Automatic fine-grained area detection for thin client systems The widespread availability of cloud infrastructures is fueling new interest in the thin client computing paradigm. However, current thin client protocols are not designed to handle new content types as often encountered in state-ofthe-art applications (e.g. multimedia editing, gaming, multimedia playback). Conveying this content using traditional thin client protocols typically results in a combination of excessive resource usage and low visual quality. In this paper, we propose an approach where the content type can vary for different portions of the screen (e.g. combination of static text and video). Once the different content types have been detected, each of them can be encoded using the most appropriate algorithm. We present two algorithms for this runtime detection. The first algorithm is operating at the pixel level, thereby being independent of the actual thin client protocol used. The second algorithm assumes the presence of a rectangle-based thin client protocol (such as the popular VNC protocol), trading independence for improved performance. The appropriate parameter settings for these algorithms are experimentally determined. Furthermore, their influence is studied in detail in terms of detection accuracy, and the time to perform the algorithms is analysed. Accurate hints are derived within less than 10 ms, indicating the high potential of this approach for use in next generation thin client systems. The thin client computing paradigm consists of offloading as many resource intensive operations as possible to a remote server and limits the client functionality to forwarding user events to the server and displaying the returned graphical content. The server handles complex computations and remote storage. The benefits from this approach are numerous and well-known [1] , including decreased exploitation cost, prevention of data loss, shared hardware resources, easier data exchange, universal access of applications, easier software update management and maintenance, etc. Clearly, the currently witnessed increase in cloud deployment is a strong enabler to leverage the functionalities and possibilities of the constrained devices such as tablets and smartphones, used to access these cloud infrastructures. Hence, a cloud architecture based on thin client computing can provide access to data and Email address: Bert.Vankeirsbilck@intec.UGent.be (Bert Vankeirsbilck) applications from any place, at any time with any device and most importantly with unhampered user experience.. Given the current network connectivity and thin client protocols to convey information between client and server, the delivery of dynamic visual content such as games and video is often an issue. Thin client protocols are typically optimized for delivering static content, and adopting the same approach for delivering dynamic content results in excessive bandwidth usage and mediocre visual experience. An approach frequently adopted in commercial thin client protocols consists of redirecting multimedia content directly to the client device for local decoding. The concept is used in Microsoft Remote Desktop Protocol (RDP) version 7 [2] and the High Definition User Experience (HDX) MediaStream feature in Citrix' products [3] . Although this approach works well for supported video formats, it is not applicable to applications that do not use a video playback codec for their visualization (such as games and visualization software).. To alleviate these problems, we have previously proposed a hybrid approach [4] that switches between two modes of operation: the classic thin client mode (suitable for static content) and a media streaming mode (preferable for dynamic content). However, a single encoding is used for the complete screen, leaving substantial room for further improvement by applying different encoding methods for different areas of the screen.. The contributions of this article can be summarized as follows. We first identify the gains (in terms of bandwidth efficiency and visual quality) of differentiating dynamic from static content on a fine-grained scale, i.e. by applying an optimized encoding for each display area. Secondly, two algorithms to perform the detection of different content types are proposed and evaluated in terms of accuracy and performance. One algorithm purely operates at the pixel level which is the lowest layer in the rendering stack, thus being highly system independent. The second algorithm uses higher level information from a thin client protocol (more specifically information on rectangles to be displayed), assuming the availability of this information, thereby trading system independence for performance (specifically in terms of analysis speed and runtime overhead). Finally, these algorithms, together with their appropriate parameter settings, are thoroughly studied to highlight the potential of these novel approaches for next generation thin client systems.. The remainder of the manuscript is organized as follows. Section 2 presents an overview of related research efforts addressing fine-grained area detection for thin client systems. In Section 3, we propose a generic architecture and building blocks to enable the classification of screen content. Two strategies to differentiate dynamic from static areas are discussed in Section 4. Section 5 presents results obtained through experiments with proof-of-concept implementations. Conclusions are summarized in Section 6. This article proposes algorithms for automatic detection of different content types for encoding the visual content for thin client computing. The approach separates the content type detection and thin client protocol encoding, in order to enable them to perform at different speeds and to allow for hysteresis in the detection component so that hints given to the encoder can be stabilized. The need for a detection system is shown via experimental results on both consumed bandwidth and user experience, and two algorithms are discussed to perform such detection, i.e. pixel analysis and thin client protocol rectangle analysis. The detection accuracy of both algorithms is evaluated, as well as the performance in terms of computation speed. Overall, we conclude that both levels of analysis have their own advantages. Thin client protocol rectangle analysis can work faster than pixel analysis because this algorithm operates in the rectangle representation domain, which allows optimized mathematics and aggregated evaluation of areas on screen. Pixel analysis is computationally more intensive (although this can be greatly alleviated by performing subsampling), but is able to overcome overestimation issues specific to rectangle analysis, leading to higher accuracy. For low motion, computer generated dynamic content, the rectangle analysis outperforms pixel analysis. Given these findings, a combined approach is expected to be beneficial for both analysis speed and accuracy. The thin client protocol rectangle analysis could perform a rapid coarse grained scan to be used as input for the pixel analysis, leading to focused sampling and fine grained area detection. Experiments with prototypes of both algorithms result in accuracies between 92% and 100%, within 8.892 ms with the pixel analysis algorithm and 11.368 ms with the rectangle analysis algorithm. Also for Full HD content, the proof-of-concept software implementations of the proposed algorithms show to be viable for real-time analysis of the desktop session.. Future work includes automatic deduction of optimal parameter settings for the detection algorithms, the detection of additional content types besides dynamic and static, and feedback of user perceived quality to guide the hinting algorithms. It would also be interesting to study the decoupling and synchronization between analysis and encoding components in more detail. Furthermore, we expect adaptive thresholds to build in intelligent inertia for switching between modes to be beneficial. Also the solution proposed for dragging windows over the screen, i.e. on detection of this case, the system should reside to full screen VNC encoding, should be investigated more thoroughly. In a thin client system, remotely executing applications heavily use the server side graphics Application Programming Interface (API) to render the content they generate. Subsequently, this graphical information is intercepted at a particular level in the visualization stack, compressed, encapsulated and transmitted over the network. The problem with this approach is that the application output is already processed for visualization and the server side of the thin client protocol is unaware of the exact nature of the generated graphics. This leads to the fundamental problem that the encoding of the content is performed agnostic of the type of graphics that is displayed. The most visible result of this approach is the encoding of embedded video in a pixel-format, leading to excessive bandwidth usage and mediocre playback quality. The performance and issues with classic thin client computing protocols have been investigated thoroughly in [5, 6, 7] , indicating the need for designing intelligent thin client protocols given that the user experience depends on network latency and bandwidth.. The problem with multimedia has been partly addressed in newer thin client protocol versions. Virtual Network Computing (VNC) [8] and FreeNX [9] include audio support. Microsoft RDP 7 and Citrix provide a similar solution (i.e. Windows Media Player redirection and HDX MediaStream respectively) by intercepting video files at the OS level and forwarding (possibly after transcoding) this content directly to the client for playback. However, for other dynamic content that is not rendered through a video codec (such as games), the screen rendering must still happen at server side and will cause a considerable burden on the network [10] . Red Hat's SPICE protocol [11] mentions heuristic identification of video streams to transmit them as M-JPEG video streams, while Teradici PC over IP (PCoIP) does feature detection of text, graphics and video on screen and encodes these accordingly to save bandwidth, as described in [12] . As these solutions are proprietary, no further information on these algorithms is available.. Previously [4] we have proposed a remote rendering architecture that differentiates screen content such that the whole screen area is either transmitted as a video stream or through a classic thin client protocol encoding. In the current article we extend this concept, aiming at finer-grained detection of dynamic and static regions, to enable encoding of parts of the screen as classic thin client protocol encoding and others as a video stream simultaneously.. Recent research [13] hooks into the Linux X server and monitors X protocol messages, resulting in an OS dependent strategy to differentiate video content from static content. By correlating image drawing commands (e.g. putImage) per application and monitoring their frequency, complete applications are classified as visually dynamic or static. The knowledge of these application windows' size and position on screen is used to differentiate between regions in the screen. The authors show that this approach is computationally beneficial, but also take the assumption that the presence of all dynamic content can be detected based on repeated invocations of the putImage()-method. However, not all applications rely on putImage() calls to render their content (e.g. GPU assisted applications). In addition, some applications also use putImage() to render static content, more specifically to refresh large portions of the display at high frequency to ensure fast updates (e.g. in games). Our proposed system focuses on pixel level analysis, where the actual screen content can be more accurately classified. By performing this analysis at the pixel level, independence on other platform components (e.g. graphics API, underlying OS and type of thin client protocol) is achieved.. Currently available standards concerning representation of scenes and meta-data formats have built-in support for content type differentiation. The MPEG standards support this differentiated content by offering multiple encoding channels in their scene formats, e.g. Binary Format for Scenes (BiFS) and Lightweight Adaptive Scene Representation (LASeR), both part of the MPEG-4 standard [14] . Thus, a thin client system using MPEG streaming could be developed based on the work presented in this paper.. The concept of thin client based cloud computing is an active research area [15] , and has been found interesting for enabling games on resource constrained devices [16, 17] . In the current paper we focus on an important building block of such systems and fill a crucial algorithmic gap to classify screen content for optimizing user experience and bandwidth consumption. Figure 1 presents the hybrid thin client encoding architecture, with an analysis component steering the encoding process. The analysis component retrieves information from various sources in the thin client server, as will be elaborated on further in this section. Based on this information, hints are given to the thin client encoder about the content type of individual components, such as parts of the screen that are text, dynamic content, available in the client side cache [18] , vector graphics encoded or to be fetched at the client side from another source or from the client hard drive. The thin client protocol encoder subsequently fetches the required input, encodes this content in the appropriate format according to the hints provided. Thus, the thin client server continuously sends appropriately encoded screen content to the client, while the analysis component is responsible for configuring the size and position of the differently encoded regions. The analysis component operates independently from the thin client encoder, for multiple reasons. First of all, this approach allows for hysteresis in the analysis, i.e. that the output of the algorithms can be held in deliberation for a period of time until it stabilizes, before reconfiguring the encoding parameters. The decoupling also ensures that the analysis algorithms can be used irrespective of the specific thin client protocol actually used. Furthermore, multiple encoding threads can be active at the same time, each taking care of the encoding of one or more specific regions and operating with its own dedicated parameters. For instance, an advanced analysis scheme could detect 3 regions of high motion content with different encoding needs. Three separate encoding threads could then be activated, with settings adapted to the specific content of the regions, e.g. one encoder operating at 60 fps allowing slight quality degradation, and the other at 30 fps with perfect quality. With the independent operation of analysis and encoding, the analysis component could be set to operate at 5 fps, implying that not each and every frame is subject to detailed analysis. This can limit the computational overhead of the overall system, keeping resources available for the graphics encoding.

O O B I O B I O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O B O O O O O O O B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B O O O O O O O B O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B I O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B


Provable data possession at untrusted stores We introduce a model for provable data possession (PDP) that allows a client that has stored data at an untrusted server to verify that the server possesses the original data without retrieving it. The model generates probabilistic proofs of possession by sampling random sets of blocks from the server, which drastically reduces I/O costs. The client maintains a constant amount of metadata to verify the proof. The challenge/response protocol transmits a small, constant amount of data, which minimizes network communication. Thus, the PDP model for remote data checking supports large data sets in widely-distributed storage systems.We present two provably-secure PDP schemes that are more efficient than previous solutions, even when compared with schemes that achieve weaker guarantees. In particular, the overhead at the server is low (or even constant), as opposed to linear in the size of the data. Experiments using our implementation verify the practicality of PDP and reveal that the performance of PDP is bounded by disk I/O and not by cryptographic computation. Verifying the authenticity of data has emerged as a critical issue in storing data on untrusted servers. It arises in peerto-peer storage systems [29, 35] , network file systems [30, 26] , long-term archives [32] , web-service object stores [48] , and database systems [31] . Such systems prevent storage servers from misrepresenting or modifying data by providing authenticity checks when accessing data.. However, archival storage requires guarantees about the authenticity of data on storage, namely that storage servers possess data. It is insufficient to detect that data have been modified or deleted when accessing the data, because it may be too late to recover lost or damaged data. Archival storage servers retain tremendous amounts of data, little of which are accessed. They also hold data for long periods of time during which there may be exposure to data loss from administration errors as the physical implementation of storage evolves, e.g., backup and restore, data migration to new systems, and changing memberships in peer-to-peer systems.. Archival network storage presents unique performance demands. Given that file data are large and are stored at remote sites, accessing an entire file is expensive in I/O costs to the storage server and in transmitting the file across a network. Reading an entire archive, even periodically, greatly limits the scalability of network stores. (The growth in storage capacity has far outstripped the growth in storage access times and bandwidth [44] ). Furthermore, I/O incurred to establish data possession interferes with on-demand bandwidth to store and retrieve data. We conclude that clients need to be able to verify that a server has retained file data without retrieving the data from the server and without having the server access the entire file.. Previous solutions do not meet these requirements for proving data possession. Some schemes [20] provide a weaker guarantee by enforcing storage complexity: The server has to store an amount of data at least as large as the client's data, but not necessarily the same exact data. Moreover, all previous techniques require the server to access the entire file, which is not feasible when dealing with large amounts of data.. We define a model for provable data possession (PDP) that provides probabilistic proof that a third party stores a file. The model is unique in that it allows the server to access small portions of the file in generating the proof; all other techniques must access the entire file. Within this model, we give the first provably-secure scheme for remote data checking. The client stores a small O(1) amount of metadata to verify the server's proof. Also, the scheme uses O(1) bandwidth 1 . The challenge and the response are each slightly more than 1 Kilobit. We also present a more efficient version of this scheme that proves data possession using a single modular exponentiation at the server, even though it provides a weaker guarantee.. Both schemes use homomorphic verifiable tags. Because of the homomorphic property, tags computed for multiple file blocks can be combined into a single value. The client pre-computes tags for each block of a file and then stores the file and its tags with a server. At a later time, the client can verify that the server possesses the file by generating a random challenge against a randomly selected set of file blocks. Using the queried blocks and their corresponding tags, the server generates a proof of possession. The client is thus convinced of data possession, without actually having to retrieve file blocks.. The efficient PDP scheme is the fundamental construct underlying an archival introspection system that we are developing for the long-term preservation of Astronomy data. We are taking possession of multi-terabyte Astronomy databases at a University library in order to preserve the information long after the research projects and instruments used to collect the data are gone. The database will be replicated at multiple sites. Sites include resource-sharing partners that exchange storage capacity to achieve reliability and scale. As such, the system is subject to freeloading in which partners attempt to use storage resources and contribute none of their own [20] . The location and physical implementation of these replicas are managed independently by each partner and will evolve over time. Partners may even outsource storage to third-party storage server providers [23] . Efficient PDP schemes will ensure that the computational requirements of remote data checking do not unduly burden the remote storage sites.. We implemented our more efficient scheme (E-PDP) and two other remote data checking protocols and evaluated their performance. Experiments show that probabilistic possession guarantees make it practical to verify possession of large data sets. With sampling, E-PDP verifies a 64MB file in about 0.4 seconds as compared to 1.8 seconds without sampling. Further, I/O bounds the performance of E-PDP; it generates proofs as quickly as the disk produces data. Finally, E-PDP is 185 times faster than the previous secure protocol on 768 KB files.. Contributions. In this paper we:. formally define protocols for provable data possession (PDP) that provide probabilistic proof that a third party stores a file. introduce the first provably-secure and practical PDP schemes that guarantee data possession. implement one of our PDP schemes and show experimentally that probabilistic possession guarantees make it practical to verify possession of large data sets.. Our PDP schemes provide data format independence, which is a relevant feature in practical deployments (more details on this in the remarks of Section 4.3), and put no restriction on the number of times the client can challenge the server to prove data possession. Also, a variant of our 1 Storage overhead and network overhead are constant in the size of the file, but depend on the chosen security parameter. main PDP scheme offers public verifiability (described in Section 4.3).. Paper Organization. The rest of the paper is organized as follows. In Section 2, we describe a framework for provable data possession, emphasizing the features and parameters that are relevant for PDP. Section 3 overviews related work. In Section 4, we introduce homomorphic verifiable tags, followed by definitions for PDP schemes and then we give our constructions (S-PDP and E-PDP). We support our theoretical claims with experiments that show the practicality of our schemes in Section 5 and conclude in Section 6. We focused on the problem of verifying if an untrusted server stores a client's data. We introduced a model for provable data possession, in which it is desirable to minimize the file block accesses, the computation on the server, and the client-server communication. Our solutions for PDP fit this model: They incur a low (or even constant) overhead at the server and require a small, constant amount of communication per challenge. Key components of our schemes are the homomorphic verifiable tags. They allow to verify data possession without having access to the actual data file.. Experiments show that our schemes, which offer a probabilistic possession guarantee by sampling the server's storage, make it practical to verify possession of large data sets. Previous schemes that do not allow sampling are not practical when PDP is used to prove possession of large amounts of data. Our experiments show that such schemes also impose a significant I/O and computational burden on the server. Deswarte et al. [17] and Filho et al. [19] provide techniques to verify that a remote server stores a file using RSA-based hash functions. Unlike other hash-based approaches, it allows a client to perform multiple challenges using the same metadata. In this protocol, communication and client storage complexity are both O(1). The limitation of the algorithm lies in the computational complexity at the server, which must exponentiate the entire file, accessing all of the file's blocks. Further, RSA over the entire file is extremely slow -20 seconds per Megabyte for 1024-bit keys on a 3.0 GHz processor [19] . In fact, these limitations led us to study algorithms that allowed for sub-file access (sampling). We implement this protocol for comparison with our PDP scheme and refer to it as B-PDP (basic PDP). A description of B-PDP is provided in the full version of the paper [3] . Shah et al. [42] use a similar technique for third-party auditing of data stored at online service providers and put forth some of the challenges associated with auditing online storage services. Schwarz and Miller [40] propose a scheme that allows a client to verify the storage of m/n erasure-coded data across multiple sites even if sites collude. The data possession guarantee is achieved using a special construct, called an "algebraic signature": A function that fingerprints a block and has the property that the signature of the parity block equals the parity of the signatures of the data blocks. The parameters of the scheme limit its applicability: The file access and computation complexity at the server and the communication complexity are all linear in the number of file blocks (n) per challenge. Additionally, the security of the scheme is not proven and remains in question.. Sebe et al. [41] give a protocol for remote file integrity checking, based on the Diffie-Hellman problem in ZN . The client has to store N bits per block, where N is the size of an RSA modulus, so the total storage on the client is O(n) (which does not conform to our notion of an outsourced storage relationship). Indeed, the authors state that this solution only makes sense if the size of a block is much larger than N . Moreover, the protocol requires the server to access the entire file. Similar techniques were proposed by Yamamoto et al. [47] , in the context of checking data integrity through batch verification of homomorphic hash functions.. Homomorphic hash functions have been used in source authentication, e.g., to verify data transfer in a pay-forbandwidth content distribution network. Krohn et al. [28] provide the best example and give a good review of other applications of homomorphic hashing. They use homomorphism to compose multiple blocks inputs into a single value. However, this protocol can only compose specific subsets of blocks, based on erasure coding. Source authentication techniques do not apply to provable data possession.. Related to provable data possession is the enforcement of storage complexity, which shows that a server retains an amount of information at least as large as the file received from the client; the server does not necessarily retain the original file. To the best of our knowledge, Golle et al. [20] were the first to propose a scheme that enforces storage complexity, based on a new assumption (n-Power Decisional Diffie-Hellman). Their scheme considers a different setting that involves three parties and provides two additional features (binding and concealing) that resemble commitment schemes. Golle et al. also briefly mention a scheme suggested by David Wagner, based on Merkle hash trees, which lowers the computational requirements for the server at the expense of increased communication. We implement Wagner's suggestion for comparison with our PDP scheme and refer to it as MHT-SC. A description of MHT-SC is provided in the full version of the paper [3] .. Oprea et al. [39] propose a scheme based on tweakable block ciphers that allows a client to detect the modification of data blocks by an untrusted server. The scheme does not require additional storage at the server and if the client's data has low entropy then the client only needs to keep a relatively low amount of state. However, verification requires the entire file to be retrieved, which means that the server file access and communication complexity are both linear with the file size per challenge. The scheme is targeted for data retrieval. It is impractical for verifying data possession.. Memory checking protocols [12, 37] verify that all reads and writes to a remote memory behave identically to reads and writes to a local memory. PDP is a restricted form of memory checking in that memory checking verifies every read and write generated from a program at any granularity. Due to this restriction, memory checking is much more difficult and expensive than proving data possession. Related to PDP, Naor and Rothblum introduced the problem of sublinear authentication [37] , verifying that a file stored on a remote server has not been significantly corrupted. They show that the existence of one-way functions is an essential condition for efficient online checking.. Similar to PDP, Juels and Kaliski introduce the notion of proof of retrievability (POR) [25] , which allows a server to convince a client that it can retrieve a file that was previously stored at the server. The main POR scheme uses disguised blocks (called sentinels) hidden among regular file blocks in order to detect data modification by the server. Although comparable in scope with PDP, their POR scheme can only be applied to encrypted files and can handle only a limited number of queries, which has to be fixed a priori. In contrast, our PDP schemes can be applied to (large) public databases (e.g., digital libraries, astronomy/medical/legal repositories, archives, etc.) other than encrypted ones and put no restriction on the number of challenges that can be executed.. An alternative to checking remote storage is to make data resistant to undetectable deletion through entanglement [45, 2] , which encodes data to create dependencies among unrelated data throughout the storage system. Thus, deleting any data reveals itself as it deletes other unrelated data throughout the system.. Our homomorphic verifiable tags are related with the concept of homomorphic signatures introduced by Johnson et al. [24] . As pointed out by the same authors, fully-additive homomorphic signature schemes cannot be secure; our homomorphic verifiable tags are able to achieve a form of message homomorphism under addition because of their special structure that uses one-time indices.. The PDP solutions that we present are the first schemes that securely prove the possession of data on an untrusted server and are computationally efficient, i.e., require a constant number of modular exponentiations and have constant I/O complexity. This makes our PDP solutions the first schemes suitable for implementation in large data systems.

B I I O O O O O O O O B I I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I B O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O


PARTITIONING SEARCH SPACES OF A RANDOMIZED SEARCH ABSTRACT: This work studies the following question: given an instance of the propositional satisfiability problem, a randomized satisfiability solver, and a cluster of n computers, what is the best way to use the computers to solve the instance? Two approaches, simple distribution and search space partitioning as well as their combinations are investigated both analytically and empirically. It is shown that the results depend heavily on the type of the problem (unsatisfiable, satisfiable with few solutions, and satisfiable with many solutions) as well as on how good the search space partitioning function is. In addition, the behavior of a real search space partitioning function is evaluated in the same framework. The results suggest that in practice one should combine the simple distribution and search space partitioning approaches. In this work 1 we develop distributed techniques for solving challenging instances of the propositional satisfiability problem (SAT). We are interested in using the best available SAT solvers as black-box subroutines or with little modification and in this way take advantage of the rapid development of SAT solver technology.. One of the interesting features in current state-of-the-art SAT solvers is that they use randomization and that their run times can vary significantly for a given instance. This opens up new opportunities for developing distributed solving techniques. The most straightforward idea is to employ a simple distribution approach where one just performs a number of independent runs using a randomized solver. This leads to surprising good speed-ups even when used in a grid environment with substantial communication and other delays [9] . The approach could be extended by applying particular restart strategies [13, 12] or using an algorithm portfolio scheme [5, 3] . Another key feature in modern SAT solvers is the use of conflict driven clause learning techniques. This feature can be exploited in the simple distribution approach and it has been shown that combining parallel learning schemes with a simple restart strategy leads to a powerful distributed SAT solving technique [10] .. Another approach to developing parallel SAT solving techniques is based on partitioning the search space to multiple parts which can be handled in parallel. This can be achieved by constraint-based partitioning where the search space for a SAT instance F is split to n derived instances F 1 , . . . , F n by including additional constraints to F. Typical implementation techniques include guiding paths [1, 14, 11] and scattering [8] .. Both simple distribution and partitioning have their strengths. The former has led to surprisingly good performance but for really challenging SAT instances it provides no mechanism for splitting the search to more manageable portions to be treated in parallel. Search space partitioning techniques offer an approach to achieving this. However, the interaction between partitioning and randomized SAT solvers is poorly understood and the work aims to shed new light on this problem. It studies in detail combination of constraintbased partitioning and randomized SAT solvers, and provides an analysis on how an efficient and robust implementation can be achieved.. The rest of the work is structured as follows. Section 2 reviews briefly relevant key characteristics of modern randomized SAT solvers and the simple distribution approach. Section 3 studies analytically the expected run time of a plain partitioning approach where a SAT instance is partitioned and then a randomized SAT solver is used to solve the resulting instances. The section provides fundamental results for two limiting cases, for ideal and void partitioning functions. Section 4 extends the study to a setting where simple distribution and partitioning are mixed. Section 5 provides an implementation of a randomized partitioning function and Section 6 verifies the results briefly using experiments, and conclusions are given in Section 7. q(t) q8(t) Figure 1 : The run time distributions of two instances for single (the q(t) plots) and eight (the q 8 (t) plots) randomized SAT solvers. The paper investigates distributed techniques for solving challenging SAT instances and focuses on combining constraint-based search space partitioning with randomized SAT solving techniques. The paper studies first analytically the expected run time of a plain partitioning approach where a SAT instance is partitioned and then a randomized SAT solver is used to solve the resulting instances. Analytical results are derived for two limiting cases, for ideal and void partitioning functions. The investigation is then extended to a setting where simple distribution and partitioning are mixed. Finally the paper proposes a randomized partitioning function and compares the function against the ideal case.. The analytical results show that partitioning can potentially lead to catastrophic failures where an increase in computing resources leads to a decrease in solving efficiency for unsatisfiable instances. The empirical results show in part that a good implementation is usually able to avoid this failure, but plain partitioning can nevertheless be worse than an approach based on simple distributed SAT solving (SDSAT). Both problems are avoided in practice with safe and repeated partitioning. The experimental and analytical comparisons show an interesting relationship between the safe and repeated partitioning approaches, suggesting that an ideal partitioning function would profit from safe partitioning whereas randomness in the partitioning function can be better exploited with repeated partitioning.

O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Conceptualising and structuring semantics in cooperative enterprise information systems models Enterprise performance is, now more than ever, one of the key points for reaching the market success. In order to increase it, economics paradigms focus on how to better manage knowledge acquiring, sharing and update. Knowledge management can be approached with the possibility offered by the sustainability goals trying to optimise different enterprise strategic domains. The modern architecture of information systems (ISs) is based on distributed networks with a grand challenge of representing and sharing knowledge managed by ISs and consequently, to remove semantics interoperability barriers. First, this paper analyses interoperability issues between cooperative enterprise information systems (CEIS). Based on this analysis, the authors propose a conceptualisation approach for semantics discovery and management in enterprise information systems models, based on applying fact-oriented transformation rules. The input of the transformation process is a conceptualised UML class model, reverse-engineered from an implemented model, and transformed into a fact-oriented model (FOM), which makes explicit the finest-grained semantics. Semantics aggregates are then computed for structuring the whole semantics embedded in enterprise applications. They define independent set of concepts with their own minimal mandatory semantics. Finally a case study is proposed to validate the practicability of our approach in a real scaled scenario involving an enterprise resource planning (ERP) and a manufacturing execution system (MES). In this paper, we proposed a conceptualisation approach for enacting implicit semantics embedded into Enterprise Information System models by a deep analysis of existing data models enriched by users' and experts' knowledge. This approach is composed of 3 steps, staging from the traditional database reverse engineering process, through a knowledge elicitation and model enrichment by domain experts, to the application of formal fact-oriented modelling rules for externalising tacit semantics. Moreover, in order to structure the whole semantics into independent aggregates that may emphasize subsystems, we defined the concept of semantic block (SB) and we developed an automatized procedure to compute these SBs. The resulting semantics architecture allows the identification of semantically selfcontained subsystems, facilitating further interoperation analysis, knowledge discovery capabilities and systems adaptations for enhancing sustainability. The conceptualisation and structuring processes have been validated on a case study involving two industrial Enterprise. Applications, demonstrating the applicability of our approach. This approach contributes to the sustainability aspects of the information systems management. In fact, it aims at extracting, formalizing and using the tacit knowledge for facilitating the maintenance of the interoperability between enterprises when major changes occur.. Further works concern using the resulting semantic conceptual model and architecture for facilitating the assessment of the (non)-interoperation barriers between Enterprise Information Systems or some of their subsystems (identified, for instance, by the semantic blocks). The resulting analysis, based on an interoperability measures map, can help information technology consulting companies for parameterising and integrating enterprise applications (ERP, MES…) taking into account interoperability constraints. Applying the whole process for conceptualising and structuring the semantics to the Sage X3. and Flexnet applications, we obtain, for each application:.  one normalised conceptual model that embeds the whole semantics (coming directly from the data schema and enriched by expert knowledge injection) and  one structuration of this semantics through the semantic blocks that emphasizes the dependencies between concepts and that highlights independent semantics aggregates.. These simplified semantic models allow a better understanding of each application's functionalities. An engineer can then focus on specific semantically independent components (i.e. the semantic blocks) of these applications when analysing their interoperation capabilities. When defining what information has to be exchanged, the semantic block allows defining priorities related to the complexity of the model or to some initial requirements. As an example, when dealing with manufacturing orders in Sage X3 application, the semantic block ; contains all the concepts that are mandatory for Sage X3 to operate correctly and thus defines the interoperability requirements when such information is picked up from another application. Those models are normalised, that means that they do not contain any modelling patterns introduced by some modellers' practices. Thus, they can be directly used by some engineers or automatized tools without any ambiguity in their interpretation.. The work presented in this paper contributes to new research dimensions related to sustainable interoperability by facilitating knowledge conceptualisation and structuration into a set of discovered semantic blocks, thus improving learning capacity to better take into account changes when adaptation is required. Moreover, this structured model allows deeply analysing interoperability requirements and thus specifying in which way a network node should react in order to enable the system, as well as the entire network, to evolve for the better sustainable interoperable state.. However, we can draw some limits of our approach. One major assumption is necessary for the approach to be practical: the application must expose its implemented data schema and experts are assumed to be able to update the conceptual model with the many constraints and practices that are not implicitly expressed in the schema. Moreover, the size of a real application schema is so huge (more than 800 tables and 600 relationships for Sage X3) that this semi-automatically implemented approach remains complex to apply due to the necessary implication of one expert.

O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O B I I O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Refactoring OCL annotated UML class diagrams Abstract Refactoring of UML class diagrams is an emerging research topic and heavily inspired by refactoring of program code written in object-oriented implementation languages. Current class diagram refactoring techniques concentrate on the diagrammatic part but neglect OCL constraints that might become syntactically incorrect by changing the underlying class diagram. This paper formalizes the most important refactoring rules for class diagrams and classifies them with respect to their impact on attached OCL constraints. For refactoring rules that have an impact on OCL constraints, we formalize the necessary changes of the attached constraints. Our refactoring rules are specified in a graph-grammar inspired formalism. They have been implemented as QVT transformation rules. We finally discuss for our refactoring rules the problem of syntax preservation and show, by using the KeY-system, how this can be resolved. Together Architect 2006 for Eclipse implements a large body of the QVT standard. 4 The implemented version of the transformation rules looks at the first glance quite different from what was specified in graphical form in Sect. 3. There are obvious changes on the notational level -Together Architect 2006 supports so far only the textual notation of QVT -but, in general, we made the experience that implementing the 4 A list of missing features not implemented yet is shipped with Together.. refactoring rules in Together Architect 2006 for Eclipse is a straightforward and -thanks to Together's matured editor and debugger for OCL -also a painless task.. Before we describe in more details the transition from a refactoring rule given in graphical notation to an implementation in textual QVT, let us recall the steps to follow when applying a rule on a concrete source model. These steps are Note that, theoretically, it could be the case that the rewriting step 2 adds a new LHS-matching substructure that has not been present in the original source model. For the refactoring rules we specified in this paper, however, this case does not occur. Please note that each refactoring rule is invoked separately by the user. This is an important difference to other rewrite systems where a model is transformed by a concurrent application of multiple transformation rules. The major obstacle to implement our graphical rules directly in textual QVT is the lack of a pattern-matching mechanism in textual QVT, which would allow to find all substructures of a source model that match with LHS (step 1). The basic entity in QVT to describe a transformation is a mapping that works on a certain domain. A mapping can call sub-mappings or queries; the latter are implemented by a sequence of OCL expressions. Mappings are written in a dialect of OCL, called Imperative OCL. This dialect is no longer side-effect free and adds to standard OCL two facilities, assignment (:=) and object creation (object ... ), for the manipulation of data structures.. The main application scenario for QVT is the description of transformations in which source and target model are instances of different metamodels. When working in this mode, the QVT mapping traverses the source model, normally by calling sub-mappings, and creates successively the target model. In our refactoring scenario, however, we have the special case that the metamodels for source and target model coincide. Moreover, the source and target model themselves coincide except at some locations where substructures have been refactored. QVT supports this special scenario by inout-variables which represent both the source and the target of a mapping. Within the mapping, it is only possible to change those parts of the data structure to which the inout-variables refer. All other, untouched, parts of the data structure will then be copied automatically from the source to the target model.. The general approach to implement our refactoring rules is as follows. A mapping implements a traversal through the source model in order to find all substructures that match with LHS. Fortunately, due to the simple structure of used LHS patterns, this task is easily programmed manually and does not require to apply sophisticated search algorithms. Then, for each matching substructure, a sub-mapping is invoked that realizes the rewriting step accordingly to RHS. Figure 32 shows the application of a QVT transformation on a concrete UML/OCL source model in our tool RoclET, 5 into which the implementation of refactoring rules has been integrated. The encoding of the graphical refactoring rules as given in Sect. 3 into textual QVT is straightforward. We have used for all refactoring rules the same structure as for rule ExtractClassUML. The main difference between graphical and implemented version is that the search for an LHS-match had to be realized by a concrete algorithm. This algorithm, however, is trivial for refactoring rules because the elements from the source model that are affected by the refactoring rule are always passed as parameters. This trait of refactoring rules minimizes the effort to search for the right location in the source model that matches with the LHS of the rule.. Encoding the RHS in textual QVT is straightforward as well; one has just to change the relevant properties of the elements identified by RHS. Please note that the implementation of RHS has only an influence on the current location and does not change anything else in the rest of the model. The refactorings considered in this paper realize a special form of model synchronization: a change in a UML class diagram should trigger an automatic update of attached OCL constraints. A minimal requirement for a refactoring rule is that a refactoring step does not destroy the syntactic correctness of the manipulated UML/OCL model. Ideally, the semantics of the model remains unchanged as well.. In this paper, five groups of refactoring rules (Rename, PullUp, PushDown, Extract, Move) are investigated and classified with respect to their influence on attached OCL constraints. Only Move-refactorings require to update attached OCL constraints but the applicability of PullUp-and PushDown-refactorings depends on the absence of certain OCL constraints. The rules targeting attributes are generally less complex than the rules for operations and association ends.. We formalized all refactoring rules in form of QVT model transformations that are based on graph-transformations. This formalization allows a precise argumentation that the refactoring rules preserve the syntax and the semantics of the models they are applied on. Syntax preservation is formally shown for one example in Sect. 5. Semantics preservation was not in the scope of this paper but has been discussed in [4] .. The understandability of graphical QVT rules depends, most likely, on the degree of familiarity with the underlying metamodel and on personal preferences. The experiences we gained when writing up and discussing multiple versions of the refactoring rules presented in Sect. 3 let us conclude that graph-transformation systems are a excellent choice for the formalization of refactoring rules. The readability of our rules can, however, be even improved for persons who are only vaguely familiar with the metamodel for UML/OCL. As shown in [5] , this can be achieved by defining a concrete syntax for refactoring rules. This concrete syntax can hide many internals of the UML/OCL metamodel from the reader, but keeps the expressive power of ordinary QVT rules.. All rules presented in this paper have been fully implemented in the tool RoclET, a versatile tool for the development and analysis of OCL specifications. RoclET's refactoring functionality takes from the user the burden to correct manually all OCL constraints that became syntactically incorrect when the underlying UML diagram has been refactored. We see this as a necessary pre-condition to pull up agile techniques, which became quite popular over the recent years on the implementation level, also to the modeling level.

B O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Regression based D-optimality experimental design for sparse kernel density estimation This paper derives an efficient algorithm for constructing sparse kernel density (SKD) estimates. The algorithm first selects a very small subset of significant kernels using an orthogonal forward regression (OFR) procedure based on the D-optimality experimental design criterion. The weights of the resulting sparse kernel model are then calculated using a modified multiplicative nonnegative quadratic programming algorithm. Unlike most of the SKD estimators, the proposed D-optimality regression approach is an unsupervised construction algorithm and it does not require an empirical desired response for the kernel selection task. The strength of the D-optimality OFR is owing to the fact that the algorithm automatically selects a small subset of the most significant kernels related to the largest eigenvalues of the kernel design matrix, which counts for the most energy of the kernel training data, and this also guarantees the most accurate kernel weight estimate. The proposed method is also computationally attractive, in comparison with many existing SKD construction algorithms. Extensive numerical investigation demonstrates the ability of this regression-based approach to efficiently construct a very sparse kernel density estimate with excellent test accuracy, and our results show that the proposed method compares favourably with other existing sparse methods, in terms of test accuracy, model sparsity and complexity, for constructing kernel density estimates. The problem of estimating probability density functions (PDFs) is of fundamental importance to all fields of engineering [1] [2] [3] [4] [5] [6] . A powerful approach for density estimation is the finite mixture model (FMM) [7] . If the number of mixture components in the FMM is known, the problem is reduced to determine the FMM's parameters, and the maximum likelihood (ML) estimate of these parameters can be obtained using the expectation-maximisation (EM) algorithm [8] . The associated ML optimisation, in general, is a highly nonlinear optimisation process requiring extensive computation but for the Gaussian mixture model (GMM), the EM algorithm can be derived in an explicit and simple iterative form [9] . However, this ML estimation is well-known to be illposed and, in order to tackle the associated numerical difficulties, it is often required to apply resampling techniques such as the bootstrap [10, 11] or other Bayesian methods [12, 13] . In general, the correct number of mixture components is unknown, and simultaneously determining the required number of mixture components as well as estimating the associated parameters of the FMM is a challenging problem.. Alternatively, non-parametric techniques, which do not assume a particular functional form for PDF, are widely used in practical applications for density estimation. The classical Parzen window (PW) estimate [14] , a well-known non-parametric density estimation technique, is remarkably simple and accurate. As the PW estimate, also known as the kernel density (KD) estimate, employs the full data sample set in defining density estimate for subsequent observation, its computational cost for testing scales directly with the sample size. In today's data rich environment, this may become a practical difficulty in employing the PW estimator. It also motivates the research on the sparse KD (SKD) estimation techniques. Various SKD estimation techniques can be divided into the two approaches.. The first class of SKD estimators starts with the full training data sample set as the kernel set and it then attempts to make as many kernel weights to near zero values as possible based on some chosen criteria. The corresponding kernels related to these very small kernel weights can then be removed from the kernel estimate, leading to a sparse representation. This class of SKD estimators include the support vector machine (SVM) based SKD estimation technique [15] [16] [17] and the related SKD estimator in reproducing kernel space [18] as well as the SKD estimation technique proposed in [19] , which is known as the reduced set density estimator (RSDE). The RSDE [19] is a typical representative of this first class of SKD estimation technique, which is said to be based on minimisation of the integrated squared error (ISE) between the unknown underlying density and the KD estimate, calculated on the training set. A close examination of this training based ISE criterion reveals that it is equivalent to the training based ISE between the KD estimator and the PW estimator. An efficient D-optimality based construction algorithm has been proposed for obtaining SKD estimates. A very small subset of significant kernels are first selected using the OFR procedure based on the D-optimality criterion. The associated kernel weights are then calculated using a modified version of the MNQP algorithm, which can further reduce the kernel model size by making some of the kernel weights to zero. The proposed method possesses a highly desired optimal sparsity property owing to the ability of the D-optimality based OFR algorithm to automatically identify a very small subset of the most significant kernels related to the largest eigenvalues of the kernel matrix, which counts for the most energy of the kernel training data. As a consequence of this optimal property, the subset kernel weight vector estimate is guaranteed to be the most accurate estimate. Furthermore, the proposed method is simple to implement and computationally efficient in comparison with other existing SKD estimation methods. The experimental results obtained have demonstrated that the proposed method compares favourably with other existing sparse kernel density estimation methods, in terms of test accuracy and sparsity of the estimate as well as complexity of density estimation process. Thus it provides a viable alternative to these existing state-of-the-art methods for constructing sparse kernel density estimates in practical applications.. Recently, research effort has also been directed to construct the RBF network or kernel model with tunable nodes [41] [42] [43] [44] [45] [46] [47] . In particular, the work [48] has investigated the application of the tunable RBF network to the PDF estimation. Further work is warranted to compare the proposed efficient sparse fixed-kernel density estimation approach with the nonlinear optimisation aided tunable-kernel density estimation method of [48] . Table 6 Performance of the PW estimator, previous SKD estimator [24] , proposed SKD estimator, RSDE estimator [19] and GMM estimator for the six-dimensional example of three-Gaussian mixture over 100 runs.

O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Tackling component interoperability in quantum chemistry software The Common Component Architecture (CCA) offers an environment that allows scientific packages to dynamically interact with each other through components. Conceptually, a computation can be constructed with plugand-play components from any componentized scientific package; however, providing such plug-and-play components from scientific packages requires more than componentizing functions/subroutines of interest, especially for large-scale scientific packages with a long development history. In this paper, we present our efforts to construct components for the integral evaluation -a fundamental sub-problem of quantum chemistry computations -that conform to the CCA specification. The goal is to enable fine-grained interoperability between three quantum chemistry packages, GAMESS, NWChem, and MPQC, via CCA integral components. The structures of these packages are quite different and require different approaches to construct and exploit CCA components. We focus on one of the three packages, GAMESS, delineating the structure of the integral computation in GAMESS, followed by our approaches to its component development. Then we use GAMESS as the driver to interoperate with integral components from another package, MPQC, and discuss the possible solutions for interoperability problems along with preliminary results. The advance of component technologies in high performance computing offers an opportunity for scientific packages to dynamically interact with each other without manually dumping files, converting data formats or painstakingly coupling codes on a case-by-case basis. With the Common Component Architecture (CCA) [1, 2] , scientists are able to construct new computations or improve the performance of their software by using components provided by other research groups through well-defined interfaces. This potential of interoperability encourages application scientists from different scientific domains to explore mechanisms to couple existing packages that offer different computing capabilities.. The standards of CCA are defined by the CCA Forum [2] , a group of scientists from different national laboratories and academic institutes who are researchers in the high performance computing community. The language interoperability of CCA is enabled by Babel [3] , a tool for solving the interoperability of components that are implemented in different programming languages such as FORTRAN, C, C++, Python, and Java. Babel relies on the Scientific Interface Definition Language (SIDL) for defining interfaces for scientific components.. Quantum chemistry is one of the scientific disciplines that are actively involved in exploring the interoperability capability offered by CCA. The complexity in quantum chemistry computations results in a large number of noncommercial packages developed by research laboratories and universities (The General Atomic and Molecular Electronic Structure System -GAMESS [4] , Massively Parallel Quantum Chemistry -MPQC [5] , and NWChem [6] are three major quantum chemistry packages from DOE and DOD), each with unique capabilities and deficiencies. The development of a new method usually requires doctoral level researchers and is very timeconsuming; it is thus an important task to integrate capabilities of different packages to enable new computations that are not possible with any single package.. of quantum chemistry packages, efforts for their componentization cannot be accomplished by any single research group. Scientists must join together to define a set of standardized interfaces and data structures for computations of interest, and then packages can be componentized accordingly.. Even with the standardized interfaces defined, componentizing a package with a long development history poses a big challenge, which must be conquered before enabling interoperability between packages. While componentizing quantum chemistry packages on a coarsegrain level was conducted in previous studies [7, 8] , another important and useful approach for the quantum chemistry community is to componentize low-level computations such as molecular integral evaluations.. In this paper we detail the process of componentizing the integral computation in GAMESS, with discussion of the difficulties we encountered and preliminary results. With the initial interoperability accomplished, two future research avenues open up: constructing more complex computations and Computational Quality of Service (CQoS) [9] in quantum chemistry. In this paper, we present our experience in developing CCA components based on a large-scale quantum chemistry package. The process of componentizing integral computation is delineated in detail and issues of interoperability are discussed. This will provide application scientists a perspective about the problems they may be facing when componentizing their packages to explore interoperation with other software. We are extending our experiments to integrate GAMESS and NWChem at the fine-grained level and also build a complete chemistry computation, such as calculating the energy, by using any two of the three chemistry packages through the CCA interfaces.. Based on our experience, community-agreed interfaces and data standards provide only the first step to componentization of a package; substantial efforts are needed to improve the usability of components, control versions of the underlying software, minimize overhead caused by extra layers of function calling, and standardize testing procedures to efficiently explore the errors in coupling many software packages. Componentizing a large-scale legacy software package is an especially challenging task. In other words, comprehensive scientific software engineering is essential in developing components that are truly shareable between scientific packages.

O O B O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O


Using a Delphi process and the Analytic Hierarchy Process (AHP) to evaluate the complexity of projects Ludovic-Alexandre Vidal, Franck Marle, Jean-Claude Bocquet. Using a Delphi process and the Analytic Hierarchy Process (AHP) to evaluate the complexity of projects. Expert Systems with Applications, Elsevier, 2011, 10.1016/j.eswa.2010 -1 - Project complexity is ever growing and needs to be understood, analysed and measured better to assist modern project management. The overall ambition of this paper is therefore to define a measure of project complexity in order to assist decision-making, notably when analysing several projects in a portfolio, or when studying different areas of a project. A synthesised literature review on existing complexity measures is firstly proposed in order to highlight their limitations.Then, we identify the multiple aspects of project complexity thanks to the construction and refinement of a project complexity framework thanks to an international Delphi study. We then propose a multi-criteria approach to project complexity evaluation, underlining the benefits of such an approach. In order to solve properly this multi-criteria problem, we first conduct a critical state of the art on multi-criteria methodologies. We then argue for the use of the Analytic Hierarchy Process. In the end, this tool permits to define a relative project complexity measure, which can notably assist decision-making. Complexity scales and subscales are defined in order to highlight the most complex alternatives and their principal sources of complexity within the set of criteria and sub-criteria which exist in the hierarchical structure. Finally, a case study within a start-up firm in the entertainment industry (musicals production) is performed. Conclusions, limitations and perspectives of research are given in the end. A project is a temporary and unique endeavour undertaken to deliver a result. This result is always a change in the organization, whatever it is in its processes, performance, products or services. This transformation consists then in a gap between a start and a final state. Time and resources are consumed to produce results, which may be deliverables and/or performance improvement and/or resource improvement (skills, knowledge). Each project is unique because there is always at least one of the following parameters that changes: targets, resources and environment. As projects became more and more present into organizations, and as they had bigger and bigger amounts at stake, it became impossible to let them live without specific and rigorous methodology. As a consequence, project management was created as a formalized and structured methodology. It is usually admitted than modern project management appeared during World War II and was initially dedicated to big military and construction projects.. For all practical purposes, lots of studies have been done, based on statistical calculations or surveys. Limits and lacks have been detected in research as well as in industry about the project predictability, since usual parameters (time, cost and quality) are clearly not sufficient to describe properly the complete situation at a given time. As a whole, the conclusion of these studies is that current methods have shown their limits, since they cannot face anymore the stakes of ever growing project complexity. For instance, as noted during discussions with consulting practitioners, in the case of oil industry, it is clear that engineering projects today are larger, involve more sophisticated technology and are organised with a higher number of contractors and partners compared to 40 years ago. As a whole, project complexity results in damages or failures for the projects. In other words, project ever growing complexity is an ever growing source of project risks.. Identifying existing project complexity sources and levels of project complexity has thus become a crucial issue in order to assist modern project management. After a review of the literature on project complexity in part 2, this paper aims at proposing an innovative measure of project complexity which incorporates the multiple aspects of this project characteristic. In order to do so, a methodology is exposed in part 3 and followed in the next paragraphs. Conclusions and research perspectives about this issue are finally given in part 9.. 2. Measuring project complexity: a literature review 2.1. Existing project complexity measures Several authors tried to define complexity measures in order to explain project failures, to identify intricate situations, to understand better project complex phenomena and to help decision-making. Indeed, such a measure is notably to assist decision-makers before engaging their projects / portfolios into too complex situations since too early decisions when facing complex and uncertain situations often fail to deliver the targeted performance.. But before choosing a suitable project complexity measure, one must be able to define a list of criteria that can be used to assess if it is good or not. Latva-Koivisto (Latva-Koivisto, 2001) proposes a first list in a research report which includes parameters such as reliability, ease of implementation and intuitiveness for instance. As far as this research work is concerned, a literature review on existing project complexity measures (or complexity measures which could be adapted to project management) was performed.. A focus was made on project complexity in terms of project systemic complexity, and not of algorithmic complexity when solving some issues about project management, such as the sequencing and scheduling problem (Akileswaran and al., 1983) . The works of Edmonds (Edmonds, 1999) , Latva-Koivisto (Latva-Koivisto, 2001 ) and Nassar and Hegab (Nassar and Hegab, 2006) were crucial sources to generate this list of about fourty complexity measure indicators. For instance, in his Ph.D. thesis, Edmonds (Edmonds, 1999) identified formulations and measures of complexity, working on a large scope of fields and applications. As for him, Latva-Koivisto (Latva-Koivisto, 2001 ) reviewed complexity measures to assess the structural complexity of business processes. He argued that the complexity of business processes could be assessed through the conversion of process charts (composed of activities, dependencies, information flows, material flows and control flows) to graphs, giving the example of the resourceconstrained project scheduling problem. If interested, one should directly refer to these three references for more information on complexity measures and formulations. Then, the obtained list of possible complexity measures was refined thanks to the previously introduced criteria. Four specific complexity measures are given here since among the most appropriate ones for a use in project management. We carried out our research thanks to interviews of some possible future project team members (5 participants) following the AHP evaluation process, given our hierarchical structure. These people were asked to perform an a priori ranking of the projects in terms of complexity. This a priori ranking was necessary to highlight the possible differences between their initial perception and the results obtained. Then, as mentioned before, specific advanced Saaty scales were elaborated with the interviewees in order to perform pairwise comparisons with less subjectivity.. For instance, if we note NS(i) the number of stakeholders for a given project i, the advance Saaty scale built in this case for the number of stakeholders criterion was the following (Figure 14) .. Building up such advanced scales permit greater consensus when performing the study in group and facilitates communication on the results of the study when performed by a single user. The methodology and measure proposed in this research work proved to be helpful in this case study. First, as shown in Figure 15 , a first table is to be built to analyse the situation of the firm regarding project complexity. The relative weight of each sub-criterion can be evaluated, which. gives information on where projects are likely to be more complex within the firm. Project managers should pay particular attention to the project complexity factors which get the best relative score (last column in figure 15 ). On the contrary, some aspects of project complexity (low scores) may potentially be neglected at a first sight. This piece of information thus permits one to concentrate more efficiently on the principal factors of project complexity under a given firm and project environment. As said before, we left the users the possibility to follow the entire AHP process, meaning that the relative weights of each criterion and sub-criteria obtained thanks to the Delphi study were not given to the users. For instance, as shown on Figure 16 , project interdependencies notably appear as the greatest source of global project complexity, since they globally account for more than 55% of the final sum score of the project in our evaluation. First, the existence of a numerical relative evaluation of project complexity within a project portfolio appears to be promising since it permits to know which projects are to be the most complex ones, but also how complex projects are. Future research works are carried out to set out a methodology which could define a threshold value (in the context of the studied project portfolio) over which projects could be rejected (notably given the experience and project maturity of the firm). Moreover, this global ranking according to the relative project complexity index we propose is all the more interesting in this case study since the employees who were interviewed had made an a priori ranking which was different. In that a priori ranking, P3 was ranked second and P7

O O B I O O B I I I O O O B O O O O O O O O O O B I O O B I I I O O O B O O O O O O O O O O O B B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O B O O O O O O B O O O O O O O O O O O O O O O O B B O O O O O O O O B B O O O O O O O O O O O B O O B B B O O O O O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O B O O B O O O O O O B O O O B B O O O O B B O O O O O O O O O O O B O O O O O O O O B B O O O O O O O O O O O O B B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O B B O O O O O O B O O O O O B O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O B O O O O O O B O O O O O O O O B B O O O B O B O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B O O O O O O O O O B O O O O O O O O O O O B O O O O O O O O O O O O O O B O O O O O O O O O O O O O B O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O B B O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O B B O O O O O O O O O O O O O O O B O O B O O O O O O O B O B B O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O