Balancing Bounded Treewidth Circuits Algorithmic tools for graphs of small treewidth are used to address questions in complexity theory. For both arithmetic and Boolean circuits, it is shown that any circuit of size n O(1) and treewidth O(log i n) can be simulated by a circuit of width O(log i+1 n) and size n c , where c = O(1), if i = 0, and c = O(log log n) otherwise. For our main construction, we prove that multiplicatively disjoint arithmetic circuits of size n O(1) and treewidth k can be simulated by bounded fan-in arithmetic formulas of depth O(k 2 log n). From this we derive the analogous statement for syntactically multilinear arithmetic circuits, which strengthens the central theorem of [MR08] . As another application, we derive that constant width arithmetic circuits of size n O(1) can be balanced to depth O(log n), provided certain restrictions are made on the use of iterated multiplication. Also from our main construction, we derive that Boolean bounded fan-in circuits of size n O(1) and treewidth k can be simulated by bounded fan-in formulas of depth O(k 2 log n). This strengthens in the non-uniform setting the known inclusion that SC 0 ⊆ NC 1 . Finally, we apply our construction to show that reachability for directed graphs of bounded treewidth is in LogDCFL. It is well-known that many hard graph theoretical problems become tractable when restricted to graphs of bounded treewidth 1 . If a graph with n nodes has bounded treewidth, there always exists a balanced tree decomposition of depth O(log n). This yields NC-algorithms for many problems, which are known to be NP-complete in general [Bod89] .. Consider the following question. Suppose one is given a circuit (Boolean or arithmetic) of size s and bounded fan-in, for which the underlying graph has bounded treewidth. Does this imply, as intuition might suggest, there must exist an equivalent bounded fan-in circuit of size poly(s) and depth O(log s) ? We show that in the Boolean case the situation is as expected, which yields the following theorem: Theorem 1.1 The class of languages accepted by non-uniform constant fan-in circuits of polynomial size and bounded treewidth equals non-uniform NC 1 .. Due to a celebrated result of Barrington [Bar86] , it is known that NC 1 can be simulated by constant width branching programs, which are skew circuits of constant width. A con-stant width circuit can be evaluated using O(1) memory, and hence SC 0 = NC 1 (SC 0 is the class of Boolean functions computable by constant width circuits of poly size, c.f. [Mah07] ). Theorem 1.1 strengthens this statement in the non-uniform setting.. For arithmetic circuits, the short answer is that the equivalent circuit need not exist: a depth O(log s) circuit of bounded fan-in computes a polynomial of degree s O(1) , but using repeated multiplication a bounded treewidth circuit of size s can easily compute a polynomial of degree 2 s . We rephrase the question to avoid this triviality.. The class of families of polynomials {p n } n≥1 of polynomial degree with polynomial size arithmetic circuits is known as VP (See e.g. [BCS97] ). Let VP[tw = O(log i n)] stand for the class corresponding to polynomial size circuits of treewidth O(log i n), and let VNC 1 denote the class corresponding to bounded fan-in arithmetic circuits of depth O(log n). Our question becomes the following: is VP[tw = O(1)] ⊆ VNC 1 ? The above question remains to be wide open. Here, we show that multiplicatively disjoint 2 circuits of size n O(1) and bounded treewidth can be simulated by bounded fan-in formulas of depth O(log n). In our notation this is stated as follows: From this, we derive the analogous statement for syntactically multilinear circuits. The resulting formulas will be syntactically multilinear (denoted with the prefix sm-) as well. This implies the lower bounds by Raz [Raz04] hold all the way up to syntactically multilinear bounded treewidth circuits. We prove Above theorems shed some light on issues regarding bounded width circuits. One has the hierarchy of classes {VSC i } i≥0 , where VSC i corresponds to arithmetic circuits of width O(log i n) and size n O(1) , for i ≥ 0. We prove the following (and the Boolean analogue):. Theorem 1.4. 2. VSC i ⊆ VP[tw = O(log i n)] ⊆ VSC i+1 [size = n O(log log n) ], for any i ≥ 1.. Arithmetic circuit width is a fundamental notion, but it is still ill-understood in its relation to other resources. Recently, it has gained renewed attention from several researchers. It more or less embodies a notion of space in the arithmetic setting (See [MR09] ). Mahajan and Rao [MR08] study the class VSC 0 [deg = n O(1) ], which is obtained from VSC 0 by requiring formal degrees of circuits to be n O(1) . Arvind, Joglekar, and Srinivasan [AJS09] give lower bounds for monotone arithmetic circuits of constant width. Theorem 1.3 strengthens the main result of Mahajan and Rao [MR08] , which states that poly size syntactically multilinear circuits of constant width can be simulated by poly size circuits of log depth (but it was explicitly left open whether the latter could be ensured to be syntactically multilinear). Theorem 1.2 strengthens Theorem 4 in [JR09] , which states that md-VSC 0 = VNC 1 .

O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Visual Exploration across Biomedical Databases Abstract-Though biomedical research often draws on knowledge from a wide variety of fields, few visualization methods for biomedical data incorporate meaningful cross-database exploration. A new approach is offered for visualizing and exploring a querybased subset of multiple heterogeneous biomedical databases. Databases are modeled as an entity-relation graph containing nodes (database records) and links (relationships between records). Users specify a keyword search string to retrieve an initial set of nodes, and then explore intra-and interdatabase links. Results are visualized with user-defined semantic substrates to take advantage of the rich set of attributes usually present in biomedical data. Comments from domain experts indicate that this visualization method is potentially advantageous for biomedical knowledge exploration. T HE amount of publicly available biomedical data has ballooned in the past several years with ever-improving technology and computational methods. In addition to increased digitization of biomedical publications, improved text mining and natural language processing techniques allow for the extraction of thousands of unique relationships from biomedical text collections. This vast quantity of biomedical data presents a unique domain-specific challenge for interface designers: what are appropriate design choices that will help knowledge discovery and exploration within the biomedical domain?. To ground our discussion, we focus on one of the most important and largest collections of biomedical data freely available on the Internet, that of the National Center for Biotechnology Information (NCBI). The NCBI maintains over 30 public databases containing biomedical information of various types, such as published medical documents (PubMed), gene listings (Entrez Gene), protein listings (Entrez Protein), and DNA sequence information (Entrez Sequence). It also stores and manages pairwise associations between records in the databases according to the various types of content. For example, a particular document d listed in PubMed might be associated with all genes G from Entrez Gene that are mentioned in d. d may also have associations with other PubMed documents that cite d as a reference, as well as associations to the PubMed documents that d itself cites. Furthermore, each gene g 2 G could have associations with the proteins for which g codes, or the DNA sequences in which g's code appears. Usually, the various types of records in these databases also have many attributes associated with them. For example, PubMed documents might be annotated with the date of publication, authors, and general topics, while gene records could be annotated with the relevant species, location on chromosome, or function. This rich space of record attributes is key in aiding understanding of the data.. Given the huge amount of data at NCBI, and the large number of databases, myriad variations of these associations are possible. To organize these data in a way useful for knowledge exploration, note that NCBI's multiple databases can be abstracted as a massive entity-relation graph. In this graph, nodes correspond to individual knowledge points or database records, such as documents, genes, proteins, and other object types. Associations between database objects can then be modeled as directed or undirected links in the graph, connecting related nodes. The entity-graph model has already been applied to various document collections, including some in the biomedical domain, and much research has dealt with providing a broad overview of research publications and trends by visualizing the graph, typically using a force-directed node layout scheme [19] , or other schemes such as circular [13] , matrix-based [7] , hierarchical [17] , [37] , [39] , or layered [12] , [35] , [46] node layouts. These types of top-down visualizations simplify the identification of concepts like research fronts [3] , [15] .. However, our motivation lies not in discovering overall trends, but rather in accomplishing the everyday technical tasks of knowledge exploration and discovery undertaken by biomedical scientists and researchers. Scientists researching a particular gene, protein, or topic want to find specific and relevant information that will aid in their research. As a result, when using NCBI's databases, they begin with a specific query or set of queries, and explore outward from the initial query result. They might also cross-reference records from multiple databases. Our visualization tools are designed to aid this query-specific exploration.. Even though the NCBI databases form an implicit entityrelation graph, the NCBI's current web interfaces offer no option to explore multiple areas of the graph simultaneously. Researchers explore the NCBI databases by retrieving a single page of information at a time, essentially limiting them to viewing a single node at a time. They must continuously click forward and backward to retrieve additional information from other NCBI databases. However, based on our interactions with biomedical domain experts and the kinds of exploratory tasks they undertake, we believe that explicitly viewing and exploring multiple nodes in parallel will lead to improved performance in exploration and discovery tasks. We provide a data collector for the NCBI databases that enables this exploration by initially retrieving a query-based subset of nodes from one or multiple NCBI databases. Users then specify a query tree that defines a data retrieval path between databases. For example, users interested in the role of genetics in alcoholism could use the data collector to perform a document keyword search for "alcoholism" within medical literature and disease databases, and retrieve links from the resulting heterogeneous set of nodes to gene records in another database.. To make use of the typically rich attribute space of biomedical data, we display graph nodes and links using a visualization technique known as user-defined semantic substrates [2] , [42] , as implemented in the Network Visualization by Semantic Substrates (NVSS) tool. Fig. 1a shows one such visualization of a query about "cervical cancer" across three NCBI databases. Unlike force-directed layouts, semantic substrates rely mainly on node attributes for meaningful and regular node placement into userdefined regions. These regions allow users to attach specific semantics to node positions on-screen, and enable a simple filtering paradigm based on node position. In contrast to other methods, semantic substrates offer expert users finegrained control over the placement of nodes and their spatial meaning. Furthermore, different node layouts can be effected by simply designing additional substrates, allowing various views of the same data, and possibly leading to different insights about the data. Semantic substrates are thus especially suited to the display of biomedical data, and represent a drastic improvement over force-directed layouts used in similar situations, such as that in Fig. 1b , as well as other node layout strategies. We used the NVSS tool to visualize the results of several queries in NCBI's biomedical databases. On reviewing our work, domain experts indicated that it shows a strong potential toward biomedical visualization applications.. The paper proceeds as follows: Section 2 contains a survey of related work in network visualization and its applications within the biomedical domain. Next, Section 3 describes the data collection process, including our data model and data collector design. In Section 4, the concept of semantic substrates is further elaborated upon, and the controls and methodology of designing and visualizing semantic substrates are introduced. Section 5 provides several visualizations of sample queries that demonstrate the power and breadth of semantic substrates in crossdatabase exploration, while Section 6 contains an evaluation of our visualization methods by domain experts. Finally, Section 7 outlines further avenues of improvement and concluding remarks. Parting from textual query result lists like those at NCBI's website, semantic substrates offer a novel way to browse and explore biomedical data across multiple databases. This browsing would be further enhanced by incorporating dynamic query retrieval of nodes and links and the subsequent visualization of results within appropriate substrate regions. Furthermore, new methods would have to be developed for visualizing the number of results, and determining and displaying the most interesting or relevant results. Navigating through the various sets of query results, in a manner analogous to a web browser's forward and back buttons, also poses a challenge. One way to incorporate query navigation might be to navigate using a tree, in the same way that our data collector uses a query tree. However, instead of nodes corresponding to databases, nodes of this navigation tree would correspond to substrates in the navigation history, similar to the history mechanism used for VisPad [43] . When a node is clicked, the previous exploration state corresponding to that node would be loaded into the visualization.. Also, as many biomedical data sets involve ontological or hierarchical relationships (e.g., Gene Ontology, MeSH terms, and Taxonomic/Phylogenetic trees), our visualizations could be enhanced by incorporating additional visualization methods within the semantic substrate framework. In particular, the regions within semantic substrates could use a treemap [8] , [18] to hierarchically organize nodes. For example, a visualization involving genes of multiple species might incorporate a treemap subdividing the region space hierarchically according to the taxonomy of genes in the data set. Node positioning within each treemap cell could be customizable depending on users' preferences. Some of the many existing alternative network visualization algorithms (e.g., layered [46] ) could be incorporated as well. Another useful feature would be a means of displaying or interacting with the ontological information associated with each node, if present.. In addition, while our current visualization favors exploration of individual nodes, such as PubMed documents or genes, more sophisticated link filtering and exploration may improve our visualization tool. In particular, NVSS currently supports link filtering based on source and destination node attributes, but would benefit from additional filtering options based on other link attributes. Also, NVSS's handling of multiple link filters is currently limited to "AND" rules (e.g., show links with source in region X and destination in region Y), but does not allow "OR" rules (e.g., show links with source in region X and destination in either Y or Z). Adding better support for link filtering and manipulation would allow more expressive queries for user exploration using semantic substrates.. As the amount of semantically tagged biomedical data continues to grow, we believe that semantically relevant visualizations like semantic substrates will have increasingly important roles in exploring and understanding biomedical databases in the near future.. Huimin Guo received the BS and MS degrees in computer science from Beijing Normal University, China. During her master's study, she exchanged to Waseda University (Tokyo, Japan) under the 1. . For more information on this or any other computing topic, please visit our Digital Library at www.computer.org/publications/dlib. Network visualization has a long and distinguished research history. In this section, we provide a brief survey of work in network visualization, and some of its many applications within the biomedical domain. For broader overviews, refer to di Battista et al. [16] , Herman et al. [26] , and Suderman and Hallett [45] .

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A theory of goal-oriented communication We put forward a general theory of goal-oriented communication, where communication is not an end in itself, but rather a means to achieving some goals of the communicating parties. Focusing on goals provides a framework for addressing the problem of potential "misunderstanding" during communication, where the misunderstanding arises from lack of initial agreement on what protocol and/or language is being used in communication. Despite the enormous diversity among the goals of communication, we propose a simple model that captures all goals. Modern computer systems consist of pieces that are built at different times, by different groups, that make no special effort to coordinate with one another. Moreover, any "standards" employed by these parties change over time as the amount of data (and/or address spaces) grows and as new applications and features are introduced. Thus, there are no longer any guarantees that these pieces interoperate-and indeed, everyday experience shows that new components are often incompatible with the old. We therefore wish to understand when interoperability in the absence of fixed standards is possible and at what expense.. To our knowledge, though, all existing models of communication problems -building on the seminal work by Shannon [7] -implicitly assume that the communicating components are designed together, so the issues of (in)compatibility that we wish to study do not arise and cannot be captured in these models. This deficiency was pointed out in an earlier work by Juba and Sudan [3] , who suggested that these * The full version of this work is available on ECCC [1] and in adapted form in the second author's Ph.D. thesis [2] . † Supported by NSF Award CCF-0939370. Copyright is held by the author/owner(s). PODC'11, June 6-8, 2011, San Jose, California, USA. ACM 978-1-4503-0719-2/11/06. problems might be addressed by explicitly introducing the goal of the communication, and furthermore demonstrated that for one example goal -delegating computation of a function -universal interoperability can be guaranteed. In this work, we establish that the earlier suggestion of Juba and Sudan is essentially valid by introducing a mathematical model of generic goal-oriented communication and showing that for broad classes of goals in this model, we can design components (algorithms) with universal compatibility.. In particular, the main feature of our work is the level of generality: while the earlier work of Juba and Sudan relied on a computational imbalance between the components, and in particular only considered the delegation of a PSPACEcomplete function by a polynomial-time bounded algorithm, our work addresses any case in which there is something to gain from the communication. For example, the problem of using a printer to produce a document -which cannot be cast as a problem of delegating computation in any reasonable sense -is captured naturally by the simple model introduced in the current work.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Secure cross-domain data sharing architecture for crisis management Crisis management requires rapid sharing of data among organizations responders. Existing crisis management practices rely on ad hoc or centralized data sharing based on agreements written in natural language. The ambiguity of natural language specifications often leads to errors and can hinder data availability. Therefore, it is desirable to develop automatic data sharing systems. This also presents additional challenges, such as evaluation of security constraints in different administrative domains and in situations with intermittent network connectivity. We compare two different architectural approaches to develop secure data sharing solutions. The first approach assumes reliable network connectivity, while the second approach works in ad hoc networks. We then suggest a unified architecture that caters for both scenarios. Crisis management often requires access to sensitive data from many organizations or different administrative domains. For example, responders from different domains may need to share medical records to provide care for the victims. We indicate the organization where data originates as the data provider and the recipient organization as the data consumer. Sensitive data must be protected according to the policies of the data provider even after it has been disseminated to users in different domains. The data provider must ensure that its data will be protected after dissemination, while the data consumer needs to know what data it will be able to access. Organizations form Data Sharing Agreements (DSA) [18] to achieve these goals, e.g., see [11] . A DSA is a signed contract stating each partner's obligations to protect data, which allows the partners to seek remedy (e.g. through legal means) for breaches of the conPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. tract. Thus, a DSA allows the data provider to trust data consumers to enforce the agreed policies in their administrative domain.. Common practices of emergency responder agencies indicate that the evaluation and enforcement of DSAs are not automated and data is often shared informally [19] . Informal data sharing requires manual decision making. However, a manual process can cause delays and errors, which can in turn lead to deterioration of the crisis at hand. Effective and scalable crisis management requires an automated and efficient DSA evaluation and enforcement system.. Existing dissemination control architectures suffer from many limitations: 1) They require recipients to contact a pre-defined central trusted authority (TA) to obtain access rights; 2) If the TA is not available, the responders cannot access the data. If, for example, the incident happens in a tunnel. The incident response vehicles may use long range communication equipment to exchange data with the outside world, while responders may have to depend on ad hoc links using short range communication of their mobile devices. It is therefore necessary to cater for data sharing in ad hoc networks [7] ; 3) The policies are unilaterally defined by the data provider who may have poor or no knowledge of user credentials and contextual information available in the data consumer's domain. This severely restricts the expressiveness of the policies. EXAMPLE 1.1. Consider a crisis scenario where the Police collects personal and medical information of an incident's evacuees, and needs to share it with employees of Local Government (LG) to coordinate medical support for the evacuees. Following the need to know principle, only those LG employees that are assigned to the incident should be given access to the data. To specify such an access policy the Police must know how to identify employees assigned to the incident in the LG's domain. Also, the LG must understand the policy to provide matching credentials.. 2 This paper presents a data sharing architecture based on the concept of DSAs that can be used both in crisis and normal situations. It caters for data access with intermittent connectivity and also enables usage control [14] , i.e., continuous control over data access. Further details of this work are also described in a longer version of this paper [9] .. The remainder of this paper is organized as follows: Section 2 discusses related works. In Section 3 we introduce the concepts of DSA. Section 4 discusses the designs for a cross-domain data sharing architecture. An overview of our implementation is given in Section 5. Finally, we conclude in Section 6. The proposed architectures provide secure data sharing based on DSAs. In addition, usage control can be enforced in adhoc networks. Moreover, it is possible to use UDSA for scenarios with and without reliable network connectivity. The UDSA architecture achieves this goal by using distributed policy evaluation and establishing the required trust relationships using DSAs. In general, when users have complete privileges on their devices, it is necessary to rely on the trusted computing (TC) technology [8] to ensure secrecy of the keys and the integrity of the security system. However, in case of responder agencies or large corporations the user privileges are often well managed. In such cases, these goals can be met by carefully restricting user access.. A pragmatic data protection mechanism for crisis management should allow a responder to override the security policies to access data in high risk situations. Implementation of such break-the-glass security mechanism should be accompanied with the creation of an activity log that can be reviewed later. Dissemination control architectures [15, 13, 2, 12 ] also known as Digital/Enterprise Rights Management (DRM/ERM) systems share many common design principles. The sensitive data is encrypted and associated with access policies. These policies are evaluated by a central trusted authority (TA) which issues the decryption keys (see Figure 1) . Park et al. [15] presented an analysis of several dissemination control architectures. However, they did not investigate how rights can be determined during cross-domain evaluations. Adam et al. [1] proposed use of an intermediate coordinator service in each organization, which is unusable when connectivity is absent. Since it is not feasible to use a centralized architectures, it is necessary to explore other rights distribution mechanisms.. Access Hierarchy based Encryption (AHE) [4] defines a hierarchy of access-levels. Each access-level is associated with a secret key which can be derived offline if the secret key of its parent node is known. Attribute Based Encryption (ABE) [5] is used to encrypt data using an attribute based policy and a TA's public key. The TA generates a secret key for each user based on the user's attributes so that they are able to decrypt data only if their attributes satisfy the policy used for the encryption. The attribute-based keys must be distributed apriori.. The Policy-based Authority Evaluation Scheme (PAES) [16] allows a data originator to specify a hierarchy of authorities trusted to correctly evaluate its policies. The set of authorities trusted to evaluate the usage control policies is not statically defined, but designated by a trust policy evaluated by a higher level authority. The set of higher level authorities is recursively defined by policies. The recursion terminates by a set of statically defined authorities at the root-level of the hierarchy. As a result this protocol allows recipients to choose a trusted authority in a more flexible manner. The UDSA architecture has been tested with development of two UDSA-aware applications. The PDP components of the architecture were developed at Imperial College London, and the PEP and PIP were developed at the European Microsoft Innovation Center (EMIC). The PDP for end-user devices has been implemented as a Java library, and the server-side PDP is exposed as a Java web service. The DPOAPI and PIP are implemented using C#. Interoperability between Java and C# components is achieved using JNBridge [10] . The two applications demonstrate use of the architecture in different scenarios. The first application provides secure access to XML documents containing information about an incident. It allows us to restrict the access to selected parts of the document. In addition, the access can be restricted based on the user's location, role, and status of the incident. User's location is determined by triangulation of wifi tags (Aeroscout tags [3] ) carried by the user. The user's identity and location credentials are issued by a security token service (STS) implemented using the Geneva Framework [6] . The second application instead provides secure access to sensitive scientific data in a typical enterprise scenario.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Thermodynamic Limit for Large Random Trees We consider Gibbs distributions on finite random plane trees with bounded branching. We show that as the order of the tree grows to infinity, the distribution of any finite neighborhood of the root of the tree converges to a limit. We compute the limiting distribution explicitly and study its properties. We introduce an infinite random tree consistent with these limiting distributions and show that it satisfies a certain form of the Markov property. We also study the growth of this tree and prove several limit theorems including a diffusion approximation. Various kinds of random trees have been studied in the literature. In this note we consider simply generated random (plane rooted) trees also known as branching processes conditioned on the total population (CBP), see [Ald91b] . Our initial motivation was a study of the secondary structure statistics for large RNA molecules, see [BH08] and [BH09] . The secondary RNA structures can be encoded via plane rooted trees and studied with the help of energy models. In [BH08] and [BH09] , it is demonstrated that the naive energy minimization approach to the prediction of typical secondary structure features fails to explain the presence of high degree branchings. However, using the language of statistical mechanics and working with Gibbs ensembles on trees, we were able to include the entropy correction and recover the typical RNA branching type. These results are concerned only with the rough information related to the branching statistics, but in this paper, we suggest a new viewpoint that helps to obtain some insights into the geometry of large random trees.. The model we work with follows the classical Boltzmann-Gibbs postulate stating that the probablity of a configuration T is proportional to e −βE(T ) , where E(T ) is the energy of T , and β is the inverse temperature in appropriate units (see the complete description of our model in Section 2). Gibbs distributions, especially their limiting behaviour under the limit of the size of the system tending to infinity (so called thermodynamic limit), are central to statistical mechanics, see [Sin82] and [Geo88] for a modern mathematical introduction.. The first goal of this paper is to prove that as the order of the tree grows to infinity, the distribution induced by the Gibbs measure converges to that of an infinite discrete tree that we explicitly describe in detail (Sections 2 to 5). This thermodynamic limit belongs to the category of discrete limits of CBP according to the terminology introduced in [Ald91b] , and our result (as well as the limiting object) appears to be new. In particular, it does not involve any rerooting procedures like the one introduced in [Ald91a] . We prove the result above for the bounded branching (or out-degree) case, although it should hold true under less restrictive assumptions.. The limiting infinite discrete tree is a more sophisticated object than a classical Galton-Watson tree. In particular, it dies out with zero probability and the progenies of distinct vertices are not independent. However, it turns out that the limiting tree is Markov in a natural sense, and the Markov transition probability is explicitly computed in Section 5. In Section 6 we notice that the number of vertices at a given distance n from the root also form a Markov chain if n is understood as a time parameter. We prove that under linear scaling this Markov chain satisfies a limit theorem with the limit given by a gamma distribution. In Section 7 we strengthen this result and show that a functional limit theorem holds with weak convergence to a diffusion process on the positive semi-line with constant drift and diffusion proportional to the square root of the space coordinate. Since this process (under the name of local time for Bessel(3) process) also serves as a scaling limit of the "height profile" for CBP itself, see [Ald91b, Conjecture 7] and [Git98] , we can say that the infinite Markov random tree that we construct belongs to the same universality class as the original CBP.. There are several natural and interesting problems arising in connection with our results. One is, obviously, strengthening them to give an alternative to [Git98] proof of the scaling limit in Aldous's Conjecture 7. Another one is to use our approach to study finer details of the random tree rather than the height profile. Our heuristic computation (see Section 8) shows that the limit can be described as a solution of an SPDE with respect to a Brownian sheet.. Acknowledgements. The author is grateful to NSF for partial support of this research via CAREER award DMS-0742424. He also thanks the referees for their useful comments.. 2 The setting and first results on thermodynamic limit Let us recall that plane trees (or, ordered trees) are rooted trees such that subtrees at any vertex are linearly ordered. In other words, two plane trees and are considered equal if there is a bijection between the vertices of the two trees such that it preserves the parent -child relation on the vertices and preserves the order of the child subtrees of any vertex. We fix D ∈ N and introduce TN = TN (D), the set of all plane trees on N vertices such that the branching number (i.e. the number of children, or out-degree) of each vertex does not exceed D. To introduce a Gibbs distribution on TN , we have to assign an energy value to each tree. We assume that an energy value Ei ∈ R is assigned to every i ∈ {0, . . . , D}, and the energy of the tree T is defined via. where V (T ) denotes the set of vertices of the tree T , deg(v) denotes the branching number of vertex v, and χi(T ) is the number of vertices of branching i in T . Since the energy of an individual vertex depends only on its immediate neigborhood via the branching number, one can say that this a model with nearest neighbor interaction. Now we fix an inverse temperature parameter β ∈ R (usually, in statistical physics β > 0, but our results apply to other values of β as well) and define a probability measure µN on TN by. where the normalizing factor (partition function) is defined by. In particular, if β = 0 or, equivalently, Ei = 0 for all i, then µN is a uniform distribution on TN . First, we are going to demonstrate that the above model admits a thermodynamic limit, i.e. the sequence of measures (µN ) N∈N has a limit in a certain sense as N → ∞. Secondly, we study several curious properties of the limiting infinite random trees.. For each vertex v of a tree T ∈ TN its height h(v) is defined as the distance to the root of T , i.e. the length of the shortest path connecting v to the root along the edges of T . The height of a finite tree is the maximum height of its vertices.. Let n, N ∈ N. For any plane tree T ∈ TN , πn,N T denotes the neighborhood of the root of radius n, i.e. the subtree of T spanned by all vertices with height not exceeding n.. For any n and sufficiently large N , the map πn,N pushes the measure µN on TN forward to the measure µN π −1 n,N on Sn, the set of all trees with height n.. Theorem 1 For each n ∈ N, the measures µN π −1 n,N on Sn converge in total variation, as N → ∞, to a measure Pn.. A proof of this theorem will be given in Section 3. At this point we prefer to introduce more definitions that will allow us to describe the limiting measures Pn.. We define. and let. where. pi ln pi is the entropy of the probability vector p ∈ ∆, and. piEi is the associated energy. The function J is used to construct the rate function in the Large Deviation Principle for large plane trees, see [BH08] , [BH09] .. It is strictly convex and its minimum value on ∆ is attained at a unique point p * . Using Lagrange's method, we find that. where λ1 and λ2 are the Lagrange multipliers. So we see that. where C = e −1−λ 1 , and ρ = e −λ 2 . In particular,. Notice that ρ can be characterized as a unique solution of. and C may be defined via. We denote J * = J(p * ) and σ = e J * . For a tree τ ∈ Sn, we introducē. Notice that the summation above excludes the highest level of the tree.. Theorem 2 For any n ∈ N, the limiting probability measure Pn is given by. where the tree τ ∈ Sn is assumed to have k vertices of height n and m vertices of height less than n. The constant Qn is a normalizing factor.. We give a proof of Theorems 1 and 2 in the next Section 3. In Section 4 we compute the value of Qn explicitly. In Section 5 we shall see that our convergence results may be interpreted as convergence to an infinite random tree.. Remark 1 Although Theorems 1 and 2 do not hold in full generality for D = ∞, we expect that there is a large class of energy functions for which analogous results are true.

O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Polynomial-time computation of exact correlated equilibrium in compact games In a landmark paper, Papadimitriou and Roughgarden [2008] described a polynomial-time algorithm ("Ellipsoid Against Hope") for computing sample correlated equilibria of conciselyrepresented games. Recently, Stein, Parrilo and Ozdaglar [2010] showed that this algorithm can fail to find an exact correlated equilibrium, but can be easily modified to efficiently compute approximate correlated equilibria. Currently, it remains an open problem to determine whether the algorithm can be modified to compute an exact correlated equilibrium. We show that it can, presenting a variant of the Ellipsoid Against Hope algorithm that guarantees the polynomial-time identification of exact correlated equilibrium. Also, our algorithm is the first to tractably compute correlated equilibria with polynomial-sized supports; such correlated equilibria are more natural solutions than the mixtures of product distributions produced previously, and have several advantages including requiring fewer bits to represent, being easier to sample from, and being easier to verify. Our algorithm differs from the original primarily in its use of a separation oracle that produces cuts corresponding to pure-strategy profiles. As a result, we no longer face the numerical precision issues encountered by the original approach, and both the resulting algorithm and its analysis are considerably simplified. Our new separation oracle can be understood as a derandomization of Papadimitriou and Roughgarden's original separation oracle via the method of conditional probabilities. We consider the problem of computing a sample correlated equilibrium (CE) [Aumann, 1974; Aumann, 1987] given a finite, simultaneous-move game. It is known that correlated equilibria of a game can be formulated as probability distributions over pure strategy profiles satisfying certain linear constraints. The resulting linear feasibility program has size polynomial in the size of the normal form representation of the game. However, the size of the normal form representation grows exponentially in the number of players. This is problematic when games involve large numbers of players. Fortunately, most large games of practical interest have highly-structured payoff functions, and thus it is possible to represent them compactly. A line of research thus exists to look for compact game representations that are able to succinctly describe structured games, including work on graphical games [Kearns et al., 2001] and action-graph games [Bhat & Leyton-Brown, 2004; Jiang et al., 2011] . But now the size of the linear feasibility program for CE can be exponential in the size of compact representation; furthermore a CE can require exponential space to specify.. The "Ellipsoid Against Hope" algorithm [Papadimitriou, 2005; Papadimitriou & Roughgarden, 2008] is a polynomialtime method for identifying a (polynomial-size representation of a) CE, given a game representation satisfying two properties: polynomial type, which requires that the number of players and the number of actions for each player are bounded by polynomials in the size of the representation, and the polynomial expectation property, which requires access to a polynomial-time algorithm that computes the expected utility of any player under any product distribution. Many existing compact game representations (including graphical games, symmetric games, congestion games, polymatrix games and action-graph games) satisfy these properties. This important result extends CE's attractive computational properties to the case of compactly represented games; note in contrast that the problem of finding a Nash equilibrium is PPAD-hard for normal form games [Chen & Deng, 2006; Daskalakis & Papadimitriou, 2005] as well as for certain compact game representations [Goldberg & Papadimitriou, 2006; Jiang et al., 2011] .. At a high level, the Ellipsoid Against Hope algorithm works by solving an infeasible dual LP (D) using the ellipsoid method (exploiting the existence of a separation oracle), and arguing that the LP (D ′ ) formed by the generated cutting planes must also be infeasible. Solving the dual of this latter LP (which has polynomial size) yields a CE, which is represented as a mixture of the product distributions generated by the separation oracle. We have proposed a polynomial-time algorithm, a variant of Papadimitriou and Roughgarden's Ellipsoid Against Hope approach, for computing an exact CE given a game representation with polynomial type and satisfying the polynomial expectation property. A key component of our approach is a derandomization of Papadimitriou and Roughgarden's separation oracle using the method of conditional probabilities, yielding a polynomial-time separation oracle that outputs cuts corresponding to pure-strategy profiles. Our approach is then spared from dealing with the numerical precision issues that were a major focus of previous approaches, and the algorithm is considerably simplified as a result. Furthermore, the correlated equilibria returned by our algorithm have polynomial-sized supports. We expect these properties of our algorithm to be independently interesting, beyond its usefulness in resolving the recent uncertainty about the computational complexity of identifying exact CE. For example, our techniques can be applied to existing algorithms that are based on the Ellipsoid Against Hope approach, such as Hart and Mansour's [2010] CE procedure with polynomial communication complexity and Huang and Von Stengel's [2008] polynomial-time algorithm for extensive-form correlated equilibria, yielding in both cases exact solutions with polynomial-sized supports.. Our algorithm has additional practical benefits: the resulting cutting planes are deeper cuts than those produced by the original oracle, resulting in a smaller number of iterations required to reach convergence, albeit at the cost of more work per iteration. It is also possible to return cuts corresponding to pure strategy profiles with (e.g.) good social welfare, yielding a heuristic method for generating correlated equilibria with good social welfare; we do note, however, that finding a CE with optimal social welfare is generally NP-hard for many game representations [Papadimitriou & Roughgarden, 2005] .

O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B O O O O O B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O B I O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Computational depth: Concept and applications Abstract. We introduce Computational Depth, a measure for the amount of "nonrandom" or "useful" information in a string by considering the difference of various Kolmogorov complexity measures. We investigate three instantiations of Computational Depth:-Basic Computational Depth, a clean notion capturing the spirit of Bennett's Logical Depth. We show that a Turing machine M runs in time polynomial on average over the time-bounded universal distribution if and only if for all inputs x, M uses time exponential in the basic computational depth of x. -Sublinear-time Computational Depth and the resulting concept of Shallow Sets, a generalization of sparse and random sets based on low depth properties of their characteristic sequences. We show that every computable set that is reducible to a shallow set has polynomialsize circuits. -Distinguishing Computational Depth, measuring when strings are easier to recognize than to produce. We show that if a Boolean formula has a nonnegligible fraction of its satisfying assignments with low depth, then we can find a satisfying assignment efficiently. We introduced three variants of computational depth and proved some interesting results about them. We mention some open problems suggested by our results. The obvious one is to improve some of our results, such as Conjecture 1. For all polynomials q there exist a polynomial p and a probabilistic polynomial-time algorithm that given any satisfiable Boolean formula φ of size n such that at least a fraction 1/q(n) of the satisfying assignments x to φ have D q,p (x|φ) ≤ log q(n), the algorithm outputs a satisfying assignment of φ with high probability.. One obvious way to prove this conjecture is trying to improve Theorem 3 that we use in the proof of Theorem 15. We stress that explicit constructions of optimal extractors would prove the conjecture. Let α(n) be a function such that 0 ≤ α(n) ≤ 1/2 for all n. Consider an oracle A chosen at random by putting x in A independently with probability α(n). Is A shallow with high probability? If α(n) = 1/2 we can simply use the characteristic sequence for the encoding. For α(n) < 1/2 the question remains open. We basically need an efficiently decodable encoding of any set S ⊆ {0, 1} n of size α(n)2 n using log 2 n α(n)2 n + n O(1) bits. This is related to the static dictionary problem (see [Pag99] ).. Of course, other variants of computational depth and their applications would also be interesting.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Practical and efficient cryptographic enforcement of interval-based access control policies The enforcement of access control policies using cryptography has received considerable attention in recent years and the security of such enforcement schemes is increasingly well understood. Recent work in the area has considered the efficient enforcement of temporal and geo-spatial access control policies, and asymptotic results for the time and space complexity of efficient enforcement schemes have been obtained. However, for practical purposes, it is useful to have explicit bounds for the complexity of enforcement schemes.In this article we consider interval-based access control policies, of which temporal and geo-spatial access control policies are special cases. We define enforcement schemes for interval-based access control policies for which it is possible, in almost all cases, to obtain exact values for the schemes' complexity, thereby subsuming a substantial body of work in the literature. Moreover, our enforcement schemes are more practical than existing schemes, in the sense that they operate in the same way as standard cryptographic enforcement schemes, unlike other efficient schemes in the literature. The main difference between our approach and earlier work is that we develop techniques that are specific to the cryptographic enforcement of intervalbased access control policies, rather than applying generic techniques that give rise to complex constructions and asymptotic bounds. In some situations, we may wish to use cryptographic techniques to enforce some form of access control. Such an approach is useful when data objects have the following characteristics: read often by many users; written once, or rarely, by the owner of the data; and transmitted over unprotected networks. Fu et al. [2006] identify content distribution networks, such as Akami and BitTorrent, as applications where some kind of cryptographic access control is particularly suitable. In such circumstances, protected data (objects) are encrypted, and authorized users are given the appropriate cryptographic keys. When cryptographic enforcement is used, the problem we must address is the efficient and accurate distribution of encryption keys to authorized users.. Author's address: Information Security Group, Department of Mathematics, Royal Holloway, University of London, Egham Hill, Egham, TW20 0EX, UK; email: jason.crampton@rhul.ac.uk. Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies show this notice on the first page or initial screen of a display along with the full citation. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers, to redistribute to lists, or to use any component of this work in other works requires prior specific permission and/or a fee. Permissions may be requested fromIn recent years, there has been a considerable amount of interest in key encrypting or key assignment schemes. In such schemes, a user is given a secret value-typically a single key-which enables the user to derive some collection of encryption keys which decrypt the objects for which she is authorized. Key derivation is performed using the secret value and some information made publicly available by the scheme administrator. The two objectives when designing such a scheme are to minimize the amount of public information and the time required to derive a key. Unsurprisingly, it is not possible to realize both objectives simultaneously, so tradeoffs have been sought. Crampton et al. [2006] provide a survey of, and taxonomy for, key assignment schemes and the various factors that affect the parameters described above.. At the same time, we have seen the development of access control models in which time plays an important role in deciding whether access requests are authorized or not [Bertino et al. 2001] . One particular application of such "temporal access control" systems is the protection of data that is made available periodically as (part of) a subscription-based service [Bertino et al. 2002] . Prior to 2006, a number of schemes for enforcing temporal access control policies using cryptographic mechanisms appeared in the literature, many of which have been shown to be insecure (see Atallah et al. [2007b] for a summary of this work). Atallah et al. [2007b] , Ateniese et al. [2006] , and De Santis et al. [2007b] described the first key assignment schemes for temporal access control with provable security properties. This work focused on two particular aspects:. -the development of schemes that provided key indistinguishability; and -the reduction of the storage required for public information and the number of operations required for key derivation.. One shortcoming of their work is that the methods used to tackle the second of these issues do not consider the actual requirements of the underlying access control policy. Instead, generic techniques to reduce the diameter of a directed graph are applied. This has two consequences: optimizations that are tailored to the particular characteristics of the problem are not considered and only the asymptotic behavior of the constructions is provided. Given that the number of time intervals m is likely to be rather small in many practical applications, it is not clear that this kind of approach is the most appropriate. Moreover, the absence of explicit bounds means that for small m it is not at all obvious which scheme is optimal. In short, existing schemes may be efficient (for large values of m) but it is questionable whether they are practical. Atallah et al. [2007a] have also studied the enforcement of "geo-spatial" access control policies. In this context, users are authorized to access data that belongs to particular locations in a rectangular grid. Atallah et al. apply rather similar techniques (as those used for temporal access control policies) to construct asymptotic bounds on the amount of space and the number of derivation steps required.. In this article, we consider optimizations for both temporal and geo-spatial access control policies that arise from a rather straightforward observation about the particular problem at hand. This enables us to present concrete schemes with precise bounds on the amount of storage and the number of derivation steps required.. The space and time complexity of cryptographic enforcement schemes can be measured in "edges" and "hops," respectively [Crampton et al. 2006] . For the enforcement of a temporal access control policy with m time points, for example, we require m(m− 1) edges and log 2 m hops, 1 whereas Atallah et al. [2007b] hops. 2 However, substantial multiplicative constants and lower-order terms may be hidden by the O notation when it comes to the number of edges and the number of hops required for key derivation. 3 For values of m that are likely to be used in practice, these terms will be of considerable importance. The actual number of hops required by the scheme of Atallah et al. [2007b] , for example, is 2 log * m + 4, which, for many values of m of practical interest, will be greater than log m . Moreover, the edge sets that are used in existing efficient constructions require bespoke algorithms for key derivation and modifications to the basic operation of a key assignment scheme [Atallah et al. 2007a] . In contrast, key derivation for our constructions remains very simple.. Finally, we demonstrate that temporal and geo-spatial access control policies (at least as they are understood in the context of key assignment schemes) are special cases of a more general type of policy, which we call an interval-based access control policy. Such policies are parameterized by an integer k, where temporal and geo-spatial policies correspond to the cases k = 1 and k = 2, respectively. Perhaps the most important contribution of this article is to describe how to construct a set of edges for an arbitrary value of k and provide tight bounds on the number of edges and key derivation hops required.. In summary, the main contributions of this article are:. -to generalize the problem of enforcement of temporal and geo-spatial access control policies to the enforcement of interval-based access control policies; -to provide tight bounds on the complexity of enforcing temporal, geo-spatial and interval-based access control policies using key assignment schemes; and -to provide simple, concrete constructions for such schemes.. In the next section, we describe some relevant background material; define what we mean by an interval-based access control policy; and introduce the problem of enforcing an interval-based access control policy using cryptographic mechanisms. In Section 3, we consider temporal access control policies. The main contribution of this section is to state and prove a rather general result and explore some special cases of this result. In this section we also consider constructions in which the user may have more than one key. In Section 4, we consider the related problem of cryptographic enforcement of geo-spatial access control policies. We describe relevant related work in both Sections 3 and 4. In Section 5, we derive results for general interval-based access control policies. We conclude with a summary of our contributions and some suggestions for future work. In this article we consider the enforcement of an interval-based access control policy, which generalizes the temporal and geo-spatial access control policies in the literature [Atallah et al. 2007a; De Santis et al. 2008] . Such policies can be enforced using cryptographic methods, often called key assignment schemes. There are several efficient key assignment schemes in the literature, in the sense that the amount of storage and the time taken to derive cryptographic keys is considerably less than that required if standard enforcement schemes are applied directly. These efficient schemes exist due to the particular structure of the graph that is used to represent intervalbased access control policies. Existing work has used generic techniques for reducing the diameter of the graph, without considering the particular relationship between the access control policy and the desired graph.. In this article we have developed a number of efficient enforcement schemes that have considerable advantages over existing ones. We focus on the development of novel techniques to provide efficient schemes designed specifically for interval-based access control policies, rather than using more generic techniques. Our approach enables us to produce, in almost all cases, exact values for the number of edges and the number of steps required to derive a key, in contrast to existing work in the literature (as shown by Tables I and II) . Moreover, we demonstrate that our constructions can be generalized to higher dimensions, yielding new insights into the efficient cryptographic enforcement of interval-based access control policies.. One disadvantage of our work in Section 5 is that we assumed that each dimension contained intervals in T n for some fixed n. In practical applications, this may not be a reasonable assumption, and it may be prohibitively expensive to "pad" each dimension and work with T k N , where N = max {n 1 , . . . , n k } and n i is the number of points in the ith dimension. One important aspect of our future work, therefore, will be to try to extend our results in Section 5 for T k n to the more general case T n 1 × · · · × T n k . Perhaps the most interesting area for future work is to consider more expressive access control policies and their enforcement using cryptographic techniques. At the Fig. 9 . The key derivation graph generated by applying Construction A.1 to T 36 . moment, we consider intervals defined over a totally ordered set of attributes A. We also intend to consider policies where A is some partially ordered set and users and objects are associated with subsets of A. Of particular interest is the case where A is a powerset defined over some set of attributes, since the resulting policies would be analogous to those used in ciphertext-policy attribute-based encryption [Bethencourt et al. 2007] . We have recently published some preliminary results in this area [Crampton 2010 ]. Figure 9 illustrates T 36 split into copies of T 6 and D 6 . The interval [3, 25] , for example, can be represented as [3, 6] ∪ [7, 24] ∪ [24, 25] , and [7, 24] can be treated as the interval [1, 3] in a copy of T 4 comprising interior copies of D 6 .. Hence, we only require key derivation edges between the "interior" maximal nodes in each diamond supernode and the nodes in each triangle supernode. An exterior maximal node is of the form 1)a + 1, m] . In other words, all intervals corresponding to maximal nodes in an exterior diamond supernode can be treated as the union of a leaf supernode and an interior diamond supernode. Clearly, we can apply this construction recursively, yielding the following construction. Finally, define every key allocation edge that connects two special nodes to be a key derivation edge.. The application of this construction to T 36 is illustrated in Figure 9 . The faint dashed lines illustrate the recursive partitioning of T 36 and copies of T 6 into supernodes. Now. Step 1 adds no more than 2m special nodes 6 and Step 2 adds mlog log m. By construction, the out-degree of each node in the key derivation graph is 2, so e(m) 5mlog log m.. Moreover, the number of hops d(m) satisfies the inequality. Hence, we may conclude that d(m) log m + log log m . A number of authors have used 'binary tree encryption," which can be used to enforce temporal access control policies cryptographically (see Backes et al. [2006] ; Canetti et al. [2007] , for example). In such schemes, assuming n = 2 m for some integer m, the parent node is [1, n] and the two child nodes of node [x, y] [13, 14] , and [15, 15] . In other words, we may enforce a temporal access control policy using binary tree encryption, by supplying each user with at most 2(log n − 1) keys, and key derivation time requires no more than log n steps. The great advantage of such schemes is that the key of a child node can be derived directly from the key of the parent, since the key derivation graph is a tree. Hence, binary tree encryption schemes require no public information.. The focus of our work, however, is on schemes-arguably, more practical schemesin which users have a single key. Two groups of researchers have studied this form of cryptographic enforcement of temporal access control in some detail. In this section we discuss these two strands of research and our own work in this area. We then summarize and compare the respective results to our work.. - Atallah et al. [2007b] propose a number of schemes that reduce the number of edges and the maximum number of hops for T m , using techniques previously developed for total orders [Atallah et al. 2006] . Henceforth, we will use the term chain, rather than total order, and write C m to denote the chain containing m elements. Atallah et al. [2007b] treat T m as the direct product of two orthogonal sets of chains and apply short-cutting techniques for chains. To derive the key for interval [z, z] . Recently, Yuan and Atallah [2009] used O (mn) copies of a scheme for a chain to create a scheme in which the user requires O (1) keys and O mn log * m edges, and the number of derivation steps is O (1). However, the article is rather vague on the details of the scheme and how it compares to the closely related work of Atallah et al. [2007a] , described in the preceding paragraphs, so it is difficult to provide a direct comparison with our work.. By Corollary 4.4, the number of edges required by our scheme is less than 2 3 mn(m + 1)(n+1) and key derivation takes no more than log mn steps. Moreover, our construction is analogous to our binary decomposition for temporal access control: we will see in the next section that our construction generalizes readily to higher dimensions; in contrast, the extension of existing schemes to higher dimensions is nontrivial.

O O O B I O B I I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O B I I O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O B I I O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O B I I O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I I O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O


VRG: A database of vascular dysfunctions related genes Heart and vascular defects occur in a large number of hereditary and sporadic human diseases as a result of a complex interplay of genetic factors. Since genome sequencing of many organisms disclosed similarities among genomes, animal models are crucial for the discovery of genes involved in those pathological processes. Therefore we propose a VRG database, in which human data have been manually managed and integrated with mouse information in order to create a catalogue of genes involved in vascular diseases. Heart and blood vessels dysfunctions are predominant causes of disability and death in humans [1] . In 2003, the World Health Organization [2] estimated that 16.7 million people die each year of cardiovascular (CV) diseases, covering 29% of all deaths around the globe, thus highlighting the value of devoting resources to study the pathogenesis of these settings.. Phenotypic alterations result from a complex network of genetic modifications [3] and a huge effort has to be done to better understand their mechanisms at the molecular scale. Even though experimental approaches could be relevant [4] [5] [6] [7] , computer science provides an important support as well. It is essential, in fact, to provide a comprehensive collection and integration of public available data generated by the research community [8] [9] [10] to allow easy access and recovery of information. To date, different databases collect information of known genes involved in human vascular diseases. For instance, the Online Mendelian Inheritance in Man (OMIM) [10] catalogues phenotypes and genotypes classified by phenotypic features and mutated gene while the Cardiovascular Comparative Genomic Database (CVCGD) [11, 12] collects well known and comparatively annotated cardiovascular genes. However, it is not straightforward to recover a complete list of genes related to vascular dysfunctions. OMIM, for example, allows only a free-text search of clinical synopsis thus rendering difficult the selection of genes involved in vascular dysfunctions. Therefore, in order to generate an accurate collection of human genes, it would be useful to review all phenotypic OMIM entries, select those directly or indirectly related to vascular dysfunctions, and collect the corresponding genes into a catalogue as complete as possible.. The increasing availability of genomic sequences from many organisms [13] [14] [15] provided the opportunity of orthologous-sequences comparison [16, 17] . This analysis revealed that sequences performing important functions are frequently conserved among evolutionarily distant species [18, 19] . Moreover, animal models yield the identification of novel genes that often cause defects when mutated in humans and therefore they are used as a tool to investigate both mono and multifactorial human diseases [6, 8, [20] [21] [22] . Because they can be the subject of large scale mutation screenings [23, 24] , animals are a simple model to apply genomic strategies. For instance, knock-out (KO) mice proved useful in elucidating gene function and provided many insights into human biology and diseases [19, 23, 24] . Therefore, genome-wide collections of KO mice can significantly contribute to biomedical discovery [23] . A prominent example is represented by the Mouse Genome Database (MGD) [9, 25] , a publicly available resource of KO mice which collects genomic, genetic, functional, and phenotypic data about mouse genes in order to identify candidate genes associated with complex phenotypes [26] . Since MGD has generated an ontology in order to catalogue the altered phenotypes of mutant mice, it results in being simple to select genes related to particular vascular dysfunctions.. Gene regulation is one of the major mechanisms underpinning the correct cardiovascular system morphogenesis and function [1, 24] and it has been demonstrated that similar molecular mechanisms are involved in its regulation both in physiological (i.e. during embryogenesis) and pathological conditions [27] . Therefore, an in depth analysis of the embryonic vascular development could yield useful information to understand the pathogenesis of vascular diseases in adults [28] . Also in this case animal models, i.e. zebrafish [29] or xenopus [30] , will be crucial to improve our knowledge.. In order to reach a more comprehensive knowledge on vascular dysfunctions it could be useful to generate a complete list of human and animal genes involved in vascular phenotypic alterations. Due to the huge amount of information collected in different databases, computerized systems could simplify data recovery, management and analysis. Therefore, we generated VRG [31], a publicly available database aimed at integrating mouse and human information, which were manually curated to create a wide catalogue of genes involved in vascular diseases.

O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O B I O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O