Arbia Riahi Sfar

Zied Chtourou

Privacy preservation using game theory in e-health application 1 st

Keywords: Privacy, Internet of things, e-health, game theory, Markovian process

In the domain of the new e-health applications, the ubiquitous nature of intelligent devices raises legitimate questions about the privacy of persons, and how to cope with the heterogeneity of user and application requirements in terms of security services. This requires the development of adaptive, context-aware and user-centric security solutions. Recent e-health applications (M2M/IoT/Web) permit remote monitoring of patient health, medical treatments, fitness information and parameters, alarm triggering, etc. Since the monitored device is tightly related to a human being, new changes arise regarding communications facilities constraints, private data protection, trust relationships, etc. In this work, we propose a Markovian game between data holder and data requester, in a weight loss program, to protect data privacy. We aim to reach a compromise between privacy concessions made by data holder and incentive motivation proposed by data requester. Finally, we show numerical results of executed experiments to evaluate the proposed model.

I. Introduction

E-health improves both personal and public health, and assists individuals in self-monitoring, disease management and access to health records. An e-health system involves different participants such as patients, research professionals, clinicians, governments, etc. In the new healthcare applications, novel technologies may play a key role. Examples may include medical mobile applications, wearable intelligent objects capturing patient's health data (blood pressure, temperature, weight...), tabs kept by hospitals to log location of personnel, etc. [START_REF] Layer | M2m enabled ecosystems ehealth[END_REF]. The usage of new means such as M2M (Machineto-Machine), IoT (Internet of Things) and Web means enhances e-health applications by integrating new technologies in data sensing, data analysis and area networking. This leads to efficiency gains in health service methods, individual's control, care quality, etc. [START_REF] Lake | Internet of things: Architectural framework for ehealth security[END_REF]. The use of electronic devices, connected to a private or public cloud, for data capture and/or supervision goals may generate new challenges [START_REF] Riahi Sfar | A roadmap for security challenges in the internet of things[END_REF]. Interactions between humans and devices may increase power consumption and require battery changes and patient's mobility must be considered with regard to device location. And, data exchange over a public network may create privacy dilemma.

In ETSI uses cases presented in [START_REF] Etsi | ehealth; standardization use cases for ehealth[END_REF], the main objectives of new e-health applications include remote monitoring of patient health and fitness information, triggering alarms when critical conditions are detected, controlling medical treatments or parameters, and so on. The analysis identifies actors and their roles for each use case and debates connectivity, interoperability, security and standardization issues. Authors specifically described the instance of personal fitness and health improvement. Examples of applications in this case may concern record health and fitness indicators during exercise sessions (heart and breathing rates, energy consumption, fat burning rate), monitoring the frequency and time of workouts, controlling the exercises intensity, running distances, etc. New challenges about using and securing mobile devices within IoT operations take place and many concerns can arise due to the storage and exchange of sensitive information through connected devices [START_REF] Tawalbeh | Iot privacy and security: Challenges and solutions[END_REF]. The expected increase of the number of connected devices will raise new security issues regarding the generated information, the number of input/outputs of a single system, and the numerous interactions between devices and/or humans. Also, data transmitted through wireless networks can be easily accessed by attackers, and even be destroyed, intercepted or altered. Unfortunately, classical and common solutions such as encryption methods are not suitable to solve the security concerns discussed previously due to the limited capabilities of connected devices [?]. many intelligent objects have insufficient onboard memory and processing capacity to handle standard protocols. They may suffer from power limitation to execute all the algorithmic computations needed for data encryption/decryption. With the integration of new technologies, security and privacy concerns involve a strong interaction of objects and humans. In e-health scenarios, the connected devices became able to act on human's behalf, and can make their decision autonomously. Node's behavior may be cooperative, selfish, malicious, curious, etc., which generates many security challenges during the decision making process [START_REF] Riahi Sfar | A game theoretic approach for privacy preserving model in iot-based transportation[END_REF]. This led many researchers to use game theory to formulate actor's interactions in e-health security scenarios where they may be modeled as attackers/defenders. This is explained by the large number of mathematical tools available for multi-user strategic decision making. They are used to develop formal decision making, algorithms and attacker behavior prediction [START_REF] Zhu | An evolutionary gametheoretic approach for assessing privacy protection in mhealth systems[END_REF]. Our contribution is threefold. First, we identify privacy concerns in an IoT based e-health system. Second, we propose a game model for privacy protection based on Markovian process. Third, we validate our theoretical findings with numerical results. We propose an e-health privacy model based on three main elements: ETSI uses cases (e-health applications for M2M communications); smart health platform architecture of Continua Health Alliance (industry consortium promoting e-health and guaranteeing end-to-end interoperability); and a common e-health scenario involving four actors: participants, coaches, clinicians and commercials. The remaining of this paper is organized as follows. Section II highlights the use of game theory to solve privacy questions and depicts the most important related works. Section III describes the overall architecture of the proposed solution. Section IV presents the game model mathematical formulation and numerical results.

II. Related work

In the last few years, numerous research efforts focus on security and privacy using game theory, but limited efforts deal with e-health applications. This section overviews some of the noteworthy works realized by various researchers. In [START_REF] Meharouech | A game theoretical approach for interference mitigation in body-tobody networks[END_REF], authors proposed a game theoretical approach with a two-stage channel allocation scheme: BBN-stage for inter-WBANs, and WBAN-stage for intra-WBAN communications to solve distributed interference mitigation problem in Bodyto-Body Networks. Their work is based on the bestresponse approach to compute the Nash Equilibria in a distributed fashion. The objective of this work is limited to interference mitigation problem and does not consider privacy and trust aspects. In [START_REF] Yi | Priority-aware pricing-based capacity sharing scheme for beyond-wireless body area networks[END_REF], authors proposed a radio resource allocation scheme for wireless body area networks (WBANs). They focused on the communications in beyond-WBANs, and debated the transmission scheme in case of a large number of gateways associating with one base station of medical centers. They provide a priority-aware pricing-based capacity sharing design by considering the quality of service (QoS) constraints for different gateways. This work focuses on QoS concerns only and is not interested in security questions related to private data protection and human/object trust management. In [START_REF] Kumar | Providing healthcare services on-the-fly using multi-player cooperation game theory in internet of vehicles (iov) environment[END_REF], authors proposed a new ehealth model combined with cloud computing platform to offer health related services in IoV (Internet of Vehicles) environment on-the-fly. They used a game theory model where vehicles act as players and tend to form and split coalitions to access e-health services. Vehicles are represented as stochastic reward nets (SRNs), and a new payoff function is designed for them taking into consideration coalition among the players in the game. Although its originality, this work did not discuss security questions in e-health domain. In [START_REF] Pasha | Framework for e-health systems in iotbased environments[END_REF], authors designed a framework for an IoT-based smart health system based on existing technology standards and communication protocols. Although their interest to solving interoperability problems, they did not discussed privacy issues in sensitive e-health scenarios. In [START_REF] Lin | Internet of vehicles for e-health applications: A potential game for optimal network capacity[END_REF], authors proposed a power control algorithm under a non-cooperative game theoretic framework to schedule data transmission in mobile hospital environments. They solved the problem of network-level optimal capacity using a game strategy based on the best-response-dynamics algorithm.

In [START_REF] Hamdi | Game-based adaptive security in the internet of things for ehealth[END_REF], authors proposed a Markovian game-theoretic model for adaptive security in IoT-based e-health applications. They introduced four strategies to conceive their game model related to the smart object energy, the channel state, the memory space and the intruder. They focused on the compromise between BAN capabilities and smart objects lifetime; and used an adaptive security policy based on authentication to evaluate their model. From a security point of view, authors analysis is limited to intrusion concerns using witness based detection methods. We consider this work very inspiring in the development of our model but we state that data sensitivity, privacy and trust concerns, frequently present in IoTbased e-health context, were not sufficiently debated. Moreover, actions and transitions of each player were not explicitly defined in their game model. In a previous work [START_REF] Riahi Sfar | A game theoretic approach for privacy preserving model in iot-based transportation[END_REF], we proposed a privacy preserving solution in ITS (Intelligent Transportation Systems) context relying on a game theory model between two actors to protect private data using an incentive motivation against a privacy concession, or leading an active attack.

III. E-health solution architecture and privacy preservation

In an e-health scenario, it is meaningful to make the following medical pre-assumptions. Clinical operations must include initial medical assessment, regular monitoring, measurement, and counseling by healthcare professionals Also, we suppose that scenario may include the following parameters: medical report, behavior modification, diet and nutrition, physical activity, time, etc. Participants create their own electronic health record through health measures including program information, preferences, visit planning, tracking data, social engagement and progress. Unquestionably, this type of healthcare services generates an increasing amount of data and evidence since electronic health records are used to trace people's health information.

This motivates the emergence and the progress of health data management research and practice [START_REF] Zhu | An evolutionary gametheoretic approach for assessing privacy protection in mhealth systems[END_REF], and the use of an approved architecture for big data. The smart health platform architecture of Continua Health Alliance has followed H.810 design guidelines and was approved by ITU [START_REF] Sector | Series H: Audiovisual and Multimedia Systems : E-health Multimedia Services and Applications -Interoperability Compliance Testing of Personal Health Systems (HRN, PAN, LAN and WAN) : Conformance of ITU-T H.810 Personal Health Devices : PAN/LAN/TAN Interface Part 1: Optimized Exchange Protocol : Agent[END_REF]. It allows a wide range of personal/clinical health devices to be used or interchanged in any setting. Furthermore, due to the performance of communication means, novel technologies can assure automatic and precise data capture, and real-time updates of health record. Accordingly, the overall architecture of the proposed e-health solution is shown in figure 1 and includes three main parts: personal health device (actuators, sensors, etc.), application hosting device (PC, personal health system, smartphone, aggregator, etc.) and healthcare service provider (clinicians, commercials, etc.), interacting as illustrated in table I.

In the big data era, the key to developing a successful e-health application is to handle efficiently a sizable amount of data, that may contain sensitive information about individuals. An increasing concern about privacy threats posed by data affluence and device ubiquity takes place. Individuals have to be sure that their data, collected for a specific purpose, are not reused for another purpose without their permission. Also, they have to avoid data inference and re-identification risks by choosing trusted service provider. Privacy is then imperative to protect sensitive information used during data handling, and finding a compromise between novelty and data protection without risking over-reaction.

To handle privacy issues, all phases of the big data value chain must be considered including acquisition/collection, analysis, storage, and use. In practice, two solutions are possible: privacy by design, and privacy enhancing technologies [START_REF] D'acquisto | Privacy by design in big data: An overview of privacy enhancing technologies in the era of big data analytics[END_REF]. The concept of privacy by design takes place at the beginning of the development of a product or service, and denotes the integration of privacy protection into both technology (computer chips, networking platforms, etc.) and organizational policies (privacy impact assessments). Embedding privacy enhancing technologies permits to avoid personal data compromise, rebuild trust between users and service providers, and consider the dimension and emerging big data environment. Available techniques to ensure privacy are summarized in [START_REF] D'acquisto | Privacy by design in big data: An overview of privacy enhancing technologies in the era of big data analytics[END_REF] and include anonymization, encryption, security and accountability controls (granular access control, policy enforcement, accountability and audit, data provenance), transparency, consent, ownership, and control (consent, privacy preferences, sticky policies, personal data stores). Authors conclude that the road to ensure big data privacy is still long and hard, as data amount is growing every day and privacy preserving mechanisms are not following accordingly.

Online privacy problem is a defying combination of information imbalance, external forces (political, social...), structural invisibility, technological components, complex privacy preferences, and unreliable modes of communication [START_REF] Kanwal | Privacy preservation in e-health cloud: taxonomy, privacy requirements, feasibility analysis, and opportunities[END_REF]. Therefore, game theory has lately emerged as a mean for modeling interactions of multiple rational selfish entities with conflicting interests, and for calculating stable system points (equilibrium) from which no entity can obtain additional benefit [START_REF] Halkidi | A game theoretic framework for data privacy preservation in recommender systems[END_REF]. Depending on information's nature, game players types, actions and final goals, many categories of security games may be distinguished (deterministic, zero-sum, Stackelberg, repeated, stochastic, incomplete information, etc.) to solve security problems as privacy protection and trust management in IoT-based networks [START_REF] Zhu | An evolutionary gametheoretic approach for assessing privacy protection in mhealth systems[END_REF].

Figure 1 illustrates the proposed solutions, where the personal e-health device plays the role of data provider, the hosting device of the application plays the role of data collector. Healthcare service provider plays the role of data user with two sub-roles (data miner and decision maker). The game model is developed between data collector and data provider (likewise for data user and data collector) when attempting to access private data. This architecture permits the game model implementation including its actors, actions, payoffs, utility functions and Nash equilibrium, as described in the following sections.

To solve privacy problems in data sharing (PPDM/PPDP), we need to consider the following aspects. First, in the data publishing/sharing model, questions concern (1) publishing data table or statistical values; and (2) results of data analysis (classifiers, regression models...). Usable techniques include anonymization (k-anonymity (PPDP)) and randomized approach (Differential privacy (PPDM)). Second, in the database-querying model (searches, recommendation, diagnosis, etc.), the query contains user's private information that need to be protected. Usable techniques include Multiparty Computation (MPC) techniques (high computational cost), and query auditing techniques to check database-privacy preservation by examining past data publishing (high computational cost). Third, the data integration model is used to enhance the knowledge quality they can obtain from their data. Solutions include MPC (to obtain statistical data) and Ensemble / data aggregation (used if the data-mining for integrated data is desired and statistical data are available).

IV. Proposed model A. Game assumptions

In the following, we make the following assumptions:

• The game involves two types of players: Data Holder (DH) and Data Requester (DR). • Players are rational and DHs grant high interest to privacy preservation of their data utility.

• The game evolution depends on the negotiation or the attack steps/parameters between DR and DH. • Actions are sequential, and the game is such that only one player moves at any point of time.

• Previous action results are included in system state.

• DH ignore DR's strategy, and can only predict it from previous action results, which are assumed to be observable by him/her. • DR can DH and DR have dependent interests and aim to maximize their benefits. • DH has the convenient decision making mechanism to assure a minimal privacy damage.

B. Model description 1) Actors and roles:

In the proposed solution, two scenarios can be distinguished. In the first scenario, data provider is the personal health device which owns sensitive data (weight scale, glucose readings, blood pressure, pulse oximetry, etc.) and, therefore plays the role of DH. The application hosting device is the data collector and plays the role of DR. In the second scenario, the application hosting device owns private data (DH), and the data user is represented by e-health service provider, commercial or decision maker who attempts to access private data (DR). We notice that in both scenarios, except different payoffs, players behave similarly when they play the same role (DH or DR). That means, data provider (personal health device) behaves in the same manner in the first scenario as data collector (application hosting device) behaves in the second scenario since both of them play the role of DH. In practice, we assume that the personal e-health device is the DH, the hosting device of the application is the data collector (DR) or the DH, the healthcare service provider is the data user (DR) with two sub-roles (data miner and decision maker). Then, it becomes possible to develop a game model where the data collector attempts to access private data hold by the data provider, and the data user aims to access private data owned by the data collector.

2) Data flow and sequence diagrams: The game proceeding is illustrated in figure 4 where we distinguish two different situations : negotiation and attack. In the first case, DR may iterate the negotiation state until reaching a satisfying agreement or abandon the game. In the second case, the DR carries an attack to compromise DH and gain access to private data, or abandon the game for communication features or demotivation reasons. Sequence diagrams in figure 2 depict behavioral aspects of a system and present the control flow among actors. In the the first situation, we highlight the different steps of the privacy game evolution in function of privacy concession and incentive motivation. In the second situation, we consider the attack case where the DR is malicious.

3) Strategies parameters: DH may provide or not private data of multiple sensors to DR in function of game evolution. Player's strategies are described in a Markovian process by transitions between states depending on five parameters: (1) energy and communication facilities, (2) DR type, (3) data privacy concession, (4) incentive motivation, and (5) attack/intrusion presence. The first parameter is related to energy and communication facilities (battery level, channel state, memory state, etc.). To simplify ideas, the node ensures that communication facilities are "f avorable" when all of the facilities are verified.

The second parameter refers to attack capability detection. We assume that external attackers are strong

P P =⇒A = p i 1 -p i

Incentive value f avorable Incentive value unf avorable p

h i 1 -p h i Active → Passive P A=⇒P = p i 1 -p i

Incentive value f avorable Incentive value unf avorable p

h i 1 -p h i
Strategy 5 (adapting to the privacy) : DH switches to the passive mode if the data loss is higher than a fixed threshold and to the active mode otherwise.

Passive →Active

P P =⇒A = pp 1 -pp concession no concession p h p 1 -p h p Active → Passive P A=⇒P = p p 1 -p p concession no concession p h p 1 -p h p
and can overhear, intercept and generate any message but do not know the defense strategy of DH. As many intrusion detection systems exist and are able to detect attacks and makes DH aware of them, we consider only the possibility of disclosing data by DH in intrusion situations. Intrusion detection is out of the scope of our work, then we suppose the existence of a suitable system, able to detect attacks and makes DH aware of them.

The third parameter is associated with the adversary type. According to the players behavior, we distinguish three types of adversaries : (1) Regular -T rusted (RT ), registered in e-health system and authorized to access private data (coach, clinicians, etc); (2) Curious-T rusted (CT ), registered but attempts to access private data by proposing incentive compensation, (3) Curious -U ntrusted (CU ), unregistered and attempts to access private data by proposing incentive compensation, or (4) M alicious -U ntrusted (M U ), unregistered and leads an attack to access private data. From DR perspective, adversary belongs imperatively to the first category (RT ).

The fourth parameter describes the incentive moti-vation offered by DR to DH . It depends on external market conditions which indicate how valuable the data is to the holder and the incentives value proposed by DR in the negotiation phase. This motivation may influence DH to change his/her initial intention by making privacy concession.

The fifth parameter presents privacy preferences and data sensitivity loss of DH. Privacy preferences may be used when a patient authorizes only specific doctors to view or modify his/her health records. The privacy loss of disclosed data can be perceived when data provider makes privacy concession by decreasing privacy preferences and disclose private data. Each player has his/her own strategy to switch between states through available actions. For each strategy, we define the transition probabilities between states according to game parameters.

V. Game formulation A. Markovian process 1) System components and states:

The objective is to find the optimal defense strategy for DH to preserve data privacy over a serial of related situations. Through a set of strategic operations, DH can adaptively maximize his/her utility to protect private data, and DR (curious or malicious) aims at minimizing DH's utility. We define eight states for each player (table III) grouped into two macro-states: active and passive. Each player makes one action to reach one state.

In the active mode, DH participates to the game and may authenticate DR, negotiate incentive motivations and privacy parameters, release his/her private data, defend him/her privacy against DR attack, or be compromised.

In the passive mode, the node does not participate to the game when it is in the idle state, or due to communication features limitations (out of process), or by rejecting (reject) the offer proposed by DR.

2) Game strategies: For simplicity, we assume that DR have the same probability to belong to any of the four player categories, which means that any node has the probability of 1 4 to be Regular -T rusted, Curious-T rusted, Curious-U ntrusted or M alicious-U ntrusted. DH type is always a Regular-T rusted node. DH's behavior is more challenging than DR since he/she has to find an equilibrium between privacy preferences and financial motivations.

In figure 3, when DR is a trusted player, negotiation and incentive motivation are not needed and transitions to the Rel state takes place. When DR is curious (trusted or untrusted) and attempts at accessing private data, he/she proposes an incentive motivation with respect of DH privacy preferences. When DR is malicious, he/she leads an attack against DH to access private data.

Table II details DH's game strategies variation among passive and active states, based on five parameters (subsection IV-B3), namely: c (energy and communication facilities), q (adversary type), p (data privacy), i (incentive motivation) and a (attack / intrusion).

Markovian process describes the system which states change over time, commonly called discrete time stochastic process. As changes are governed by a probability distribution, the next state depends only on the current system state. Every finite state in the Markovian process has at least one stationary distribution (also called steady state) which satisfies:

π = πP, with i π(i) = 1
Where π(i) expresses the probability that Markovian process in state i, and P = (P ij ) is a N × N stochastic matrix specifying the transition rules. The power of the transition matrix gives interesting information about the evolution of the process.

We think that DH's behavior is more challenging than DR's since he/she has to find an equilibrium between privacy preferences and financial motivations. DR aims only at accessing private data and is not called to make privacy concessions. The Markov representation has the following state-space: S = {Idl, Aut, Rel, Rej, Com, OoP } ∪ {(N eg, i) : i = 0, 1, ...} ∪{(Att, j) : j = 0, 1, ...}, Any state of the form (N eg, i) ((Att, j) resp.) means that DH/DR has been negotiating (Attacking/Defending resp.) for i (j resp.) times.

3) Transition matrix: Figure 3 depicts the state diagram from DH perspective. For calculation needs, we consider the following probability values (a, b, c, d, e, f , g, h, and k ∈ [0, 1]) and transition matrix is : Steady state probabilities are represented in figure 5 where we notice that for a low value of a (a = 0.1), probabilities of active states are high (favorable communication features). For high values of b (authentication), attack and compromising possibilities are limited. For high values of c (authentication), releasing probability is high, reject and negotiation probabilities ares low. In addition, DH decision depends on parameters d (intention of disclosure), e (intention of reject), f (intention of abandon), and 1 -(d + e + f ) (indecision). When d heighten, release probability increases and negotiation intention decreases. The system behaves inversely for parameter e. In attack scenario, DH decision depends on parameters g (attack intention), h (attack success), f (abandon intention), and 1-(g+h+k) (DR persistence). For high values of g, communications features are limited and the systems lasts log time in Idle state. For high values of h, probability of DH compromising is high. Similarly, for high values of k, DH compromising and data release probabilities increase.

P = Idl Aut Rel Rej Com OoP N eg Att          Idl Aut Rel Rej Com OoP N eg Att a b 0 0 0 0 0 1 -(a + b) 0 0 c 0 0 0 1 -c 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 d e 0 f 1 -(d + e + f ) 0 g 0 0 0 h k 0 1 -(g + h + k)          Start End

B. Utility functions

After observing the state at each stage, both players decide their actions for the current stage. DH controls the granularity of the released data to protect his/her context privacy. To reach final states, DH calculates utility function value to decide whether accept or reject current DR proposed offer. It reflects his/her ability to release private data against an incentive motivation. We construct U , the utility function of DH, composed of two sub-functions: a loss function, which returns the privacy concession; and a gain function, which represents the impact of the incentive motivation. We consider DH is interested in both privacy and incentive and we model the game utility function as defined in [START_REF] Karimi Adl | Privacy consensus in anonymization systems via game theory[END_REF]:

U (pinc, ppriv) = A[C + Cinc * hinc(pinc) + Cpriv * hpriv(ppriv)] + B;
where p inc and p priv are the probability of making privacy concession and the probability of accepting incentive motivation proposed by DR, h inc and h priv are functions of p inc and p priv . C 0 , C inc and C priv are the intercept and marginal effects of h inc (p inc ) and h priv (p priv ) on DH's decision to disclose private data or reject. h inc and h priv can be any non-decreasing functions. A and B are external fixed costs. p inc and p priv are defined independently, but express the same event of disclosing private date when accepting incentive motivation [START_REF] Riahi Sfar | A game theoretic approach for privacy preserving model in iot-based transportation[END_REF]. Then, their values coincide:

p f := p priv = p inc ;
For incentive model, we refer to [START_REF] Xu | Privacy or utility in data collection? a contract theoretic approach[END_REF]:

h inc (p) = λ * √ p;
where λ is the data value to the DR. For privacy model, we consider the proposal of [START_REF] Wu | Game theory based correlated privacy preserving analysis in big data[END_REF]:

h priv (p) = α * ln(p + β) + γ;
where {α, β, γ} ∈ [0, 1] are privacy parameters. Then utility function is given as follows:

U (p) = C 0 + C 1 * h inc (p inc ) -C 2 * h priv (p)];
where {C 0 , C 1 , C 2 } are positive constants.

C. Equilibrium solution

Each player tries to maximize his/her profit (utility or payoff) function by choosing an appropriate strategy with knowledge of the strategy space and profit functions of the other players but with no information concerning the current strategy used by rivals. Therefore, each player must conjecture the strategy(ies) used by his/her rival(s).

In stochastic games, the number of players and possible states are finite, then it must have an equilibrium solution [START_REF] Liang | A survey on game theoretical methods in human-machine networks[END_REF]. Moreover, the existence of the NE for the proposed game model results from the fact that the objective function defined in the previous subsection is continuous and defined on a compact [START_REF] Hamdi | Game-based adaptive security in the internet of things for ehealth[END_REF]. We solve the game equilibrium numerically by solving the following optimization problem:

p f := Argmax {U (p) ; p ∈ [0, 1]} , ( 1
)
p f is the optimal probability of disclosing private data. For simplicity and without loss of generality, we use normalized values of privacy concession and incentive motivation to highlight the influence of these parameters on decision making by DH. Figure 6 presents normalized values of DH payoff in function of disclosure probability for varying incentive motivation and privacy concession. For high privacy concession, disclosure probability and DH payoff are low due to the compromise between privacy preservation and incentive motivation. For low privacy concession, disclosure probability is close to 1 and DH payoff is high, decision is quite evident when data are not sensitive.

VI. Conclusion

In this work, we discussed security concerns in a weight loss program context of e-health application. The dynamic nature of new environments such as IoT, M2M

and Web leads to new challenges in relation with data privacy. To model the behavior of involved actors, we propose a game model for privacy preservation based on Markovian process. Depending on the adversary actions, each player has to choose among a set of strategies to switch to a new state. Each player aims to maximize his/her payoff by the end of the game. Then, we validate our theoretical findings through simulation results. In the future, many directions can be explored. First, we will focus on privacy and incentive parameters changes and their impact on players behaviors. Second, we will study the 'long term' players payoffs and their effect on the game events. Third, we can change the actor types in the weight loss program scenario and study the new actions and payoffs models.

Figure 2 .

 2 Figure 2. Sequence diagrams of the privacy game ((a): DR trusted/curious, (b): DR malicious).

Figure 3 .

 3 Figure 3. State diagram representations of the game from the DH perspective

Figure 4 .

 4 Figure 4. Flow Diagram of the privacy game.

Figure 5 .Figure 6 .

 56 Figure 5. Steady states for variable game parameters

Table I E

 I -health system interactions in weight loss program scenario[START_REF] Lake | Internet of things: Architectural framework for ehealth security[END_REF].

	System elements		Interactions
	Personal Health Device	Application Hosting Device	Ensuring that data user knows exact measurements values, time and place; and that this critical data are not lost during transportation and handling.
			Device observations (one-way): transmission of measurement(s) between
	Application Hosting Device	Device connectivity	personal health gateway and health/fitness service. Questionnaires: patient reported outcome measures, or questionnaires, used in clinical setting to collect information directly from the patient.
			Consent management: enabling patients to authorize healthcare providers to
			access and share sensitive information.
			Capability exchange: reducing the amount of information that must be
			pre-configured on e-health device to obtain interoperability.
			Authenticated Persistent Session: enabling a persistent secure channel in the
			cellular environment where bandwidth, power, and IP resources may be
			limited and/or intermittent.
	Application Hosting Device	E-health records	Carrying personal healthcare monitoring information to electronic medical record systems (measurements captured by devices).
	Application Hosting Device	Medical systems/providers	Enabling healthcare documents to be shared over a wide area network between hospitals and care providers.

  adapting to the communication facilities) : DH switches to the passive mode if one of the parameters of communication f acilities is not acceptable and to active mode if all the parameters are acceptable.Strategy 2 (adapting to the attack): DH switches to active/passive mode depending on intrusion detection result.Strategy 3 (adapting to the adversary) : DH may switch to the passive/active mode if DR is untrusted (reject). He/she switches to the active mode (disclose, or negotiate) if DR is trusted.Strategy 4 (adapting to the incentives) : DH may switch when the proposed incentives are not interesting.

				Table II
				Game strategies
	Transition	Transition probability	Condition	Condition
					Probability
	Strategy 1 (Passive →Active	P P =⇒A =	pc 1 -pc	f avorable unf avorable	p h c 1 -p h c
	Active → Passive	P A=⇒P =	p c 1 -p c	f avorable unf avorable	p h c 1 -p h c
	Passive →Active	P P =⇒A =	pa 1 -pa	no attack attack	p h a 1 -p h a
	Active → Passive	P A=⇒P =	p a 1 -p a	no attack attack	p h a 1 -p h a
	Passive →Active	P P =⇒A =	pr 1 -pr	adversary trusted adversary untrusted	p h r 1 -p h r
	Active → Passive	P A=⇒P =	p r 1 -p r	adversary trusted adversary untrusted	p h r 1 -p h r
	Passive
	→Active


R Hill

CONTINUUM MICRO�MECHANICS OF ELASTOPLASTIC POLYCRYSTALS

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

INTRODUCTION

IN CONTINUUM mechanics of solids a basic problem of long standing is to correlate polycrystal and monocrystal behaviour under plastic strain. Specifi cally, supposing the shapes, orientations, and mechanical states of all grains in an aggregate known at some stage, at least in a statistical sense, it is required to derive the isothermal constitutive relations for the aggregate as a whole. These are the tensor connexions between arbitrary differential increments of overall stress and quasi-static strain, formed as space averages of the field variables. Once the incremental fields have been determined somehow, the accompanying changes in the geometry and state of all grains follow from the given monocrystal properties. In this way the total effect of a continuing process of overall deformation can in principle be analysed step by step.

The incremental behaviour at a generic stage, however, is the sole object of interest here. Neither the preceding strain path nor the existing pattern of local stress and lattice orientation are particularized. Correspondingly, a constitutive relation of sufficiently general type is adopted f o r a typical grain, capable of re presenting any actual mechanism of plastic fl ow. The aim is to construct a broad theoretical framework for rationalizing observations on metal polycrystals at ordinary temperatures. Computations for particular aggregates are deferred and the present conclusions are mainly qualitative.

It is regarded as being of the essence of the problem to take due account of the inhomogeneity of the distortion within a polycrystal. In fact, the primary task of the analysis will be to determine the average strain concentration factor in grains with a given lattice orientation. For this purpose we follow in spirit the 'self-consistent' method originated independently by HERSHEY (1954) and KRONER {1958) for elastically deformed aggregates. However, it has been found necessary to re-appraise the method and to systematize its details. An extension to plastically deformed aggregates is then formulated. This differs fundamentally from one also due to KRONER (1961), which was developed by BuDIANSKY and Wu (1962) and HuTCHIN"ON {1964).

SYMBOLIC NOTATION

In order to let the essential structure of subsequent formulae appear more clearly, a familiar symbolic notation is adopted for curvilinear tensors.

Associated tensors of second order are denoted simply by their kernel letter, u say, set in lower case boldface as if for a vector. Correspondingly, their tensor components in any representation are considered to be arranged in some definite sequence as a 9 x 1 column. Associated tensors of fourth order are denoted by an ordinary capital, A say, and are regarded as 9 x 9 matrices. More precisely, the leading pair of indices is set in correspondence with rows and the terminal pair with columns, both in the chosen sequence, so that the second-order inner product of tensors A and u can be written as the matrix product Au. Similarly, AB can stand for the fourth-order inner product of A and B. Subsequent formulae can be interpreted in terms of tensor components in any representation, so long as it be done consistently.

A special word is needed in regard to inverses of fourth-order tensors A, which are here always symmetric with respect to interchange of the leading pair of indices and also of the te � minal pair. The representative matrices are thus singular, with rank � 6; for instance, As vanishes identically when s is the column for any skew second-order tensor. Nevertheless, equations of type u =Av are compatible when u and v are any symmetric second-order tensors and matrix A has rank 6.

In this sense we can define a unique inverse A-1 as the solution of AA-1 =l or A-1A =I,

where I is a 'unit' matrix with the symmetries of A and with mixed tensor

components i ( o k ' s,1 + 01i oki)
m terms of the Kronecker delta. Then

A-1 u = A-1Av Iv= v as required, for any A, u and v with the stated properties.

AN AUXILIARY PROBLEM

(i) A single crystal, arbitrarily ellipsoidal in shape, is imagined to be embedded in a finite homogeneous mass of some different material. Neither phase is necessarily elastic or isotropic, but in each the invariant relationship between an objective stress-rate + and the strain-rate E is supposed to be one-one and linear. The tensors of instantaneous moduli are denoted by L e and L, respectively, and their inverse compliances by Mc and M. In addition to the symmetries mentioned already, the representative matrices are required to have full diagonal symmetry so that the cross-moduli and compliances are pairwise equal. A further minimal restriction is that the respective quadratic forms, u (Lu) etc., in any second-order tensor u of rank I are positive.

On the external surface the velocity is prescribed to correspond to a uniform overall strain-rate i. Primarily, we seek the deformation induced within the crystal, given that the velocity and traction-rate are continuous across the inter face. To he definite, stress-rate is taken to be the convected time-derivative of contravariant Kirchhoff stress, based on the current configuration. In the absence of body forces this satisfi es the equilibrium equations

2_ (+'' + -rtk 'i:J vi) = o ()xt ()xlc
where vi is velocity, i'lTt k /'i:l x' = 0 since the existing stress is self-equilibrated, and xi is a rectangular coordinate. The convective term would vanish identically in a field of uniform straining and will in any event be disregarded, presuming the existing stress to be a sufficiently small fraction of the dominant moduli.

This approximation is permissible since Hadamard instability, which would involve local spins large compared with the strain-rates, is prevented by the minimal restrictions placed on the moduli (HILL 1962, § 4 (ii)). Moreover, these same re strictions also ensure a unique solution (op. cit. § 4 (iii)), which can therefore be expected to have the character of a uniform field locally perturbed in the neigh bourhood of the crystal. In particular the overall, or macroscopic, stress-rate T is then equal to Li, since the contribution from the crystal becomes vanishingly small when the outer phase is sufficiently extensive. Furthermore, T and i are also approached asymptotically by the local field values at the external surface.

It is plain that the solution is formally identical with that of the analogous displacement problem in linearized elasticity when both materials are Green-elastic.

In that context the sohi.tion is well known in outline when the outer phase can be treated as unbounded. Its principal feature is that the ellipsoid is strained uni formly, though not necessarily coaxially (EsHELBY 1957;1961 ).

This property prompts the introduction of an ' overall constraint ' tensor L* for the outer phase, with inverse M*, in respect of loading over the interface by any distribution of traction-rate compatible with a uniform field of stress-rate, +* say. That is, if E* is the accompanying uniform rate of straining of the ellipsoid,

+* = -L* E*, E * = -M* +* .

{I)

The

{3)

which furnish the required fields in the crystal in terms of the macroscopic quantities. It seems that this attractively direct approach has not been adopted by other writers, with apparently the single exception of HERSHEY (1954), who, however, did not emphasize its advantages.

(ii) Instead, following EsnELBY (1957), it has become customary to focus attention on the entire two-phase system, starting from a certain transformation problem for an infinite homogeneous elastic continuum with stiffness tensor Lt .

In this, an ellipsoidal region would undergo an infinitesimal transfonnation strain e if free, but attains only the strain Se in situ. The tensor S is determinable uni quely, by virtue of the minimal restriction on L, and it obviously possesses an inverse s-1 since e vanishes with Se (no stress being then induced outside the transformed region nor therefore within it). The xt components of S, being dimen sionless, are functions of the moduli ratios and of the aspect ratios of the ellipsoid and its orientation in the frame of reference. When L is isotropic, explicit formulae for the components on the ellipsoid axes have been given by Eshelby (op. cit.). Formulae for the two-dimensional analogue have been given recently by BHARGA

T = L* (L* + L)-1 = (M* + M)-1 JU. } } (5) (6)
The signifi cance of T is that the stress T* in the transformed region can be written as TT, where T is the stress that would rcmoYe the strain e. Separate symbols P and Q have been introduced for the products in (5) since these appear frequently in the sequel. We note the further connexions t Pre-occupation with this standpoint can lead to needlessly devious derivations. An extreme example is to be found in s"veral papers by BHARGAVA and RADHAKR!SHNA (1963a, b; 1964) on the two-dimensional auxiliary problem.

The elastic field outside the ellipse is actually obtained by exact analysis at the outset, from which L•, M * and the compatible internal field could forthwith be r<>ad off, but are not. Instead, the total potential energy of both phases is laboriously computed for any final internal strain, and afterwards minimized as a Jneans of satisfying the remaining requirement of traction continuity at the interfaC'e.

tW1LLIS (1964, private communication) has developed this iuto a feasible numerical procedure by reducing the integrals.

and

P-1 = L* +L, Q-1 =M* +M. } (7)
PL +MQ=l,

P = M (I -T) . Q = L (I -S),
From the latter pair one sees that matrices P and Q have the diagonal symmetry stipulated for the moduli and compliances (while S and T generally do not). This

in terms of the overall constraint of the outer phase. Eliminating this with the help of ( 7), we have the variants

Ac-1 =l +P (Lc -L), Bc-1 =l +Q(Mc -M), (11)
in terms of the explicit differences between the phase properties, and involving quantities directly to do with the transformation problem.

PoLYCRYSTAL ELASTICITY

(i) We consider polycrystals whose geometry is such that the grains can be treated, on average, either as variously-sized spheres or as similar ellipsoids (in particular elliptic cylinders) with their corresponding axes aligned. On the other hand, the lattice orientation in the cartesian frame of reference may vary from grain to grain, not necessarily randomly.

Tensors Le and Mc will now denote the stiffness and compliance of a typical crystal, in respect of incremental 'elastic' strain (not an essential interpretation, as remarked in § 3 (i)). In the auxiliary problem L and M become the overall tensors for the polycrystal itself, while L * , M * , S and T specifically relate to the sphere or ellipsoid representing the average grain shape. Consequently, in a common frame of reference, the components of L, M , L * , M * , S, T, P, Q are constants, whereas the components of L e , .1. llc, Ac , Be depend on local lattice orientation.

In the 'self-consistent' method due to HERSHEY (1954), and independently to KRONER (1958), the stress fi eld around a grain in the auxiliary problem is taken to be representative of the actual neighbouring field in the polycrystal, averaged for all grains of that orientation. Further, and more explicitly, it is postul8��1 that a certain macroscopic tensor quantity should be obtained as the average, over the relevant range of lattice orientations, of the corresponding local tensor for a grain in the auxiliary problem. But which quantity should be singled out for this treatment has perhaps seemed arbitrary hitherto : Kroner examined two possibilities, only one of which was tried by Hershey, while EsHELBY (1961, § 6) proposed yet a third. Still other choices are equally natural. By means of (2), however, it is a simple matter to established their equivalence, thus finally justifying the description ' self-consistent.'

To begin with, suppose that the macroscopic strain-rate is taken as the average of the crystal strain-rate in the family of auxiliary problems. Then, from (8) and afterwards ( 9 That such dual approaches are equivalent can be seen at a glance from (2) : the leading equation states an invariant linear relation between deviations from the respective means, and so the average deviations necessarily vanish together.

If, now, one wished to transform equations ( 12) by means of {10), they could first be put as The matrix factors P, Q , S , T are non-singular and can be dropped. It is then apparent that not only are ( 12) and (13) equivalent to one another but also to each of

{(Le -L) Ac} = o, {(Mc -M) Be}= O. (14)
In fact, as they stand, these are just the averages of the dual 'polarization tensors' :

{Tc -LEc} = (L* + L){i -Ee}= 0, {Ee -M+c} = (M* + M){-.f -+c} = 0, obtained directly from (2).
Retufing again to ( 12) and ( 13), and combining them m turn with (11) :

{[I + P(Lc -L ) ) -1} =1, {[I +Q(Mc -M)]-1} =1. (15)
Alternatively, by combining ( 14) and ( 11),

{ [ p + (Le -L)-1)-1} = o, {[ Q +(Mc -M)-1]-1} = o. (16)
While these four variants are equivalent, as already proved, it may in practice be slightly more convenient to proceed from one in preference to the others. In any event the final result of carrying out the appropriate averaging is a set of algebraic equations just sufficient to determine the separate components of Lor M, in terms of matrices P and Q furnished by the solution of the transformation problem.

On the other hand, if the primary datum is the constraint tensor of the outer phase in the auxiliary problem, a possible starting-point would be either of

{(Le -L) (L* + Lc)-1} = O, {(Mc -M) (M* + Mc)-1} = o, (17)
from (1 0) with (1 4). The equivalence with (1 6) can be checked at once by means of (7). More attractive variants are

(L* + L)-1 = { (L* + Lc)-1 }, (M* + M)-1 = { (.Llf* + Mc)-1}, ( 1 8)
from (1 0) with (1 2) and (1 8) respectively. Or these can be ' solved ' as

L = {(L* + Lc)-1}-1 -L*, M = f (M* + Mc)-1}-1 -M* .
(ii) It appears that the self-consistent method has so far been applied numeri cally only when the grains are spheres and the lattice orientation is random.

Tensors L and M are then isotropic and can be written in the symbolic notation as or still more shortly as

L = 81e ii ' + 2µ. (I -ii ' ), 1 •. , 1 I .. , M = -t i + -( -i i ), 81e 2µ. L = (81e, 2µ.), M = ( s 1 1e' 2 1 µ. ) • ( 19
)
where 1e and µ. are the usual bulk and shear moduli. Column i is the ' unit vector ' representing s,1 /y'8, and the row i ' is its transpose, so that i ' i = I. Clearly, matrices i i ' and Ii i ' represent isotropic operators that decompose a second order tensor, such as stress or strain, into its hydrostatic and deviatoric parts.

They also have the properties

(i i ' )2 = ii ' , ii ' (1 -ii ' ) = o, (I -i i '
)2 = Iii ' .

It follows that the product of any pair of isotropic fourth-order tensors is isotropic and commutative, and that the coefficients in its _decomposition are just the respec tive products of the original components. For instance, the order of factors in any product in (4), ( 5) and (6) can be reversed, with the consequence that T=l -S and S = («, /3) sayt,

P = (t• �)' L* = (3ix " {l -o:), 2 ; (I -P) ) ' = 2µ. ( 2, 1 p P ) , T = (1 -IX, 1 -p), Q = (81e (1 -o:), 2µ. (1 -{J)), �!* = (-0: -fJ ) -s1e (1 -o:) ' 2µ. (1 -P > ' -1 ( p ) = 2µ i. 1 -{3 • {2 0}
Equally, the average of any orientation-dependent fourth-order quantity, with matrix Z say, is isotropic and can be similarly decomposed : where ' tr ' stands for trace (i.e. sum of elements in the principal diagonal). Coe fficients g, 71 are invariants and can therefore be evaluated from the cartesian com ponents of Z for any convenient lattice orientation. In this way each of the equivalent relations ( 15), ( 16), ( 17) or ( 18), when averaged in form {Z} = 0, is reduced to a pair of simultaneous algebraic equations g = O = 71 in the overall moduli K and µ. Kroner and Hershey, starting in effect from the second of ( 13), arrived re spectively at the second of (15) and ( 18), both of which yield a quartic equation 71 = O for µ alone when the lattice has cubic symmetry (in which case g = 0 states the obvious fa.ct that K is just tbe single crystal bulk modulus). The quartic contains a non-vanishing factor 9K + 8µ, the numerator of the fraction 1 -{J corresponding precisely to the factor T noticed above, and so can be reduced at sight to a cu bi ct.

The cubic, as such, was also obtained by Kroner essentially from the first of ( 12), which leads to the first of ( 16), and again by Eshelby from the first of ( 14) phrased in terms of energiest. But the final coincidence of these approaches, here shown to be inevitable, went unexplained.

AUXILIARY PROBLEM WITH PLASTIC FLOW

The previous formulation and analysis of the auxiliary problem already covers certain inelastic behaviour (for instance hypoelastic), but not elastic/plastic behaviour as typefied by the common metals at not too high temperatures. This is characterized by a non-linear relation between stress-rate and strain-rate (still homogeneous of degree one). With polycrystalline metals mainly in mind, we therefore attempt an appropriate extension of the analysis in § 3.

(i) Suppose, first, that only the crystal is elastic/plastic, Then equations (2) still hold and the connexion between local and overall quantities, replacing (3), is clearly determinable in principle. To derive it explicitly, suppose the operator Mc for a crystal in situ to be piecewise linear. If necessary, this can always be assumed as an approximation that can be made as close as one wishes. Then

M mcmc' c -Jlc

= T/ ---+ • • • • • he {21)
where JI e is the elastic compliance tensor of a crystal, and each T/ is 1 or 0 according as its associated me' +e is positive or negative. Succeeding terms, up to any finite number, are similar in type to the one displayed. This law is recognizably akin to what is often premissed for multislip in a metal cubic crystal. Without neces sarily intending this interpretation, one may say that the strain-rate tensor in a contributory 'mode of plastic deformation ' always has a representative vector in a specific direction, typically me where me' me = 1; furthermore, ' workharden ing ' in this mode is controlled by a modulus he, whose value may conceivably depend both on the mode in question and on which others are simultaneously activated. Naturally, every me and he is a function also of the current stress in tNamely with the usual notation for crystal moduli. The version given by ESHELBY (1961) contains some misprints.

tKroner's second method, essentially in the form of the first of (15), has recently been adopted by KNEER 0963)

to compute the bulk and shear moduli when the lattice is hexagonal.

the crystal and of its mechanical state, while the cartesian components of any me depend as well on lattice orientation.

It can now be seen that M c is constant in each of the pyramidal i:egions created by the dissection of stress-rate space by the set of hyperplanes me' + c = 0, etc.

In particular, it is equal to ,,I( e in the region whose boundary corresponds to the local vertex on the yield surface of the crystal. Within .any pair of adjoining re gions the families of active modes differ by just one member whose ' direction ' is normal to the mutual interface. Moreover, this member is not activated by any stress-rate lying in the mutual surface; consequently, strain-rate varies con tinuously with stress-rate through the entire space. Finally, because of the assumed normality, matrix Mc automatically has the required diagonal symmetry when this is stipulated for ,,l(c• A linear equation, identical with the second of (3), is therefore valid in respect of each pyramidal region in +c space or its equivalent in 1' space.

When the yield surface is locally regular, its unique normal defines the direction of the possible plastic strain-rate. Expression ( 21 in the direction of the yield surface normal.

In the event that both phases have the same elastic moduli, so that .!t'c = L, ,,(( c = M, these formulae reduce to A _I Pie le ' c - + T/ gc -le' P i e '

B _ 1 Q mcmc' c - -TJ he+ me' Q me' , .,.. E•v -m me T c--TJ c h+ ' Q ' e me m!'
that each T/ is taken as 1 or O according as its associated m ' T is positive or negative.

The analysis in (i ) above is then rigorously valid within each region of the space of overall stress-rate given by this dissection. In the formulae it is only necessary to insert the appropriate branch of L and M from the modifi ed (2 7), together with the associated L* , M* , S, T, P and Q.

(i ii) KRONER (196 1) has suggested a different scheme. In BuDIANSKY and Wu's elaboration of this (1962), adopted also by HUTCHINSON (1964), the representative outer phase is given the constitutive law

E-i=.A (+-T )
where .A is the elastic compliance (assumed isotropic) of the aggregate and of the individual crystals. This is an artificial relation, patently not quasi-elastic; never theless Eshelby's analysis is still presumed to apply. The writer has not understood the subsequent line of argument, but the eventual formulae imply that

Ee -E -.A* ( +c-T ) and so, in particular, that the aggregate deforms homogeneously when the crystals are rigid/plastic (.A, .A* = 0). Thus, in effect if not by expressed intention, KRONER et al. assign to the outer phase the overall isotropic constraint that the aggregate would in fact exert if its incremental deformation were always purely elastic. This disregards the pronounced directional weaknesses in the constraint of an already yielded aggregate.

If used with the present formulae in (i) above, Kroner's proposal would entail replacing L* , M* , S, T, P and Q by their elastic counterparts. Neither Budiansky and Wu nor Hutchinson obtain such formulae, but calculate instead the rate of hardening of typical crystals in a random aggregate loaded either by uniaxial tension or pure shear. At the same time the overall hardening of the aggregate itself is computed by the self-consistent method.

SELF-CONSISTENT MODEL WITH PLASTIC FLOW

It is proposed to combine the hypothesis of § 5 (ii) with the self-consistent method of averaging. The object of calculation is now the macroscopic constitu tive law itself. The unknown matrix M will certainly have the structure (2 7), since not only are its piecewise linearity and diagonal symmetry intrinsic to this theory but they are also clearly compatible with the law (2 1) assumed for the individual crystals. Of course the branches of M will not normally be foreseeable at the outset. They are determinable in principle with the help of the requirement that the overall stress-rate should always depend continuously on strain-rate.

Fortunately, the elastic branch at least can be located already. It is associated with the pyramidal region defined by the inequalities me ' (.A* + .Ac)-1 (.A* +.A) 1' < 0, ...... , for all crystals and modes. .A* is the reciprocal constraint tensor associated with the overall elastic compliance .A satisfying (.A* + .A) -1 = {(.A* + .A c } -1 } as in (18). The hyperplanes bounding this elastic region in overall stress-rate space correspond of course to the tangent planes at the currently given stress-point on the yield surface of the aggregate. The vertex is more or less pronounced according to whether the directions ( J + ..K e� *)-1 me, ..... , span a large or small solid angle. Without resort to computation, the analysis can be carried farther only in particular cases. Suppose, for example, that the crystals are elastically isotropic and that the current internal stress is such as to activate just one mode m, whose direction in strain-rate space is moreover the same for all grains. The typical crystal compliance can then be written as it is confirmed that the criterion expression is essentially the same for both branches (the factor in square brackets being positive). The conclusion is, therefore, that the aggregate also deforms by the one plastic mode, for the overall stress, and that its overall rate of hardening is implicitly given by (28). Since M* depends on M, which is itself a function of h, this equation is quite complicated. Leaving it and returning to (24), we obtain the following expression for the inhomogeneity of the internal fields :

(29)

The inhomogeneity in strain-rate is seen to be of the same type in all grains, though deflected from direction m.

  corresponding matrices have of course diagonal symmetry, as may easily be shown by Betti's reciprocal theorem, and are functions of L or 1Jf and the aspect ratios of the ellipsoid. Once L* and ill* have been determined, the solution of the auxiliary problem follows by superimposing the uniform fields "T and i, and identify ing +* with +e -"i and E* with Ee E. Then or Finally, +c -T = L* (i -Ee), Ee -i = M* (i -+c), L* Ee+ +c = (L* + L) i, M* +c +Ee= (M* + 111 ) T. (L* +Le) Ee= (L* + L) i , (111 * +life} + c = (M* + M) T,

  v A and RADHAKRISHNA (1964) when the medium is orthotropic and by WILLIS (1964} when it has cubic symmetry. For general anisotropy the basis for a three-dimen sional solution was sketched by EsHELBY {1951, p. 105)t. The general connexion with L* or M* is most easily obtained by imagining the transformation problem solved from the viewpoint of (1 ), interpreted in an elastic context. That is, we substitute e* =Se, T* = L (e*e) m T* = -L* e* . Then, since these hold for all e, L* S = L ( I -S), (I -S) M* =SM, (4) where I is the unit tensor defi ned in § 2. These are equivalent formulae for L* or M* in terms of S. Or they can be put inversely as S = (L* + L)-1 L = M* (M* + M)-1 for Sin terms of L* or M*. Another dimensionless tensor T, the dual of S, could just as well be admitted on this footing. Set so that and 111 * T =S M = P, say, TL= L* S = Q, say, M* 1' = M (I T), ( I -T) L* = TL,

  can of course also be established purely within the context of the transformation problem by means of Betti's reciprocal theorem. (iii ) We return to the original auxiliary problem. As in a related situation (HILL 1963) it is advantageous to define' concentration-factor tensors' Ac and Be such that Ee= Aci, (8) with the consequent inter-relations Le Ac= BcL, (9) From (8), Ac = (L* + Lc)-1 (L* + L), Be = (M * + Mc)-1 (M* + M ) ,

  are indicated by enclosure within curly brackets. Alternatively, dual operations with stress-rate give (13)

  1e -I) Ac}= o, {(Mc -MBc -1) Be}==-� o, P{(Lc-L)Ac} =O, S{ (Mc-M)Bc}=O. Treating (13) similarly, Q{ (Me-M)Bc}=O, T{(Lc-L)Ac}=O.

  {Z} = (�. 71) where �=tr (Zi i ' ), f + 571 =tr Z, tThe actual values are a:= 8 -5/l = 1</(" + ! 1>) [see, tor example, E8BEIJlY (1957)J.

  ) terminates with the mode shown and inverts to where le le ' .!t'c -Le = TJ - ge le = ,[£' c me. gc -he = me',[£' e me = le' ,,/( c le. } (22) 9'c is the tensor of elastic moduli, reciprocal to ,,l(c , and we assume that gc > O. By evaluating in analogous fashion the matrix reciprocals in (IO), the concentration factors are obtained as A c = [1 + T/ (L* + !f' c) -1 le le ' ] (L* + ,[£' c) -1 ( L* + L) (23) ge -le' (L* + .!t'e)-1 lc where T/ is I or 0 according as le' (L* +.!ee)-1 (L* + L) i is positive or negative, and B = [1 -T/ (M* + ,,l(e)-1 me m e ' ] (M* + ,,(( )-1 (M* + M) (24) c he+ me' (M* + ,,l(et1 me c where T/ is I or 0 according as me' (M* + ,,(( c)-1 (M* + M) 1' is positive or negative. Denominators of the quotients here are identically equal and are assumed positive (for which an amply sufficient condition would be that the various matrices are positive definite). The plastic part of the crystal strain-rate is Ec1' = (M _ ,,(( ) B T = m me' (M* + ,,l(c )-1 (M* + M) T c e e 7J c he+ me' (M* + ,,(( c)-1 me '

  mm' Mc=..K+ TJ -- h e where only the hardening parameter varies from grain to grain. Then, in the family of auxiliary problems for the various orientations, 'YJ is simultaneously l or O according as m' (M* + ..K)-1 (M* + M) 'T is positive or negative; in particular, for the elastic branch ..K this criterion expression becomes m' 'i. By solving {Be} = I for M, when the concentration factor Be is the indicated speciali zation of (24), one finds that mm' M = ..K + 'l'Jh -, regardless of what M* might be, where [ h + m' ( M* + ..K) -1 m ]-1 ={[h e+ m' (M* + ..K)-1 m]-1}.

  virtue of the a posteriori reduction m' (M* + ..K)-1 (M* + M) 1= = m' [1 + 'YJ (M* + ..K)

where P and Q are as in (7). When, in addition, the phases are elastically isotropic the decomposition (20) is available. Thus, supposing also that the plastic mode involves no dilatation, as is appropriate for metals, i" c B e T = T -2µ (1 -{3) Ec1' with If, further, the mode is a simple shear without hardening, we recover the prototype formulae of BuDIANSKY, HASHIN and SANDERS [1960, (12) and ( 13), obtained via the transformation problem outlined in § 3 (ii) here] .

More to the present purpose, suppose that the crystal is rigid/plastic, without specializing in other directions. Then, by putting .Kc = 0 in (24), and using (4), L* '

where 71 is 1 or 0 according as (S-1 m e )' 'i is positive or negative, and

as in (4), a prime signifying the transpose. Equally, by a limiting operation on (23) or directly from A c

[which is the second of (9) with the first of (5) in the form S' = LP] , (26) where 71 is 1 or O according as (P-1 me)' i is positive or negative, and

as in (7).

(ii) Suppose, now, that the macroscopic constitutive law of an elastoplastic polycrystal is known and can be approximated piecewise linearly :

where each 1J is I or O according as its associated m' tis locally positive or negative.

Consider the corresponding auxiliary problem where the crystal has the constitutive law (21}. If the stress-rate at all points in the outer phase induces one and the same branch of M, the material behaviour is quasi-elastic and the previous analysis remains rigorously valid for the particular overall loading. It would be possible in principle to determine the loading ranges for which this happened, is respect of any given branch and any lattice orientation.

A more practicable course is to take as the representative outer phase a truly elastic material whose properties coincide with the actual branch of M associated with whatever overall stress-rate may be in question. Naturally, for certain loadings, the resulting solution of the auxiliary problem will sometimes violate the original (27) locally in the outer phase, but we can reasonably hope that the net error in the overall constraint will be negligible.

Expressed formally, our hypothesis means that ( 27) is modified to the extent

The latter effect is purely elastic and would vanish if the crystals and aggregate were rigid/plastic, i.e. if .K = 0. In that event the strain-rate would necessarily always be homogeneous in the auxiliary problem, and so .U* = 0 while m ' +c =he and m ' i = h. Thus h = {he} is the limiting form of (28). To determine the stress rate field uniquely, the auxiliary problem must naturally be re-set in the manner appropriate to rigid/plastic solids with a (piecewise) linear constitutive law (HILL 1956). When the direction of the only activated mode is not the same in all grains, combining {Be}= I with (25) or {Ac} = I with (26) leads to the implicit equation p = { 17 he + "::a:'i* mJ (30}

for L or M. The accompanying conditions on 17 define a pyramidal dissection of the space of the overall stress-rate by hyperplanes with normals s-1 me, for the various branches of S.

Further consequences are left for future investigation.

ACKNOWLEDGMENT

This work is part of a programme of research on mechanics of materials which is supported by a grant from the Department of Scientific and Industrial Research.