Jean-Louis Soubeyroux

Sarah Petit

Mélissa Mikolajczyk

Hervé Muguerra

Sébastien Pairis

Philippe Odier

Roughness and texture of epitaxial LZO thin films grown on RABiTS Ni5W substrates

Keywords: High-temperature superconductors, defects, Superconducting films, Coated conductors

Low cost Coated Conductors (CC) are required in order to put together competitive superconducting cables. The buffer layer architecture is one of the key aspects of CC processing. Very interresting results have been obtained with complex architectures. It may not be necessary to have high Jc for cable applications, thus simpler architectures can be considered. We suggested that only one buffer could be sufficient. Because the YBCO deposition needs a perfect surface for epitaxy, we aim to eliminate the different defects appearing on this surface. To do so we suggest to identify the defects. We show the annealing results of the NiW/LZO substrates with La 2 Zr 2 O 7 (LZO) deposited by MOD at different annealing temperatures. The buffer layer microstructure is studied in detail and the texture is investigated as a function of the annealing temperature.

I. INTRODUCTION

M any examples of La 2 Zr 2 O 7 oxide (LZO) buffer layer made by chemical solution deposition (CSD) have been synthesized on highly bi-axially textured Ni-5at%W (Ni5W) substrates [START_REF] Sathyamurthy | Chemical Solution Deposition of Lanthanum Zirconate Buffer Layers on Biaxially Textured Ni-1.7% Fe-3% W Alloy Substrates for Coated-conductor Fabrication[END_REF][START_REF] Knoth | Detailed investigations on La2Zr2O7 buffer layers for YBCO-coated conductors prepared by chemical solution deposition[END_REF][START_REF] Chen | Chemical solution deposited lanthanum zirconium oxide thin films: Synthesis and chemistry[END_REF][START_REF] Cheng | Characterization of MOD-derived La2Zr2O7 epi-layers on textured Ni5W substrates by electron backscattered diffraction[END_REF][START_REF] Paranthaman | Modified Lanthanum Zirconium Oxide buffer layers for low-cost, high performance YBCO coated conductors[END_REF][START_REF] Roche | Microstructural changes induced by the pyrolysis step on epitaxial La2Zr2O7 thin films grown by metalorganic decomposition[END_REF] obtained by the so called Rolling Assisted Biaxially Textured Substrate technique (RABiTS). LZO acts as a barrier against diffusion of the Ni toward YBCO [START_REF] Molina | Chemically deposited La2Zr2O7 buffer layers for YBCO-coated conductors: film growth and microstructure[END_REF][START_REF] Molina | Barrier efficiency of sponge-like La2Zr2O7 buffer layers for YBCO-coated conductors[END_REF] and must limit the oxidation during the different steps of the synthesis process of the coated conductor [START_REF] Wang | Behavior of oxygen diffusion in buffer layers for coated conductors[END_REF][START_REF] Petit | LZO, a Protective Barrier Against Oxidation of NiW Alloys[END_REF]. This buffer layer is used as a template to grow epitaxially the superconducting layer made of YBa 2 Cu 3 O 7 (YBCO) and for example deposited by MOCVD [START_REF] Caroff | La2Zr2O7 single buffer layer for YBCO RABiTS coated conductors[END_REF][START_REF] Stadel | MOCVD and MOD of YBCO and Buffer Layers on Textured Metal Tapes[END_REF]. We focussed our studies on a simplified architecture composed of only the substrate, one LZO buffer layer and one YBCO superconducting layer. This choice was made with the perspective of making an economic process. Using the combination of CSD for the buffer and MOCVD for the YBCO, critical currents reaching or exceeding 1 MA/cm 2 (self field at 77 K) have been obtained on Ni5W RABiTS. So, the development of coated conductors requires attention to defects reducing the superconductivity. Their origin is not clear. It is then necessary to identify all possible sources of defects in the buffer that could induce misoriented grains in YBCO. Compared to more complexe architectures generally used (involving up to 5 or 6 intermediate layers), the detrimental contribution of defects in the buffer is more prominent. Rikel et al [START_REF] Rikel | Simplified Procedure for Estimating Epitaxy of La2Zr2O7-Buffered NiW RABITS Using XRD[END_REF] showed the importance of the quality of the buffer layer in the case where one LZO buffer on Ni5W RABiTS substrate was covered with YBCO deposited by MOCVD.

LZO has a cubic structure with a 7.8 % structural mismatch with Ni5W and is grown by epitaxy on Ni5W after a rotation of 45° of its unit cell for better matching the substrate lattice [START_REF] Rapenne | High-resolution transmission electron microscopy observations of La2Zr2O7 thin layers on LaAlO3 obtained by chemical methods[END_REF]. Due to this property, many papers showed that LZO reproduced exactly the grain morphology of the substrate obtained by the RABiTS process [START_REF] Knoth | Highly textured La2Zr2O7 buffer layers for YBCO-coated conductors prepared by chemical solution deposition[END_REF]. The microstructure of LZO was made of small rounded crystallites (20-50 nm) with nanovoids [START_REF] Molina | Chemically deposited La2Zr2O7 buffer layers for YBCO-coated conductors: film growth and microstructure[END_REF][START_REF] Rapenne | High-resolution transmission electron microscopy observations of La2Zr2O7 thin layers on LaAlO3 obtained by chemical methods[END_REF] originating from the released gases during the CSD process, but the crystallization process made these voids cubic [START_REF] Molina | Barrier efficiency of sponge-like La2Zr2O7 buffer layers for YBCO-coated conductors[END_REF]. The grain boundaries of the Ni substrate were transferred to the LZO microstructure by the epitaxial process giving rise to the typical grain morphology mentioned above. Twins that were present in the substrates were also reproduced in the LZO microstructure but with misorientations [START_REF] Petit | Effect of twins in Ni substrates on the microstructure of LZO films for coated conductors[END_REF]. It is often said that twins must be suppressed as much as possible in metallic substrates for high superconducting performances of the YBCO layer. Other defects such as misorientations in the LZO surface layer have been observed [START_REF] Knoth | Growth of thick chemical derived pyrochlore La2Zr2O7buffer layers for YBa2Cu3O7-x coated conductors[END_REF][START_REF] Molina | Grain growth and biaxial texture of chemically deposited La2Zr2O7 buffer layers for YBCO-coated conductors[END_REF][START_REF] Narayanan | Thick lanthanum zirconate buffer layers from water-based precursor solutions on Ni-5%W substrates[END_REF], but no work has been dedicated to this kind of defects. The aim of this work was to investigate peculiarities of the microstructure of LZO buffer layers grown on Ni5W by CSD at different annealing temperatures. This paper focuses on misorientation defects observed by SEM-EBSD and X-ray techniques. It was discovered that these grains can change with annealing temperature while they keep a good texture.

II. EXPERIMENTAL

LZO films were deposited on Ni5W textured tapes (from Evico, Dresden) by CSD-MOD using propionate solutions prepared from acetylacetonate precursors [START_REF] Roche | Microstructural changes induced by the pyrolysis step on epitaxial La2Zr2O7 thin films grown by metalorganic decomposition[END_REF] and dip-coated in the low evaporation mode (Landau mode). The film was then dried at 60°C for 2 min. in air to form a solid polymer, subsequently pyrolyzed at 350°C for 60 min. under primary vacuum or argon and finally crystallized at various temperatures for 30 min. under flowing Ar-5%H 2 (heating rate 550 °C/h for both steps).

X-ray data were measured with a four circles diffractometer (Seiffert, Germany) working at the CuK wavelength. The diffractometer is equipped with a Xenocs optic (Xenocs, France) allowing a small divergence (0.06° horizontal) of the X-ray beam and a graphite monochromator before the analyzer.

SEM images were performed using a FEG-SEM from Zeiss (Zeiss ultra+, Germany) equipped with an EBSD unit using 1ME-04 "HKL" monitoring software (Oxford Instruments). Atomic Force Microscopy (AFM) images were acquired with a Veeco D3100.

III. RESULT AND DISCUSSION

A. The defects Fig. 1 shows a typical SEM top view with a 50 000 times magnification. The LZO "normal" grains are columnar grains of 20 to 50 nm appearing in white. Some holes are also present and appear on this view as black spots. The other defects which are circled in white are larger (300-500 nm), seem to be flat and in the figure have a grey color. This kind of defects can cover more than 5% of the surface as measured by image analysis on a SEM top surface view (the defects appear as darker grey than "normal" grains). They are not favorable as epitaxial centers for the next buffer layer as we have oberved by EBSD that inside a defect the orientation was very different from the <001> one. Morover, a rugosity of the order of a nanometer is requiried together with a good lattice match. So these defects have to be avoided in order to grow YBCO on top of LZO.

B. The effect of annealing temperature

In previous studies, we demonstrated that a fast heating rate was necessary during the crystallization process [START_REF] Jimenez | Effect of the annealing process on the microstruture of La2Zr2O7 thin layers epitaxially grown on LaAlO3 by metalorganic decomposition[END_REF] but we stopped our study of the annealing temperature at 960°C, because we were mainly studying this effect on the porosity of the LZO layer. We did not pay a closer attention to the surface morphology.

Several experiments were performed at crystallization temperatures of 980, 1020 and 1060°C for 30 min. under flowing Ar:5%H 2 , all the other parameters were kept constant such as dip-coating extraction speed, drying temperature and using a first stage at 350°C under primary vaccuum. Fig. 3 shows a top surface view by SEM of a LZO layer annealed at 980°C. The previously described defects can be seen as slightly darker grey. A calculation by image analysis using the Visilog™ software shown in the insert evidenced these areas in red, a 4% contribution to the total surface was obtained. Fig. 4 shows the top surface view by SEM of a LZO layer annealed at 1020°C. The defects are less numerous as a calculation of the surface occupied by defects is only 1%. Fig. 5 shows the top surface view by SEM of a LZO layer annealed at 1060°C. The grains morphology is completely different from previous observations and the defects are not present as such.

More surface analysis have been done by EBSD. From Fig. 6a to 8a the EBSD maps of the cube texture components (<001> component is in red) of the LZO layer after annealing at the different temperatures are shown. For 980°C (Fig. 6a), 98.4% of the scan points have been indexed as LZO phase and only some regions appear in black, meaning no indexation from a single phase or presence of an amorphous grain. A maximum misorientation of 13° was measured.

For 1020°C (Fig. 7a), 98.9% of the scan points have been indexed as LZO phase and no region appears in black. This means that the surface of the LZO layer is well adapted for a 1ME-04 new epitaxial phase that will be deposited on top. A maximum misorientation of 15° was measured. For 1060°C (Fig. 8a), 75.6% of the scan points have been indexed as LZO phase while many points appear in black. By a close examination of the Kikuchi patterns of these black points it appears that most of them present a multiple set of lines indicating several misorientations in the analyzed scan surface. A maximum misorientation of 16° was measured.

Analysis of the orientations have also been made by X-ray diffraction. Pole figures (001) and ( 222) and scans in rolling direction (RD) and transverse direction (TD) have been made. Because their penetrating power the CuK X-rays used analyze the entire layer thickness (100 nm). Fig. 6b to 8b show the (222) pole figures of the LZO layer annealed at various temperatures. Table I reports the measured FWHM. For the three temperatures studied the results obtained by this analysis are quite similar as the pole figures show well defined spots. The quality of the texture is measured by the width of the rocking curves along different directions. The film quality depends upon the smallest width and the best roundness of the spots. As the highest temperature gives the roundest spots and the smallest FWHM values, we can state following these criteria that the texture quality is increasing with temperature. However, these criteria don't take into account the amorphous grains that don't diffract in the directions measured in pole figures. We can also observe on the (222) pole figure of the LZO layer and of the (111) pole figure of the Ni5W substrate that they present less twins than the starting substrate by annealing the LZO buffer at 1020°C. These twins are present in these pole figures in the middle of the map. We have also used the AFM technique in order to obtain another view of the LZO layer surface. Fig. 9 shows the map for the sample annealed at 1020°C. The LZO grains are 1ME-04 identical to those of the previous studies with a round top shape and a size of 20 nm [START_REF] Caroff | La2Zr2O7 single buffer layer for YBCO RABiTS coated conductors[END_REF]. The Ra roughness measured on the 25 µm 2 full surface is 0.95 nm and the Rms is 1.24 nm, which correspond to lower values than those measured on different samples by Sathyamurthy (5.4 nm) [START_REF] Sathyamurthy | Chemical solution deposition of lanthanum zirconate barrier layers applied to low-cost coated-conductor fabrication[END_REF] or Knoth (3 nm) [START_REF] Knoth | Detailed investigations on La2Zr2O7 buffer layers for YBCO-coated conductors prepared by chemical solution deposition[END_REF]. More results corresponding to different temperatures are reported in Table I.

IV. CONCLUSION

We have been able to increase the surface quality of the LZO layer by annealing it at higher temperatures than those previously used and keeping the same profile temperature for the whole process. The best temperature used was 1020°C. An unexpected fact when the annealing was performed at higher temperature was the twinning reduction. It can be supposed that a higher temperature may change the substrate texture and consequently the nucleation at the surface of the metallic substrate. Too high temperature such as 1060°C may change the substrate texture too much which may cause wrong orientations degrading the LZO epitaxy.

New YBCO layer deposition by MOCVD has been done by the PerCoTech company (http://percotech.com/en/home) [START_REF] Stadel | MOCVD and MOD of YBCO and Buffer Layers on Textured Metal Tapes[END_REF] on a sample annealed at 1020°C. The quality of this not very thick layer (350 nm) gave a transport current of the order of 1 MA/cm 2 . Further work is under way, in particular the effect of a second buffer layer on the current transport properties.

Fig. 1 .

 1 Fig. 1. SEM top view with a 50 000 times magnification of the LZO layer annealed at 960°C.An AFM map of the same sample taken on a 1x1 µm 2 square surface is shown in Fig.2. The columnar LZO grains are shown in white and the defect is easily recognizable. A transverse profiling is given in the insert. The depth is 4 nm and the width 400 nm.

Fig. 2 .

 2 Fig. 2. AFM map of the LZO layer annealed at 960°C.

Fig. 3 .

 3 Fig. 3. SEM top surface view of a LZO layer annealed at 980°C. In the insert, image analysis of the defects.

Fig. 4 .

 4 Fig.4. SEM top surface view of a LZO layer annealed at 1020°C. In the insert, image analysis of the defects.

Fig. 5 .

 5 Fig. 5. SEM top surface view of a LZO layer annealed at 1060°C.

Fig. 6 .

 6 Fig. 6. a) SEM-EBSD mapping and b) X-ray (222) pole figure of a LZO layer annealed at 980°C..

Fig. 7 .

 7 Fig. 7. a)SEM-EBSD mapping and b)X-ray (222) pole figure of a LZO layer annealed at 1020°C.

Fig. 8 .

 8 Fig. 8. a)SEM-EBSD mapping and b)X-ray (222) pole figure of a LZO layer annealed at 1060°C.

Fig. 9 .

 9 Fig. 9. AFM map performed on LZO annealed at 1020°C.

TABLE I TEXTURE

 I

	PARAMETERS, PERCENTAGE OF KIKUCHI LINES INDEXED IN EBSD,
	AFM ROUGHNESS AT DIFFERENT ANNEALING TEMPERATURES
	Annealing	LZO	FWHM of	FWHM of	EBSD	AFM
	temperature	004 peak	rocking	rocking	% indexed	Ra
	(°C)	RX	curve along	curve along		(nm)
		intensity	RD (°)	TD (°)
	980	127	6.47	5.93	98.4	2.35
	1020	134	6.63	5.85	98.9	0.95
	1060	98	6.44	5.82	75.6	2.10

ACKNOWLEDGMENT

The authors thank Drs C.E. Bruzek and A. Allais from Nexans France and C. Jimenez from LMGP/Grenoble-INP for fruitful discussions.


est destinée au dépôt

Taking into Account Manufacturing Faults in PMSM for Diagnosis Purposes

Fractional slot winding configurations are now widely used creating by the way compact actuators with high torque/mass ratios mainly by reducing coils end configuration [START_REF] Bianchi | Design Considerations for Fractionnal Slot Winding Configurations of Synchronous Machines[END_REF]. Some assembly techniques of iron lamination, as shown on Fig. 1, have been used to make possible the automatic winding of such actuators. The major drawbacks of these assembly techniques are eddy current losses, radial force unbalances and construction fault introducing parasitic air-gaps.

II. MODELING OF SOME MANUFACTURING FAULTS Generally fractional slot PM motors can be built using the assembly process depicted on Fig. 1-a or Fig. 1.b. As an illustration, a 18 slots 16 magnets PM motor is considered with a parasitic air-gap between one tooth and the stator's yoke such in Fig. 1-c. Its thickness is called 結 喧 and it is assumed to be constant along the teeth top. Due to this parasitic air-gap, two main consequences can be observed. The first one concerns direct and quadrature fluxes which contain second order harmonics. This can evaluate by both Finite Element (FE) and Permeance Network (PN) models as shown on Fig. 2 [2]. The second consequence concerns the apparition of a high level of cogging torque depending on the position and the thickness of the parasitic air-gap. The frequency of this torque matches with the 2 nd harmonic of the supply frequency. Consequently to this construction faults, the motor behaves as a motor with an inter-turn fault even if its windings are healthy. Such situations should be confusing especially for online monitoring techniques of inter-turn faults.

III. CONSEQUENCES REGARDING FAULT DETECTION

The presence of these inherent faults has a great influence on fault indicators used in monitoring techniques [START_REF] Iamamura | Study of Static and Dynamic Eccentricities of a Synchronous Generator Using 3-D FEM[END_REF]- [START_REF] Leboeuf | Real Time Detection of Inter-turn Faults using Back-EMF Estimation and Residual Analysis[END_REF]. Indeed, neglecting these effects in the healthy model of the motor can lead to the non detection of short-circuit faults involving few turns and creating weak unbalance.

In the full paper, improved model which allows creating new indicators able to be relevant even for motors with parasitic air-gaps, will be presented.

Taking into Account Manufacturing Faults in PMSM for Diagnosis Purposes

  Leboeuf, Thierry Boileau, Babak Nahid-Mobarakeh, Noureddine Takorabet, Farid Meibody-Tabar, Guy Clerc To cite this version: Nicolas Leboeuf, Thierry Boileau, Babak Nahid-Mobarakeh, Noureddine Takorabet, Farid Meibody-Tabar, et al.. Taking into Account Manufacturing Faults in PMSM for Diagnosis Purposes. IEEE CEFC, Nov 2012, Oita, Japan. p. 470. hal-00814827 E.G. 2(b) OR 9(d) Abstract-This paper deals with some problems related to the use of fractional slot winding configurations in recent PM motors designs. The main idea is to take into account specific characteristics such as parasitic air-gaps which are leading to unexpected behaviors. Depending on the situation this behaviors can be mistaken electrical or mechanical faults. The aim is to develop improved models of compact actuators avoiding false alarm issues in diagnosis methods. I. GENERAL ISSUES OF RECENT PMSM DESIGN Recently, Permanent Magnet Synchronous Motors (PMSM) design has been strongly improved answering to automotive industry or aircraft transportation requirements.

Fig. 1 :

 1 Fig. 1: Example of recent PMSM designs.

Fig. 2 :Fig. 3 :

 23 Fig. 2: Direct and quadrature fluxes harmonics with 結 喧 = 0.2兼兼 (fondamentals are removed)

Université de Lorraine -GREEN, Vandoeuvre-lès-Nancy, 54516, France

Universté de Lyon-AMPERE, Villeurbanne, 69616, France noureddine.takorabet@ensem.inpl-nancy.fr


Florent Lafarge
email: florent.lafarge@inria.fr

Xavier Descombes
email: xavier.descombes@inria.fr

Josiane Zerubia
email: josiane.zerubia@inria.fr

TEXTURAL KERNEL FOR SVM CLASSIFICATION IN REMOTE SENSING : APPLICATION TO FOREST FIRE DETECTION AND URBAN AREA EXTRACTION

We present a textural kernel for "Support Vector Machines" classification applied to remote sensing problems. SVMs constitute a method of supervised classification well adapted to deal with data of high dimension, such as images. We introduce kernel functions in order to favor the distiction between our class of interest and the other classes : it gives an information of similarity. In our case this similarity is based on radiometric and textural characteristics. One of the main difficulties is to elaborate textural parameters which are relevant and characterize as well as possible the joint distribution of a set of connected pixels. We apply this method to remote sensing problems : the detection of forest fires and the extraction of urban areas in high resolution images.

INTRODUCTION

In the mid-nineties, a supervised classification method called "Support Vector Machine" was introduced by Vapnik [START_REF] Vapnik | The nature of statistical learning theory[END_REF]. This method, derived from the Perceptron problem of Rosenblatt [START_REF] Rosenblatt | Principles of Neurodynamics[END_REF], is well adapted to deal with data of high dimension because the algorithm complexity doesn't depend on the data dimension. That is why SVMs are used in pattern recognition problems, in particular in remote sensing. In our case, we want to elaborate a general method in order to detect special areas in high resolution images using textural and radiometric characteristics. The kernels are functions introduced to make possible the SVM classification, by specifying the notion of similarity that we are looking for in the pattern recognition problem. In this paper, we propose a new kernel based on a textural information (which depends on the homogeneity of pixel intensity) and a radiometric information (which depends on the hue). One interest of our kernel is to be adjustable by the capability to weight the importance of texture with respect to radiometry by introducing a tuning parameter. It enables to detect various kinds of objects. We have applied this method to forest fire detection and urban area extraction in SPOT5 satellite images.

PROPOSED METHOD

Support Vector Machines classification

In this section, we present the SVM classification method. First, we introduce some notations. We call E, the data space (i.e. the input space) and Y , the label space (i.e. the output space). Here, Y is composed of two classes : Y = {-1, 1}. We call F , a subset of E which represents the class of interest, A, the training set (which is a subset of E × Y ) and ω, the classifier (function of E → Y ). The theorical aim of a supervised classification problem is to construct a classifier consistent with the training set. In particular, if we search a linear classifier ω(x) = w.xθ, the aim is to find the classifier parameters (w, θ) which verify

∀(x, y) ∈ A, y × (w.x -θ) > 0 (1)
The idea of the SMV is to search the best classifier which gives the biggest margin of security. In fact, as the classifier parameters are defined up to a scale factor, we impose

∀(x, y) ∈ A, y × (w.x -θ) > 1 (2)
It means we define two hyperplanes parallel to the classifier which are going to lean against the nearest data in order to center as well as possible the classifier between both classes (see figure 1). It is an optimisation problem because we want to find the classifier which maximizes the Euclidian distance between both hyperplanes (called the margin) under the constraint defined by equation ( 2). But, in most cases, we cannot find a linear classifier consistent with the training set : the classification problem is not linearly separable. One solution consists of changing the feature space. We introduce a mapping Φ : E → E which projects the data in a space of higher dimension where the problem is linearly separable [START_REF] Shawe-Taylor | An Introduction to Support Vector Machines[END_REF]. The dual representation of the optimisation problem is then given by the following formula : It is a convex optimisation problem. The optimal solution α ⋆ gives the optimal classifier parameters w ⋆ and θ ⋆ . Finally, the optimal classifier ω ⋆ is given by :

max α N i=1 α i -1 2 N i=1 N j=1 α i α j y i y j (Φ(x i )|Φ(x j )) under ∀i, α i ≥ 0 N i=1 α i y i = 0 (3)
ω ⋆ (x) = sign R + N i=1 α ⋆ i y i (Φ(x i )|Φ(x)) -θ ⋆ (4)
Finding the mapping Φ is a very difficult problem. Instead of searching for Φ, it is easier to search directly for a function

K : E×E → R defined by K(x i , x j ) = (Φ(x i )|Φ(x j ))
for (x i , x j ) ∈ E × E and called a kernel function.

In fact, the knowledge of K is sufficient to compute the optimal classifier. One of the principal interests of the kernel functions is the faculty to compose several kernels in order to set a more complex kernel which is better adapted to the problem [START_REF] Pontil | Properties of support vector machines[END_REF]. In the following section, we construct such a kernel.

Textural kernel

The complex patterns we want to detect in satellite images don't make the problem linearly separable. Therefore, it is necessary to introduce a kernel which is able to give relevant informations about the differentiation of classes. This section describes the construction of a kernel based on textural informations. First, we take a texture parameter derived from a Markovian Gaussian model proposed in [START_REF] Descombes | GMRF parameter estimation in a non-stationary framework by a renormalization technique: Application to remote sensing imaging[END_REF].

P (X s |X r , r ∈ V (s)) = 1 Z V (s) exp   -β( r∈V (s) (X s -X r ) 2 + λ(X s -µ) 2 )   (5)
where V (s) is the neighborhood of the site s, λ and β are the parameters of the model and µ, the local mean and Z V (s) , the local partition function.

P (X s |X r , r ∈ V (s)) ≡ N αm s + λµ α + λ , 1 2β(α + λ) (6)
where α = card(V (s)) and m s = 1 α r∈V (s) X r . This probability follows a normal distribution whose variance will be considered as the texture parameter. It is estimated by the "comet tail" method described in [START_REF] Descombes | Champs markoviens en analyse d'images[END_REF]. By defining eight different neighborhoods in eight directions [START_REF] Lorette | Texture analysis through a markovian modelling and fuzzy classification: Application to urban area extraction from satellite images[END_REF], we obtain eight texture parameters σ 2 d for each site of the image. Now, we are going to construct the kernel. As we are dealing with a Markovian modeling, the data space is composed of the sites of the image and their neighborhoods : E = {(x s , {x r /r ∈ V (s)})/s ∈ S}. We project the data in a new space which includes the texture parameters. For that, we introduce the mapping

Φ 1 : E → E × Σ X s → Φ 1 (X s ) = X s γσ 2 (d) (7)
where Σ = {{γσ 2 d /d ∈ D}/s ∈ S} , D is the set of the eight directions and γ, a tuning parameter. Then, we compose it with a Gaussian kernel K g in order to obtain a robust kernel. A Gaussian kernel is very useful because it enables to calculate similarity in a space of infinite dimension [START_REF] Pontil | Properties of support vector machines[END_REF]. Finally, we obtain the following kernel :

∀(X s , X t ) ∈ E 2 K(X s , X t ) = K g (Φ 1 (X s ), Φ 1 (X t )) = exp - Φ 1 (X s ) -Φ 1 (X t ) 2 2σ 2 ( 8
)
where σ is the variance of the Gaussian kernel. The lower the value of σ, the better the learning of an example. But in this case, we must be careful about the over-learning phenomenon.

More explicitly, the kernel can be written as follows :

K(X s , X t ) = e " -1 2σ 2 P (r,q)∈C s,t (xr-xq) 2 +γ 2 P d∈D (σ 2 (d),s -σ 2 (d),t ) 2 " (9)
We can see in equation ( 9) that the kernel is composed of a radiometric term and a textural term which is weighted by the tuning parameter γ. It is a very important parameter : according to the searched pattern, it is necessary to balance the importance of the textural information with respect to the radiometric information, as we will see in the next section.

We use the soft margin method [START_REF] Samuelides | Réseaux neuronaux et Apprentissage[END_REF], in order to accept the presence of errors in the classification. This method enables to relax the constraint (2) by introducing variables of relaxation. We violate some constraints in order to stretch the margins of the classifier set. The obtained classification is then regularized by morphological opening and closing.

The optimisation problem (3) is solved by an ICM algorithm [START_REF] Besag | On the statistical analysis of dirty pictures[END_REF], which is modified by adding constraints to the random draw. This algorithm has two parameters : the tuning parameter γ and the variance σ. The calibration of those parameters is made for a range of images.

Application to forest fire detection

In most cases, we detect forest fires by using ground temperature estimation from Thermical InfraRed images.

But here, we apply our method to panchromatic images from SPOT5 (5m resolution). Our aim is to detect smokes which are emitted by forest fires. The training set is composed of a piece of smoke and a piece of cloud (see figure 2). The presence of a piece of cloud in the training set is necessary to make the distinction between cloud and smoke, due to the similarity of their textures. Figure 3 shows the result. The smoke area is well detected. Contours are accurate. Figure 4 is a result on a second image of the same range, always using the previous training set. There are two small false alarms but the smoke area is well detected. It is important to notice that, on smokeless images, there is practically no over-detection. In this application, the tuning parameter γ has been chosen so that the radiometry and the texture have the same weight in the similarity criterion.

Application to urban area extraction

The extraction of urban areas is a well known problem. We apply our algorithm to SPOT5 simulations at 5 meters of resolution. The urban areas appear as heterogenous areas without distinction of hues. Therefore, the weight of the textural term in the kernel is increased. More precisely, we take σ = γ.σ ′ and we let tend γ to infinity. So, we obtain a kernel which is purely textural.

The training set is very simple : as we can see on figure 5, it is a crop of an image of Toreilles (France) composed of a piece of urban areas and a piece of fields. The results (see figures 6 and 7) are satisfactory. There are few false alarms and urban areas are well detected. The separation between urban areas and fields is accurate.

CONCLUSION

The proposed algorithm gives good results and is able to detect a large range of patterns on high resolution images. This is the main advantage of the proposed method : the adjustable kernel permits to deal with various applications in remote sensing such as forest fire detection or urban area extraction. However, it is necessary to calibrate efficiently the training set for a range of images. In the future, we should work on this problem.

||w|| 1 MARGEFig. 1 .

 11 Fig. 1. Linear classifier margin

Fig. 2 .Fig. 3 .Fig. 4 .

 234 Fig. 2. Training set

Fig. 5 .Fig. 6 .Fig. 7 .

 567 Fig. 5. Training set

ACKNOWLEDGEMENTS

The authors thank Alcatel Space Cannes for their partial financial support and CNES and SPOTIMAGE for providing the SPOT5 images of Esterel-Les Maures region via the ISIS program.


Florent Lafarge

Xavier Descombes

Josiane Zerubia

Marc Pierrot-Deseilligny

AN AUTOMATIC BUILDING RECONSTRUCTION METHOD : A STRUCTURAL APPROACH USING HIGH RESOLUTION SATELLITE IMAGES

We present an automatic 3D city model of dense urban areas from high resolution satellite data. The proposed method is developed using a structural approach : we construct complex buildings by merging simple parametric models with rectangular ground footprint. To do so, an automatic building extraction method based on marked point processes is used to provide rectangular building footprints. A collection of 3D parametric models is defined in order to be fixed onto these building footprints. A Bayesian framework is then used : we search for the best configuration of models with respect to both a prior knowledge of models and their interactions, and a likelihood which fits the models to the Digital Elavation Model. A simulated annealing scheme allows to find the configuration which maximizes the posterior density of the Bayesian expression.

INTRODUCTION

For the last decade, the automatic 3D reconstruction of urban areas has become a topic of interest. Faced with the urbanization development, 3D-models with connected planar facets are used in various applications such as the computing of electromagnetic wave propagation or the creation of virtual realities. Several automatic methods giving satisfactory results, such as perceptual organization [START_REF] Nevatia | Automatic and interactive modeling of buildings in urban environments from aerial images[END_REF], parametric models [START_REF] Weidner | Fowards Automatic Building Reconstruction from High Resolution Digital Elevation Models[END_REF] or polyhedral approach [START_REF] Baillard | A plane-sweep strategy for the 3D reconstruction of buildings from multiple images[END_REF], have been developed using aerial images. Nowadays, this problem is tackled by another kind of data : the submetric satellite images. The main advantages of satellite data compared to aerial images are a high swath width and ground coverage. However, such data have a "relatively low" resolution and a "low" signal to noise ratio to deal with 3D reconstruction problems. For example, our satellite data have 4 pixels per square meter contrary to aerial data used in [START_REF] Baillard | A plane-sweep strategy for the 3D reconstruction of buildings from multiple images[END_REF] which have about 140 pixels per square meter. Those drawbacks do not allow to robustly use standard methods developed for the aerial image case. The main alternative consists in proposing methods based on an important prior knowledge concerning urban structures. An automatic building extraction method [START_REF] Ortner | Building extraction from Digital Elevation Model[END_REF] based on marked point processes is used to provide rectangular building footprints. It consists in extracting the building outlines through a configuration of rectangles from Digital Elevation Models (DEM) which are altimetric descriptions of urban areas. Figure 1 shows the result using a DEM provided from multiple stereo pairs (3-views) of PLEIADES simulations (0.5 meter resolution -B/H=0.2) by the French Geographic Institute (IGN) and computed by an algorithm based on [START_REF] Roy | A maximum-flow formulation of the ncamera stereo correspondence problem[END_REF]. Our goal is then to construct a 3D city model from the DEM and Fig. 1. Building extraction result from a Digital Elevation Model associated rectangular building footprints. To do so, a structural approach is used : buildings are reconstructed by merging simple urban structures. The last ones are defined through a collection of 3D parametric models with rectangular ground footprint. This approach is preferred since it is less complex, more robust to satellite data and more adapted to rectangular building footprints. Such an approach has been used in [START_REF] Fuchs | Efficient subgraph isomorphism with a-priori knowledge. application to building reconstruction for cartography[END_REF] based on a restricted grammar of symmetric models in a peri-urban area context from aerial data. Using a Bayesian framework, the method is based on the definition of a density which contains both a prior knowledge on the buildings, taking into account the interactions existing between neighboring models, and a data term which fits the models to the DEM. A Markov Chain Monte Carlo technique coupled with a simulated annealing is used to find the configuration of models which maximizes this density.

MODEL COLLECTION

Notations

Let us consider:

• S, a set of sites and I = {x(s)/s ∈ S}, a set of intensities defined for a given DEM.

• R, the object space of a rectangle which is defined by five parameters : its center (xc, yc) and its length, width and orientation (L, l, φ). • C ∈ R N , the rectangle configuration representing the building footprints associated with I and computed by the method described in [START_REF] Ortner | Building extraction from Digital Elevation Model[END_REF] (N represents the number of rectangles). • Si, the subset of S whose sites are inside the rectangle i ∈ C. • D = {x(s) ∈ I/s ∈ Si , i ∈ C}, the set of data • T , the state space and θ = (θi)i∈C ∈ T , a configuration of models M. • f θ i , the function from Si to R which associates the roof altitude of the model defined by θi to each site of Si. ], [0, l] and [0, l 2 ] respectively. More details about these models are available in [START_REF] Lafarge | A parametric model for automatic 3D building reconstruction from high resolution satellite images[END_REF].

Choice of the model collection

DENSITY FORMULATION

Let us consider the measurable space (T , B(T ), µ(.)) associated to the measure µ(.) (see [START_REF] Lafarge | A parametric model for automatic 3D building reconstruction from high resolution satellite images[END_REF] for a detailed description of µ(.)). We consider the random variable Θ distributed in T which follows an unnormalized density h(.) against µ(.). h(.) is actually the posterior density of a configuration θ of models, given D. In a Bayesian framework, this density can be obtained as follows :

h(θ) = h(θ/D) ∝ hp(θ)L(D/θ) (1)
A requirement is to be able to build both a prior density hp(θ) and a likelihood L(D/θ). In the following, these two terms are detailed.

Likelihood

Let us consider Di, the partial data of rectangle i defined as D = S i∈C Di. L(Di/θi) represents the probability of observing Di knowing the object θi. By considering the hypothesis of conditional independence (it means we disregard the overlapping of rectangles), the likelihood can be expressed as:

L(D/θ) = Y i∈C L(Di/θi) = Y i∈C exp(-f θ i -x i) ( 2
)
. i is the norm defined from the function space of Si to R by :

f i = 1 card(Si) X s∈S i |f (s)| (3)
So, the likelihood is linked to the Z-error of the L1 norm between the DEM and the parametric modeling defined by the configuration θ. The L1 norm is preferred to the L2 norm since the DEM is neither exact nor accurate. The L2 norm is too sensitive to the DEM errors.

Prior density

The prior term allows to favor some configurations and penalize other ones. Some interactions between objects are defined thanks to a neighborhood relationship ν (see Figure 3). The existence of a

hp(θ) = exp -[U h (θ) + Ur(θ)] (4)

Getter of roof height adjustment

The getter of roof heights of buildings are dependent on neighboring urban structures. It is important to define an interaction term which favors the getter of roof height alignment between neighboring rectangles. This term has to be:

• attractive for similar getter of roof heights (i.e. with a difference lower than half a floor)

• repulsive for different getter of roof heights (i.e. with a difference between half a floor and one floor)

• neutral for distant getter of roof heights (i.e. with a difference higher than one floor)

To do so, we define the energy term U h as follows:

U h (θ) = X iνj f h (|Hg i -Hg j |) (5)
where f h is a real value function specified in [START_REF] Lafarge | A parametric model for automatic 3D building reconstruction from high resolution satellite images[END_REF] (see Figure 4), which depends on ω h , a positive constant potential and H f , a constant which represents a floor height (in practice, we take H f = 3 meters).

Roof top linking up

It is important to develop an interaction which favors roof top linking up between neighboring buildings while respecting the possibility of roof top discontinuity. We propose an interaction which attracts the roof top extremities of neighboring buildings when the roof top height differs from less than a floor height (see Figure 5). The associated energy is modeled as follows:

Ur(θ) = X iνj ωr dc(ei, ej) ( 6
)
where ei is the point (in

OPTIMIZATION

We want to find the configuration which maximizes the density h(.).

We search for the Maximum A Posteriori estimator θMAP :

θMAP = arg max θ h(θ) (7)
This is a non convex optimization problem in a high and variable dimension space T since the models of collection M are defined by a different number of parameters.

A stochastic optimization based on a Reversible Jump Markov Chain Monte Carlo method [8] [START_REF] Robert | Monte Carlo Statistical Methods[END_REF] is well adapted to this problem. It is an optimization method derived from Markov Chain Monte Carlo techniques which allows to deal with variable dimension state spaces. It consists in simulating a discrete Markov Chain (Θt) t∈N on T of invariant measure π (specified by the density h(.)) which performs small jumps between spaces of variable dimensions. One of the main advantages of such a sampler is that the chain asymptotically converges towards π for all initial configuration Θ0.

In practice, a simulated annealing is used : the density h(.) is substituted by h(.)

1 D t
where Dt is a sequence of temperatures which tends to zero as t tends to infinity. At the beginning of the algorithm (i.e. when the temperature is high), the process is not really selective : it allows to explore the density modes. When the temperature decreases, configurations which have a high density will be favored. Although a logarithmic decrease is necessary to ensure the algorithm convergence, temperature decreases geometrically in practice, in order to reduce the computing time. More details about the optimization process are available in [START_REF] Lafarge | A parametric model for automatic 3D building reconstruction from high resolution satellite images[END_REF].

RESULTS

In most cases, using energy models implies parameter tuning. Those parameters correspond to weights of the various energy terms ω h and ωr, which are chosen by trial and error. Figure 6-a/c presents two examples of building 3D reconstruction associated respectively with the data (Figure 6-b) and the 3D ground truth provided by the French Geographic Institute (Figure 6-d). The result presented in the figure 6-a is satisfactory compared to the associated data. We can see the importance of the prior knowledge through getter of roof height alignments and roof top linkings up. The proposed modeling in the figure 6-c does not allow to represent some details [START_REF] Lafarge | A parametric model for automatic 3D building reconstruction from high resolution satellite images[END_REF]. However, the global shape is respected and the generalization level is acceptable for satellite data. Figure 6-e shows the result obtained from Amiens downtown DEM (see Figure 1). It is a satisfactory result with respect to the 3D ground truth (Figure 6-f). The main drawback is the presence of artefacts due to a non optimal rectangle overlapping and roof top linking up impossibility in some specific places. Figure 6-g represents the associated error map which provides three pieces of information. First, it provides the not found areas of the building extraction (in black). They correspond to low flat buildings of inner courtyards that the building extraction method [START_REF] Ortner | Building extraction from Digital Elevation Model[END_REF] cannot detect. Then, we can see the false alarms of building extraction (in white -rate : 12%), mainly located around the reference building footprint (due to a "drooling" DEM on the building contours which generates wider rectangles). Finally, it provides Z-errors between the reconstruction result and the 3D ground truth (red to yellow). The corresponding Root Mean Square Error (RMSE) of common building footprints is 3.2 meters. This value is satisfactory for a fully automatic method using 2.5 meter Z-resolution DEMs on dense urban areas.

CONCLUSION

Results obtained by the new method proposed in this paper show that the use of a structural approach based on a parametric model collection is well adapted to deal with satellite data in an automatic context. The obtained 3D reconstructions, and especially the roof reconstructions, are satisfactory : a majority of urban structures is close to reality. The proposed prior knowledge allows to compensate for the low quality of data. However, the main drawback is the presence of artefacts due to a non optimal rectangle overlapping and roof top linking up impossibility at some locations. A solution would consist in using polygonal building footprints by morphing the rectangle configuration into polygon configuration. In the future, we should work on this problem.

Figure 2 Fig. 2 .

 22 Figure2shows the proposed collection of 3D parametric models with rectangular ground footprint, denoted by M = (Mm) m∈[START_REF] Nevatia | Automatic and interactive modeling of buildings in urban environments from aerial images[END_REF]13] . It is composed of 13 models which are parametrically simple and al-

Fig. 3 .

 3 Fig. 3. Neighborhood relationship ν -(a) : non neighboring rectangles (b) : neighboring rectangles

Fig. 4 .

 4 Fig. 4. left : favored configuration center :function f h right : penalized configuration

R 3 )

 3 corresponding to the roof top extremity of the model θi and ωr, a positive constant potential. dc(., .) is the function corresponding to the distance related to the L2-norm in R 3 if |(Hc i + Hc i ) -(Hc j + Hc j )| < H f and 0 if not.

Fig. 5 .

 5 Fig. 5. left : penalized configuration right : favored configuration

Fig. 6 .

 6 Fig. 6. (a)-(b) : example of reconstructed building and the associated data (c)-(d) : example of reconstructed building and the associated 3D ground truth c IGN (e)-(f)-(g) : Result on a downtown corresponding to figure 1 -the associated 3D ground truth c IGN -the associated evaluation map

ACKNOWLEDGMENTS

This first author would like to thank the French Geographic Institute (IGN) and the French Space Agency (CNES) for partial financial support during his PhD. The authors thank the French Space Agency (CNES) for providing PLEIADES simulations.


Luca Costabello

Serena Villata

Oscar Rodriguez Rocha
email: oscar.rodriguezrocha@polito.it

Fabien Gandon

Access Control for HTTP Operations on Linked Data

Access control is a recognized open issue when interacting with RDF using HTTP methods. In literature, authentication and authorization mechanisms either introduce undesired complexity such as SPARQL and ad-hoc policy languages, or rely on basic access control lists, thus resulting in limited policy expressiveness. In this paper we show how the Shi3ld attribute-based authorization framework for SPARQL endpoints has been progressively converted to protect HTTP operations on RDF. We proceed by steps: we start by supporting the SPARQL 1.1 Graph Store Protocol, and we shift towards a SPARQL-less solution for the Linked Data Platform. We demonstrate that the resulting authorization framework provides the same functionalities of its SPARQL-based counterpart, including the adoption of Semantic Web languages only.

10 We use N/A when the feature is not considered in the work.

Introduction

In scenarios such as Linked Enterprise Data, access control becomes crucial, as not all triples are openly published on the Web. Solutions proposed in literature protect either SPARQL endpoints or generic RDF documents and adopt Role-based (RBAC) [START_REF] Sandhu | Role-based access control models[END_REF] or Attribute-based (ABAC) [START_REF] Priebe | A pattern system for access control[END_REF] models. The Semantic Web community is recently emphasizing the need for a substantially "Web-like" interaction paradigm with Linked Data. For instance, the W3C Linked Data Platform3 initiative promotes the use of read/write HTTP operations on triples, thus providing a basic profile for Linked Data servers and clients. Another example is the SPARQL 1.1 Graph Store Protocol4 , a set of guidelines to interact with RDF graphs with HTTP operations. Defining an access control model for these scenarios is still an open issue 5 . Frameworks targeting HTTP access to RDF resources rely on access control lists, thus offering limited policy expressiveness [START_REF] Hollenbach | Using RDF Metadata To Enable Access Control on the Social Semantic Web[END_REF][START_REF] Hulsebosch | Context sensitive access control[END_REF][START_REF] Muhleisen | SWRL-based Access Policies for Linked Data[END_REF][START_REF] Sacco | An access control framework for the web of data[END_REF]] (e.g., no location-based authorization). On the other hand, existing access control frameworks for SPARQL [START_REF] Abel | Enabling Advanced and Context-Dependent Access Control in RDF Stores[END_REF][START_REF] Costabello | Context-aware access control for rdf graph stores[END_REF][START_REF] Flouris | Controlling Access to RDF Graphs[END_REF] add complexity rooted in the query language and in the SPARQL protocol, often introducing ad-hoc policy languages, thus requiring adaptation to the HTTP-only scenario.

In this paper, we answer the research question: How to design an authorization framework for HTTP-based interaction with Linked Data? This research question breaks down into the following sub-questions: (i) how to define an authorization model featuring expressive policies based on standard Web languages only and (ii) how to adopt this model in HTTP-based interaction with Linked Data scenarios like the Graph Store Protocol (GSP) and the Linked Data Platform (LDP).

We adapt the Shi3ld authorization framework for SPARQL [START_REF] Costabello | Context-aware access control for rdf graph stores[END_REF] to a SPARQLless scenario. We choose Shi3ld because its features satisfy our requirements: (i) it adopts attribute-based access policies ensuring expressiveness, and (ii) exclusively uses Semantic Web languages for policy definition and enforcement.

We illustrate Shi3ld-GSP, an intermediate version designed for the SPARQL 1.1 Graph Store HTTP Protocol. We progressively shift to the Linked Data Platform context, a scenario where SPARQL is no longer present. We have developed two solutions for this scenario: (i) an authorization module embedding a hidden SPARQL engine, and (ii) a framework where we completely get rid of SPARQL. In the latter case, the Shi3ld framework adopts a SPARQL-less subgraph matcher which grants access if client attributes correspond to the declared policy graphs. For each framework, we evaluate the response time and we show how the authorization procedure impacts on HTTP operations on RDF data.

The key features of our attribute-based authorization frameworks for HTTPbased interaction with Linked Data are (i) the use of Web languages only, i.e., HTTP methods and RDF, without ad-hoc languages for policies definition, (ii) the adoption of attribute-based access conditions enabling highly expressive policies, and (iii) the adaptation to the GSP and LDP scenarios as a result of a progressive disengagement from SPARQL. Moreover, Shi3ld is compatible and complementary with the WebID authentication framework 6 .

In this paper, we focus on authorization only, without addressing the issues related to authentication and identity on the Web. Although we discuss stateof-the-art anti-spoofing techniques for attribute data, the present work does not directly address the issue.

The remainder of this paper is organized as follows. Section 2 summarizes the related work, and highlights the requirements of an authorization model for our scenario. Section 3 describes the main insights of Shi3ld, and presents the three proposed solutions to adapt the framework to HTTP operations on RDF. An experimental evaluation of response time overhead is provided in Section 4.

Related Work

Many access control frameworks rely on access control lists (ACLs) that define which users can access the data. This is the case of the Web Access Control vocabulary (WAC) 7 , that grants access to a whole RDF document. Hollenbach et al. [START_REF] Hollenbach | Using RDF Metadata To Enable Access Control on the Social Semantic Web[END_REF] present a system where providers control access to RDF documents using WAC. In our work, we look for more expressive policies that can be obtained without leading to an increased complexity of the adopted language or model.

Similarly to ACLs, other approaches specify who can access the data, e.g., to which roles access is granted. Among others, Giunchiglia et al. [START_REF] Giunchiglia | Ontology driven community access control[END_REF] propose a Relation Based Access Control model (RelBAC ) based on description logic, and Finin et al. [START_REF] Finin | ROWLBAC: representing role based access control in OWL[END_REF] study the relationship between OWL and RBAC [START_REF] Sandhu | Role-based access control models[END_REF]. They briefly discuss possible ways of going beyond RBAC such as Attribute Based Access Control, a model that grants access according to client attributes, instead of relying on AC lists.

The ABAC model is adopted in the Privacy Preference Ontology (PPO) 8 [19], built on top of WAC, where consumers require access to a given RDF file, e.g., a FOAF profile, and the framework selects the part of the file the consumer can access, returning it. In our work, we go beyond the preference specification based on FOAF profiles. Our previous work [START_REF] Costabello | Context-aware access control for rdf graph stores[END_REF] adopts ABAC for protecting the accesses to SPARQL endpoints using Semantic Web languages only.

Other frameworks introduce a high level syntax for expressing policies. Abel et al. [START_REF] Abel | Enabling Advanced and Context-Dependent Access Control in RDF Stores[END_REF] present a context-dependent access control system for RDF stores, where policies are expressed using an ad-hoc syntax and mapped to existing policy languages. Flouris et al. [START_REF] Flouris | Controlling Access to RDF Graphs[END_REF] present an access control framework on top of RDF repositories using a high level specification language to be translated into a SPARQL/SerQL/SQL query to enforce the policy. Muhleisen et al. [START_REF] Muhleisen | SWRL-based Access Policies for Linked Data[END_REF] present a policy-enabled server for Linked Data called PsSF, where policies are expressed using a descriptive language based on SWRL9 . Shen and Cheng [START_REF] Shen | A semantic context-based model for mobile web services access control[END_REF] propose a Context-Based Access Control Model (SCBAC) where policies are expressed using SWRL.

Access control models may consider not only the information about the consumer who is accessing the data, but also the context of the request, e.g., time, location. Covington et al. [START_REF] Covington | Securing context-aware applications using environment roles[END_REF] present an approach where the notion of role proposed in RBAC is used to capture the environment in which the access requests are made. Cuppens and Cuppens-Boulahia [START_REF] Cuppens | Modeling contextual security policies[END_REF] propose an Organization Based Access Control model (OrBAC) that contains contextual conditions. Toninelli et al. [START_REF] Toninelli | A semantic context-aware access control framework for secure collaborations in pervasive computing environments[END_REF] use context-awareness to control access to resources, and semantic technologies for policy specification. Corradi et al. [START_REF] Corradi | Context-based access control management in ubiquitous environments[END_REF] present UbiCOSM, a security middleware adopting context as a basic concept for policy specification and enforcement.

Restricting HTTP operations on Linked Data

Before discussing how we modified the Shi3ld original proposition [START_REF] Costabello | Context-aware access control for rdf graph stores[END_REF] to obtain a SPARQL-less access control framework for HTTP operations on Linked Data, we provide an overview of the original Shi3ld authorization model for SPARQL endpoints. Shi3ld [START_REF] Costabello | Context-aware access control for rdf graph stores[END_REF] presents the following key features:

Attribute-based paradigm. Shi3ld is an attribute-based authorization framework, i.e., authorization check is performed against a set of attributes sent by the client along the query that targets the resource. Relying on attributes provides broad access policy expressiveness, beyond the access condition lists adopted by RBAC frameworks. That means, among all, creating locationbased and temporal-based access policies. Semantic Web languages only. Shi3ld uses access policies defined with Semantic Web languages only, and no additional policy language needs to be defined. In particular, the access conditions specified in the policies are SPARQL ASK queries. CRUD permission model. Access policies are associated to specific permissions over the protected resource. It is therefore possible to specify rules satisfied only when the access is in create, read, update and delete mode. Granularity. The proposed degree of granularity is represented by named graphs, allowing protection from triples up to whole dataset.

The HTTP-based interaction with Linked Data requires some major modifications to the above features: although we keep the attribute-based paradigm and the CRUD permission model, the new versions of Shi3ld satisfy also the following requirements:

Protection of HTTP access to resources. Protected resources are retrieved and modified by clients using HTTP methods only, without SPARQL querying 11 . RDF-only Policies. In the SPARQL-less scenario, access conditions are RDF triples with no embedded SPARQL. Granularity. The atomic element protected by Shi3ld is a resource.

In this paper, we rely on the definition of resource provided by the W3C Linked Data Platform Working Group: LDP resources are HTTP resources queried, created, modified and deleted via HTTP requests processed by LDP servers 12 . Linked Data server administrators adopting Shi3ld must define a number of access policies and associate them to protected resources. Access policies and their components are formally defined as follows: Definition 1. (Access Policy) An Access Policy (P ) is a tuple of the form P = ACS, AP, R where (i) ACS is a set of Access Conditions to satisfy, (ii) AP is an Access Privilege, and (iii) R is the resource protected by P . Definition 2. (Access Condition) An Access Condition (AC) is a set of attributes that need to be satisfied to interact with a resource. Definition 3. (Access Privilege) An Access Privilege (AP ) is the set of allowed operations on the protected resource. AP = {Create, Read, U pdate, Delete}.

The lightweight vocabularies used by Shi3ld are s4ac 13 for defining the policy structure, and prissma14 for the client attributes 15 . Client attributes include user profile information, device features, environment data, or any given combination of these dimensions, in compliance with the widely-accepted definition by Dey [START_REF] Dey | Understanding and using context[END_REF] and the work by Fonseca et al. 16 (we delegate refinements and extensions to domain specialists, in the light of the Web of Data philosophy). The main classes and properties of these vocabularies are visualized in Figure 1. Shi3ld offers a double notation for defining access conditions: with embedded SPARQL (Figure 2a) for SPARQL-equipped scenarios and in full RDF (Figure 2b), adopted in SPARQL-less environments. Whenever an HTTP query is performed on a resource, Shi3ld runs the authorization algorithm to check if the policies that protect the resource are satisfied or not. The procedure verifies the matching between the client attributes sent with the query and the access policies that protect the resource. Shi3ld deals with authorization only. Nevertheless, authentication issues cannot be ignored as the trustworthiness of client attributes is critical for a reliable access control framework. Shi3ld supports heterogeneous authentication strategies, since the attributes attached to each client request include heterogeneous data, ranging from user identity to environment information fetched by device sensors (e.g. location). The trustworthiness of user identity is achieved thanks to the WebID 6 compatibility: in Shi3ld, user-related attributes are modelled with the foaf vocabulary 17 , thus easing the adoption of WebID. Authenticating the attributes fetched by client sensors is crucial to prevent tampering. Hulsebosch et al. [START_REF] Hulsebosch | Context sensitive access control[END_REF] provide a survey of verification techniques, such as heuristics relying on location history and collaborative authenticity checks. A promising approach is mentioned in Kulkarni and Tripathi [START_REF] Kulkarni | Context-aware role-based access control in pervasive computing systems[END_REF], where client sensors are authenticated beforehand by a trusted party. To date, no tamper-proof strategy is implemented in Shi3ld, and this is left for future work.

Moreover, sensible data, such as current location must be handled with a privacy-preserving mechanism. Recent surveys describe strategies to introduce privacy mainly in location-based services [START_REF] Duckham | Moving forward: location privacy and location awareness[END_REF][START_REF] Krumm | A survey of computational location privacy[END_REF]. Shi3ld adopts an anonymitybased solution [START_REF] Duckham | Moving forward: location privacy and location awareness[END_REF] and delegates attribute anonymisation to the client side, thus sensitive information is not disclosed to the server. We rely on partially encrypted RDF graphs, as proposed by Giereth [START_REF] Giereth | On partial encryption of rdf-graphs[END_REF]. Before building the RDF attribute graph and sending it to the Shi3ld-protected repository, a partial RDF encryption is performed, producing RDF-compliant results, i.e., the encrypted graph is still RDF (we use SHA-1 cryptographic hash function to encrypt RDF literals). On server-side, every time a new policy is added to the system, the same operation is performed on attributes included in access policies. As long as literals included in access conditions are hashed with the same function used on the client side, the Shi3ld authorization procedure still holds 18 .

We now describe the steps leading to a SPARQL-less authorization framework for HTTP operations on Linked Data. Our first proposal is a Shi3ld authorization framework for the SPARQL 1.1 Graph Store Protocol (Section 3.1). In Sections 3.2 and 3.3 we describe two scenarios tailored to the Linked Data Platform specifications, the second being completely SPARQL-less. Our work is grounded on the analogies between SPARQL 1.1 functions and the HTTP protocol semantics, as suggested by the SPARQL Graph Store Protocol specification 4 .

Shi3ld for SPARQL Graph Store Protocol

The SPARQL 1.1 HTTP Graph Store Protocol 4 (GSP) provides an alternative interface to access RDF stored in SPARQL-equipped triple stores. The recommendation describes a mapping between HTTP methods and SPARQL queries, thus enabling HTTP operations on triples. The Graph Store Protocol can be considered as an intermediate step towards an HTTP-only access to RDF datastores, since it still needs a SPARQL endpoint.

Figure 3a shows the architecture of the authorization procedure of Shi3ld for GSP-compliant SPARQL endpoints (Shi3ld-GSP). Shi3ld-GSP acts as a module protecting a stand-alone SPARQL 1.1 endpoint, equipped with a Graph Store Protocol module. First, the client performs an HTTP operation on a resource. This means that an RDF attribute graph is built on the client, serialized and sent with the request in the HTTP Authorization header 19 . Attributes are saved into the triple store with a SPARQL 1.1 query. Second, Shi3ld selects the access policies that protect the resource. The access conditions (SPARQL ASK queries, as in Figure 2a) included in the policies are then executed against the client attribute graph. Finally, the results are logically combined according to the type of access condition set (disjunctive or conjunctive) defined by each policy. If the result returns true, the HTTP query is forwarded to the GSP SPARQL engine, which in turns translates it into a SPARQL query. If the access is not granted, a HTTP 401 message is delivered to the client.

Shi3ld-LDP with Internal SPARQL Engine

The Linked Data Platform Initiative (LDP) proposes a simplified configuration for Linked Data servers and Web-like interaction with RDF resources. Compared to the GSP case, authorization frameworks in this scenario must deal with a certain number of changes, notably the absence of SPARQL and potentially the lack of a graph store.

We adapt Shi3ld to work under these restrictions (Shi3ld-LDP). The framework architecture is shown in Figure 3b. Shi3ld-LDP protects HTTP operations, but it does not communicate with an external SPARQL endpoint, i.e. there are no intermediaries between the RDF repository (the filesystem or a triple store) and Shi3ld. To re-use the authorization procedure previously described, we integrate an internal SPARQL engine into Shi3ld, along with an internal triple store. Although SPARQL is still present, this is perfectly legitimate in a Linked Data Platform scenario, since the use of the query language is limited to Shi3ld internals and is not exposed to the outside world 20 . Despite the architectural changes, the Shi3ld model remains unchanged. Few modifications occur to the authorization procedure, as described in Figure 3a: clients send HTTP requests to the desired resource. HTTP headers contain the attribute graph, serialized as previously described in Section 3.1. Instead of relying on an external SPARQL endpoint, attributes are now saved internally, using an INSERT DATA query. The access policies selection and the access conditions execution remain substantially unchanged, but the whole process is transparent to the platform administrator, as the target SPARQL endpoint is embedded in Shi3ld.

SPARQL-less Shi3ld-LDP

To completely fulfill the Linked Data Platform recommendations, thus achieving a full-fledged basic profile for authorization frameworks, we drop SPARQL from the Shi3ld-LDP framework described in Section 3.2. Ditching SPARQL allows RDF-only access policies definition, and a leaner authorization procedure. To obtain a SPARQL-less framework, we re-use the access policy model and the logical steps of the previously described authorization procedure, although conveniently adapted (Figure 3c). First, Shi3ld-LDP policies adopt RDF only, as shown in Figure 2b: attribute conditions previously expressed with SPARQL ASK queries (Figure 2a) are expressed now as RDF graphs. Second, the embedded SPARQL engine used in Section 3.2 has been replaced: its task was testing whether client attributes verify the conditions defined in each access policy. This operation boils down to a subgraph matching problem. In other words, we must check if the access conditions (expressed in RDF) are contained into the attribute graph sent along the HTTP client query. Such subgraph matching procedure can be performed without introducing SPARQL in the loop. To steer clear of SPARQL, without re-inventing yet another subgraph matching procedure, we scrap the SPARQL interpreter from the SPARQL engine [START_REF] Corby | The kgram abstract machine for knowledge graph querying[END_REF] used in Section 3.2, keeping only the underlying subgraph matching algorithm 21 .

To understand how the SPARQL-less policy verification procedure works and comprehend the complexity hidden by the SPARQL layer, we now provide a comprehensive description of the adopted subgraph matching algorithm, along with an overview of the RDF indexes used by the procedure. The algorithm checks whether a query graph Q (the access condition) is contained in the reference graph R (the client attributes sent along the query). The reference graph R is stored in two key-value indexes (see example in Figure 4): index I s stores the associations between property types and property subjects, and index I o stores the associations between property types and property objects. Each RDF property type of R is therefore associated to a list of property subjects S p and a list of property objects O p . S p contains URIs or blank nodes, O p contains URIs, typed literals and blank nodes. Blank nodes are represented as anonymous elements, and their IDs are ignored. The query graph Q, i.e., the access condition attributes, is serialized in a list L of subject-property-object elements {s i , p i , o i } 22 . Blank nodes are added to the serialization as anonymous s i or o i elements. The matching algorithm works as follows: for each subject-property-object {s i , p i , o i } in L, it looks up the indexes I s and I o using p i as key. It then retrieves the list of property subjects S p and the list of property objects O p associated to p i . Then, it searches for a subject in S p matching with s i , and an object in O p matching with o i . If both matches are found, {s i , p i , o i } is matched and the procedure moves to the next elements in L. If no match is found in either I s or I o , the procedure stops. Subgraph matching is successful if all L items are matched in the R index. Blank nodes act as wildcards: if a blank node is found in {s i , p i , o i } as object o i or subject s i , and O p or S p contains one or more blank nodes, the algorithm continues the matching procedure recursively, backtracking in case of mismatch and therefore testing all possible matchings. The example in Figure 4 shows a matching step of the algorithm, i.e., the successful matching of the triple " :b2 p:nearbyEntity http://alice.org/me" against the client attributes indexes I s and I o . The highlighted triple is successfully matched against the client attributes R.

Note that policies might contain location and temporal constraints: Shi3ld-GSP (Section 3.1) and Shi3ld-LDP with internal SPARQL endpoint (Section 3.2) handle these conditions by translating RDF attributes into SPARQL FILTER 21 Third-party SPARQL-less Shi3ld-LDP implementations might adopt other off-theshelf subgraph matching algorithms. 22 A preliminary step replaces the query graph Q intermediate nodes into blank nodes. Blank nodes substitute SPARQL variables in the matching procedure. clauses. The subgraph matching algorithm adopted by SPARQL-less Shi3ld-LDP does not support geo-temporal authorization evaluation yet.

The three Shi3ld configurations described in this Section use the Authorization header to send client attributes. Even if there is no limit to the size of each header value, it is good practice to limit the size of HTTP requests, to minimize latency. Ideally, HTTP requests should not exceed the size of a TCP packet (1500 bytes), but in real world finding requests that exceed 2KB is not uncommon, as a consequence of cookies, browser-set fields and URL with long query strings23 . To keep size as small as possible, before base-64 encoding, client attributes are serialized in turtle (less verbose that N-triples and RDF/XML). We plan to test the effectiveness of common lossless compression techniques to reduce the size of client attributes as future work. Furthermore, instead of sending the complete attribute graph along all requests, a server-side caching mechanism would enable the transmission of attribute graph deltas (i.e. only newly updated attributes will be sent to the server). Sending differences of RDF graphs is an open research topic24 and we do not address the issue in this paper.

Evaluation

We implemented the three scenarios presented in Section 3 as Java standalone web services25 . The Shi3ld-GSP prototype works with the Fuseki GSP-compliant SPARQL endpoint26 . The Shi3ld-LDP prototype with internal SPARQL endpoint embeds the KGRAM/Corese 27 engine [START_REF] Corby | The kgram abstract machine for knowledge graph querying[END_REF]. Our test campaign assesses the impact of Shi3ld on HTTP query response time 25 . We evaluate the prototypes on an Intel Xeon E5540, Quad Core 2.53 GHz machine with 48GB of memory. In our test configuration, Shi3ld-GSP protects a Fuseki SPARQL server, while Shil3d-LDP scenarios secure RDF resources saved on the filesystem. First, we investigate the relationship between response time and the number of access conditions to verify. Second, we test how access conditions complexity impacts on response time. Our third test studies the response time with regard to different HTTP methods. We execute five independent runs of a test query batch consisting in 50 HTTP operations (tests are preceded by a warmup run). Each query contains client attributes serialized in turtle (20 triples). The base-64 turtle serialization of the client attributes used in tests 25 is 1855 bytes long (including prefixes). Tests do not consider client-side literal anonymization (Section 3).

Our first test shows the impact of the access conditions number on HTTP GET response time (Figure 5a and5b). Each policy contains one access condition, each including 5 triples. We progressively increased the number of access conditions protecting the target RDF resource. Not surprisingly, the number of access conditions defined on the protected resource impacts on response time. In Figure 5a we show the results for Shi3ld-LDP scenarios: data show a linear relationship between response time and access conditions number. We tested the system up to 100 access conditions, although common usage scenarios have a smaller number of conditions defined for each resource. For example, the 5 access condition case is approximately 3 times slower than unprotected access. Nevertheless, ditching SPARQL improved performance: Figure 5a shows that the SPARQLless configuration is in average 25% faster than its SPARQL-based counterpart, due to the absence of the SPARQL interpreter. As predicted, the delay introduced by Shi3ld-GSP is higher, e.g., 7 times slower for resources protected by 5 access policies (Figure 5b). This is mainly due to the HTTP communication between the Shi3ld-GSP module and Fuseki. Further delay is introduced by the Fuseki GSP module, that translates HTTP operations into SPARQL queries. Moreover, unlike Shi3ld-LDP scenarios, Shi3ld-GSP uses a shared RDF store for protected resources and access control-related data (client attributes and access policies). This increases the execution time of SPARQL queries, thus determining higher response time: in Figure 5b, we show the behaviour of Shi3ld-GSP with two Fuseki server configurations: empty and with approximately 10M triples, stored in 17k graphs (we chose the "4-hop expansion Timbl crawl" part of the Billion Triple Challenge 2012 Dataset 28 ). Results show an average response time difference of 14%, with a 27% variation for the 5 access condition case (Figure 5b). The number and the distribution of triples in the RDF store influence Shi3ld-GSP response time. Results might vary when Shi3ld-GSP is coupled with SPARQL endpoints adopting different indexing strategies or with different triple number and graph partitioning.

In Figure 5c, we show the impact of access conditions complexity on HTTP GET response time. The requested resource is protected by a single access condition, with growing complexity: we added up to 20 triples, and we assess an access condition containing a FILTER clause (for SPARQL-based scenarios only). Results show no relevant impact on response time: this is because of the small size of the client attributes graph, over which access conditions are evaluated (in our tests, client attributes include 20 triples). Although attribute graph varies according to the application domain, it is reasonable that size will not exceed tens of triples.

The third test (Figure 5d) shows the delay introduced by Shi3ld for each HTTP operation. The figure displays the difference between response time with and without access control. We executed HTTP GET, POST, PUT and DELETE methods. Each HTTP method is associated to a 5-triple access condition. As predicted, the delay introduced by Shi3ld is independent from the HTTP method.

In Section 2, we addressed a qualitative comparison with respect to the related work. On the other hand, addressing a quantitative evaluation is a tricky point: among the list in Table 1, only few works explicitly designed for the Web come with an evaluation campaign [START_REF] Abel | Enabling Advanced and Context-Dependent Access Control in RDF Stores[END_REF][START_REF] Costabello | Context-aware access control for rdf graph stores[END_REF][START_REF] Flouris | Controlling Access to RDF Graphs[END_REF][START_REF] Hollenbach | Using RDF Metadata To Enable Access Control on the Social Semantic Web[END_REF][START_REF] Muhleisen | SWRL-based Access Policies for Linked Data[END_REF]. Moreover, although some of these works provide a response time evaluation, the experimental conditions vary, making the comparison difficult.

Conclusions

We described an authorization framework for HTTP operations on Linked Data. The framework comes in three distinct configurations: Shi3ld-GSP (for the SPARQL 1.1 Graph Store Protocol) and Shi3ld for the Linked Data Platform (with and without the internal SPARQL endpoint). Our solutions feature attribute-based access control policies expressed with Web languages only. Evaluation confirms that Shi3ld-GSP is slower than the Shi3ld-LDP counterparts, due to the HTTP communication with the protected RDF store. Shi3ld-LDP with internal SPARQL endpoint introduces a 3x delay in response time (when resources are protected by 5 access conditions). Nevertheless, under the same conditions, the SPARQL-less solution exhibits 25% faster response times. We show that response time grows linearly with the number of access conditions, and that the complexity of each access condition does not relevantly impact on the delay. ()"*+," '"*+"-." /01234,5"

'"*+"-'!" /01234,5"

'"*+"-#!" /01234,5"

'"*+"-#!" /01234,"6" 789:;<5"

!"#$%&#"'()*"''+*#,' =>1?3@AB=C" =>1?3@A9DC"-=C*<E95" =>1?3@A9DC"-=C*<E934,,5" !"#$%&'(%$")*+$"",+%-" -123456(-+" -1234560/+"7-+89:0;" -1234560/+"7-+89:04<==;" Future work includes ensuring the trustworthiness of attributes sent by the client. Furthermore, a caching mechanism for client attributes must be introduced, to speed up the authorization procedure. The caching mechanism must be coupled with an efficient strategy to send attributes updates, to reduce the average size of HTTP requests. Finally, an effective administration interface to define access policies has to be designed, as user interaction issues should not be underestimated.

Fig. 1 :Fig. 2 :

 12 Fig. 1: Interplay of s4ac and prissma vocabularies for Shi3ld access policies.

Fig. 3 :

 3 Fig. 3: Shi3ld Configurations

:Fig. 4 :

 4 Fig. 4: Example of subgraph matching used in the SPARQL-less Shi3ld-LDP.

  28 http://km.aifb.kit.edu/projects/btc-2012/ ./012+3"456789":;<"*8'=5>" +,-./012+3"4?$!@"8=-7/5*"-A"?$BC"D=E7,*>"

Fig. 5 :

 5 Fig. 5: Shi3ld response time evaluation.

Table 1

 1 summarizes the main characteristics of the related work described above 10 : none of the presented approaches satisfies all the features that we require for protecting HTTP operations on Linked Data, i.e.: absence of ad hoc policy languages, CRUD permission model, protection granularity at resourcelevel, and expressive access control model to go beyond basic access control lists.

		Web-based	AC model	Policy language	Protection granularity	Permission model Context Awareness	Conflict verification	Eval.
	WAC 7	YES RBAC	RDF	RDF document	R/W	N/A	N/A	N/A
	Abel et al. [1]	YES ABAC	Custom	triples	R	YES	N/A	YES
	Finin et al. [9]	YES RBAC	OWL/RDF	resources	N/A	N/A	N/A	N/A
	RelBAC [12]	YES relation	DL	resources	N/A	N/A	N/A	N/A
	Hollenbach[13]	YES RBAC	RDF	RDF document	R/W	N/A	N/A	YES
	Flouris et al. [10]	YES RBAC	Custom	triples	R	N/A	YES	YES
	PeLDS [17]	YES RBAC	SWRL	RDF document	R/W	N/A	N/A	YES
	PPO [19]	YES ABAC	RDF, SPARQL RDF doc(part)	R/W	N/A	N/A	N/A
	SCBAC [21]	YES context	SWRL	resources	N/A	YES	YES	N/A
	Shi3ld-SPARQL[4] YES ABAC	RDF, SPARQL named graphs	CRUD	YES	N/A	YES
	Covington [5]	NO	RBAC	Custom	resources	R/W	YES	YES	N/A
	CSAC [14]	NO	gen. RBAC XML	resources	R	YES	N/A	N/A
	Proteus[22]	NO	context	DL	Resources	N/A	YES	YES	YES
	OrBAC [6]	NO	organizationDatalog	resources	R/W	YES	YES	N/A
	UbiCOSM [3]	NO	context	RDF	resources	N/A	YES	YES	YES

Table 1 :

 1 A summarizing comparison of the related work.

http://www.w3.org/TR/ldp/

http://www.w3.org/TR/sparql11-http-rdf-update/

http://www.w3.org/2012/ldp/wiki/AccessControl

http://www.w3.org/2005/Incubator/webid/spec/

http://www.w3.org/wiki/WebAccessControl

http://vocab.deri.ie/ppo

http://www.w3.org/Submission/SWRL/

This is in compliance with the LDP specifications.

An LDP server is an "application program that accepts connections in order to service requests by sending back responses" as specified by HTTP 1.1 definition.

http://ns.inria.fr/s4ac

http://ns.inria.fr/prissma

Although this vocabulary provides classes and properties to model context-aware attributes, it is not meant to deliver yet another contextual model: instead, well-known Web of Data vocabularies and recent W3C recommendations are reused. For more details, see Costabello et al.[START_REF] Costabello | Context-aware access control for rdf graph stores[END_REF].

http://xmlns.com/foaf/spec/

The adopted technique does not guarantee full anonymity[START_REF] Krumm | A survey of computational location privacy[END_REF]. Nevertheless, the problem is mitigated by the short persistence of client-related data inside Shi3ld cache: client attributes are deleted after each authorization evaluation. Encryption is not applied to location coordinates and timestamps, as this operation prevents geo-temporal filtering.

We extend the header with the ad-hoc Shi3ld option. Other well-known proposals on the web re-use this field, e.g. the OAuth authorization protocol.

https://developers.google.com/speed/docs/best-practices/request

http://www.w3.org/2001/sw/wiki/How_to_diff_RDF

Binaries, code and complete evaluation results are available at: http://wimmics.inria.fr/projects/shi3ld-ldp

http://jena.apache.org/documentation/serving_data