UHH Submission to the WMT17 Quality Estimation Shared Task

The field of Quality Estimation (QE) has the goal to provide automatic methods for the evaluation of Machine Translation (MT), that do not require reference translations in their computation. We present our submission to the sentence level WMT17 Quality Estimation Shared Task. It combines tree and sequence kernels for predicting the post-editing effort of the target sentence. The kernels exploit both the source and target sentences, but also a back-translation of the candidate translation. The evaluation results show that the kernel approach combined with the baseline features brings substantial improvement over the baseline system.

Introduction
The evaluation of Machine Translation (MT) output is a sub-field of MT research that has experienced a great amount of interest in the past years. The process of MT evaluation involves three factors: an input segment in a source language, the candidate translation (also known as target sentence) which represents the output of a MT system when translating from the source language to the target language and a reference translation in the target language. The assessment of MT quality can be divided into two categories depending on whether it requires the presence of a reference translation or not. The reference-based evaluation scores the candidate translation by comparing it to the reference translation.
On the other hand, the reference-free evaluation, also known as quality estimation (QE), predicts the quality of a candidate translation based solely on the information contained in the source and target sentences. QE can be performed at different levels of granularity: word, sentence or phrase and it involves classifying, ranking or predicting scores for the candidate translations. A sentence-level QE system is conventionally constructed based on a set of features encoding the information contained in the source and target sentences, which are used for learning a prediction model. The features employed for this task can be of different types, like surface features, language model features or linguistic features. The positive influence of syntactic features on the performance of QE systems has been extensively studied, including in Rubino et al. (2012), Avramidis (2012) or more recently in Kozlova et al. (2016). However, the process of identifying the best performing set of features, is a task that is both expensive and requires a considerable amount of engineering effort (Hardmeier, 2011). On the other hand, kernel methods do not require the explicit definition of the features, and rely on the scalar product between vectors for capturing the similarity shared by the sentence pairs.
In this paper we present our submission to the WMT17 Shared Task on sentence level Quality Estimation, that makes use of sequence and tree kernels in predicting a continuous score representing the post-editing effort for the target sentence. The novel contribution of our system is the combination of different types of kernels. Moreover, we use a back-translation of the target sentence into the source language as an additional data representation to be exploited by the kernels, together with the usual source and target sentences representations. Furthermore, we construct additional explicit features by applying the kernel functions directly on the pair of source and back-translation sentences, a method that to our knowledge has not been used before. The evaluation performed demonstrates that the combination of the kernel approach and the baseline together with the newly introduced feature vectors brings consistent improvement over the baseline system. This paper is organized as follows. The related work is presented in Section 2, while the methods employed and the implementation are described in Section 3. The experimental setup and the evaluation results are introduced in Section 4, while the last section summarizes our findings and presents future work ideas.
An approach for QE based on syntactic tree kernels is introduced in (Hardmeier, 2011), where a binary SVM classifier is trained to make predictions about the quality of the MT output. The datasets are syntactically analyzed using constituency and dependency parsers. The Subset Tree Kernel (Collins and Duffy, 2001) is used for the constituency trees, while the Partial Tree Kernel (Moschitti, 2006a) (Moschitti, 2006b) was judged as being more appropriate for the dependency trees. The evaluation shows that the combination between baseline features and the tree kernels achieves the best performance. These findings are further validated in Hardmeier et al. (2012) where a QE system is proposed based on a set of 82 explicit features combined with syntactic tree kernels.
Syntactic tree kernels for QE are also explored in Kaljahi et al. (2014), where a set of hand crafted constituency and dependency based features together with subset tree kernels applied on the constituency and dependency tree representations are used. The evaluation results demonstrate that the source constituency trees perform better than the target sentence constituency trees. This work is further extended in Kaljahi (2015), where multiple QE systems based on syntactic and semantic features are introduced.
The work presented in this paper differs from previous kernel approaches for QE by the innovative use of sequence kernels in addition to the previously utilized tree kernels. We extend on the previous kernel QE research by also making use of a back-translation of the target sentence in the computation of the kernels. While backtranslations features have been previously utilized for QE (e.g. (Bechara et al., 2016)), their potential as an additional structural input representation for kernels has never been studied before. Furthermore, we exploit the potential of the scores of the kernel functions applied on the source and backtranslation sentences as additional hard-coded features.

Methods and implementation
In this section details about the methodology and the implementation will be presented. First, tree and sequence kernels will be introduced, followed by the description of the implementation of these kernels in the context of QE. Finally, the machine learning platform used for implementing the QE systems will be presented.

Kernels for Quality Estimation
A kernel function computes the similarity between two structural representations without requiring the identification of the entire feature space (Moschitti, 2006a). To achieve this, the scalar product between vectors of substructure counts is computed in a vector space with a possibly infinite number of dimensions (Nguyen et al., 2009). Different kernel functions, depending on the type of structural input data they require, have been proposed including sequence, tree or graphs kernels. Tree kernels make use of tree representations for their computation, while sequence kernels calculate the similarity between the input sequence representations based on the number of common subsequences they share.
In the case of tree kernels, a series of algorithms have been proposed, e.g. in Collins and Duffy (2001) or Moschitti (2006a), based on the type of tree fragments (e.g. subsets, subtrees or partial trees) they take into consideration in their computation. On the other hand, sequence kernels have also been extensively studied in Bunescu and Mooney (2005) or Nguyen et al. (2009).
In this paper, we focus on the Partial Tree Kernel (Moschitti, 2006a) and the Subsequence Kernel (Bunescu and Mooney, 2005). The Partial Tree Kernel (PTK) was chosen because it is more flexible than the subtree or subset kernels in its calculation by taking partial subtrees into account. The Subsequence Kernel (SK) uses a dynamic pro-  gramming approach to determine the number of common patterns between the two input sentences.
In our experiments, the patterns taken into account were composed of the lexical items. In order to use the tree kernel functions, the source and the target sentences were parsed using the Bohnet graph-based dependency parser (Bohnet, 2010), which was chosen because of its high accuracy. The data was first preprocessed by performing lemmatization and pos-tagging. Publicly available 1 pre-trained models were used for analyzing the source, target and back-translation sentences.
For learning using the Partial Tree Kernel, a transformation of the dependency parse tree is required, as introduced in Croce et al. (2011). We followed the lexical-centered-tree approach, where the grammatical relation and the pos-tag are encoded as the rightmost children of a dependency tree node. In the case of sequence kernels, the only preprocessing step applied was the tokenization of the input sentences. In order to investigate if prior lemmatization of the input sentences influences the results, we created two variants for each structural representation: an exact one containing the actual lexical items and a simplified non-exact one consisting of their corresponding lemmas.
Furthermore, we incorporated a backtranslation of the target sentence as an additional structural input representation for both the tree kernels and the sequence kernels. The backtranslation was obtained using the free online Google Machine Translation system 2 . We also exploited the full capability of the kernel functions by utilizing their explicit scores when applied on the source and back-translation sentences. We computed the scores for both the non-exact representations, and the exact ones. The scores were normalized using the formula from Croce et al. (2011) with T1 and T2 denoting the structural representations and K the type of kernel function applied.

KeLP (Kernel-based Learning Platform)
In our implementation, we applied the Partial Tree Kernel 3 and the Sequence Kernel 4 together with the epsilon-regression SVM implementations made available in the KeLP package (Filice et al., 2015b) (Filice et al., 2015a  Learning Platform) is a Java Machine Learning library that provides the venue for implementing kernel based machine learning algorithms together with kernel functions. KeLP provides built-in support for multiple vectorial or structured data representations, which can be leveraged at the same time by combining different kernels into a single model. The package has a series of advantages, among them platform-independence, flexibility of use and its modularity that makes it easily extensible. The training of the QE prediction models was performed using the Support Vector Machine epsilon-Regression implementation with default parameters from the KeLP package. For the baseline systems a radial basis function (rbf) kernel was chosen, while for the other implemented QE systems the linear combination between the baseline features rbf kernel and the additional structural kernels was used.

Experimental setup
The evaluation was performed using the datasets released for the QE sentence-level shared task by the Second Conference On Machine Translation (WMT17) 5 . The data consists of tuples, containing the source segment, the target sentence and a manually post-edited version of the target sentence, together with their associated post-editing score. The WMT17 dataset is composed of both English-German and German-English tuples. The English-German dataset, pertaining to the IT domain, consists of 23000 tuples for training, with additional 1000 instances for development. Two sets, comprised of 2000 units each, were made available for testing. On the other hand, the German-English dataset provides 25000 tuples for training, 1000 units for development and a test set consisting of 2000 instances, with the general domain categorized as Pharmaceutical. The QE baseline systems used for evaluation are based on the sets of 17 baseline features made available by the QE sentence-level shared task. They consist of surface features (e.g the number of tokens/punctuation marks in the source sentence), language model features (e.g LM probability of the source/target sentences), but also n-gram based features (e.g percentage of unigrams in quartile 4 of frequency (higher frequency words) in a corpus of the source language).

Results
The systems were evaluated based on their predicted scores using Pearson's correlation coefficient and the Mean Average Error (MAE), with the former being chosen as the primary method of evaluation for the WMT17 sentence-level QE task. We experimented with different model combinations and the results of the evaluation are presented in the tables that follow, where we have highlighted our submissions to the sentence level shared task. To better distinguish between models, the following QE system notation scheme was utilized: [Kernel [level]], where Kernel identifies the type of kernel used: PTK or SK and level represents the input type of sentence the kernel was applied to: source (marked with src), target (marked with mt) and back-translated target (marked with mtbk). The linear combination between the different kernel functions was marked with the plus sign. The systems can be categorized according to multiple criteria. The first one considers the presence of the new kernel features, which divides the systems into baseline features and baseline+new   features systems. The second criterion is represented by the presence of the lemmatization in the pre-processing pipeline of the input sentences, which partitions the systems into exact and not exact ones.
A series of preliminary experiments was conducted which indicated that strictly structural kernel based methods could not capture all the relevant features for constructing a high performing QE system. Therefore, a combination between the baseline rbf kernel with additional structural kernels was implemented for the reported QE systems.
We can notice that all the systems, corresponding to both language pairs outperformed the baseline systems in terms of Pearson correlation. Of particular interest are the systems making use of the new kernel features, which succeeded in surpassing the corresponding systems that only used the baseline features.
The results also show that the addition of the back-translation as additional input data, proved on average beneficial for improving the correlation scores over systems that make use of only the source and target sentences as input data for the kernel functions.
In addition, we can observe that the sequence kernels based systems are highly performant in terms of Pearson's coefficient, albeit slightly worse on average than the tree kernels based implementations. This is a very important aspect, as the integration of sequence kernels into QE systems does not require additional external tools and therefore makes them well suited for low-resource language pairs, that might lack high-quality syntactic tools like parsers or taggers. Moreover, by employing a sequence kernel, the parsing of MT output is effectively bypassed. This constitutes an advantage as the parsing of target sentences often represents a challenging task due to the ungrammaticality of the MT generated output.

Conclusions and future work
In this paper, we presented our submission to the sentence level QE task, based on sequence and tree kernels. We have also investigated the performance of additional kernel-based features, as well as the benefit of incorporating a back-translation of the machine translation output as an additional input data representation, which to our knowledge has not been studied before. The results indicate that both ideas contribute useful additions to the baseline systems. We have also demonstrated that sequence kernels are a high performing method for predicting the quality of MT translations, that have the advantage of not requiring additional resources for their computation.
We plan to further extend the current work by using constituency trees besides dependency trees for the computation of the tree kernels. We also plan to investigate if the choice of the MT system for the back-translation, affects the evaluation results. Lastly, more combination schemes between the tree and sequence kernels will be explored together with additional datasets and language pairs.


Improving Reliability of Wireless Sensor Network (WSN) Using Network Coding Multipath Routing

This research proposed new method to improve performance of WSN. It used network coding on transmission scheme. The researcher had modified the existing network coding multipath routing for a novel node selection to own residual power node in network coding routing mechanism and to improve reliability of a WSN. This routing mechanism was placed in router for routing purpose. Then, Software network simulation method was done by using OMNET++ platform and MiXiM Framework library. The result shows that proposed method to select nodes and execute network coding succeeds on improving performance of WSN like the reliability compared to the previous method.

I. INTRODUCTION
The current routing and transmission data packet use a single path or track such as in Wireless Sensor Network (WSN) (Peng, Walid, Hwang, & Low, 2016). WSN is a network formed by some sensors node that is spacey distributed and networked. Most of these networks have function to monitor the physical or environmental conditions. There are two unique and diverse characteristics in WSN (Wang, Yang, & Zhao, 2012).
Nodes communicate with others using wireless radio channels and always distribute in complex environment interferences. Moreover, the batteries are used as its energy supply for these node sensors. Whereas, it is known that the battery is limited energy resources. Therefore, a reliable transmission in WSN should be done in two stages which have higher successful delivery ratio and lower energy consumption.
Developing an efficient and reliable routing or transmission protocol for WSN is an interesting issue. For example, multipath routing in WSN is used to improve the reliability of WSN by using many tracks or path transmissions from the source node to the sink node (Peng et al., 2016;Chihani & Denis, 2011). However, the high redundancy in path transmission results in more transmissions and requires more energy consumption. This is the drawback of multipath routing scheme implemented in WSN.
Transmission Control Protocol (TCP) cannot be performed on wireless radio links because of the tightly constrained channel. It needs network coding scheme to address this TCP problem. Previous research has also been designed to address this problem by using network coding scheme. According to Ahlswede, Ning Cai, Li, and Yeung (2000), network coding is a scheme for enhancing transmission capacity in a network. However, there is inefficient process in the previous research. This research has modified the existing network coding using the multipath TCP in WCN to improve the reliability of WSN.
Many researches have been done on WSN field, especially on the issue of limited resources such as limited power, limited computing, limited buffer, high loss transmission, and redundancy in WSN. Dinusha et al. in Rathnayaka and Potdar (2013) improved the research on TCP implementation including the congestion control and reliability for WSN with a novel topology and protocol used. Moreover, Kim, Klein, Soljanin, Barros, and Médard (2014) found out that the ordinary TCP could not be implemented on WSN. Nestor Michael et al. in Tiglao and Grilo (2012) made an analytical model, but it was not implemented. It was because many intermediate nodes had limited buffer which was not easy to do the caching process. Then, the researchers like Wang et al. (2012), Wang, Yang, Zhao, Xu, and Lan (2014), and Yang, Zhong, Sun, and Yang (2010) have used network coding to enhance the properties of WSN focusing on energy efficiency since all of the sink nodes use battery.
This research proposes the new method for improving performance of WSN. The researcher has modified network coding multipath routing algorithm for improving WSN performance. This modification is suitable and can be implemented in WSN environment. In the end, it is expected to improve WSN performance.

II. METHODS
The research flow diagram is described in Figure 1. The first step starts with the research question to identify the research topics. Then, literature study is used to deepen the research topic and find out the research gap as the problem statement. Based on the problem identified, the hypothesis and objectives are proposed. The next step is to conduct an analysis of existing method and design an enhancement of the existing method in accordance with the previous hypothesis to create the proposed method. The proposed method is run in a software simulation, and the results are checked. It is to see whether it improves and fulfills the hypothesis and objective or not. If it is not, the making of the proposed method will be repeated. Figure 2 shows the topology of WSN (IEEE 802.11.5.4). Nodes in WSNs are mainly used for monitoring purposes such as environment monitoring (air pollution, temperature, humidity and machine monitoring (observing the condition of a machine). Due to its compact nature, nodes in the networks have certain characteristics and constraints (Gasser, 2011). First, nodes should function unattended except to change the battery every year. Second, energy consumption (CPU, sending, receiving) needs to be kept to a minimum to save battery power. Third, resources (CPU power, memory, energy) are scarce. Fourth, the network must adapt to churn (i.e., nodes joining and moving out due to failure). Fifth, the location of nodes can affect the network's topology.

Figure 1 Research Flow Diagram
In traditional routing and transmission data, the intermediate node receives a packet to a destination in the routing tables, then it will store the data packet and begin to send it back to its destination via the link that it has in the routing table (store and forward) (Kim et al., 2014). The method is suitable for a network node having a wired link that is qualified. However, it is unsuitable for a wireless sensor node that has complex link due to sharing common air transmission.

Figure 2 Wireless Sensor Network
Multipath routing WSN can improve reliability of WSN regarding successful delivery ratio. However, the problem of higher transmission redundancy is the energy consumption (Wang et al., 2012). Therefore, it still needs to be improved by considering the limited battery power issue in WSN. One of the solutions is network coding method.
This research uses modified network coding multipath routing with a power aware node selection method to improve the existing network coding multipath routing in WSN. In this methods, not all intermediate nodes will be involved in routing discovery and maintenance which process and forward the packet data from source to sink. With proposed network coding multipath routing using this linear network coding, it can improve the reliability of WSN regarding the successful delivery ratio and power efficiency.
This research simulates the method by using combined tools, OMNET++ and MiXiM framework Simulator. OMNET ++ network simulator is the proven result and the real experiment by Xian, Shi, and Huang (2008) and Rousselot et al. (2009).
Next, there is network coding multipath routing algorithm. In the existing WSN routing, mostly uses the broadcast method of multipath routing (Wang et al., 2012). When a sensor node as a source has data to be transmitted to a destination node (sink), the node will attempt to transmit the data packets with broadcast directly. Each node which can capture the signal of data packets will try to forward the data packets by creating multipath routing transmission of packet data from source to sink. The intermediate node will forwards the data packet broadcast if the Time to Live (TTL) packet data is still enabled (TTL >1). In the end, the data packet is received in the sink, and the transmission data is over. The script captured from the default WSN broadcast routing is as follows.

III. RESULTS AND DISCUSSIONS
The proposed modified network coding multipath routing algorithm is designed. The main idea of this new method is how to identify and select the node that can be used in multipath routing network coding. Not all nodes are involved in network coding multipath routing to forward packet data transmission automatically. The best node will be selected as the multipath routing node and will do network coding to forward data transmission from source to sink. The best node as intermediate nodes has RSSI and residual power capacity that surpass the threshold value set in the simulation. To implement the proposed method, it uses the algorithm to determine which nodes can be added to the routing path and used to forward the data packets from source to sink. The routing discovery algorithm is as follows. The addition of one parameter about the condition of battery power is to select Intermediate Node selection (Node between) which serves to forward the data packet. This is an additional parameter other than RSSI that has been used in the previous parameter. When the data have TTL value more than 1, the intermediate node will do network coding and en route the network coding by decoding packet data to its neighbor. The comparison of the previous method and the proposed method can be seen in Figure 3. Proposed method fixes the previous method by using power residual capacity scheme.
The experiments are performed by using simulation software tools in the form of OMNET++ with the several scopes. Those are (1) standard WSN: IEEE 802.15.4 (Lr-WPAN) with frequency 2,4 Ghz; (2) the nodes on WSN have static mobility and line of sight transmission; (3) performance metrics: successful delivery ratio, and energy consumption; (4) MiXiM framework on OMNET++ platform.
The design of software simulation is to create a collection of existing module as a sensor node, a modified network coding algorithm multipath routing, network topology, make schemes and set several parameters of simulation, and combine all these elements into a single simulation. Figure 4 shows the simulation stages. It starts from routing discovery and data processing.
Once the desired network topology is formed by several sensor nodes. Then, the initial process is the process of routing discovery to search the routing table for delivering packet data from source node to sink node. When WSN has a sensory data needing to be transmitted from source to sink, the source node will perform network coding initially as a source node. The data packet that is already in network coding will be distributed on multipath routing way to neighbor nodes, intermediate nodes. The intermediate node receives the data signal, checks, and does the next network coding. Then the nodes resubmit it to its neighbor sensor nodes. This process continues in the intermediate node to the sink node. When the sink node has received enough data packets, it can restore the original data.
The data transmission process will occur continuously until there is no more data to be transmitted. On the sidelines of the data transfer process, there will be the creation of routing maintenance to ensure the continuity of network coding multipath routing.
The researcher uses two scenarios to measure and analyze the existing network coding multipath routing and enhance modified network coding multipath routing with the proposed method. Figure 5 and Figure 6 show the network topology with both scenarios. The network topology in scenario 1 has five sensors in the system and scenario 2, and there are more sensors than scenario 1. These two scenarios show two environment condition such as simple condition (scenario 1) and more complex environment (scenario 2). Some metrics describes the performance grade of technique against the elements of wireless networking. Some of these metrics have been carefully selected to provide an overview of the behavior and the reliability of the network coding multipath routing in WSN. The analysis of this research only focuses on data sensor transmission from source to sink node, and the metrics to measure the features to data packets. The other controls on overhead data are ignored. Further explanation and details regarding these metrics are explained.
The successful delivery ratio indicates the successful ratio of the packet that is received by sink divided with number sent by source node. The equation is as follows.

Successful Delivery Ratio = (Number of Packet Sent / Number of Received Packets) × 100%
(1) Then, for average energy consumed, it is an average measure of the amount of energy (mWatt second or Joule). A node uses it in transmitting sensor data from source to sink.

Average Energy Consumed = (Total energy used by all involved nodes) / (number of involved nodes)
(2) Next, there is energy consumption per packet sent. This metric is the measure of amount energy which is wiped out by WSN in sending a packet from a source to a sink for a data packet sent. Then, energy recovery is the value of the additional energy that will be needed by WSN to ensure that all the package is delivered to sink.

Energy Recovery = (1-Successful Delivery Ratio ) × (Energy consumption per packet sent)
( In the simulation scenario, the research use lower bound of Bit Error Rate (BER) as the parameter. BER is number error bits that have been delivered from source to destination divided by total number bits have been delivered. This parameter is lower bound on BER in physical MiXiM decider module (decider for the 802.15.4 narrow band module) in the simulation. A data packet will be successfully received by a node if the BER value calculation shows that packet data node is still below the lower bound of the BER values.
The result of is based on two scenarios. Multipath routing enhanced by proposed method of network coding get better successful delivery ratio than the existing network coding multipath routing in the scenario 1. All the values are lower than the parameter. Figure 7 shows the result of scenario 1. From the Figure 7(a), it can be concluded that the proposed method has average of 3% for successful delivery ratio. The proposed method of network coding spends equal battery power to the existing network coding multipath routing in scenario 1. The difference is not significant, just 0,00085653 joule or 0,856 mili joule. It can be seen in Figure  7(b). This is because the battery module statistics of node does not measure the value of power that is consumed by the process computing network coding. Thus, the changes in proposed method of network coding multipath routing do not provide a significant improvement.
Next, 100% of data transmission is accepted in an application. Then, the proposed method of network coding requires less additional energy recovery (joule) than the network coding routing, about 5,58 joule for 500 packets sent. with the modification of existing algorithms in multipath routing (with additional parameters in the form of node power), it has proven to increase the reliability in WSN. Table 1 shows the summary of result in scenario 1. The proposed method of network coding gives improvement of reliability in WSN regarding successful delivery ratio and energy recovery. Based on scenario 2, in Figure 8, it can be seen that the proposed method of network coding gets better successful delivery ratio than the existing multipath routing. Using lower bound of BER as the parameter, the average improvement of proposed method is 3,0% from the existing multipath routing. However, the proposed method of network coding spends equal battery power to the existing network coding multipath routing in scenario 2. The difference is 0,0004 joule for 500 packets sent. Thus, the changes in algorithm multipath routing coding do not provide a significant improvement to existing algorithms. Moreover, the simulation results in the almost same value of energy consumption. With higher value of BER lower bound, it means that physical decider sensor nodes are more tolerant of bit errors in the received data packet. It certainly increases the successful delivery ratio, because the data packet is error and not acceptable. However, with its greater tolerance error rate, the data packet is worthy to be accepted. The differences in BER lower bound apparently do not affect energy consumption significantly. Even though the lower bound of BER value is changed, it still shows the insignificant difference in energy consumption. It is because a number of packet data transmission in the network is not outstanding or almost the same number as the number data packet in WSN (500 packets). WSN topology is flooded with the same number traffic and tries to send it to destination node. Thus, all nodes will make the equal numbers of data.
An application requires 100% of data transmission. Then, the proposed method of network coding requires less additional energy recovery (joule) than the existing network coding multipath routing. The improvement is about 5,58 joule for 500 packets sent.
With higher value of BER lower bound, it means that physical decider sensor nodes will be more tolerant of bit errors in the received data packet. With the more tolerance of physical decider sensor nodes, the smaller amount of packet data is considered an error and does not get to the sink node. This will certainly reduce the additional energy required to process of data error recovery or missing data packet. Thus, the modified algorithm on multipath routing gives a reliable improvement in WSN. Table 2 gives summary of result in scenario 2. The proposed method of network coding on multipath routing give improvement of reliability in WSN in successful delivery ratio and energy recovery. The successful delivery ratio is 186,1170, and current method is 186,1174. There is a little difference.

IV. CONCLUSIONS
The modified network coding multipath routing can improve the reliability of WSN. The existing method that only uses standard signal as parameter of intermediate node selection in routing discovery and maintenance is added with new mechanism to measure capacity of battery on the intermediate node. The proposed method can improve the reliability of the previous method regarding higher successful delivery ratio and lower additional energy recovery of WSN. This is because the proposed method is more selective in choosing the intermediate nodes. Not only these nodes can receive RSSI that exceeds the threshold, but it must also have capacity of battery that exceeds the set limit. Thus, WSN can be more selective and more efficient in using the existing wireless channels because not many nodes are involved. Finally, there will be more efficience in delivery data sensor of WSN.


extfieldsofstudy: Engineering Physics

text:
Image and Morphology in Modern Theory of Architecture

This paper is devoted to some important and fundamental problems of the modern Russian architectural theory. These problems are: methodological and technological retardation; substitution of the modern professional architectural theoretical knowledge by the humanitarian concepts; preference of the traditional historical or historical-theoretical research. One of the most probable ways is the formation of useful modern subject (and multi-subject)-oriented concepts in architecture. To get over the criticism and distrust of the architectural theory is possible through the recognition of an important role of the subject (architect, consumer, contractor, ruler, etc.) and direction of the practical tasks of the forming human environment in the today’s rapidly changing world and post-industrial society. In this article we consider the evolution of two basic concepts for the theory of architecture such as the image and morphology.

Introduction
One of the important problems that Russian architectural theory faces today is loss of self-identity. This may be explained by the long time of cultural isolation during the Soviet period, when Russian architectural theory fell out of the international architectural process. Currently, Russian architecture and architectural theory are trying to find a way back into mainstream architecture. However, a glance at contemporary Russian architectural theory reveals a range of important problems:  orientation to traditional historical and theoretical research;  orientation to ideal issues, vague cultural values and global generalizations;  substitution of architectural research by direct transfer and borrowing of concepts from the humanities;  methodological backwardness and indiscriminate borrowing of terms from foreign languages in incorrect translations. The creative potential of Russian architecture as a successor to the avant-garde's spirit of transformation is stifled with ideological constraints that keep plaguing Russian architectural theory.
A way out of the crisis in Russian architectural theory might be the development of a subjectoriented theory of architectural activity pursuing:  methodological renovation;  orientation of theoretical thought to the human needs of architectural practice;  focus on new forms of practice, with theory paving the way of practice. The development path of the Russian architectural theory towards to the subject-oriented theory is associated with basic ideas about the image and morphology of the architectural object. Since the concepts of image and morphology fully reflect the attitude and position of the subject in the architectural process. The paper consists of three blocks: historical lessons from Russian Avant-Garde architecture, evolution of ideas about the image and morphology -from perceiving to interpreting, design experience -from static volumes to variable multilayered environments.

Historical lessons from Russian Avant-Garde architecture
The evolution of contemporary architecture is associated with ideas and concepts that took place in the 1920s. The emergence of new architectural concepts in Russia is usually linked to the names of N Ladovsky, K Melnikov, I Leonidov, M Ginzburg, I Golosov, the brothers Vesnin; V Tatlin, V Kandinsky, and K Malevich. And we owe it to S O Khan-Magomedov [1], well-known Russian architectural historian, that the ideas of Russian avant guarde have become popular internationally. Russian architectural avant guarde experienced an extensive ideological influence of the formal method in art studies. An important role in the development of these ideas belonged to A Hildebrand and H Wölfflin, who had a profound influence on Russian scholars as well. Thus, A Gabrichevsky and V Favorsky studied in Germany. The development of the formal method lasted in Russia till the end of the 1920s.
The ideas of the formal school received different interpretations in the Russian context. Theoretical findings and innovative breakthroughs of Russian architectural avant-guarde in the 1920s had broad international repercussions, but it was banned in the 1930s among a whole variety of concepts and movements that were rejected by the Soviet state as contradicting Marxism.
Unfortunately, today the phenomenological tradition in architectural theory, both internationally and in Russia, is associated with the names of western scholars. However, as early as in the 1920s Alexander G. Gabrichesvky, a Russian art theoretician and historian, formulated a fundamental concept that anticipated the later western and contemporary philosophical and theoretical interpretations of architectural form generation along the phenomenological lines. It was impossible to get acquainted with A.Gabrichevsky's ideas until very recently. Only in the 2000s, a full collection of A. Gabrichevsky's work was published and caused a sensation in Russian art studies. He published most of his works on theory of art and architecture in the 1920s, which were not republished for a long time. Some of his works on art and philosophy of art were not published at all and existed in manuscripts.
For A.Gabrichevsky, the fundamental issue was that of primary elements in «plastic art experience» [2]: space and mass, thing and life, nucleus and shell. Leaving aside the pair «spacemass», which has been given a lot of attention in architectural theory, both Russian and international (in its «solid-void» interpretation), we will try to identify issues that are more relevant to the origin of the phenomenological movement in Russian architectural studies in the 1920s. We list the main provisions:  the bodily character of spatial experience,  thing as the fixing of a useful human gesture;  form as a trace of the living on the dead;  image as a hieroglyph. So the phenomenological interpretation of form by Gabrichesvky they had a basis, which was the formal method. In the phenomenological concept, the basis is the position of the individual experiencing his bodily presence in the world of things where the vitality of his gesture leaves a trace on the dead matter and generates an object (or a system of objects) as a shell/boundary between Self and non-Self.
The phenomenological approach may be regarded as conceptually primary, as all postulates of the compositional school of form generation may be derived from it, but not vice versa. It looks to the origins -the bodily character of spatial experience and, accordingly, the «barrier-ness» of form. Gabrichevsky's phenomenological concept sought to unravel human values and meanings in the vital form-building gesture and its fixing as a «trace» in material form.
During the period of its development, the Russian phenomenological school had no actively practicing architects/followers capable of linking this theory with advanced design practice, materials and constructions. The phenomenological concepts were untimely in the 1920s, when there were no today's shell forms, «nonlinear» materialisations of gesture or vanishing, changeable, fully transparent multilayered barriers.
Gabrichevsky's complex theoretical concept had like minds such as V Kandinsky, P Florensky, V Favorsky, and followers such as D Arkin, V Markuzon, etc. But the political and ideological situation in Russia in the 1920s was not conducive to its development. As a result, the Russian phenomenological school did not happen, but its ideas anticipated a number of tendencies that were later developed by western theorists of architecture such as J Itten, С Norberg-Schultz, Ch Day and that came to Russia much later, including through the interpretations of foreign authors such as M Heidegger, M Merleau-Ponty, P Riccoeur, etc.
The Russian phenomenological ideas in theory of architecture formulated by Gabrichevsky are in line with the contemporary humanistic views of the role and place of the subject in the world. It is to be hoped that they will not remain just history and find their way into modern-day architecture. Today's reflective, transparent, ghostly, nonlinear architectural forms may benefit a lot from formgeneration concepts such as nucleus-shell, shell-boundary, spatial volume, and gesture and trace, which seem to be more in line with the material and philosophical context of contemporary architecture.

Evolution of ideas about the image and morphology
In the context of contemporary consumer society, architectural activity should allow for a variety of values maintained by both the consumer and the architect, the engineer, the developer, the contractor, etc. Thus, it is important to understand the new role and place of the subject in the modern world and architectural process.
In Russia, the evolution to this understanding has been connected with the development of ideas of form under the influence of various philosophical and psychological concepts relating to the «perceiving individual» and have been progressing:  from concepts of visual perception by some abstract individual to those of the 'Interpreting Individual' who humanizes architectural space with his presence;  from the idea of socio-cultural determination of perception to the issue of «meaning», with a corresponding shift in emphasis from form building to meaning expression by means of architectural form;  from emphasis on the role of the languaged subject/interpreter who assigns meanings to material object to the priority of the subject/customer in architecture and inter-subject interactions in the design process. The reference points of architectural theory shift from the object to the subject and, thus, from the Perceiving Individual to the Interpreting Individual. Therefore, the authors of this paper sees the link between the image as carrier of meanings and the morphology of architectural object as the most significant direction of development for contemporary architectural theory.
Image is the basic concept for describing inter-subject interactions in architecture and introducing a value component into design activity, which is essential for meeting various human needs in architecture. The image of an architectural object as the basis of the communication process may be structured based on a certain model. One such author's model is suggested below. The specific feature of this model is the processuality and layered structure of the image. These structural layers/components of the image represent various value manifestations [3]:  the orientation component forms a psychological action space that determines the character of movement and emotional states of mind; The need to allow for the changing needs of the subjects/participants of the architectural design process leads to a change in the basic reference points of the architectural object's consumer as a representative of postindustrial society. Given this, the primary role shifts to the specificity of interaction between the images that exist in the minds of various subjects/participants of the design process with regard to the future architectural object. These images reflect, to a varying degree of divergence, the set of ideas about the functions, structure, comfort, identity and socio-cultural importance of the architectural object. It then becomes increasingly important to secure the preferred images in the morphological structure of the object.
It is obvious that the sensorily perceived morphological basis of architectural object cannot be reduced to compositional, typological or other characteristics, which is the traditional way of describing morphology in architectural studies. We need to identify fundamental components that underlie the «encounter» between the individual and the material-spatial world and mark its location. Such basic component is given by «barrier», which limits movement and defines space for possible action. It is supplemented with a «stimulus», coordinating and stimulating possible movements of the individual. We deal here with an essentially dual approach to describing the morphology of an architectural object: bodily spatial description introducing the position of the subject, and geometric description which does not include the position of the subject.
The bodily spatial aspect is described by the system «barrier -stimulus» [3]. It implies the bodily presence of the individual in the spatial object. Bodily spatial description rests on biologically inherited stereotypes determined by human corporeity, a special formation that determines the horizon of human experience before any thinking and, thus, anonymity, synthetic spatial experience without rational mediation or subordination to any function.
The geometry is described by means of well-known geometric systems: shapes, their superposition, modification, transformation, association with certain planes and surfaces and location, types of space and ways of their arrangement including linearity (unidirectionality) and nonlinearity (poly-variant type). This form of description presents an object as something «ideal» and abstract, existing independently from the subject. The fundamental principles of geometric description are represented by geometric archetypes. Archetype is a mental 'residue" of numerous ancestors' experiences, being quintessentially a form of inheriting the social, i.e. apriori comprehension and perception schemas that make the thinking possible. The fundamental principles, including the geometric ones, are present in the majority of historical, religious and philosophical works interpreting the issue of origin of the universe. The fundamental principles are manifestations of ideal Being in the form of living Being, which then becomes consciousness. The further existence of the fundamental principles appears as ideal realities, or geometric archetypes in our case, replicated in human creativity as a reflection of natural and cosmic laws. The emergence of ideal realities and the development of the process of alienation of the «ideal» from the «real» happen due to an operating system, natural language, which is a basis for the development of other artificial language-like formations.
The morphological structure of an architectural object understood through the system of barriers and stimuli is characterized by the introduction of the individual with his corporeity into space, where the body (not the geometry) determines a series of possible interactions with the object. This approach to constructing the morphological structure proceeds from the priority of the needs of various subjects

Design experience -from static volumes to variable multilayered environments
The classical concepts of architectural objects as architecture of buildings are becoming the past. The distinctive feature of the latest architecture is processuality and dynamism in the unfolding of the architectural object, realized in concepts of neutral and processual architecture of barriers, shells, and veils. Architectural form generation is revealed through the poetics of the barrier's contours as the art of creating "boundary-ness" by means of which the individual enters into relationships with the Other: environment, culture, society [3,4].
The dialogic nature of architectural object manifests itself in two aspects: as a space of action or being, and as an identity or 'face' of the object in the environment / culture. This is determined by the duality of sensory perception of the architectural object as a corporeal/tactile field with fixed boundaries of action, relationships between spaces and some degree of isolation, and as a visual field underlying the visual perception of these boundaries. The visual field of the object determines its perception as a system of barriers described by a varying degree of visual and light permeability, visual focusing or defocusing of the object's contours as a space of action, and structurality. The nature of the barrier determines dynamics in the relationship 'individual-object-environment' that unfolds through:  the fixing / demolition (and re-creation) of the spatial level of orientation;  identification of the degree of inclusion or isolation of the object's internal space in the spatial/temporal context of the environment (simultaneity in the experiencing of the external and the internal);  determination of plastic attitude towards the environment as a basis underlying the values and environmental qualities of the object, through:  traditional plastic techniques of treatment of the impenetrable enveloping plane,  disorganization, duplication, distortion in the mirror reflection of the enclosure surface,  disappearance and illusoriness of the visually transparent barrier,  stage-by-stage distancing of the multilevel barrier,  unstable geometry of the contour dissolving the form of the object in the environment and setting itself against the traditional orthogonal;  mobility, variability, transformability of the barrier. The relationship between the architectural object and the culture and history shows itself also through the characteristics of the enclosure surface:  traditionality, stability of routine forms of visually impenetrable barriers;  the eventful character of unstable visual fields creating new orientation sets of objects with transparent, reflecting and contour-variable enclosures;  the paradoxicality of geometrical shifts in enclosure planes. The variability of an architectural object's structure and its adaptation to various rapidly changing human needs is ensured by the use of multiply nested systems and different degrees of penetrability of the barriers (both material and optical) set on chaotic (arbitrary) spatial grids. A nested system implies the presence of some multilevel spaces permeating the building and making it possible to achieve certain variability in vertical circulation. In a nested system, we parametrically set the character and quantity of nestings, the capacity and orientation of ultimate nested elements, and the construction of the barrier. It also enables transition from orthogonal planning grids to chaotic ones, implying the introduction of another variable -the degree of surface curvature and maximum allowable range of its variation (from the standpoint of convenience of use and maintenance). The character of the barrier may vary over a broad range:  from a multilayered barrier to a nested system of spatial volumes (both principal and buffer ones) and relationships between them;  in the degree of penetrability and optical characteristics of the material barrier;  in the visual permeability and stability / instability of the optical barrier;  the degree of inclusion of natural components as barriers (plants, water, etc.). The processuality of an architectural object emphasizes both its adaptability and its social essence organizing a series of interactions between subjects and providing conditions for meeting their needs (including potential ones). The emphasis on the priority of the perceiving subject/consumer does not at all deny the presence of author's personality and does not impair the creative process; rather, it reveals new, yet unknown facets through a mechanism of identification of the architect's personality with the Other (the consumer), which allows one to come to know the Other and oneself through the Other.

Conclusion
In modern-day Russia, traditional architectural activities and ideas are being reviewed, largely under the influence of leading western architects who have matured in market-driven consumer society, towards more varied interaction between architect and society. Architectural design is gradually drifting away from a rigid administrative system, with a growing understanding of its polylogue character where each and every participant should have an opportunity to satisfy their needs without prejudicing the needs of another. An important role in this belongs to the changing concepts of image and morfology and idea of basic neutrality of architectural object, its openness to change, multiple use and polysemy of interpretations. The conceptuality and spatial-temporal variability of a modern-day building (and environment) is a basis for architectural design in the post-industrial context. The article deals with the evolution of representations about the image and morphology, the role of the subject in architectural design. The concept of a figurative and morphological structure of an architectural object is proposed, which determines the possibility of developing and improving polysubject concepts of modern architecture. The main points put forward in the work: Thesis one -image is the basic concept for describing inter-subject interactions in architecture and introducing a value component into design activity.
Thesis two -the phenomenological direction is oriented to establishing the fundamentals of spatial form organization from the standpoint of an individual with his corporeity. The system «barrierstimulus» introducing the standpoint of a subject with biological stereotypes underlying it. «Barrier» limits movement and defines space for possible action; «stimulus» coordinates and stimulates possible movements of the individual Thesis three -architectural form generation is revealed through the poetics of the barrier's contours, the art of creation of boundariness by means of which the individual enters into relations with Another: environment, culture, society. The poetics of boundariness reveals the artistic aspects of contemporary architecture. The fundamental difference of the contemporary architecture is its processuality and dynamism of an architectural object. The newest architectural objects are becoming multi-environment objects including: interior spaces, buffer spaces separating to a varying degree from exterior effects, open exterior environments with natural components.
The concepts proposed in the article are tested in experimental and educational design in Ural State University of Architecture and Art [4].


Privacy conscious architecture for personal information transfer from a personal trusted device to an HTTP based service

Modern services request personal information from their customers. The personal information is not needed only for identifying the customer but also for customising the service for each customer. In this paper we first analyse the existing approaches for personal information handling and point out their weaknesses. We desribe an architecture for the delivery of personal information from the customer to the HTTP based service in the Internet. For personal information storing our architecture relies on a mobile device, such as a customer’s mobile phone. The access of the service is conducted with a traditional desktop computer. The information is transmitted to the service on request via a desktop computer that fetches the information from a mobile device over a wireless link. The goal of our approach is to simplify the use of services by helping the customer to provide the required personal information. Furthermore our approach is designed so that existing services require only minor changes. We introduce methods for the customer to control his own privacy by providing notation to define the required security measures for automated data transfer. Finally we discuss the possible security risks of our architecture.

I. INTRODUCTION
John manages to publish a paper in a conference and now he has to arrange his trip to the conference. First he connects to the conference website and registers himself as a conference presenter. In the registration process he types in his personal information e.g. name, address, and phone number. After the conference registration he connects to the airline web page and reserves plane tickets to the conference. Again, he has to type in the same set of personal information. A similar procedure is repeated when John reserves a hotel room and orders the proceedings of the previous conference from the online bookstore.
The example above presents a typical case where services request information about the users of the service. In addition to personal information also the wishes, preferences or needs of the users are often queried by the web-sites. This gathered information, so called user profile, is then used for identifying the user as well as for personalising the content of the page like in the web based bookstore Amazon.com. According to LaRose et al. [1] , the information collected by web based services typically includes last name, credit card number, demographics, telephone number, street address etc., which Manuscript received June 29, 2004; revised May 09, 2005, and November 09, 2005. This paper was presented in part at the Conference on Software, Telecommunications and Computer Networks (SoftCOM) 2004.
Authors are with Lappeenranta University of Technology, Department of Information Technology (e-mail: {Pekka.Jappinen, Mika.Yrjola, Jari.Porras} @lut.fi) are all very private and can be used to identify the user. Similar results are presented by Heikkinen et al. [2] in their survey of over 100 websites offering personalised services. According to their research, most of the websites required personal information similar to the example above. The use of Internet services leads to a situation where the user has several different profiles in the web [3]. Although the information is gathered for personalisation purposes, the user centricity is decreased as the user is confused by what data each of the services holds in their user profiles.
In this paper we base our work on the fact that services request and use personal information and users provide this information to the services. We take a user-centric approach to the personal information management problem as we believe that the user should have ownership of his/her own profile data. We see that the data should be stored locally as the local storage is fundamentally more private. Therefore, in our approach the data containing personal information is stored at the user's personal trusted device, e.g. mobile phone. We present an architecture that uses this local profile storage in HTTP based services.
The rest of the paper is organized as follows. Chapter 2 considers the personal information and the location where it should be stored. This chapter also contains some related work from the field of our research. Chapter 3 describes the general architecture of our mobile device based approach. Chapter 4 discusses the personal information, its handling and the methods used to protect privacy. Chapter 5 describes the communication of different pieces of the architecture and shows how the architecture operates. In chapter 6 we go briefly through the potential attacks against our system. Finally chapter 7 concludes the paper and discusses future research.

II. PERSONAL INFORMATION MANAGEMENT
The term personal information can be interpreted in several ways. In personal information management (PIM), personal information means information that is owned by the user, e.g. to-do list, calendar notes or phone numbers. The personal information required for the personalisation of services is information about the given person such as name, address and different kinds of preferences. The latter is what we consider personal information in this paper. In [4] personal information is shortly analysed and then divided into user profile and identities according to the view point. If we are looking at the personal information from the user-centric point of view then we should talk about identities rather than user profiles collected by the services. Although the user-centricity is the main goal of our research, we use the general term personal information in this paper.
In our research the more important issue, than exact content of the personal information, is the management of the data. We have taken the existing approaches as the base for our work and propose an approach that combines the best parts of each approach. Figure 1 presents all these approaches, namely 1) registration, 2) database at network, 3) browser and 4) PTD based approaches. The existing approaches 1) -3) are shortly introduced in this chapter and motivation for our approach is given. Many of the current Internet services utilize the registration approach. Users have to register for the service before they can start using it. The service stores the information about the customers, i.e. user profile, into its database for further usage. Thus next time the user accesses the same service he doesn't have to provide the same information again. Instead, the service looks up the user profile from its database. In order to find the correct personal information from the database a user authentication is required. Besides the basic identifying information, services may request the user's preferences, follow the user's behaviour on the server and store the gathered information into an appropriate database. The stored information is then used to personalise the service i.e. adapt the service outlook and content into a more customer friendly form. Effective personalisation will provide better customer satisfaction and thus increase the customer's loyalty towards the service [5], [6]. Effective personalisation also requires a lot more information about the customer than just simple contact data.
However, the service database is not always the most optimal place for the information as claimed in [7]. As the variety of the used services grows, the places to where the user has to provide his personal information grow and the confusion about the contents of the user profiles increases. If the information needs to be changed the user needs to know all the places where the information is stored. It is unlikely that the user remembers all these places thus resulting in contradictory information. Another problem arises when considering the security of the personal information. When the information is stored in the service database, the user has to trust that the service provider is capable of storing the information securely enough. The more services the user uses, the bigger is the chance that one of them has weaknesses in their security system. To minimise the amount of databases the personal information is stored in, the customer can easily decide to concentrate on to only few service providers.
A second possibility is to store the personal information in a single database on the network. This database can be administrated by a trusted third party or the customer. Some of the single sign-on (SSO) approaches such as Microsoft .NET passport [8] and Liberty Alliance [9] can be used to provide a third party based solution for the personal information storage problem. However, originally the .NET passport required the service provider to pay a fee to Microsoft. This meant that small service providers could not afford to adopt the passport. It is also unlikely that temporary services like conference registrations are willing to do the extra work required to join in the SSO system especially when all they need is simple registration information for a one time event.
In Liberty architecture, service and identity providers form circles of trust in which the participants transfer information about the user. The creation of a circle of trust requires negotiations between the participating partners. Like in the .NET passport this is unsuitable for one time services provided by small service providers. In these approaches the user has to trust the third party and that the third party uses secure methods when handling the user's sensitive data. Also the trusted party has to be the same party for both user and service provider. If there are several third parties providing similar personal profiles, the service provider has to have a contract with most of them, in order to not exclude any users. Obviously, information stored on third party servers, is available only when a connection can be formed between the service provider and the servers. Thus the use of the service relies not only on the reliability of the network between the customer and service but also the network between service and the third party. This problem is graver in countries that have poor international Internet connections. Finally, the third party service may change the way it functions and the terms of use. For example Microsoft has stated that they will cease to offer passport functionality outside their own services. In Microsoft and Liberty approaches the user has no control over his/her profile, which is a serious drawback.
Other centralized approaches have been proposed. Koch proposes IDRepository that allows users to own their own profiles [10]. At the same time this approach supports complex user profile attributes. In the Wireless World Research Forums (WWRF) book of visions Bettstetter et al. suggested a user controlled personal profile server [11]. A more detailed solution was described by Thai et al. [12]. Their Integrated Personal Mobility Architecture relied on the customer's home network as a location to store personal information. Compared to third party approaches the user controlled database is easier for service providers since they don't have to have contracts with different third parties. The data is available for services when the profile server is up and running. A security conscious user will turn the service on only when needed, thus increasing security.
The third obvious location for the personal information storage is at the user end. New web browsers have the capability to store some information for the user. Thus, the information is stored in the place, from where it is easiest to use and update. There exist two approaches that can be used to determine what information will be filled in an empty form. In the first approach the stored information depends on the web page. The browser remembers what the user has typed into the form fields, when the form was filled in before. In the second approach the web page supports the browser's personal information scheme, so that the browser itself can determine what information is given in what field [13]. Although the web browsers will enhance this personal information storage functionality rapidly, it does not help the mobile or nomadic users. Mobile and nomadic users typically access the services from several different terminals at different places.
All the aforementioned approaches have problems in information access, security and management issues. Although offering personalised services whenever accessible, the service database approach suffers from security and management issues. The biggest challenge is in keeping the information coherent on different services. The trusted third party approach offers coherence but suffers from the access issue. It is possible that the user may connect to the service but the trusted third party is non-accessible. Accessibility is further improved by the use of a browser based approach. With this approach the personal information is accessible and updatable if the same browser or computer is used all the time. Unfortunately, this type of local information approach does not support nomadic users. To overcome these problems we have developed an approach where personal information is stored in the customer's mobile device. The personal information can be requested from there by the service either directly or via the service accessing device e.g. the desktop computer. In this approach the personal data is under the customer's control i.e. the customer always can access the data and can define who is allowed to fetch the data automatically. The data is available for the service when the customer is using the service. Therefore the service does not have to store all the data in its database.
Similar approaches have been proposed by many researchers. The EU funded Simplicity project [14] concentrates on the use of services through different terminals and devices. In order to provide seamless usage of services in different devices the Simplicity project proposes the use of a so called Simplicity device to store the user profile. Although several possibilities for the storage are given they conclude that the SIM + smart phone combination is not very far from the ideal storage and processing device. Thus from this point of view the Simplicity project is quite close to our approach. Riche et al. proposes in [3] a distributed client side approach where the user profiles are stored in several user devices. Each device can store a part of the profile. Although the approach is very intuitive as the user often uses a limited number of devices, the challenge is in the synchronization of the profile data, as seen in the paper. This concept is out of the scope of this paper as we consider only a single device as the storage for personal information.
III. PTD BASED APPROACH In this paper we present an approach that supports nomadic users and offers manageable, accessible and private storage of personal information. In our approach the personal information is stored in a single personal mobile device, i.e. Personal Trusted Device (PTD). The Personal trusted device term is used in many places. In electronic commerce/banking the personal trusted device means mainly a device that offers strong authentication of the user for the services [15]. Although authentication is important in some cases, it is not the main issue in our approach. Security issues of the PTD are also emphasized in the presentations of [16], [17]. In [17] the PTD is defined with the more extensive scope in mind, but the discussion is mainly on the security and privacy level. In our approach the definition and the purpose of PTD is more on the use of services through the PTD than on the security issues of the communication. Security issues are important, but they are only a part of the bigger scope of the PTD approach. For us personal means that the device is used only by one person: the owner of the device. This means that that person can trust that the device holds the right information and it is not tampered. The device has its own authentication method to verify that the owner of the device is handling it. PTD may be used for authentication purposes but it can also be used to enable anonymous personalisation of the service [18]. For us, PTD is a device that is carried around almost at any time and any place and it is used in local (personal area networking, local area networking) and in global communications. PTD is the centre or the hub of all personal communication the user wishes to perform. Our concept of the personal trusted device in personal communications is further explained in [19].  Figure 2 presents example cases where PTD can be used as a part of the service access. In a) and b) the services are used through the PTD whereas in c) PTD is just a complementary part of the service access. The actual access to the service in c) is conducted via a fixed terminal such as a desktop computer. In this paper we concentrate on case c). Approach a) is presented in details in [18].  The concept of PTD can be further expanded by considering PTD as personal information storage, as was done in [20]. The idea of PTD, e.g. mobile phones, is that it stays with the user all the time and thus the information stored in it can be accessed and used whenever necessary. In [20] a separate service, i.e. mobile electronic personality -ME, for personal information handling was defined. ME itself is a part of PTD as presented in Figure 2.
The ME service (presented in Figure 3), consists of two databases and a security agent. All the personal information is stored in the personal information database while information about the services and their authentication credentials are stored in the service definitions database. The security agent handles the requests of personal information. Before any piece of data is sent, there is a check to determine whether the requester has rights to the information [20].
Information confidentiality definition Information access rights for services.  The goal of this paper is to present how the personal information stored at the PTD can be used in traditional HTTP based services. The architecture for personal information transfer from a personal trusted device to a HTTP based service consists of four physical parts (Figure 4) User, personal trusted device (PTD), service accessing device (SAD) and the service. The service itself can be any type of service provided in the Internet. SAD is used by the user to connect to the service and is usually a desktop or a laptop computer. The PTD that contains the personal information is owned by the user and in general it can be a PDA or a mobile phone. Figure 4 shows the basic operations and parts of the system. The general process of service usage where personal information is accessed from PTD can be divided into 5 phases.
1) The user connects to the Internet service with the SAD by using generic Internet protocols such as HTTP.
2) The service requests personalization information from the SAD. 3) SAD connects to the PTD. 4) PTD transfers the requested information to the SAD. 5) SAD forwards the information to the service.
Depending on the type of information that is transferred, user action might be required between steps three and four. User action ensures that sensitive information, such as credit card numbers, is not transmitted without the user's consent. The privacy aspects have to be taken into account before the actual communication procedures are defined in more detail. If the user identity is required by the service, PTD may be used as an authentication token. The authentication credentials can be transmitted through the same route as personal information.

IV. PERSONAL INFORMATION AND PRIVACY
From a privacy point of view, different pieces of personal information vary from each other. There exists identifying information such as a real name or address that reveals the person's identity and thus may provide risk towards the privacy. Then there is the general preference information such as preferred type of sports, which alone does not reveal the identity, but can be used for service personalisation. The difference in the sensitiveness of the data should affect also on the handling of such data.
In the PTD based approach the data is stored at the user's PTD, from where it is fetched by the SAD when required. From a usability point of view, the fetching of data should happen automatically without extra effort from the user. On the other hand sensitive data should not be transmitted without the user's consent. The decision what information is transmitted automatically from PTD to SAD and which information requires explicit approval, has to be done by the user. In our model each piece of personal data has a security level attribute, which is a value between 0 and 9. The bigger the value the more sensitive is the data. This value is set by the user when the data is added on the database of ME. This approach was chosen to keep the system simple and understandable for the user although hardcore network users may prefer more options on configuration.
For each security level, the user can define what kind of security measures have to be taken into account, before the transaction of personal information can be committed. For ME, three distinct security measures have been defined:

1) Service authentication 2) Encryption 3) User interaction
Service authentication means that before the personal information is given, the service has to be authenticated as a trusted service. From the communication architecture point of view, three different grades of authentication can be identified. On grade one, service authentication is not required and the information is delivered to whoever requests it. On grade two, the service authentication is done by the SAD which informs the PTD about the service authentication. This approach is useful when SAD is a trusted device, such as the user's personal computer, that is used frequently to access services. Therefore, the SAD can be trusted to perform the service authentication. When dealing with untrusted SAD, such as a public computer, service authentication should be done by the PTD. This grade three authentication requires that a service certificate is stored at the PTD. Modern mobile phones and PDA's have enough memory to store the certificates and have enough computation power to accomplish the authentication in adequate time. In order to determine whether the used SAD is actually trusted SAD, the PTD should hold certificates of the trusted SADs. When the communication between SAD and PTD is created authentication of the SAD should be executed.
From an encryption point of view, the transmission of personal information can be either considered to be between PTD and the service or divided into two halves, namely SAD-PTD and SAD-service communication links. Encryption between the SAD and the service protects information eavesdropping on Internet communications, while SAD-PTD communication protects against local eavesdroppers. The encryption decision for these links can be independent from each other. Often the used service is accessed by using secure HTTP, where all the transmitted data is encrypted. When requesting the personal information, SAD should inform the PTD about the used encryption algorithm and the key size. This information provides the base for the PTD to decide whether the encryption is adequate for data to be sent. For SAD-PTD communication, wireless communication standards e.g. Bluetooth, have encryption mechanisms specified in them. ME can then decide whether the included encryption method is secure enough. When the encryption between separate links is not enough, encryption has to be implemented between the PTD and the service. Such an approach also prevents the SAD from eavesdroping personal information and is therefore recommended when the SAD cannot be trusted, e.g. when the service is accessed from a public computer at the library. Encryption between SAD and PTD requires encryption key exchange that will add some overhead to the actual communication and some complexity to the communication model.
User interaction means that the user explicitly expresses, by pressing the appropriate buttons on PTD, whether the given piece of information can be sent to the service or if transaction should be cancelled. In order to keep the service personalization as transparent as possible, the user interactions should be minimized. Therefore, only the most important information at highest security level, such as the credit card number, should require explicit user confirmation. Since the user might trust more on some services than others, the requirement for the explicit user action can be defined for each service separately. Just like the case with the personal information, also the services have appropriate security levels attached. The personal information, that has a lower or equal level than the level of service, may be sent without the user's explicit approval.
The used security methods are decided by the PTD and are based on the definitions made by the user at the configuration stage. For example, the user might require that for level 4 information the service has to be authenticated and the transmission should have at least a 128-bit encryption, while for level 5, a 256-bit encryption is required.
A lot of the privacy related research concentrates on defining the level of the user identity. In his PhD thesis Goldberg called these levels as nymities starting from verinymity where the user's real identity is known to real anonymity where nothing is known about the user's identity [21]. Several research projects such as DAIDALOS [22], Mobilife [23] and PRIME [24] have defined ways of handling a variety of pseudonyms the user may have when using different types of services. In our approach the user identity and nymity is not considered. User authentication, whether with pseudonym or real identity, is not conducted by ME. On the other hand, the user preference information can be acquired by the service even if the user has not been registered on the service. Thus it is possible for the user to remain anonymous and still gain the benefit from personalisation. For example, the user may get recommendations about the book types he prefers at the online bookstore without logging in. Once he finds something interesting he may log in to the service and reveal his identity to order the book. The user may not have even used the given service beforehand and gain the personalised recommendations anyway.

V. SERVICE USE AND COMMUNICATION
Let's go back to the example in the beginning of the paper where John was registering to the conference, but now he uses our architecture. Figure 5 describes the messages and actions required in such use. First John connects to the conference webpage just like before: he types in the conference URL and web browser then sends the request to the service. The conference server provides a web page for registration, which also contains a JavaScript that starts a plug-in program on the browser. The plug-in program handles the communication between the SAD and the PTD. It first forms the connection to the PTD. If there are several devices providing the personal information, John has to select his own PTD from a list. Then the plug-in requests the required personal information from PTD. Depending on the security settings John may have to accept the transmission explicitly from his PTD. The plug-in fills in the registration form with the acquired data. Finally the data is sent to the service when John presses the send registration button on the web page.
In order to determine, which part of the transmitted data is the name and which part is the address, a notation for the data is required. Unfortunately, personal information is marked in various ways depending on the situation. Service providers have their own proprietary ways to store it for their own use as do web browsers [13]. E-commerce has its own model for <xs:simpleType name="MESecLev"> <xs:restriction base="xs:integer"> <xs:minInclusive value="0"/> <xs:maxInclusive value="9"/> </xs:restriction> </xs:simpleType> <xs:element name="FullName"> <xs:complexType> <xs:simpleContent> <xs:extension base="xs:string"> <xs:attribute name="SecurityLevel" type="MESecLev"/> </xs:extension> </xs:simpleContent> </xs:complexType> </xs:element> Schema 1: Part of the schema for personal information field names that is designed for e-commerce purposes [25]. For contact information a vCard standard has been defined [26], [27]. In addition, several independent projects have defined XML based markup for the name and the address information [28]. Unfortunately, none of these are widely adopted in services so far. Also the aforementioned notations do not take into account the privacy issues stated in previous chapter nor do they include preference information.  To fulfill the needs of our approach we have developed a simple XML schema for personal information (Schema 1). The schema contains tag names for different personal information pieces and a MESecLevel attribute that states the security level of the given piece of information. The information is stored in the PTD following the XML schema. The same tag names are also used by the service when it requests personal information. Thus when a request arrives, ME simply browses through the DOM (Document Object Model) tree of the personal information database to find a tag that is equal to the one in the request.
To support our architecture, the conference organizer has to make some changes in the registration webpage. First of all there has to be a JavaScript code that starts the plug-in. Then the tag attributes that state which field is for surname and which is for address should follow the naming scheme of ME. Although a lot of research is going on in the semantic web research field for matching different notations to each other using ontology languages, the current version of the plug-in does not have such a possibility.
From the example above, it can be seen that the communication in our architecture can be separated in two separate parts: Service-SAD and SAD-PTD. Since the service is accessed via an HTTP protocol, the communication between the service and SAD naturally relies on the HTTP too. The communication between SAD and PTD is independent of the service access protocol. Therefore, even if the service access method changes from HTTP to another protocol, the defined SAD-PTD communication protocol remains the same. On SAD, the SAD-PTD communication is handled by a simple program such as a web browser plug-in [29]. This enables the possibility to use the method defined for personal information transfer between the mobile device and the transparent service provided through an ubiquitous network [30].
In our implementation Bluetooth wireless technology [31] is used for the SAD-PTD communication. Bluetooth consumes little power so that it can be used in mobile devices that usually rely on battery power [32]. In addition to that, the Bluetooth support on mobile devices is getting more common. Therefore, it is very likely that in the future most users that have a mobile device have also the Bluetooth communication capability. Bluetooth supports a variety of protocols and their use in different cases is defined in several profiles [33]. For our implementation an OBEX protocol was selected due to its simplicity. OBEX is also supported by the IrDA standard [34]. Therefore, the OBEX protocol stack is already implemented in most of mobile devices that support infrared communications.

A. Service-SAD communication
Communication between the service and the SAD is done by using an HTTP protocol. The messages needed for the personal information access, are encapsulated in the payload of the HTTP messages. This requires additional functionality to the SAD as well as the service, but allows the end user to use already familiar ways to access the services.
Since plug-in is used for handling the communication between SAD and PTD, it has to be activated by the HTML document that the SAD requested from the service. The activation is done by using JavaScript on the web page. The actual request can be either part of the HTML document or a parameter on the JavaScript that runs the plug-in.
In the HTML document approach the request is encoded on the web page throuhg a distinguished field where ID is a PERSONALISATION REQUEST. Plug-in can find this field by browsing the DOM tree of the document. The field contains a list of personalization information that the service requests. If the HTML Document holds a form to be filled, the field names on the form can be notated following the XML-schema for the personalization information. This way the plug-in can check the requested information from the field names. If the request is delivered as a parameter the request is decoded right at the SAD by the plug-in program. This is faster than browsing through the DOM tree. Support for both ways for request, helps the service providers to adapt the service to apply the ME approach.
No matter which way the request is done, it consists of a list of wanted personal information and optionally the certificate of the service. The requested personal information field names should match those that are defined in the XML schema for personal information. These are then forwarded to the PTD.
The response to the service is encapsulated also in the payload of the existing protocol message, such as HTTP POST. The response may contain the requested information as an whole, special code for providing reason for failure not getting information or just part of the information and explanation code. Again the personal information is tagged in XML following the XML schema for the personal information and is part of the response document.

B. SAD-PTD communication
The communication between the SAD and the PTD is done in two separate steps. The first step is to discover the Bluetooth devices that support ME ( Figure 6). After discovery, the retrieval of the personal information from PTD can be done (Figure 7).
In first step, all the devices in the range of the SAD are called via service discovery protocol (SDP) to find out devices that support the ME service and therefore have the capability to transmit personal information. SAD then shows all the found devices on its screen, from where the user can select his own PTD. PTD's Bluetooth hardware address (BDADDR) can also be stored in the user's plug-in configuration file to avoid the slow discovery process. After the correct Bluetooth device is determined, the normal Bluetooth connection forming takes place. When the OBEX connection is formed between the  The personal information request consists of five fields: size of service public key, service public key, authentication level, encryption level and requested personal information fields. These fields are separated from each other by a colon. If SSL (Secure Sockets layer) communication is used the plug-in can get the service's public key from the browser's database, otherwise the key should be in the incoming web page. If there is no public key available the size of the service public key is 0 and the key file is left empty. The authentication level defines whether the service is authenticated by the SAD or not. Encryption level defines the size of the encryption key used for the symmetric encryption of the SAD-service connection. If no encryption is used the encryption level is set to 0. In practice this means that when SSL is used for service access, authentication is set to 1 and the encryption level is bigger than zero. When using OBEX the request is encoded in the OBEX GET message.
For the personal information request there are two types of responses: personalization response, which contains the requested personal information and error response, which tells the reason why the requested information was not delivered. The reply is encoded as one object, which is sent to the SAD in the OBEX response message.

VI. SECURITY RISKS
The targets for possible attackers in the architecture can be divided into two groups: communication channels and hardware. For communication between the SAD and the service our architecture does not provide any real additional security measures. PTD may conduct the authentication of the service using the standard X.509 certificates and asymmetric cryptography on behalf of the SAD. This approach is similar to commonly used SSL connections The connection between SAD and PTD can also be compromised. There are several attacks developed against Bluetooth connections that utilise the insecure implementation of the Bluetooth stack on host devices [35], [36]. The short communication range of Bluetooth is not a valid security point either as there has been developed a device called the bluesniper rifle that can intercept a Bluetooth signal over kilometers of distance [37]. Even though Bluetooth uses a strong encryption algorithm it is possible to force connected devices to conduct a new key exchange process and after that eavesdrop on the communication [38]. Therefore, the connection has to be secured at the application layer.
The hardware targets for attacker may be the PTD, service or SAD. First of all the attacker may steal PTD and then take the information out from it directly. To prevent direct data theft from the device the user has to be authenticated before the preferences data on the database can be read or edited. An attacker may also try to pretend to be a trusted SAD or service in order to acquire information from the device. Used authentication methods based on asymmetric cryptography are reliable as long as the public key transfer is conducted safely. Man-in-the-middle attack during the keyexchange is a valid thread. Using a public SAD for eavesdropping the personal data transfer between the PTD and service can be prevented by end-to-end security measures stated in Chapter 3.
Although these risks are real our architecture has also some benefits from a security point of view. Attacking against the PTD or the communication channel will only provide the attacker information about one person. A service provider, holding big databases about its customers, is a much more attractive target to the criminal mind. Thus against an attacker who wants to steal identities of hundreds of persons, our architecture can be said to be more secure than existing systems. On the other hand when the target is a single person the advantage is not that clear. The more services the person uses the bigger is the risk that one of them has a vulnerability in their security system through which the personal data can be stolen. Thus it can be stated that the more services used the bigger the benefit, from a security point of view, for architecture.
The current security measures provide basic security, but the existing problems should be further researched. In that research it should be kept in mind that the main goal of the architecture is to add usability. Therefore the security methods should be kept as transparent to the user as possible.

VII. CONCLUSION
In this paper we have presented an architecture for transferring personal information stored in a mobile device to the Internet service. The mobile device as personal information storage location provides advantages for information security. Sensitive information is stored only at one place instead of many places, which means that up keeping the information is simple. The mobile device holds the information of only one person, which makes the device less of an attractive target for information thieves.
The information is available for any Internet service with the user permission regardless of user registration. Thus the usability of the services is enhanced as the users do not have to type in repetitive information in every service. The approach also enables the possibility to provide an anonymous user a personalised view of the service. The used approach requires little changes to the service itself as most of the work is done by an external downloadable browser plug-in. Therefore, the described approach can be applied in several existing services with little cost.
Further research is required to define an effective user interface for controlling personal information. User interface research should answer the question on how the user can easily define, which information can be acquired automatically by services and which services are actually allowed to do so. Additional research should be conducted on the security issues of the data transfer. Furthermore, support for identity management and pseudonyms should be researched.