the LMC method. Matsuo et al. [START_REF] Matsuo | A new control strategy for optimum-efficiency operation of a synchronous reluctance motor[END_REF] proposed a solution of minimizing the input power of a SynRM drive by adding a small amount of perturbation to the flux current reference Isd. However, the variation of Isd during the search process and around its optimal value in steady state results in undesirable torque disturbance. Moreover, the developed method is slow reaching the optimum. Kim et al. [START_REF] Kim | Control of induction motors for both high dynamic performance and high power efficiency[END_REF], Sousa et al. [START_REF] Sousa | A fuzzy logic based online efficiency optimization control of an indirect vector-controlled induction motor drive[END_REF] and Ta and Hori [START_REF] Ta | Convergence improvement of efficiencyoptimized control of induction motor drives[END_REF] used respectively Fibonacci search method, fuzzy-logic based controller and the Golden section search method to minimize the input power of an induction motor drive. These methods improve the speed convergence of the search process (t < 2s). The torque pulsation caused by the stepwise decrease in the flux current has been simply eliminated by incorporating a low-pass filter in the efficiency optimization algorithm. These methods using Fibonacci or Golden section algorithms to minimize the input power have not yet been used for SynRM. This paper presents an optimal efficiency method for vector-controlled synchronous reluctance motor drive. The loss minimization control is implemented with a search controller using the Fibonacci's search algorithm as proposed in [START_REF] Kim | Control of induction motors for both high dynamic performance and high power efficiency[END_REF]. The studied machine is a classical low power line start synchronous reluctance machine (600W) with a rugged rotor and a complete squirrel cage. The stator is the same as an induction motor and has symmetrical three phase windings. The cross section of the experimental machine is shown in Fig. 1. Photography of the rotor is given in Fig. 2.

The contents of this paper are organized as follows. In section 2, the basic equations and the rotor-oriented vector control of the SynRM are developed. Experimental results of input power measurement are given for transient and steady state conditions for different load torque and speed values. The implementation of the optimal efficiency control using Fibonacci search algorithm is developed in section 3. Comparisons between simulation results and experimental tests are given and show the validity and the limits of the proposed method. Section 4 concludes the paper.

Vector control of SynRM and input power measurement

A. Basic equations

The two-axis representation of the synchronous reluctance motor is given in Fig. 3. For the modeling, magnetic hysteresis, skin effect (in the rotor bars) and iron losses are neglected. The air-gap magnetomotive forces are assumed to be sinusoidally distributed.

The well-known d-q voltage equations in the rotor reference frame are as follows:

Ψ + = (4)
The stator and rotor flux linkages that appear in (1)-( 4) are related to the currents by:

rd d sd sd sd i M i L ⋅ + ⋅ = Ψ (5) rq q sq sq sq i M i L ⋅ + ⋅ = Ψ (6) sd d rd rd rd i M i L ⋅ + ⋅ = Ψ (7) sq q rq rq rq i M i L ⋅ + ⋅ = Ψ (8)
All the electrical parameters of the SynRM used for tests are listed in the appendix. The equation of motion and the expression of the electromechanical torque are written as:

T T f dt d J em - = Ω ⋅ + Ω ⋅ (9)
( )

sd sq sq sd em i . i . . p T Ψ - Ψ = ( 10
)
where J is the moment of inertia, f the friction coefficient and T the load torque.

The instantaneous input power is expressed in terms of the direct and quadrature-axis stator voltages and currents components as:

sq sq sd sd i u i u P ⋅ + ⋅ = (11)

B. Vector control of SynRM

A functional block diagram of the synchronous reluctance machine vector control is given in Fig. 4. The SynRM is fed by a voltage-source PWM inverter with a switching frequency of 10 kHz. The control is achieved with a DSP board (TMS320C31). Hall effect current transducers and a rotor position sensor with a resolution of 1024 pulses/revolution provide the information to monitor the current vector Isd and Isq from the phase currents isa and isb. Currents are sampled every 0.1 ms. Conventional PI controllers are used for current loops (d-axis and q-axis current controllers). The PI controllers allow to obtain a response time of 3 ms in both d-axis and q-axis current loops.

For the speed loop, an IP controller with an integrator antiwindup is used. IP algorithm is executed every 1 ms and generate the needed Isqref current reference. A current limiter is used to ensure that stator current remains within rated value.

The synchronous reluctance machine is coupled with a DC generator. For a constant output speed (maintained by the speed loop), the load torque T is maintained constant with a fixed load resistor on the DC generator and a fixed field excitation.

The efficiency-optimization block using Fibonacci search controller is represented in Fig. 4. It searches the optimal reference value of the flux component of the stator current Isdref for which the input power Pin is minimum. The speed error ∆N is used to restore the rated value of the flux current after a change in speed reference value or a change in load torque to ensure good dynamic transient [START_REF] Kim | Control of induction motors for both high dynamic performance and high power efficiency[END_REF], [START_REF] Sousa | A fuzzy logic based online efficiency optimization control of an indirect vector-controlled induction motor drive[END_REF].

The on-line efficiency optimization control will be developed in section 3.

C. Input power measurement

As shown in Fig. 5, the input power is calculated as the product of the measured dc-bus voltage Udc by the dc-bus current Idc:

dc dc in I . U P = (11)
The input power Pin includes motor output power, motor losses and inverter losses. The input power measurement must be noiseless to ensure a good working of the search controller [START_REF] Abrahamsen | On the energy optimized control of standard and highefficiency induction motors in CT and HVAC applications[END_REF]. So, the dc-link current Idc is first filtered with selfinductance L = 20 mH as shown in Fig. 5. The input power is then calculated with a 1 ms sampling period (the same as the speed loop) and is averaged over 20 periods in order to reduce the noise.

An experimental study of the input power behavior of the synchronous reluctance motor drive was carried out with the implemented experimental drive system. Fig. 6 shows the experimental result of the input power measurement during transient conditions. Figures 6(a) to 6(d) show respectively the d-axis current (Isd), the q-axis current (Isq), the mechanical speed (N), and the power input (Pin). For this test, the machine is first initialized with the rated value of the flux current (Isdref = 2.5 A). The machine is then accelerated from 0 to 400 rpm under no-load condition. It can be seen in Fig 6(b) that q-axis current is limited at Isqrefmax = 7 A to ensure that stator current remains within rated value. A load torque step of 3 Nm is applied at t = 2.2 s. Fig. 6(d) shows the input power behavior during the test. It can be seen that the input power attains about 900W during the speed acceleration. It reaches the value of almost 150 W in steady state for no load condition. When the load torque is applied, the q-axis current increases from about 0.8 A to 4 A. It can be seen in Fig. 6(d) that the input power increases from 150 W to 400 W after a transient of about 0.5 s.

This test shows that the input power can be measured with precision (the noise is low) during transient and steady state conditions. The input power measurement will be used in the next section with the optimum efficiency controller. Fig. 7 illustrates the variations of the measured input power Pin versus d-axis current in steady state condition for different values of the mechanical speed (250, 500 and 800 rpm) and different values of the load torque T (0, 1.2, 2 and 3 Nm). To obtain these curves, the output power is maintained constant with the DC generator and the d-axis current reference Isdref is varied (the search controller is inhibited during these tests). Then, the corresponding input power is measured by using [START_REF] Lubin | Magnetic saturation effects on the control of a synchronous reluctance machine[END_REF]. Fig. 7 indicates that there exists a minimum input power operating point for all the combinations of speed and load torque values. It can be observed that the optimal value of the d-axis current increases with the loading and is not subject to the speed value. For the studied machine, the optimal value of the flux current is always included between a lower value of about 0.5 A and a higher value of about 3 A. One can also see that the input power is flat near the point of optimal efficiency. Therefore, the power measurement must be very precise and noiseless to be used with the search controller.

Optimum efficiency controller

A. Fibonacci Search Method

The efficiency controller searches the optimal value of the d-axis component of stator current, for which the input power of the drive is minimum. The efficiency control is based on the Fibonacci search algorithm. The Fibonacci search method is known as the most efficient (golden section is next) that it requires the smallest number of input power evaluations to find the optimum value of the d-axis current [START_REF] Kowalik | Methods for unconstrained optimization problems[END_REF]. This method is applicable to unimodal functions with a single variable (a function is unimodal when it presents a unique optimum in a given interval). It not requires the calculation of derivatives at each step (it is important when the signal presents noise).

The Fibonacci search is based on the sequence of Fibonacci numbers which are defined by the equations:

k F F F 1 F F k 2 k 1 k k 1 0 = ≥ ∀ + = = = - - 21 , 13 , 8 , 5 , 3 , 2 , 1 , 1 F 2
The principle of Fibonacci search algorithm applied to input power minimization is described in Fig. 8. This figure shows the search process for 4 input power evaluations P1, P2, P3 and P4. At the beginning, we start the algorithm by defining the initial conditions. The initial conditions are the minimum and maximum values of the d-axis current Isdmin and Isdmax. These values determine the length of the first search interval L1. We must also define the flux current tolerance λ around its optimal value to predetermine the number of the input power evaluations n [START_REF] Kowalik | Methods for unconstrained optimization problems[END_REF]. The number of input power evaluations is the integer n such that:

2 n 1 n F I I F min sd max sd + + ≤ λ - ≤ (13)
The algorithm can now calculate the values of d-axis current references Isd1 and Isd2 in the first interval L1 (L2 is the length of the second interval): The input powers P1 and P2 corresponding to Isd1 and Isd2 are measured according to [START_REF] Lubin | Magnetic saturation effects on the control of a synchronous reluctance machine[END_REF] and are compared. For the studied example, the input power P1 is less than the input power P2 and the new search interval becomes L2. Although two input power measures are required in the initial interval L1, only one further input power measure (P3) is required in the reduced interval L2. The input powers P3 and P1 are compared and the interval is reduced to L3. The search procedure continues until the number of iteration n defined by ( 13) is attained. The optimal value of the reference d-axis current is placed to the middle of the last interval. Fig. 9 shows the flowchart of minimization of the input power using Fibonacci search algorithm.

+ = - = λ ⋅ - + - ⋅ = - (14)
Several tests have been carried out and compared with simulation results to confirm the validity of the algorithm. We are going to present the results of three tests. The first one is a no load test with a constant speed reference of 500 rpm. The second one is a 2 Nm load torque test with constant speed reference of 500 rpm. The last test is a rated load torque test with a constant speed reference of 500 rpm. This last test allows to show that stability problems can appear during the search process if the lower value of the first search interval Isdmin is chosen too small.

START Initial conditions:

Isdmin, Isdmax, λ

Compute n from (13) Compute L2 from ( 14)

Isd1 = Isdmax -L2 Isd2 = Isdmin + L2 Measure : P1 corresponding to Isd1 P2 corresponding to Isd2 P1 > P2 ? Isdmax = Isd2 Isd2 = Isd1 Isd1 = Isdmin + Isdmax -Isd1 N > n ? STOP Isdopt = Isd1 + Isd2 2 N > n ? P1 = P2 ; Measure: P2 corresponding to Isd2 STOP Isdopt = Isd1 + Isd2 2 Isdmin = Isd1 Isd1 = Isd2 Isd2 = Isdmin + Isdmax -Isd2 N =

B. No-load Test With Constant Speed Reference

Fig. 10 shows simulation results for no-load condition. The rotor speed is fixed at 500 rpm. The simulation algorithm is based on the SynRM model developed in section II. The inverter is considered as an ideal PWM power supply. The simulation algorithm is written in C-language and uses a standard fourth order Runge-Kutta integration routine.

Initial conditions for Fibonacci search algorithm (length of the first interval <Isdmin; Isdmax> and d-axis current tolerance λ) are fixed using experimental results of Fig. 7:

A 2 . 0 A 5 I A 0 I max sd min sd = λ = = (15)
The number of input power evaluations n and the d-axis current references Isd1 and Isd2 are calculated by using ( 13) and ( 14):

A 1 . 3 I A 9 . 1 I 6 n sd2 1 sd = = = (16)
The time period of one step change of d-axis current reference is fixed to 1s. This value is determined by the transient behavior of the input power (Fig. 6). The input power must be measured after the steady state is established.

Fig. 10(a) and Fig. 10(b) show respectively the d-axis current Isd and the input power P. The input power is calculated with [START_REF] Lubin | Magnetic saturation effects on the control of a synchronous reluctance machine[END_REF]. The d-axis current is initialized with its rated value (Isdref = 2.5 A). At t = 5s, the efficiency optimization is activated. After six step changes in d-axis current reference, the input power is reduced from 100 W to about 65 W. A reduction of 35% power input is obtained. The optimal value of d-axis current reference after the search process is equal to 1 A. Fig. 11 shows experimental results obtained for identical conditions as reported in the previous simulation. The results are in close agreement to the simulation ones. The input power decreases from 150 W to 100 W. The d-axis current decreases from 2.5 A to 0.8 A which is the optimal value for no load condition and a mechanical speed of 500 rpm as shown in Fig. 7. One can observed that the simulated input power are smaller than the experimental one because inverter losses, iron losses and stray losses has not been taken into account for the simulation. Fig. 11(c) shows that the mechanical speed is not disturbed during the search process. C. Load Test With Constant Speed Reference Fig. 12 shows experimental results obtained for a load torque of 2 Nm (0.66 p.u.) and a speed value of 500 rpm. Regulating of the Fibonacci search algorithm are the same that previously [START_REF] Kioskeridis | Energy efficiency optimisation in synchronous reluctance motor drives[END_REF]. The initial value of Isdref is deliberately chosen large (Isdref = 6 A) to show the accuracy of the optimization efficiency search process. At t = 5s, the efficiency optimization is activated. The input power is reduced from 560 W to 320 W. The d-axis current decreases from 6 A to 2.2 A which is the optimal value for the test conditions (500 rpm, 2 Nm) as shown in Fig. 7.

D. Stability problem; lower limit for Isdmin

During the search process, the d-axis current reference may be so small that the motor pulls out because the electromagnetic torque becomes smaller than the load torque.

Fig. 13 shows simulation results where stability problem occurs during the first step of the search process (5 s < t < 6 s). The rotor speed is fixed at 500 rpm and the load torque is fixed at a large value of 9.5 Nm. During the first step of the search process, the d-axis current reference is fixed at Isd1 = 1.9 A ( 16) and the q-axis current reaches its limit (isq = 7 A, see Fig. 13(b)). In steady state condition, the electromagnetic torque of synchronous reluctance motors depends of the two components of the stator current vector isd and isq :

( )

sq sd sq sd em i i L L p T ⋅ ⋅ - ⋅ = (17)
The electromagnetic torque value corresponding to isd =1.9 A and isq =7 A is equal to 8.8 Nm (the unsaturated values of Lsd and Lsq are given in the appendix). During the first step of the search process, the electromagnetic torque value is smaller than the load torque value as it can be seen in Fig. 13(c). Therefore, the machine pulls out and the mechanical speed decreases strongly.

Fig. 14 shows experimental results obtained for rated load torque and a mechanical speed fixed at 500 rpm. For this test, the Fibonacci algorithm is adjusted as previously [START_REF] Kioskeridis | Energy efficiency optimisation in synchronous reluctance motor drives[END_REF]. Fig. 14(a) and Fig. 14(b) show respectively the d-axis current and the q-axis current. At the first step of the search process, the qaxis current reaches its limit and the speed decreases strongly as foreseen by the simulation results. To avoid such problem, one must impose a minimum limit for Isdmin [START_REF] Abrahamsen | On the energy optimized control of standard and highefficiency induction motors in CT and HVAC applications[END_REF]. Several experimental results have shown that this lower limit should be the optimal value of d-axis current for no-load condition (Isdmin = 0.8A).

Conclusion

From the energy-saving viewpoint, it is important to improve the efficiency of variable speed motor drives in the process industries. In this paper, input power minimization of a synchronous reluctance motor drive with Fibonacci search controller has been presented. Experimental results obtained for different levels of load torque have shown the accuracy of the proposed method. However, We have shown that the lower limit of the first search interval (Isdmin) had to be chosen with care to avoid stability problem during the search process.

Appendix

Nomenclature: usd, usq: d-and q-axis stator voltages, isd, isq: d-and q-axis stator currents, ird, irq: d-and q-axis damper currents, Ψsd, Ψsq: d-and q-axis total stator flux linkages, Ψrd, Ψrq: d-and q-axis total rotor flux linkages, Rs:

stator resistance, Rrd, Rrq: d-and q-axis damper resistances, Lsd, Lsq: d-and q-axis stator inductances, Lrd, Lrq: d-and q-axis rotor inductances, Md, Mq: d-and q-axis mutual inductances, J: moment of inertia, electrical speed of the rotor reference frame, p: number of pole pairs, P:

motor input power, Udc: dc bus voltage, Idc: dc bus current, Pin: dc bus input power.

Machine parameters:

The SynRM used for test is a 230 V, 3A, 50 Hz, 600W four-pole, 1500 rpm with the following parameters:

Fig. 1 .

 1 Fig. 1. Cross section of the studied machine.

Fig. 2 .

 2 Fig. 2. Rotor structure of the studied machine.

Fig. 3 .

 3 Fig. 3. Two-axis model in the rotor reference frame.

Fig. 5 .

 5 Fig. 5. Input power measurement.

  Fig. 4. Block diagram of the experimental system.

Fig. 6 .Fig. 7 .

 67 Fig. 6. Starting transient and load torque step transient for SynRM under test: (a) d-axis current Isd, (b) q-axis current Isq, (c) mechanical speed N, (d) input power Pin. Experimental results

Fig. 8 .

 8 Fig. 8. Decision process for the Fibonacci search algorithm.

Fig. 9 .

 9 Fig.9. Flowchart of minimization of the input power using Fibonacci search algorithm.

Fig. 10 .

 10 Fig. 10. Simulation results for no-load torque and with a speed reference of 500 rpm: (a) d-axis current Isd, (b) input power P.

Fig. 11 .

 11 Fig. 11. Experimental results for no-load torque and with a speed reference of 500 rpm: (a) d-axis current Isd, (b) input power Pin, (c) mechanical speed N.

Fig. 12 .

 12 Fig. 12. Experimental results for 2 Nm load torque and Nref = 500 rpm, (a) d-axis current Isd, (b) input power Pin, (c) mechanical speed N.

Fig. 13 .

 13 Fig. 13. Stability problem; Simulation results for 9.5 Nm load torque and Nref = 500 rpm: (a) d-axis current Isd, (b) q-axis current Isq, (c) electromagnetic torque Tem, (d) mechanical speed N.

Fig. 14 .

 14 Fig. 14. Stability problem; Experimental results for full load torque and Nref = 500 rpm: (a) d-axis current Isd, (b) q-axis current Isq, (c) input power Pin, (d) mechanical speed N.

Rs = 7

 7 .8 Ω; Lsd = 0.54 H; Lsq = 0.21 H; Rrd = Rrq = 1Ω; Lrd = 0.1 H; Lrq = 0.046 H; Md = 0.153 H; Mq = 0.088 H; J = 0.038 Kg.m 2 ; f = 0.0029 Nm/(r/s);

Biographie


Tom Guérout
email: tguerout@laas.fr

Mahdi Ben Alaya
email: ben.alaya@laas.fr

Autonomic energy-aware tasks scheduling

Keywords: Autonomic, Framework, self-management, Simulations, Energy, Efficiency, DVFS

The increasing processing capability of data-centers increases considerably their energy consumption which leads to important losses for companies. Energy-aware task scheduling is a new challenge to optimize the use of the computation power provided by multiple resources. In the context of Cloud resources usage depends on users requests which are generally unpredictable. Autonomic computing paradigm provides systems with self-managing capabilities helping to react to unstable situation. This article proposes an autonomic approach to provide energy-aware scheduling tasks. The generic autonomic computing framework FrameSelf coupled with the CloudSim energy-aware simulator is presented. The proposed solution enables to detect critical schedule situations and simulate new placements for tasks on DVFS enabled hosts in order to improve the global energy efficiency.

I. INTRODUCTION

The article is based on the use of an autonomic framework and a simulator which allows to compute energy-aware simulations. The aim is to do energy-aware scheduling of tasks. The combination of using these two tools allow to have the benefit of the autonomic middle-ware to detect specific events, and the simulator to obtain informations about energy consumption which help to take a scheduling decision.

Autonomic computing paradigm is a concept based on the human body's autonomic nervous system. A such system manages the functioning of computer applications and systems with minimum human intervention, in the same way that the autonomic nervous system regulates body systems without conscious human input. The goal of autonomic computing is to create autonomous systems, capable of high-level functioning by implementing self-management properties such as self-configuration, self-optimisation, self-healing and selfprotection.

The increasing use of data-centers makes the analysis of energy consumption increasingly important. Some metrics to evaluate their efficiency are known (PUE, ERE) [START_REF] Patterson | ERE: A metric for measuring the benefit of reuse energy from a data center[END_REF] and much researches are ongoing to find new ways to reduce energy. Real platforms can be used to lead these phases of validation, but it involves a significant preparation time and physical measurements are not always possible or easy to do depending on the available equipments. That is why simulators are more commonly used in this area. CloudSim already has some energy-aware functionalities included in its architecture, and has been chosen to be improved and used to conduct energyaware DVFS simulations in this article.

This article is organized as follows. First, section II presents a state of the art on energy-aware tools and autonomic frameworks. Section III describes the CloudSim simulator, the new implementation of DVFS added and how it is able to do energy-aware simulations. Then, Section IV presents the autonomic framework called FrameSelf. In section V, first results obtained using both FrameSelf and CloudSim are given. Finally, section VI concludes and presents ideas for future work.

II. STATE OF THE ART

A. Autonomic tools

Autonomic Computing is a paradigm proposed by IBM in 2001 [START_REF] Kephart | The vision of autonomic computing[END_REF]. It aims at developing distributed system capable of self-management to hide intrinsic complexity to administrators and users. An autonomic manager is organized into four main modules, which are Monitor, Analyzer, Planer and Executor. These modules share the same knowledge (managed resources details, policies, symptoms, request for change, plans, etc.), exploit policies based on goal and environment awareness and constitute together the MAPE-K control loop.

Recent works on autonomic computing addressed some of the self-management capabilities applied in specific domains such as DeployWare [START_REF] Flissi | Deploying on the grid with deployware[END_REF] for dynamic software deployment, OceanStore [START_REF] Kubiatowicz | Oceanstore: An architecture for global-scale persistent storage[END_REF] for resource allocation reconfiguration, Gryphon [START_REF] Pietzuch | Congestion control in a reliable scalable message-oriented middleware[END_REF] for communication patterns adaptation, and Astrolabe [START_REF] Birman | Scalable data fusion using astrolabe[END_REF] for autonomic query processing. Cited autonomic solutions are designed to handle problems in specific domains, and are in most cases highly dependent on the type of managed resources. These framework are not modular and do not support multi-model representations in their knowledge bases for advanced management.

B. Energy-aware tools

Energy-aware tools are solutions, that can be used at different levels, which allow to minimize the power consumption of hosts in a data-centers. In this section, only the host level is addressed and the three common energy-aware tools are presented, considering that all used hosts enable virtualization.

The first solution, called "ON/OFF" method turns off hosts not enough used (compared to a CPU load threshold), and switched on them again if necessary. In this case any all processes running in this host have to be moved to other host(s), and thus, the host previously underutilized can be turned off. Conversely, when all hosts are over-used and the demand is too high, one or more host are started.

As described just above, it is sometimes necessary to move processes from host to host. This mechanism is called migration [START_REF] Keir | Live migration of virtual machines[END_REF]. It allows to move a virtual machine (and all its environment) from a host to another. These migrations are not free in terms of energy because every movement requires time and it is also important to take into account the total cost of such action. This technique frees the hosts and then turn them off, in order to try to use operating hosts at their maximum potential (consolidation). Two kinds of consolidations works can be defined on virtual machines placement and virtual machines migration, as it detailed in [START_REF] Feller | Autonomic and energy-efficient management of large-scale virtualized data centers[END_REF].

Finally, the DVFS (Dynamic Voltage and Frequency Scaling) [START_REF] Kolpe | Enabling improved power management in multicore processors through clustered dvfs[END_REF] allows to dynamically change the voltage and the frequency of a host in relation to their CPU load. In the Linux kernel, the DVFS can be activated in five different modes: Performance, PowerSave, UserSpace, Conservative and OnDemand. Each mode has a governor to decides whether the frequency must be changed (increased or decreased) or not.

Three of these five modes use fixed frequency : Performance uses the CPU at its highest frequency, PowerSave uses the CPU at its lowest frequency and the UserSpace mode allows the user to choose one of all available frequencies.

The two last DVFS modes, Conservative and OnDemand have a dynamical behaviour. It means that the CPU frequency can vary over time regarding the CPU load.

The governors of these two modes work with thresholds (one or two) and periodically check whether the CPU load is lower (or higher) than these thresholds before taking their decision to change the current frequency. The Conservative governor works with an up threshold and a down threshold, when the CPU load is higher than the up threshold the frequency is increased, when the CPU load is under the down threshold the CPU frequency is decrease. This mode is very progressive, and each CPU frequency is done step by step through all available frequencies. The OnDemand mode uses only one threshold and favours the performance by directly set the fastest CPU frequency when the CPU load exceeds the threshold. A decreasing CPU frequency happens if the CPU load stays below the threshold for a while.

A lower frequency reduced the CPU power consumption, it slows down an application consuming a lot of calculation, but without affect the time spent in I/O or communication.

III. ENERGY-AWARE SIMULATIONS

This section presents the features developed and incorporated in the CloudSim simulator in order to support energy-aware simulations using DVFS. CloudSim has been chosen for this work because it is composed of many energy-aware tools needed to run reliable simulations. Some other powerful simulators like SimGrid [START_REF] Casanova | Simgrid: A generic framework for large-scale distributed experiments[END_REF], GSSIM [11] [12] or GreenCloud [START_REF] Kliazovich | Greencloud: A packet-level simulator of energy-aware cloud computing data centers[END_REF] have been analysed and taken into account, but they do not collect enough energy-aware tools needed for this work.

A. CloudSim overview

CloudSim [START_REF] Calheiros | Cloudsim: a toolkit for modeling and simulation of cloud computing environments and evaluation of resource provisioning algorithms[END_REF] is a Cloud simulator based on GridSim [START_REF] Buyya | Gridsim: A toolkit for the modeling and simulation of distributed resource management and scheduling for grid computing[END_REF]. CloudSim is a toolkit for modeling and simulation of Infrastructure as a Service (IaaS) cloud computing environments. The data-centers architecture is well modeled and can be easily modified by the user according to its needs. It allows users to define the characteristics of data-centers, including number and characteristics of hosts, available storage, network topology, and patterns of data-centers usage. CloudSim allows the virtualization, development of scheduling policies, network simulation between data-centers as well as compute the cost of a IaaS cloud computing service. Energy functionalities of CloudSim allow to turn off hosts, migrate virtual machines and the integration of energy models.

In order to have all energy tools needed in this simulator, the DVFS has been implemented and added in the core of the simulator. Governors of the five DVFS modes, as they are present in the Linux kernel have been implemented. Their role is to determine whether the CPU frequency must be modified, and their decision is directly related to their intrinsic decision rule. A frequency change directly impacts the CPUs capacity in MIPS (Millions Instructions Per Second) and inexorably the total capacity of the host. Indeed, the new DVFS package (Figure 1) is composed of one abstract class which contains all common parameters of the different modes, and each specific mode's behaviour is described in the five other distinct classes. This package is closely linked with CPU and Host classes of CloudSim, so as to allow the analysis and the control of their load, frequencies and capacity states.

B. DVFS integration

It also involves how the simulator has to manage the virtual machines capacities. For example, if the system decides to reduce the frequency, the sum of the capacities of all virtual machines can temporarily exceed the maximum capacity of the host. In this case, the size of each virtual machine must be decrease in proportion to the new host capacity to fit them in this host. The same situation occurs when one or more new virtual machines are created and need to be hosted. If the sum of capacities of all virtual machines running and those of the new virtual machines created exceeds the maximum capacity of the host the same process of reducing the capacity of virtual machines is applied.

Also, when part of the capacity of a host is freed, the capacity of virtual machines still running can be increased. This event occurs when a virtual machine finishes its execution or when the CPU frequency is increased, all virtual machines sizes are increased in proportion to the free capacity of the host, while taking care to not exceed their maximum available capacity.

These different situations that imply to dynamically modify virtual machines capacities regarding the frequency changes also mean that the DVFS package has been implemented so as to be closely linked to the virtualization layer and the main core classes of CloudSim.

Finally, an input XML configuration DVFS file has been added to allow the user to specify:

• the available frequencies of the CPU • which DVFS mode has to be activated • thresholds' values to be used (for dynamic modes)

C. Simulations using dynamic DVFS policy

For these simulations the dynamic OnDemand mode is used. Its intrinsic behaviour allows to reduce the CPU frequency during an Idle CPU phase, and set it to its maximum when a CPU burn phase comes. These frequency changes are managed by the OnDemand governor and give low power consumption when the host is under-used. This governor also favours the performance of the host when the full CPU computation power is needed. Indeed, it sets the CPU frequency at the maximum available value as soon as the CPU load overstep a threshold (95% of CPU load). Conversely, when the CPU load stay under this threshold, the CPU frequency is decreased step by step using all frequencies available in the host. If a host is temporally under-used, but not for long enough to decide to move its tasks, this dynamic mode allows to reduce the energy consumption while keeping this host switched on.

D. How are simulations used

In the autonomic context, two types of events can be defined. The first one concerns the arrival of a new task that need to be schedule in one host. The other event happens when a host is under-used regarding a CPU load threshold (15% for example). These two cases lead to trigger an autonomic event, in the first case the aim is to find the best host in term of energy consumption to execute the task, in the second one it is necessary to freeing the host (stop and move all processes) by migrating all tasks to other hosts. Of course, these moves are not free in term of time, due to the time need to stop processes, copy data from one host to another(s) and then continue the execution on new chosen hosts. In term of energy consumption this lead to switch off one host, indeed saving energy, and consolidate the others that already have enough running processes to keep them switched on.

In these two described cases, simulations are dynamically used in order to find the best energy efficiency scheduling of tasks.

The next section introduces the autonomic framework, Frameself.

IV. FRAMESELF AUTONOMIC FRAMEWORK

The Frameself [START_REF] Ben Alaya | Frameself: A generic context-aware autonomic framework for self-management of distributed systems[END_REF] framework is a generic autonomic manager based on the IBM autonomic architecture reference [START_REF] Parashar | Autonomic computing: concepts, infrastructure, and applications[END_REF]. The monitor, analyzer, planer, and executer operate as expert systems to emulate the decision-making ability of human experts. These modules are independent from managed resources and are designed to solve complex problems by reasoning about knowledge, like an expert. Each module is divided into two parts, one fixed, independent of the system: the inference engine, and one variable: the knowledge base model. The Frameself global architecture is described in Figure 2.

A. Main components overview

The monitor collects events from different sensors and transforms, extends and formats them in a standardized format to make them consistent for processing. It discards events that are deemed to be irrelevant for the management platform and ignores events pertaining to systems that are downstream of a failed resource. Masking is different from filtering because it allows to dynamically hide unfiltered events according to the environment changes. The monitor also merges duplicates of the same event that may be caused by network instability. It infers symptoms based on received events using knowledge models then publish generated symptoms on the message bus to make them available to the analyzer. The monitor acts as a proxy to connect specific event collectors that depends on existing sensors. Depending on the targeted system, a specific event collector can be an asynchronous event subscriber, a synchronous event requester, or an even log file parser.

The analyzer subscribes to the message bus and receives published symptoms. It infers Requests For Change (RFCs) based on received symptoms and knowledge models, then publishes them on the message bus in order to make them available to the planner. The analyzer can also check and validate a policy entered by the administrator and can resolve conflicts between policies.

The planner subscribes to the message bus and receives published Plans. It reads information related to policies and available effectors from the knowledge base, generates action plans leading to received RFCs, then publishes generated plans on the message bus to make them available to the Executer. The planner can also convert high-level policies into low-level ones and employ them to guide the decisions.

The executer subscribes to the message bus and receives published plans. It interprets received actions and checks whether it has the rights and means to execute them. It schedules and orchestrates the execution process by describing the automated arrangement and coordination of actions in time, then executes them on distributed destinations. The executer acts as a proxy to connect specific action dispatchers that depend on existing effectors. Based on the targeted system, a specific action dispatcher can be a web-service client able to request web-services or a deployment manager able to send and execute script files into distributed machine.

The Knowledge Base allows to maintain all essential informations to execute self-management operations on the managed system. Knowledges can be divided in different categories :

-Topology of the system architecture.

-Descriptions of sensors and effectors.

-Data about symptoms, RFCs, actions and used policies. Other domain specific models such as ontology or graphs, and reasoning rules can be instantiated, within the knowledge base, independently for each control loop component. Thus, each model can be handled in a decoupled way which enables to manage a multi-model knowledge base.

B. Functioning description

The monitor subscribes to available sensors and receives events such as a managed resource "CPU usage", or "New task arrival". Collected events are normalized, filtered, aggregated, and then inserted in the knowledge base monitoring session.

The monitor applies business rules using the Drools inference engine [START_REF] Proctor | Relational declarative programming with jboss drools[END_REF] to generate relative symptoms such as "Low CPU" or "NonScheduled task" and sends them to the analyzer. This latter provides the mechanisms that correlate and model complex situations. These mechanisms allow the autonomic manager to learn about the environment and help to predict environment changes. It receives symptoms as input, generates new knowledge about required requests for change (RFCs) such as "deploy task" or "migrate task" and sends them for planning.

The planner acts as a decision module for selecting the appropriate hosts to execute tasks. It saves received RFCs as goal states, reads models of possible actions and facts from the knowledge base and applies an energy efficiency policy to guide its work. The planner generates actions such as "1 install task" then "2 starting task" for task deploying, or "1 stop task", "2 delete task", "3 install task", then "4 start task" for task migration. The executor performs the received plan using effectors and controls the actions execution with consideration for dynamic updates.

The next section presents first results obtained both on autonomic management and energy-aware scheduling.

V. FIRST RESULTS

Performance results are experimented to calculate the overload that FrameSelf generates to handle an increasing number of events. Obtained time values include monitoring and analysing processes based on the Drools inference engine, as well as the planning process based on the CloudSim energy-aware simulator. Figure 3 shows the FrameSelf selfmanagement capacity calculated after receiving and handling new task arrival events from a number of 10 to 1000 events. Scheduling results obtained with CloudSim have been done using a metric that allow to classify hosts by their power consumption characteristic related to their free capacity.

The metric considered to be minimized, called Watt Per Mips (WPM), is defined as follow: Lets denote the considered set of hosts by H j = {H 1 , ..., H n } with a maximum of N b H elements, then for each host each set of CPUs can be defined as H cpus Finally, the WPM metric computed for each host H j is equal to:

WPM = nbCP U i=1   (P cpui max -P cpui min ) × N b V M k=1 M V M k max M H j max    N b CP U (1)
This metric allows to find the best green host at a given time t, by taking into account each current CPU frequency (defined in MIPS in equations), the potential of a host to accommodate new tasks (free capacity), and the powers values of the host using these current CPUs frequencies.

The scheduling time depends on how many hosts are taken into account and how many tasks have to be scheduled. Results using this metric (eq 1) have been done with 20 hosts and is depicted on Figure 4. Results on this figure have been obtained with CloudSim by simulating a tasks scheduling, from a number of 10 to 1000 tasks, with the same arrival time.

VI. CONCLUSION

This article presents first ideas and first results of using both autonomic framework and an energy-aware simulator. The aim is to use the decision rules bases of the autonomic manager to schedule and migrate tasks. Two critical situations are detected such a new task arrival, so needs to be schedule and an under-used host needed to be freeing. The autonomic framework is used for energy efficiency self-optimization and the simulator is used to be able to have estimations of the power consumption using different scheduling policies in order to take an energy efficient scheduling decision.

Proposed perspectives include new experiments using more complex scenario, by multiplying the number of type of events and using a real platform architecture model to involve a higher number of hosts in order to validate the scalability of this approach. Another perspective is to adapt this approach to a real scheduler, as OAR [START_REF] Capit | A batch scheduler with high level components[END_REF], in Grid and Cloud infrastructures.

Fig. 1 .

 1 Fig. 1. Classes of the new DVFS package added in the CloudSim simulator

Fig. 2 .

 2 Fig. 2. Frameself architecture overview

Fig. 3 .

 3 Fig.3. FrameSelf self-managing capacity using 20 hosts.

  a maximum of N b CP U elements. Finally, the set of virtual machines running on these hosts are defined byV M k = {V M 1 , ..., V M n } with a maximum of N b V M elements.Then, power and capacity of hosts and CPUs are defined as: P Hj min and P Hj max : the powers deliver by an host H j at Idle (0%) and Full (100%) states.

Fig. 4 .

 4 Fig. 4. CloudSim scheduling time using 20 hosts.

  P cpui min and P cpui max : the powers deliver by a CPU cpu i of a host H j ( cpu i ∈ H cpus j ) at Idle (0%) and Full (100%) states. Each capacity of Host, CPU and virtual machines are defined as: Hj curr : the current capacity of the host H j (in MIPS).Hj max : the maximum capacity of the host H j (in MIPS).

	M
	M
	M cpui curr : the current capacity of the CPU cpu i (in MIPS).
	M V Mk max : the maximum capacity of virtual machine V M k
	(in MIPS).
	Lets define minimum and maximum powers (at Idle and
	Full states) given by the CPUs as:
	P cpui min =	P min ×M host j curr cpu i M H j curr	and P cpui max = P host j max ×M curr cpu i H j M curr


QoS-aware AFDX: benefits of an efficient priority assignment for avionics flows Tasnim Hamza, Jean-Luc Scharbarg, Christian Fraboul Université de Toulouse -INPT/ENSEEIHT -IRIT 2, rue Camichel -31000 Toulouse, France

Abstract-AFDX (Avionics Full Duplex Switched Ethernet) standardised as ARINC 664 is a major upgrade for avionics systems. The certification imposes to guarantee that the end-toend delay of any frame transmitted on the network is upperbounded and that no frame is lost due to buffer overflow. This guarantee is obtained thanks to a worst-case analysis assuming a FIFO scheduling policy of flows on each output port.

For future aircraft, it is envisioned to modify AFDX switch and to use a Fixed Priority scheduling policy of flows (QoS AFDX using IEEE 802.p mechanisms). A worst-case analysis of such a network has been proposed, based on the Trajectory approach.

But the remaining issue is to efficiently assign available priorities to the avionics flows inside the network without modifying the application knowledge. The objective is then to minimise overall the worst case end to end delay of flows and consequently to minimise needed buffer size at switch level.

The main contribution of this paper deals with the assignment of priorities to the flows using the well-know Optimal Priority Assignment algorithm (OPA) which was first defined for monoprocessor preemptive systems. The schedulability test is then based on the worst case delay analysis of each flow allocated on the AFDX QoS network computed by the trajectory approach.

The proposed mechanisms have been applied on an industrial AFDX case study using two priority levels and the overall worstcase delay could be reduced by 20 %.

I. CONTEXT

Full duplex switched Ethernet eliminates the inherent indeterminism of vintage (CSMA-CD) Ethernet. Nevertheless, it shifts the indeterminism problem to the switch level where various flows can compete for output ports.

Avionics AFDX multicast flows are called Virtual Links (VLs) [START_REF]Arinc specification 664: Aircraft data networks, parts 1[END_REF]. They are statically defined (burst and rate contract) and are statically mapped on the network of AFDX switches.

For a given VL, the end-to-end communication delay of a packet is the sum of transmission delays on links and latencies in switches. As the links are full duplex there is no packet collision on links. The transmission delay only depends on the transmission rate and on the packet length. But, the latency in switches is highly variable because of the confluence of asynchronous VLs, which compete on each switch output port (according to a scheduling policy).

Many work has been devoted to the worst case analysis of end-to-end delays on an AFDX network implementing FIFO scheduling policy. For certification reasons, a first tool, based on the Network Calculus theory and implemented by Rockwell Collins, has been proposed for the computation of an upper bound for the end-to-end delay of each VL. This approach models the traffic on the AFDX network as a set of sporadic flows with no QoS classes differentiation. A second approach based on the trajectory concept has been proposed [START_REF] Bauer | Improving the worstcase delay analysis of an afdx network using an optimized trajectory approach[END_REF]. It identifies for a given frame all the competing frames which can delay this frame in all the output ports visited.

This second approach has been generalised in order to implement a Fixed Priority scheduling policy of QoS-aware AFDX network [START_REF]Applying trajectory approach with static priority queuing for improving the use of available afdx resources[END_REF]. A worst-case analysis of such a network has been proposed. It can be applied for any number of priority levels and gives tight end-to-end delay upper bounds.

The remaining issue is to assign priorities to VLs in order to demonstrate the efficiency of QoS aware switches. A relevant objective for this priority assignment consists in minimising the overall worst case end-to-end delay of VLs. Indeed, the worst-case end-to-end delay of a VL highly depends on its path. When all the VLs have the same priority, it leads to very different worst-case delays for different VLs. Assigning priorities to VLs should reduce this difference, leading to smaller higher delays. This priority assignment must be done without additional knowledge of avionics flows.

II. PRIORITY ASSIGNMENT FOR QOS-AWARE AFDX

An Optimal Priority Assignment algorithm (OPA) has been proposed in the context of monoprocessor preemptive systems [START_REF] Audsley | On priority assignment in fixed priority scheduling[END_REF]. For an asynchronous periodic task set, OPA generates an optimal priority ordering while using a polynomial number of schedulability tests. It first assigns the lowest priority to one task which respects its deadline with this lowest priority. It continues till the remaining unassigned set of tasks is empty. If at a step no task can be assigned the current priority, no feasible priority assignment exists. At each step, a schedulability test is applied to the task which is assigned the current priority in order to determine whether it respects its deadline or not. The schedulability test has to be OPA compatible. It means that it has to respect the following conditions:

• Condition 1: Schedulability of a task may, according to the test, be dependent on the set of higher priority tasks, but not on their relative priority ordering.

• Condition 2: Schedulability of a task may, according to the test, be dependent on the set of lower priority tasks, but not on their relative priority ordering.

• Condition 3: When the priorities of any two tasks of adjacent priority are swapped, the task being assigned the higher priority cannot become unschedulable according to the test, if it was previously deemed schedulable at the lower priority.

A first extension of OPA has been proposed in order to minimise the number of priority levels [START_REF] Audsley | On priority assignment in fixed priority scheduling[END_REF]. Indeed concrete systems support a limited number of priority levels. The minimisation is achieved by successively maximising the number of tasks assigned to priority levels from the lowest one to the highest one. OPA has also been extended to other types of systems (e.g. multiprocessor systems) [START_REF] Davis | Improved priority assignment for global fixed priority pre-emptive scheduling in multiprocessor real-time systems[END_REF]. In most cases the priority assignment is no more optimal since the schedulability test is not exact. However OPA-based solutions are often better than solutions considering heuristic priority assignment [START_REF] Davis | Improved priority assignment for global fixed priority pre-emptive scheduling in multiprocessor real-time systems[END_REF].

Algorithm In this paper, we propose the extension of OPA for the assignment of priorities to VLs transmitted on a QoS-aware AFDX. The approach is summarised in Algorithm 1. Since the goal is to minimise the overall worst-case delay of any VL transmitted on the network, the proposed solution consists in considering that this overall worst-case delay is the deadline of all the VLs. The approach minimises priority levels: as proposed in [START_REF] Audsley | On priority assignment in fixed priority scheduling[END_REF], it assigns as many VLs as possible to each priority level. The remaining issue is to get an OPAcompatible schedulability test. Such a test is presented in the next paragraph.

III. SCHEDULABILITY TEST

The trajectory approach computes a sure upper-bound of the end-to-end delay of a VL transmitted on an AFDX network implementing either FIFO scheduling [START_REF] Bauer | Improving the worstcase delay analysis of an afdx network using an optimized trajectory approach[END_REF] or Fixed Priority (FP) scheduling [START_REF]Applying trajectory approach with static priority queuing for improving the use of available afdx resources[END_REF]. The solution proposed in this paper is based on the trajectory approach for FP. The trajectory computation includes all the delays encountered by a frame of a given VL on its trajectory, namely:

• transmission time of the considered frame on links,

• switching latencies,

• delay due to the workload of the competing VLs with the same priority as the VL under study,

• delay due to the workload of the competing VLs with higher priority than this of the VL under study,

• delay due to the workload of the competing VLs with lower priority than this of the VL under study.

This computation is OPA-compatible.

• The workload of higher priority VLs is computed without considering their relative priority order. Thus condition 1 is respected.

• The workload of lower priority VLs is the largest frame with lower priority. Thus it does not depend on the relative priority order of these VLs and condition 2 is respected.

• Increasing the priority of a VL has two impacts. First, higher priority VLs can become same priority VLs or lower priority VLs. Second same priority VLs can become lower priority VLs. It can be shown that none of these impacts can increase the overall workload of competing VLs. Thus condition 3 is respected.

IV. FIRST RESULTS

The proposed approach has been applied to a realistic AFDX configuration including 8 switches and 984 VLs (see [START_REF] Charara | Methods for bounding end-to-end delays on an AFDX network[END_REF] for a description of the configuration). The worst-case delays of VLs assuming FIFO scheduling are between 0.2 ms and 15.4 ms. Thus we fix the deadline for any VL to 12.3 ms (roughly 80 % of the worst-case delay with FIFO). The approach proposed in this paper is able to assign priorities such that all the VLs respect their deadlines. Only two priority levels are needed.

V. CONCLUSION

First results on priority assignment of avionics flows on a realistic AFDX configuration are promising: the overall worstcase delay is reduced by 20 % with two priority levels.

Further evaluation is still needed in order to better estimate the improvement that could be obtained with of a larger number of priority levels.

Moreover the minimisation of the overall worst-case end to end delay is interesting in order to minimise the size of needed buffer of a QoS aware switch. Then the test should concern the maximum backlog in any switch. Such a test has been proposed in [START_REF] Garikiparthi | Calculation of worst case backlog for afdx buffers with two priority levels using trajectory approach[END_REF] for two priority levels. It has to be extended to any number of priority levels.


I Marrakchi

M Turki-Hadj

S Djaziri-Larbi

M Jaïdane-Saïdane

G Mahé

SPEECH PROCESSING IN THE WATERMARKED DOMAIN: APPLICATION IN ADAPTIVE ACOUSTIC ECHO CANCELLATION

Audio watermarking, or embedding information in a host signal was originally used for digital copyright protection purposes. As audio coding, watermarking is progressively brought in audio processing applications.

In this paper, we investigate some benefits of watermarking in signal processing. We focus here on a generic application : adaptive Acoustic Echo Cancellation (AEC). The proposed Watermarked AEC (WAEC) is based on a coupling of two adaptive filters. The first one extracts a rough estimation of the echo response to the known stationary watermark embedded in the speech signal. This extracted estimation constitutes the reference signal for the second adaptive filter. Driven by the known watermark, the second adaptive filter estimates then the actual echo path. The goal here is to drive the estimation of the echo path by the watermark itself, in order to take advantage of the its optimal properties (whiteness and stationarity).

As expected, the proposed WAEC exhibits better transient and steady state performance than the classical one. These results of some interest follow from the fact that the second adaptive filter deals with much more stationary signals that the first one.

INTRODUCTION

Recently, watermarking, or embedding information in a host signal, originally used for digital copyright protection purposes has arisen the interest of researchers in many other application fields. In particular, watermarking was used to enhance the performance of audio processing systems. Indeed, in [START_REF] Larbi | Réflexion sur un annuleur d'écho robuste aux non stationarités de la parole[END_REF] watermarking aimed to stationarize the audio signal. The performance of a classical AEC was then improved [START_REF] Larbi | Audio watermarking : a way to modify audio statistics[END_REF]. In [START_REF] Gilloire | Using auditory properties to improve the behaviour of stereophonic acoustic echo cancellers[END_REF], the ill-conditioning of the input covariance matrix in a stereophonic AEC system, was reduced. In [START_REF] Peters | Psychoacoustical excitation of the (N)LMS algorithm for acoustical system identification[END_REF], Iapatov and Huffman sequences were embedded in speech signal, through perceptual masking, to improve the AEC performance. Note that classical adaptive filters exhibit low performance when dealing with non stationary data.

This paper investigates the benefits of classical signal processing in the watermarked domain, where operating in the watermarked domain refers to processing of watermarked signals. Here, the watermarking is associated to an AEC system according to an original way. Whereas the AEC was driven by the watermarked audio signal in the latter references, the goal here is to drive the estimation of the echo path by the watermark itself, in order to take advantage of the optimal properties of the watermark (whiteness and stationarity).

The paper is organized as follows : section 2 introduces a basic version of the WAEC. To meet the inaudibility constraint the basic version is modified. The retained version of WAEC is then presented in section 3. Performance analysis of the proposed WAEC are discussed in section 4. Simulation results, presented in section 5, demonstrate the benefits of the proposed approach. Comparison with classical AEC is performed.

WATERMARKED AEC

The proposed WAEC aims at exploiting the good transient and steady state performance of adaptive filters in presence of an uncorrelated stationary input. Therefore, the structure of a classical AEC is modified in such a way that the actual echo is adaptively estimated using a reference echo signal that includes the convolution between the actual echo path and a known white stationary signal. As a matter of fact, the stationary white sequence, embedded in the received speech, is the carrier of the acoustic impulse response to be identified. The proposed WAEC is depicted on Fig. 1. Note that in this basic version, the watermarking process corresponds to a simple addition of the white signal and the received speech.

i + c n k E i + E i + E i + w k x k x w k F H k c T c H T k W k H w k i + E c E e t k e w k y k c e k - copy of H w k i + T E E E E E e tr k - FIG.
1 -Preliminary version of the watermarked AEC.

Fig. 1 shows two coupled adaptive filters. The first one H k is driven by the non stationary watermarked input

x w k = x k + w k ,
where x k is the received speech signal and w k the stationary and white watermark. The generic AEC delimited by a dashed box on Fig. 1 provides an estimation of the reference echo signal y k used by the second adaptive filter H w k . The latter is driven by the watermark w k only. The estimation of the watermark echo is

e t k = e k + (H k ) T W k = F T W k + n k + (V k ) T X k n k , (1)
where V k = F -H k denotes the deviation vector that describes the behaviour of H k ( T denotes the transpose operator). According to (1), the echo is a sum of the useful information F T W k and the non stationary noise n k . That is equivalent to a situation where e t k is the new reference signal and the echo path F is driven by w k .

Since H w k performs in a more stationary context, it provides a better estimation of the acoustic echo path F than H k . Consequently, H w k is the filter used to compute the echo estimate ŷn = (H w k ) T X w k , where X w k = (x w k , .., x w k-p+1 ) T is the watermarked non stationary tap input vector. Therefore, the transmitted residual echo is given by e tr k = y k -ŷk , where y k = F T X w k +n k corresponds to the actual echo corrupted by a noise n k assumed to be white. Note that an NLMS adaptation is used to adjust the two adaptive filters of length p assumed to be equal to that of the impulse response F.

-The update equations related to H k are given by

e k = y k -(H k ) T X w k (2) H k+1 = H k + µ k e k X w k (3) where µ k = µ X w k 2 is the normalized step size.
-The second adaptive filter, H w k , is updated as follows

e w k = e t k -(H w k ) T W k (4) H w k+1 = H w k + µ w k e w k W k , (5)
where W k = (w k , .., w k-p+1 ) T is the stationary tap input vector and µ w k = µ w X w k 2 the normalized step size. By substituting in (4) the echo e t k given in (1), one can write

e w k = F T W k -(H w k ) T W k + n k = (V w k ) T W k + n k . (6)
V w k = F -H w k denotes the deviation vector related to H w k . The analysis of ( 1) and [START_REF] Scalart | On integrating speech coding functions into echo cancelling filters with decorrelating propeerties[END_REF] shows that the steady state performance of the adaptive filter H W k and consequently that of the proposed AEC depends on the Signal to Noise Ratio

SNR w = P x P w .
The lower the SNR w is, the better performance of the watermarked AEC can be achieved. But for low values of SNR w , the watermark w k becomes audible whereas the inaudibility constraint must be satisfied in practice. Thus, in order to ensure the watermark masking, modifications of this basic version of the WAEC are made.

THE PROPOSED WATERMARKED AEC

In general, speech watermarking is performed using a perceptual weighting filter [START_REF] Paillard | PERCEVAL : perceptual evaluation of the quality audio signals[END_REF][START_REF] Wai | Speech coding algorithms[END_REF]. In our case, the watermark masking is based on a spectral shaping filter derived from the speech spectral envelope. Moreover, the intensity of the spectral shaped output is reduced by about 13 dB in order to ensure an inaudibility quality equivalent to that obtained by a perceptual weighting filter. The spectral shaping filter coefficients are deduced from the speech predictor. The speech predictor is used here to achieve 1. the masking of the white sequence, 2. the whitening of the watermarked input sequence which aims to enhance the convergence speed of the first NLMS adaptive filter. Indeed, in the previous WAEC, the watermarked input is correlated and consequently the convergence speed of H k is slow. Note that the whitening is already used for system identification purposes [START_REF] Mboup | LMS coupled adaptive prediction and system identification : A statistical model and transient mean analysis[END_REF]. The bloc diagram of the modified WAEC is presented in Fig. 2 and detailed in the following.

i + c n k E i + x k x w k F H k H T k W k H w k i + c E e t k e w k y k e k - i + T E E E E e tr k - copy of H w k w k S k (z) c c T c E λ σ e x (k) ' c w k copy of copy of i + E E E i + c E E t k p s s - E k (z) E k (z)
FIG. 2 -The proposed WAEC scheme.

The whitening filter

The speech is assumed to be an AutoRegressive process of order M (AR (M)). So,

x k = (P k ) T X k-1 + e x k ,
where e x k is the prediction error of variance σ 2 e (k), P k = (p 1 k , ..., p M k ) T the predictor coefficients vector and X k-1 = (x k-1 , ..., x k-M ) T the input vector. A NLMS adaptation is used to update the predictor coefficients :

P k = P k-1 + η k e x k X k-1 , (7)
where

η k = η X k
2 is the normalized step size. The whitening filter transfer function is E k (z) = 1 -P k (z), where P k (z) denotes the predictor transfer function.

The spectral shaping filter

The transfer function S k (z) of the all-pole spectral shaping filter is then expressed by

S k (z) = λ σ e (k) E k (z) .
The attenuation factor λ is chosen so that 20 log 10 (λ ) = -13 dB. Thus, the watermarked signal is obtained according to x w k = x k +t k , as shown on Fig. 2, where t k refers to the spectral shaped watermark signal.

The echo estimation

Let e x k , e xw k and e n k be the through E k (z) filtered signals x k , x w k and n k respectively. By applying the whitening filter to y k , we obtain the reference echo for

H k e y k = F T E x k + F T W k + e n k ,
where E x k = (e x k , ..., e x k-p+1 ) T and

W k = λ σ e (k)W k .
The error signal e k controlling the update of H k is

e k = e y k -(H k ) T (E x k +W k ),
and the reference echo signal for the second adaptive filter

H w k becomes e t k = e k + (H k ) T W k = F T W k + e n k + (V k ) T E xw k e n k , (8)
where E xw k = (e xw k , ..., e xw k-p+1 ) T . The error e t k expressed by [START_REF] Haykin | Adaptive Filter Theory[END_REF] points out that the useful information for the filter H w k is F T W k . Therefore, and as shown on Fig. 1, the filter H w k is driven by w k , and its coefficients are adapted according to

H w k+1 = H w k + µ w k e w k W k , (9)
where the error e w k is given by

e w k = (V w k ) T W k + e n k . (10)
In this section, we have detailed the structure of the WAEC. In the following, we focus on the performance analysis of the proposed system.

PERFORMANCE ANALYSIS OF THE PROPOSED WAEC

The transient and steady state performances of the proposed WAEC are analysed in comparison with those of the generic AEC, delimited by a dashed box on Fig. 1. For this comparison, the generic AEC must be driven by the watermarked signal x w k , because the available reference echo is generated by the watermarked speech. Indeed, it has been proved in [START_REF] Larbi | Audio watermarking : a way to modify audio statistics[END_REF] that watermarked audio is more stationary than the host signal. Furthermore, in [START_REF] Larbi | Réflexion sur un annuleur d'écho robuste aux non stationarités de la parole[END_REF] the authors have already shown that a classical AEC presents higher performance when driven by the watermarked speech instead of the original.

The transient and steady state behaviour of the classical AEC and the WAEC are studied through the time variation of the deviation vectors V k and V w k respectively. Using ( 1), ( 4) and ( 5) it is easy to show that

V k+1 = (I -µ k X w k (X w k ) T ) A V k + µ k n k X w k C , ( 11
)
where I refers to the identity matrix of rank p. Besides, by combining ( 8), [START_REF] Wai | Speech coding algorithms[END_REF], and (10), it follows that

V w k+1 = (I -µ w k W k (W k ) T ) B V w k + µ w k e n k W k D . ( 12
)
We remind that the mean convergence depends on the conditioning of the matrices A and B [START_REF] Haykin | Adaptive Filter Theory[END_REF].

Taking the expectation value of both sides of (11) one obtains

E[V k+1 ] = (I -µR x w (k))E[V k ], (13)
where

R x w (k) = E X w k (X w k ) T X w k 2
. This result is obtained assuming the classical hypothesis of statistical independence between V k and X w k . Similarly, assuming that e n k is of zero mean and statistically independent from w k , it follows from ( 12) that

E[V w k+1 ] = (I -µ w R w (k))E[V w k ] (14)
where

R w (k) = E W k W k T W k 2
. From equations ( 13) and ( 14)

we can notice that in the classical case, the transient behaviour is governed by the matrix R x w (k), whereas in the case of the proposed WAEC, the transient behaviour depends on the matrix R w (k). The eigenvalue spread of R w (k) is expected to be small compared to that of R x w (k) since w k is much more uncorrelated than the watermarked speech x w k . This is illustrated by Fig. 3, where we compare the condition numbers of the covariance matrices R x w (k) and R w (k), computed over sample frames of length 20 ms. Knowing that the covariance matrix of a white signal has a logarithmic condition number equal to zero, we conclude from Fig. 3 that R w (k) is better conditioned than R x w (k). Hence, we may confirm that the convergence rate of the WAEC will be higher than that of the classical AEC.

The analytical study of the mean square convergence is difficult to carry out as the signals are correlated and non stationary. However, one can see from equations ( 13) and ( 14) that the steady state performance of the AEC and the WAEC adaptive filters depends crucially on the instantaneous values of

P C k = E (C k ) T C k and P D k = E (D k ) T D k respectively. As H w
k performs in a more stationary context, P D k is expected to have smoother variations and lower values than P C k . This aspect will improve the WAEC performance in the steady state.

SIMULATION RESULTS

The parameter settings chosen for all reported simulations are :

-a speech signal sampled at 8 kHz and a car acoustic impulse response truncated to 100 taps, -SNR = 40 dB, -η = 0.0025, -M = 4 and p = 100. For the transient behaviour analysis, the same step size value 0.01 is used for the two coupled adaptive filters of the proposed WAEC. For the classical AEC with watermarked input, the step size is also fixed to 0.01. To demonstrate the enhancement of the convergence rate achieved by the proposed WAEC, we plot on Fig. 4 the time variations of the MSD related to the WAEC H w k and the MSD obtained by the classical AEC with a watermarked input (H k ). The MSD measure is defined here for a deviation vector V k as

MSD dB = 10 log 10 E V T k V k
As expected theoretically, since the watermark is much more white than the watermarked signal, the convergence rate of the proposed WAEC is much higher than that of the classical AEC.

To have comparative results in steady state, the choice of the step size values must ensure the same convergence rate for both AEC systems (the classical and the proposed one). To meet this condition, the same step size value 0.01 is used for both coupled adaptive filters of the proposed WAEC, whereas, for the classical AEC with watermarked input, the step size is fixed to 0.1.

The measure of the effect of an echo cancellation filter is the so-called Error Return Loss Enhancement (ERLE) :

ERLE(k) = 10 log 10 E[y 2 k ] E[e 2 k ]
,

where y k is the echo signal (it is the same in both cases) and e k is the residual error in the generic AEC case. The equivalent residual error in the WAEC case is denoted e tr k on Fig. 2. To confirm the steady state analysis presented in Section 4, we depict on Fig. large values during the low dynamics of the watermarked speech. This results in considerable disturbance of the MSD time evolution as shown on Fig. 6. Consequently, the ERLE related to the generic AEC is impaired as displayed by Fig. 7. Indeed, we notice that the WAEC achieved a 10 dB gain in the ERLE.

The reported results presented on Fig. 4 and Fig. 7 show that both the transient and the steady state performances are considerably improved by the WAEC.

CONCLUSION

This paper investigated the advantages of speech processing in watermarked domain. We have presented an original way to exploit watermarking for the improvement of a generic AEC performance. The new proposed WAEC benefits from the fact that white and stationary signals are the ideal inputs for classical adaptive filters. Compared to the classical AEC, the proposed WAEC exhibits much higher convergence rate and lower MSD. Moreover, an ERLE enhancement of up to 10 dB was achieved. These reported re- sults are very promising and the slightly higher complexity of the WAEC is not a serious drawback considering the actual high-performance digital signal processors (DSP). However, a deeper theoretical and experimental analysis needs to be carried out to further improve the WAEC system.

FIG. 3 -

 3 FIG. 3 -Condition number of R w (k) (WAEC, in blue) and of R x w (k) (classical AEC with watermarked inputin black).

FIG. 4 -

 4 FIG.4-MSD time variation in the WAEC case (in blue) and in the classical AEC case with watermarked input (in black).

FIG. 5 -

 5 FIG. 5 -Time variation of P Dk (WAEC, in blue) and P C k (classical AEC with watermarked input, in black).

FIG. 6 -

 6 FIG.6-MSD time variation in the steady state and in both cases : WAEC (in blue) and classical AEC with watermarked input (in black).


Paul Lajoie-Mazenc

Emmanuelle Anceaume

Gilles Guette

Thomas Sirvent

Valérie Viet

Triem Tong

Mécanisme de réputation distribué préservant la vie privée avec témoignages négatifs

Keywords: Systèmes distribués, Mécanismes de réputation, Vie privée, Cryptographie appliquée

Les mécanismes de réputation permettent de réduire les risques pris par les utilisateurs dans les réseaux ouverts et à large-échelle en associant un score de réputation aux utilisateurs, qui résume leur comportement passé. Néanmoins, pour atteindre leur objectif, ces mécanismes peuvent mettre en danger la vie privée de leurs utilisateurs. Des solutions préservant la vie privée de leurs utilisateurs ont été proposées ; cependant, elles n'offrent pas de garanties de vie privée assez fortes, ou réduisent l'utilité de la réputation. Dans cet article, nous proposons un mécanisme de réputation distribué préservant la vie privée, tout en permettant aux clients de témoigner positivement ou négativement ; cette proposition repose à la fois sur des outils cryptographiques et des tierces parties distribuées. Nous montrons également que notre proposition est efficace, et donc utilisable en pratique.

Introduction

Les mécanismes de réputation sont devenus des outils puissants permettant d'instaurer la confiance dans des réseaux où les utilisateurs ne se connaissent pas, par exemple dans le cadre du commerce électronique. Les clients témoignent sur les fournisseurs de service avec lesquels ils interagissent, ce qui permet aux autres utilisateurs de savoir comment se comportent ces fournisseurs sans les connaître. Ces mécanismes sont généralement distribués, ce qui évite qu'une autorité centrale ne contrôle les réputations de tous les fournisseurs de service, et ne soit un point unique de défaillance du système.

Cependant, les mécanismes de réputation requièrent de nombreuses informations personnelles pour atteindre ce but : le témoignage d'un client sur un fournisseur permet de connaître la fréquence des interactions du client, leur type, etc. C'est pour cette raison que des mécanismes de réputation préservant la vie privée sont apparus. Les premiers mécanismes visaient à préserver le secret des témoignages des clients, pour éviter qu'un fournisseur ne puisse exercer de représailles sur un client l'ayant mal noté. Hasan et coll. [START_REF] Hasan | A decentralized privacy preserving reputation protocol for the malicious adversarial model[END_REF] proposent une telle approche, tolérant les comportements byzantins des fournisseurs ainsi que des clients tout en préservant le secret des témoignages : une fois qu'un client a témoigné, il est impossible de savoir si ce témoignage est positif ou négatif. Cependant, la vie privée des clients eux-mêmes n'est pas préservée, et un fournisseur est toujours capable de discriminer un client sur la base de son identifiant.

Des mécanismes garantissant des propriétés de vie privée plus fortes sont donc apparus. Par exemple, Bethencourt et coll. [START_REF] Bethencourt | Signatures of reputation[END_REF] proposent un mécanisme garantissant un anonymat total des clients et des fournisseurs. En outre, ce mécanisme permet de repérer les bourrages d'urne ; en effet, un client ne doit pas être capable de témoigner de nombreuses fois sur un fournisseur pour augmenter artificiellement sa réputation. Ainsi, les auteurs proposent d'associer les témoignages sur un même fournisseur, afin de ne prendre en compte qu'un seul témoignage par client. C'est-à-dire qu'ils proposent un moyen permettant de vérifier si deux témoignages ont été émis par un même client -sans dévoiler ce client. Cependant, ce mécanisme a deux inconvénients majeurs. Premièrement, les clients ne peuvent témoigner des mauvais comportements ; la réputation des fournisseurs ne peut pas diminuer. Deuxièmement, un fournisseur a besoin de 500 ko par témoignage reçu pour prouver sa réputation à un client potentiel : ce mécanisme est inefficace.

Dans cet article, nous proposons un mécanisme de réputation efficace préservant la vie privée des clients et des fournisseurs, permettant aux clients d'émettre des témoignages positifs et négatifs. La Section 2 motive les propriétés nécessaires à un tel mécanisme, tandis que la Section 3 fournit une description hautniveau de notre proposition.

2 Propriétés de vie privée et de sécurité Préserver la vie privée des utilisateurs réduit les discriminations : les clients ne doivent pas être capables de cibler un fournisseur particulier pour médire sur lui, et réciproquement. Il faut donc éviter qu'un client ne connaisse l'identité d'un fournisseur au moment où il témoignage ; de cette manière, l'identité du fournisseur n'a aucune influence sur le témoignage. Similairement, les fournisseurs ne doivent pas savoir qui sont leurs clients pendant les transactions. En outre, si deux fournisseurs ou plus combinent les informations à propos de leurs témoins, ils peuvent potentiellement tracer ces clients. Il faut donc assurer que les clients de différents fournisseurs ne peuvent être associés.

Notre mécanisme doit également garantir des propriétés de sécurité. Tout d'abord, rappelons que les clients doivent être en mesure d'émettre des témoignages négatifs. Il faut donc assurer que, si un client désire émettre un témoignage négatif, le fournisseur avec qui il interagit ne peut l'en empêcher : c'est l'indéniabilité des témoignages. Similairement, les clients peuvent omettre de témoigner, volontairement ou non. Afin de calculer un score de réputation représentatif du comportement des fournisseurs de service, il faut que les fournisseurs puissent obtenir un témoignage par défaut quand le client refuse d'en émettre un. Il faut également garantir qu'un utilisateur malveillant, à l'intérieur d'une collusion ou pas, est incapable de forger un témoignage qui n'aie pas été émis à l'issue d'une transaction légitime, ou un score de réputation qui ne soit pas son score de réputation légitime. Finalement, nous avons expliqué précédemment qu'un client pouvait émettre de nombreux témoignages sur un unique fournisseur afin d'augmenter considérablement sa réputation. Lorsque les clients sont complètement anonymes, de tels bourrages d'urne ne peuvent être évités. C'est pourquoi, à l'instar du mécanisme de Bethencourt et coll. [START_REF] Bethencourt | Signatures of reputation[END_REF], il faut permettre d'associer les témoignages sur un même fournisseur.

Pour résumer, un mécanisme de réputation préservant la vie privée de ses utilisateurs doit garantir les cinq propriétés suivantes : (1) la vie privée des fournisseurs est préservée ; (2) celle des clients également ; (3) un client ou un fournisseur ne peut pas dénier un témoignage ; (4) les témoignages et scores de réputation sont inforgeables ; (5) les témoignages multiples sont détectés.

Description de notre mécanisme

Nous présentons maintenant notre mécanisme de réputation. Dans un premier temps, nous expliquons pourquoi utiliser deux tierces parties de confiance, et comment les choisir. Nous décrivons ensuite une interaction. Finalement, nous montrons que ce mécanisme est efficace.

Tierces parties distribuées

Gestion des témoignages Les clients doivent pouvoir émettre des témoignages négatifs. Les fournisseurs ne peuvent pas gérer eux-mêmes les témoignages qu'ils reçoivent ; en effet, les fournisseur peuvent alors simplement « oublier » les témoignages négatifs reçus afin d'améliorer leur réputation. Ainsi, il faut qu'une tierce partie stocke les témoignages. De plus, les fournisseurs doivent être anonymes ; un client ne doit pas être capable de distinguer deux fournisseurs parce que leurs témoignages sont gérés par deux tierces parties différentes. Ainsi, la gestion des témoignage impose une tierce partie de confiance qui soit unique pour tous les fournisseurs. Cette tierce partie est responsable des scores de réputation des fournisseurs, et atteste leur calcul. Notons qu'elle n'a pas besoin d'être en ligne en permanence : il est suffisant qu'elle signe les réputations à intervalles de temps réguliers.

Garantie de l'indéniabilité L'indéniabilité des témoignages et la vie privée des utilisateurs peuvent paraître contradictoires ; en effet, le client ne doit pas connaître le fournisseur au moment où il choisit son témoignage, mais il doit pouvoir émettre son témoignage sur le fournisseur -et donc connaître l'identifiant du fournisseur -une fois choisi. Nous proposons d'utiliser une tierce partie de confiance garantissant l'émission des témoignages. Il ne faut pas que chaque utilisateur composant cette tierce partie connaisse l'identifiant du fournisseur : dans ce cas, si le client est en collusion avec un seul de ces utilisateurs, il peut connaître l'identifiant du fournisseur. À cet effet, nous utilisons un schéma de partage de secret. Ainsi, chaque composant de la tierce partie reçoit une seule part du secret, qui ne donne aucune information. En cas de besoin, les parts peuvent être combinées pour reconstruire le secret. Notons que, bien que cette tierce partie doive être en ligne pour assister les transactions, elle n'a pas besoin d'être unique pour toutes les transactions.

Nous pourrions choisir d'utiliser une seule tierce partie pour remplir les deux rôles. Cependant, ceuxci nécessiteraient d'avoir une tierce partie unique pour tous les fournisseurs et transactions, et en ligne. Une telle tierce partie requerrait trop de ressources dans un système large-échelle. Nous proposons donc une première tierce partie, les signataires accrédités, gérant les scores de réputation, et une deuxième, les porteurs de part, garantissant l'émission des témoignages.

Choix des tierces parties Les signataires accrédités sont responsables du calcul de tous les scores de réputation, et sont donc cruciaux au fonctionnement du mécanisme de réputation. Pour cette raison, nous proposons de choisir les fournisseurs de service gérant les plus gros volumes de transactions. Le choix des porteurs de part est différent. En effet, ils sont choisis aléatoirement pour chaque transaction parmi les fournisseurs de service. Le client et le fournisseur se mettent d'accord sur un nonce aléatoire, et les porteurs de part sont ensuite choisis en itérant une fonction de hachage H sur ce nonce. S'il y a N porteurs de part possible, les n porteurs de part choisis en utilisant le nonce nonce sont les {H(nonce i) × N/2 h , 1 i n } où H est une fonction de hachage dont les sorties font h bits, et n est choisi afin qu'il y ait n porteurs de part différents dans l'ensemble résultant. Le nombre de porteurs de part nécessaires peut être modélisé par une distribution hypergéométrique, dépendant de plusieurs paramètres : le nombre d'utilisateurs, la proportion d'utilisateurs malveillants, ainsi que la probabilité maximale désirée d'obtenir une collusion. La figure 1 présente le nombre de porteurs de part nécessaires pour une telle probabilité de 2 -20 , c'est-à-dire environ 10 -6 . Cette figure montre d'une part que le système passe à l'échelle, et d'autre part que le nombre de porteurs de part nécessaire reste acceptable.

Ébauche du protocole d'interaction

Une interaction entre un client et un fournisseur se déroule en trois étapes.

Preuve de réputation À intervalles de temps réguliers, chaque fournisseur de service reçoit une signature des signataires accrédités portant sur sa réputation. Cette signature est une signature proxy anonyme [START_REF] Fuchsbauer | Anonymous proxy signatures[END_REF], ce qui permet au fournisseur d'en masquer certains éléments. Le fournisseur peut notamment masquer son identité pour éviter de révéler son identité, et préserver sa vie privée.

Partage de secret Une fois qu'un client a vérifié la réputation du fournisseur qui l'intéresse, ils choisissent ensemble un nonce leur permettant de choisir les porteurs de part. Pour ce faire, ils utilisent un protocole de tirage au sort sécurisé pour empêcher le client et le fournisseur de contrôler le nonce, et donc les porteurs de part. Une fois que les porteurs de part ont été choisis, le client et le fournisseur utilisent le schéma de partage de secret pour garantir l'indéniabilité des témoignages à leur partenaire. Le schéma de partage de secret utilisé est plus précisément vérifiable, afin de garantir que le bon secret sera reconstruit. Une fois que les partages ont été vérifiés, le fournisseur et le client peut procéder à la transaction. Calcul des réputations À intervalles de temps réguliers, les signataires accrédités récupèrent tous les témoignages, et mettent à jour les scores de réputation des fournisseurs. Finalement, ils signent les réputations des fournisseurs en utilisant des signatures proxy anonymes.

Émission du témoignage

Performances du mécanisme

Pour évaluer les performances du système, toutes les opérations cryptographiques effectuées par chaque utilisateur au cours d'une interaction sont comptées. En utilisant des temps de référence, il est ensuite possible d'évaluer le temps de calcul nécessaire à chaque utilisateur. La figure 2 présente ces temps, pour un système comprenant un signataire accrédité et 28 porteurs de part, ce qui suffit à empêcher les collusions avec une probabilité 2 -20 dans un système de 10 8 utilisateurs, dont 5% de malveillants. Comme le montre cette figure, les temps de calcul sont réalistes et permettent une implémentation pratique de ce mécanisme. Le nombre de signataires accrédités pourrait même être augmenté : le seul temps dépendant de ce nombre correspond à la preuve de réputation, et en dépend linéairement. Pour 25 signataires accrédités, la preuve de réputation demande 401 ms au client et 268 ms au fournisseur. De plus, dans le pire cas, les utilisateurs n'échangent que 300 ko pendant une interaction complète, ce qui prouve l'efficacité du mécanisme.

Conclusion

Dans cet article, nous avons décrit un mécanisme de réputation distribué préservant la vie privée de ses utilisateurs, qui permet également aux clients d'émettre des témoignages négatifs, tout en étant efficace. Cette approche, décrite précédemment [AGL + 14], montre qu'un compromis acceptable entre réputation et vie privée peut être atteint.

Dans le futur, nous prévoyons d'étudier une variante optimiste de notre mécanisme, qui ne nécessite les porteurs de part que lorsque le client ou le fournisseur refuse de participer à l'émission du témoignage.

  Après la transaction, le client et le fournisseur émettent le témoignage. Il y a alors trois scénarios, suivant leur comportement : (A) le fournisseur et le client participent ; (B) le client ne participe pas ; (C) le fournisseur ne participe pas. Dans le premier cas, le client commence par choisir ton témoignage. Le fournisseur révèle ensuite son identifiant, ce qui permet l'émission du témoignage. Dans le deuxième cas, le fournisseur peut construire le témoignage grâce aux porteurs de part. Dans le dernier cas, le client choisit son témoignage avant d'obtenir l'identifiant du fournisseur via les porteurs de part.

FIGURE 1 :FIGURE 2 :

 12 FIGURE 1: Nombre de porteurs de part nécessaires