Houda Hamdi-Rozé

) / Zeineb

Ben Ali

Martine Ropert

) / Lénaïck Detivaud

Samira Aggoune

Dominique Simon

Gilles Pelletier

Yves Deugnier

Véronique David

/ Edouard Bardou-Jacquet

-Houda Hamdi-Rozé

VARIABLE EXPRESSIVITY OF HJV RELATED HEMOCHROMATOSIS: "JUVENILE" HEMOCHROMATOSIS?

Juvenile hemochromatosis is a rare autosomal recessive disease due to variants in the Hemojuvelin (HJV) gene. Although biological features mimic HFE hemochromatosis, clinical presentation is worst with massive iron overload diagnosed during childhood.

Our study describes clinical features and results of genetic testing for a group of patients initially referred for a hepcidino-deficiency syndrome and for whom HJV hemochromatosis was finally diagnosed. 662 patients with iron overload and high serum transferrin saturation were tested, and five genes (HFE, HJV, HAMP, TFR2, SLC40A1) were sequenced.

Among our cohort, ten unrelated patients were diagnosed with HJV hemochromatosis. Genetic testing revealed five previously published and five undescribed variants: p.Arg41Pro, p.His180Arg, p.Lys299Glu, p.Cys361Arg and p.Ala384Val.

Surprisingly, this study revealed a late age of onset in some patients, contrasting with the commonly accepted definition of "juvenile" hemochromatosis. Five of our patients were 30 years old or older, including two very late discoveries. Biological features and severity of iron overload were similar in younger and older patients Our study brings new insight on HJV hemochromatosis showing that mild phenotype and late onset are possible. Genetic testing for HJV variants should thus be performed for all patients displaying a non-p.Cys282Tyr homozygous HFE hemochromatosis with hepcidin deficiency phenotype.

A C C E P T E D M A N U S C R I P T

INTRODUCTION

Juvenile hemochromatosis is a rare autosomal recessive disease, known to be responsible for severe iron overload in young patients, due to deleterious variants in the HJV (or HFE2) gene. HJV is located on chromosome 1q and encodes a 426 amino acid protein called hemojuvelin (HJV) [START_REF] Papanikolaou | Mutations in HFE2 cause iron overload in chromosome 1q-linked juvenile hemochromatosis[END_REF] which is a bone morphogenic protein 6 (BMP6) co-receptor. Hemojuvelin is a critical regulator of hepcidin expression, acting downstream of HFE or TFR2, which explain the severe phenotype observed in that disease. [START_REF] Latour | Deletion of BMP6 worsens the phenotype of HJV-deficient mice and attenuates hepcidin levels reached after LPS challenge[END_REF] Although biological features mimic HFE hemochromatosis (high serum ferritin and serum transferrin saturation), clinical presentation is more severe with massive iron overload associated to cardiomyopathy, [START_REF] Filali | Juvenile hemochromatosis HJV-related revealed by cardiogenic shock. Blood cells[END_REF][START_REF] Cherfane | A late presentation of a fatal disease: juvenile hemochromatosis[END_REF] hypogonadism, diabetes, cirrhosis, and an increased risk of death. [START_REF] Lamon | Idiopathic hemochromatosis in a young female. A case study and review of the syndrome in young people[END_REF][START_REF] Cazzola | Juvenile genetic hemochromatosis is clinically and genetically distinct from the classical HLA-related disorder[END_REF] The p.Gly320Val (c.959 G>T) is the most frequent variant responsible for HJV hemochromatosis, as reported in the first description of Papanikolaou et al. [START_REF] Papanikolaou | Mutations in HFE2 cause iron overload in chromosome 1q-linked juvenile hemochromatosis[END_REF] and in many other studies since. [START_REF] Lanzara | Spectrum of hemojuvelin gene mutations in 1q-linked juvenile hemochromatosis[END_REF][START_REF] Lee | Genetic abnormalities and juvenile hemochromatosis: mutations of the HJV gene encoding hemojuvelin[END_REF][START_REF] Walker | Juvenile iron overload--advances, but no answers[END_REF][START_REF] Aguilar-Martinez | Juvenile hemochromatosis caused by a novel combination of hemojuvelin G320V/R176C mutations in a 5year old girl[END_REF] For now, more than 40 variants in HJV gene have been identified. [START_REF] Core | Hemojuvelin and bone morphogenetic protein (BMP) signaling in iron homeostasis[END_REF] The mainstay of the phenotypical presentation is young age at diagnosis, symptoms of iron overload appearing between the first and third decade. [START_REF] Papanikolaou | Mutations in HFE2 cause iron overload in chromosome 1q-linked juvenile hemochromatosis[END_REF] Thus it is usually advised to test for HJV pathogenic variants in young patients (<30) with non HFE hemochromatosis. (12) (13, 14) However variable expressivity is well described in HFE hemochromatosis, [START_REF] Allen | Iron-overloadrelated disease in HFE hereditary hemochromatosis[END_REF] and has been reported in rare form of hemochromatosis [START_REF] Bardou-Jacquet | Variable age of onset and clinical severity in transferrin receptor 2 related haemochromatosis: novel observations[END_REF][START_REF] Hamdi-Roze | Rare HFE variants are the most frequent cause of hemochromatosis in non-c282y homozygous patients with hemochromatosis[END_REF][START_REF] Lan | Sex and acquired cofactors determine phenotypes of ferroportin disease[END_REF]. Regarding HJV, variable age of onset has been suggested in family from Japanese origin that may prompt to test for HJV even in patients older than 30. [START_REF] Koyama | Three patients with middle-age-onset hemochromatosis caused by novel mutations in the hemojuvelin gene[END_REF] This study reports our experience of patients with HJV hemochromatosis, their clinical features and the results of genetic testing. The intra-assay and interassay coefficient of variation was 3.5% and 6.3%, respectively and the lower quantification limit was 0,01nmol/l. The reference range for hepcidin concentration in normal subjects was 4 to 30 nmol/l.

A C C E P T E D M A N U S C R I P T

PATIENTS AND METHODS

Hemojuvelin (HJV)

Sequencing of the entire coding region and intronic flanking sequences of the HJV gene (NM_213653.3) was carried out. Sanger sequencing was performed until 2013 using the ABI Prism terminator cycle sequencing ready reaction kit and ABI prism 377 DNA sequencer (Applied Biosystems), or the BigDye terminator cycle sequencing kit and 3130 XL Genetic Analyser (Applied Biosystems). Since 2014, next-generation sequencing (NGS) has been performed using the Ion AmpliSeq Library Kit 2.0 and Ion PGM 200 Sequencing Kit (LifeTechnologies) following the manufacturer's protocol. Samples were sequenced on the Ion Torrent PGM and confirmed by Sanger analysis if a variant was found. To exclude association with variant in other genes involved in iron metabolism, sequencing of the HFE, HAMP, SLC40A1 and TFR2 coding and intronic flanking regions was performed. Moreover, microcytogenetic rearrangements were searched by multiplex ligation probe amplification (MLPA -MRC-Holland) on the five genes.

The pathogenicity of the newly identified missense variants was estimated according to their frequency in large public genetic databases (Exome Sequencing Project (20), 1000 Genome Project [START_REF] Brooks | A global reference for human genetic variation[END_REF], Exome Aggregation Consortium ( 22)), in silico predictions, and functional and segregation data when available. Classification of already described and newly found variants has been established according to the American College of Medical Genetics and Genomics (ACMG) guidelines. [START_REF] Richards | Standards and guidelines for the interpretation of sequence variants: a joint consensus recommendation of the American College of Medical Genetics and Genomics and the Association for Molecular Pathology[END_REF] Written informed consent for genetic analysis was obtained from all subjects or their parents if minors. Family study was offered when a variant was identified. 1.

A C C E P T E D M A N U S C R I P T A C C E P T E D M A N U S C R I P T

No deleterious variant was found in HAMP, SLC40A1 and TFR2 for these patients. However, sequencing of HFE revealed a p.Cys282Tyr/p.His63Asp compound heterozygosity in patient 9 and p.Cys282Tyr heterozygosity in patient 10. The variants identified are distributed all along the protein, without preferential location in one of the domains (Fig. 1).

Family study was available for 6 patients. Patient's 8 brother was homozygous for the p.Arg288Trp variant and had severe hemochromatosis with diabetes diagnosed at the age of 28. Screening in patient's 5 family uncovered the homozygous p.Arg385X variant in his 6 years old brother before the onset of iron overload or any clinical sign (normal serum transferrin saturation and ferritin). Heterozygosity was found in his parents, who had third degree consanguinity, and in his sister. In patient 2, 3, 6 and 7 who had heterozygous compound variants, family study identified heterozygous subjects for each variant, confirming that variants were situated in trans; all these individuals had normal iron blood tests.

Among this cohort, nine patients underwent phlebotomies which were well tolerated, whereas patient 5 and his brother both received iron chelating agents (deferasirox or deferoxamine), because of local practice habits. The two male patients with hypogonadism (patient 1 and 8) were treated with androgen replacement therapy.

A C C E P T E D M A N U S C R I P T

DISCUSSION

Among the patients referred for non HFE hemochromatosis with elevated transferrin saturation to our centre between 2005 and 2016, we identified 10 patients with HJV related hemochromatosis. Five HJV variants were previously published and five are new pathogenic variants. Clinical expression was diverse, varying from few symptoms to full blown picture with multiple organ damages.

As reported in previous studies, the p.Gly320Val variant was the most frequent in our patients. Their phenotype was consistent and did not differ from patients with other variants. No correlation between the types of variant and clinical nor biological features was found, due to the number of different variants and the variability of phenotype.

Five new variants in HJV were identified in our patients. Phenotype suggested a deleterious impact of these variants in all cases. For 4 of these variants, family studies confirmed the heterozygous compound state as variants were located in trans. According to the new ACMG guidelines, two of these variants (p.Arg41Pro and p.Lys299Glu) are of uncertain significance whereas three of them (p.His180Arg, p.Ala384Val and p.Cys361Arg) are likely pathogenic.

The variants in the N-terminal half of the protein impairs HJV-BMP6 binding, whereas those in the Cterminal part seem to prevent HJV secretion and its cleavage by TMPRSS6 [START_REF] Healey | Repulsive guidance molecule is a structural bridge between neogenin and bone morphogenetic protein[END_REF][START_REF] Pagani | Hemojuvelin N-terminal mutants reach the plasma membrane but do not activate the hepcidin response[END_REF]. The Arginine residues 41, 176 and 288 are important for the protein activity as their mutation decreases HJV membrane expression [START_REF] Rausa | Identification of TMPRSS6 cleavage sites of hemojuvelin[END_REF]. However, unlike Arg 176 and Arg 288 that are involved in HJV autoproteolysis, the variant p.Arg41Ala does not seem to have an impact on this process, although the reduced membrane expression could explain the milder phenotype observed in patient 2. Nevertheless, the Arginine to Proline variation discovered in our patient may impair the bone structure of the protein and prevent BMP-binding.

The newly found variant p.His180Arg affects a residue that forms an aromatic cage that stabilizes the highly conserved Arg 176 . [START_REF] Rausa | Identification of TMPRSS6 cleavage sites of hemojuvelin[END_REF] This role of His 180 may explain why a variation could decrease HJV efficiency.

Although the HJV protein is folded due to four disulfide bonds, the Cys 361 (that corresponds to the Cys 354 on the mouse protein) isn't involved in one of them. ( 27) Nevertheless, population, computational and allelic data allow us to classify the p.Cys361Arg as a likely pathogenic variant. Similarly the p.Lys299Glu and p.Ala384Val variants whose positions has not been investigated in functional studies, have convergent arguments to classify them as uncertain significance and likely pathogenic respectively.

The notable peculiarity of our study is the late age of onset in some patients, contrasting with the diagnosis of "juvenile" hemochromatosis. Five of our patients were 30 years old or older, including two very late discoveries, at 53 and 60 years old (patient 2 and 7). However biological features and severity of iron overload was similar in younger and older patients.

Reasons for this potential late expression are not obvious and do not seem to be linked to the type of variant. In the study by Koyama et al., variants in HJV were identified in the homozygous state in patients aged 48 and 51 with a phenotype similar to that of our patients. [START_REF] Koyama | Three patients with middle-age-onset hemochromatosis caused by novel mutations in the hemojuvelin gene[END_REF]. In our study, both

A C C E P T E D M A N U S C R I P T

patients 2 and 7 were compound heterozygous, respectively p.Arg41Pro/p.Arg176Cys and p.Leu101Pro/p.Ala384Val. The p.Arg176Cys variant had previously been described at a homozygous state in a 17-years old patient [START_REF] Ka | Phenotypic and functional data confirm causality of the recently identified hemojuvelin p.r176c missense mutation[END_REF] and at a heterozygous state associated with the p.Gly320Val in a 5-years old patient [START_REF] Aguilar-Martinez | Juvenile hemochromatosis caused by a novel combination of hemojuvelin G320V/R176C mutations in a 5year old girl[END_REF]. In the first description of the p.Leu101Pro variant, homozygous patients were aged from 8 to 23 years old [START_REF] Lee | Genetic abnormalities and juvenile hemochromatosis: mutations of the HJV gene encoding hemojuvelin[END_REF]. The p.Arg41Pro and p.Ala384Val were newly described variants which putative lower pathogenicity may explain this lower expressivity, although it may also be due to other genetic or environmental factors.

This variable age of onset and severity of HJV hemochromatosis is similar to the previously described variable expressivity of HFE [START_REF] Allen | Iron-overloadrelated disease in HFE hereditary hemochromatosis[END_REF] or TFR2 ( 16) related hemochromatosis. Of note their suggested interaction in the same signaling cascade at the cell membrane (2, 29) could explain similar susceptibility to modifying factor eventually leading to hepcidin deficiency. Thereby, patient 9 who had the highest serum ferritin was compound heterozygous p.Cys282Tyr/p.His63Asp in HFE which could have contributed to enhance the expression of disease.

In conclusion, our study shed new light on HJV hemochromatosis and suggests that although its clinical expression is often typical, milder phenotype and late onset are possible. Thus, genetic testing for HJV variants should not be restricted to young patients or severe iron overload and should be proposed in all cases of non p.Cys282Tyr HFE hemochromatosis with hepcidin deficiency phenotype.

AKNOWLEDGEMENTS

Figure 1

 1 Figure1legend: Distribution of the variants found in our cohort. Five variants have already been published (upper line) but the five others have been newly identified in our cohort, always at a heterozygous state associated with a known alteration. These variants seem to be evenly distributed on the protein. Construction was made using ProteinPaint.[START_REF] Zhou | Exploring genomic alteration in pediatric cancer using ProteinPaint[END_REF]

  variants were screened as part of the diagnosis activity of the French Reference Centre for Rare Genetic Iron Overload Diseases between 2005 and 2016. Genetic testing for HJV was performed in 662 patients with elevated serum ferritin (men > 300 µg/L and women > 200 µg/L) and/or hepatic iron overload according to liver biopsy or magnetic resonance imaging (>100µmol/g), associated with high serum transferrin saturation. Patients with HFE p.Cys282Tyr homozygosity were excluded.

	Human samples were obtained from the processing of biological samples through the Center for
	Health Biological Ressources (Centre de Ressources Biologiques Santé -CRB Santé) of Rennes BB-
	0033-00056.There search protocol was conducted under French legal guidelines and fulfilled the
	requirements of the local institutional ethics committee. All blood samples for biochemical assays
	and genetic testing were collected prior to any treatment (phlebotomy or chelator).
	Serum hepcidin-25 was quantified using a competition CE-marked Enzyme Immunoassay (EIA) kit (S-
	1337; Peninsula Laboratories International, San Carlos, CA, USA) following the instructions of the
	manufacturer. Serum samples were diluted in supplied standard diluent and analyzed in duplicate at
	450nm on a microplate reader (Victor®-Perkin Elmer Massachusetts USA). Hepcidin concentrations
	were interpolated from standard curves generated by logistic 4-parameter nonlinear curve fitting.

RESULTS

  Between 2005 and 2016, ten unrelated patients were diagnosed with HJV hemochromatosis. Their clinical and biological features are detailed in Table1.

	Genetic testing revealed five previously published variants: p.Gly320Val (c.959 G>T), p.Arg176Cys
	(c.526C>T), p.Leu101Pro (c.302 T>C), p.Arg385X (c.1153 C>T) and p.Arg288Trp (c.862 C>T) and five
	unpublished variants: p.Arg41Pro (c.122 G>C), p.Lys299Glu (c.895 A>G), p.His180Arg (c.539 A>G),
	p.Ala384Val (c.1151 C>T) and p.Cys361Arg (c.1081 T>C). Three patients were homozygous for the
	p.Gly320Val variant, one was homozygous for p.Arg385X and one for the p.Arg288Trp variant. Five
	patients were compound heterozygous: p.Arg41Pro/p.Arg176Cys, p.Leu101Pro/p.Lys299Glu,
	p.Leu101Pro/p.His180Arg, p.Leu101Pro/p.Ala384Val and p.Gly320Val/p.Cys361Arg. All new variants
	were found at a heterozygous state associated with a known pathogenic alteration.
	Results of pathogenicity classification for these variants are reported in Table

Table 1

 1

		: clinical and biological features
							Liver
							iron
	N°	Sex, age and ethnic origin	Clinical signs	Ferritin (ng/ml)	Tf sat (%)	Hepcidin (nmol/l)	range: Content (MRI) (normal	Liver biopsy	HJV variants	Variant classification
							<36
							µmol/g)
	1	M, 28	Hypogonadism	3300	58		350		p.Gly320Val	Pathogenic
		Caucasian							(c.959G>T)
									+/+
	2	M, 53	Arthralgia	4220	86			Massive	p.Arg41Pro	Uncertain
		Caucasian	Skin					iron	(c.122G>C)	significance
			hyperpigmentation					overload,	+/-
								cirrhosis		Pathogenic
									p.Arg176Cys
									(c.526C>T)
									+/-
	3	F, 27	Cardiac failure		85	1.6		Iron	p.Leu101Pro	Pathogenic
		Caucasian	Diabetes					deposits,	(c.302T>C)	Uncertain
			Secondary					no	+/-	significance
			amenorrhea					fibrosis
			Severe						p.Lys299Glu
			Arthropathy						(c.895 A>G)
			Skin						+/-
			hyperpigmentation
	4	M, 31		3700	91			Important	p.Gly320Val	Pathogenic
		Caucasian						iron	(c.959G>T)
								overload,	+/+
								severe
								fibrosis
	5	M, 8	Asthenia	282	83	0.7	190		p.Arg385X	Pathogenic
		North							(c.1153C>T)
		African							+/+
	6	M, 31	Arthralgia	2300	100			Iron	p.Leu101Pro	Pathogenic
		Caucasian						overload	(c.302T>C)
								433	+/-	Likely
								µmol/g		pathogenic
									p.His180Arg
									(c.539A>G)
									+/-
	7	F, 60	Asthenia	4800	86	1.1	340		p.Leu101Pro	Pathogenic
		Caucasian	Diabetes						(c.302T>C)
			Skin						+/-	Likely
			hyperpigmentation							pathogenic
									p.Ala384Val
									(c.1151 C>T)
									+/-
	8	M, 32	Hypogonadism	4959	90		350		p.Arg288Trp	Likely
		Caucasian							(c.862 C>T)	pathogenic
									+/+
	9	F, 30	Secondary	7137	100		Massive	Massive	p.Gly320Val	Pathogenic
		Caucasian	amenorrhea				overload	iron	(c.959G>T)
			Arthralgia					overload,	+/-	Likely
			Atrial fibrillation					cirrhosis		pathogenic
									p.Cys361Arg
									(c.1081T>C)
									+/-
	10	F, 16	Asthenia	2270	89		300		p.Gly320Val	Pathogenic
		Caucasian	Hypogonadism						(c.959G>T)
			Skin						+/+
			hyperpigmentation

ACCEPTED MANUSCRIPT

Figure 1


Sathish Ramakrishnan

Andrea Gohlke

Feng Li

Jeff Coleman

Weiming Xu

James E Rothman
email: james.rothman@yale.edu

Frederic Pincet
email: pincet@lps.ens.fr

High throughput monitoring of single vesicle fusion using free-standing membranes and automated analysis

Keywords: Content release, lipid mixing, holey silicon substrate, protein mobility, SNARE

In vivo membrane fusion primarily occurs between highly curved vesicles and planar membranes.

A better understanding of fusion entails an accurate in vitro reproduction of the process. To date, supported bilayers have been commonly used to mimic the planar membranes. SNARE proteins, that induce membrane fusion, usually have limited fluidity when embedded in supported bilayers.

This alters the kinetics and prevents correct reconstitution of the overall fusion process. Also, observing content release across the membrane is hindered by the lack of second aqueous compartment. Recently, a step towards resolving these issues was achieved by using membranes spread on holey substrates. The mobility of proteins was preserved but vesicles were prone to bind to the substrate when reaching the edge of the hole, preventing the observation of many fusion events over the suspended membrane. Building on this recent advance, we designed a method for the formation of pore-spanning lipid bilayers containing t-SNARE proteins on Si/SiO2 holey chips allowing the observation of many individual vesicle fusion events by both lipid mixing and content release. With this setup, proteins embedded in the suspended membrane bounced back when they reached the edge of the hole which ensured vesicles did not bind to the substrate. We observed SNARE-dependent membrane fusion to free-standing bilayer of about 500 vesicles. The time between vesicle docking and fusion is ~1s. We also present a new multi-modal open source software, Fusion Analyzer Software (FAS), which is required for fast data analysis.

INTRODUCTION

Model membranes are often used to mimic physiological processes in vitro. By offering a simplified and controlled environment, they provide valuable information that would be difficult to obtain from complex in vivo systems. For decades, membrane fusion, which is an archetypal example of such process, has been well reproduced and characterized using primarily small liposomes and supported membranes as model membranes. The well-established bulk liposome/liposome fusion assay detects cumulative effects. [START_REF] Weber | SNAREpins: minimal machinery for membrane fusion[END_REF] It provided the initial evidence that soluble N-ethylmaleimide-sensitive factor attachment protein receptors (SNAREs) are the core of the protein machinery that fuels membrane fusion and was subsequently used in hundreds of studies to better characterize this machinery. However, observation of a single fusion event is not possible with this assay because of the low sensitivity and time resolution. Hence, other technical approaches have been envisioned. For instance, Ha's group has developed a setup in which the fusion of two tethered vesicles is evidenced by monitoring the mixing of the lipids from both membranes. [START_REF] Yoon | Multiple intermediates in SNAREinduced membrane fusion[END_REF] Later on, this technique was further improved for content mixing measurements. [START_REF] Kyoung | Studying calcium-triggered vesicle fusion in a single vesicle-vesicle content and lipid-mixing system[END_REF] In most physiological fusion processes, small vesicles fuse with flat membranes, e.g. in neurotransmission, synaptic vesicles fuse with the presynaptic plasma membrane. Supported bilayers that mimic this flat geometry were employed to study SNARE-mediated single vesicle fusion events in combination with fluorescence microscopy. [START_REF] Domanska | Single vesicle millisecond fusion kinetics reveals number of SNARE complexes optimal for fast SNAREmediated membrane fusion[END_REF][START_REF] Fix | Imaging single membrane fusion events mediated by SNARE proteins[END_REF][START_REF] Kiessling | Single SNARE-mediated vesicle fusion observed in vitro by polarized TIRFM[END_REF] However, despite being an established tool the method suffers from immobile embedded proteins, interactions with the substrate, and lack of a second aqueous compartment. The protein mobility and substrate interactions were partially resolved by the introduction of polyethylene glycol spacer between the membrane and the substrate. [START_REF] Karatekin | A fast, single-vesicle fusion assay mimics physiological SNARE requirements[END_REF] While this technique allows the observation of single vesicle fusion by lipid mixing, it does not permit recording of cargo release through fusion pores. Due to the number of drawbacks associated with the supported bilayers, there is a demand for an alternative method to mimic the fluid nature of the native membrane separating two distinct compartments.

Pore-spanning planar lipid bilayers provide an attractive alternate system in which cis-and transside of the membrane can be monitored separately providing a native environment for membrane proteins and lipids. Claudia Steinem's group pioneered the generation of pore-spanning membranes and showed their application towards SNARE fusion. Using confocal microscopy, the group showed SNARE-mediated single vesicle fusion events on both supported and free-standing lipid bilayers. Each cavity was large enough to spatially address the lipid bilayer on top of the substrate. [START_REF] Schwenen | Resolving single membrane fusion events on planar pore-spanning membranes[END_REF] However, major disadvantages of the reported method are that the vesicles were mostly binding at the rim of the substrate, docking times were long, docked vesicle seemed to poorly diffuse and the fluorescence readout from top of the chamber requires large aqueous volume. An improved method proposed by the same group using larger holes overcame some of these disadvantages. [START_REF] Kuhlmann | SNARE-Mediated Single-Vesicle Fusion Events with Supported and Freestanding Lipid Membranes[END_REF] Despite a satisfactory lateral mobility of proteins, liposomes initially docked to the free-standing membrane tended to bind to the substrate upon reaching the edge of the hole.

Hence, only a few percent of liposomes actually fused with the free-standing membrane. These liposomes exhibited docking times between 4 and 60 s before final fusion occurred, which is on average shorter than supported membranes with observed docking times up to 150 s. [START_REF] Fix | Imaging single membrane fusion events mediated by SNARE proteins[END_REF][START_REF] Schwenen | Resolving single membrane fusion events on planar pore-spanning membranes[END_REF][START_REF] Bowen | Single molecule observation of liposome-bilayer fusion thermally induced by soluble N-ethyl maleimide sensitive-factor attachment protein receptors (SNAREs)[END_REF][START_REF] Xu | A Programmable DNA Origami Platform to Organize SNAREs for Membrane Fusion[END_REF] Since physiological fusions occur after ~1 s, the faster kinetics shows the relevance of free-standing membranes compared to supported membranes. No content release has been reported yet with pore-spanning membranes. However, since Boxer and coworkers have shown at a single vesicle level that inner leaflet lipids could mix without content release, [START_REF] Chan | Effects of linker sequences on vesicle fusion mediated by lipid-anchored DNA oligonucleotides[END_REF] it became clear that content-mixing experiments are crucial to derive conclusions of fusion experiments. Hence, it still remains challenging to mimic the physiologically relevant environment in an artificial system with fast fusion time scales and the ability to do content release experiments.

In addition to the development of model membrane systems, a computer-aided image analysis is required to decrease the work load in analyzing single vesicle fusion events. Currently, a majority of data analysis is based on manually defined regions of interest. However, this method is time consuming and labor intensive to analyze large data sets in particular. A previous study has used a particle tracking algorithm to speed-up data analysis. [START_REF] Smith | Computer-Assisted Tracking of Speckle Trajectories in Fluorescence Microscopy: Application to Actin Polymerization and Membrane Fusion[END_REF] This method provides a good setting for analyzing lipid mixing in the vesicles, but it is more labor intensive when both lipid mixing and content release need to be tracked. Also, it adds complexity when the method is based on porespanning membranes as the grid pattern needs to be recognized by the software for automatic processing of several holes.

Here, we propose an optimized pore-spanning lipid bilayer system capable of recording SNAREmediated fusion events by lipid-mixing as well as content release at a sub 50 ms time scale. In this system, a freestanding lipid bilayer containing the full length transmembrane t-SNARE complex (syntaxin 1/SNAP-25) was formed by Giant Unilamellar Vesicle (GUV) spreading on a Si/SiO2 chip exhibiting 5 µm wide holes. Fluorescent small unilamellar vesicles (SUVs) containing v-SNAREs (VAMP2) were added to this system, allowing us to monitor SNARE dependent single vesicle fusion events using confocal microscopy with a resonant scanner. Using this assay, we are not only able to follow lipid and protein diffusion in the planar membrane, vesicle docking and lipid spreading but also content mixing during the fusion process. In addition, we introduce a newly developed robust open-source analysis software, the "Fusion Analyzer Software" (FAS), that enables high-throughput analysis of membrane fusion recorded by fluorescence confocal microscopy. This program was mainly developed for the pore-spanning membrane system, but the source-code can be customized for other methods as well.

RESULTS

Generation of pore-spanning proteo-membranes and their characterization.

Pore spanning proteo-membranes are formed by the disruption of GUVs containing transmembrane proteins on a Si/SiO2 chip (Micromotive, Germany). Using optical adhesive (NOA 81, Norland Optical Adhesives) eight chips are evenly placed and glued to a glass coverslip and enclosed with 8-well Ibidi sticky slide (Figure 1A (i)). Each chip contains an array of thousands of cylindrical holes (5 µm diameter x 100 µm depth) which can each hold up to 2 pL of solution (Figure 1A (ii)). The measured dimensions of each well are 9.4 x 10.7 x 6.8mm (w x l x h) and a minimum volume of 300 µL solution is required to cover the chip. This setup makes the recording of membranes accessible by confocal microscopy. We previously published a suitable protocol for generating proteo GUVs through osmotic shock, which was shown to be applicable to a range of transmembrane and membrane-associated proteins, allowing them to retain their functionality. [START_REF] Motta | Formation of Giant Unilamellar Proteo-Liposomes by Osmotic Shock[END_REF] We used this protocol to prepare proteo-GUVs. Here, a full-length t-SNARE clone containing a single cysteine (SNAP25-Q20C) was expressed and purified, labeled with Alexa-488 and reconstituted into GUVs composed of 70 mol% 1,2-dioleoyl-sn-glycero-3-phosphocholine (DOPC) and 30 mol% 1,2-dioleoyl-sn-glycero-3-[phospho-L-serine] (sodium salt) (DOPS) with a protein to lipid ratio of 1:1000 in a 0.2 mM sucrose containing buffer (Figure 1B and Material and Methods for details on the protein and protocols). ii)

i) i)
ii)

Addition of GUVs 10 µm

Si/SiO 2 Coverslip Excitation Emission

After formation, the proteo-GUVs were pipetted onto a plasma cleaned, ethanol and water/buffer rinsed Si/SiO2 chip and centrifuged in presence of buffer (25 mM HEPES, 100 mM KCl, 1 mM DTT, pH 7.4) containing 5 mM MgCl2 to mediate the attachment and rupture of GUVs on the chip. The residual low amounts of sucrose incorporated into the proteo-GUVs lead to slow sedimentation. We found that controlled time-dependent formation of proteo-GUV is crucial to achieve maximum lipid bilayer spreading on the chip and should take about 45 mins for best results (Figure S1). Use of 5 mM MgCl2 is recommended to obtain high coverage in addition to GUV formation time. Unspread and loosely bound GUVs were removed by washing carefully with magnesium-free buffer. A homogeneous fluorescence distribution was observed across the hole showing that the incorporated proteins are spread evenly in the freestanding part of the bilayer (Figure 1C (i)). The fluorescence signal from the hole remained unchanged after 2 hours, confirming the stability of the lipid bilayer to perform time-lapse measurements (Figure 1

C (ii)).
The part of the membrane bound to the substrate (dark areas in Figure 1C (i)) is not visible because Si/SiO2 is opaque. This protocol can be adapted to generate pore spanning membranes containing any transmembrane proteins of interest.

Capturing of content beneath the pore spanning proteo membrane.

To verify that the proteo-membranes are pore-spanning and able to separate the bottom and top compartments from each other, we added 20 mM soluble Tetramethylrhodamine (TRITC) in the buffer prior to GUV rupture and a fluorescent lipid (NBD-DOPE) at 1.5 mol% in the bilayer; proteins were not fluorescent in this experiment. After spreading of the proteo-GUV on the substrate, the buffer was exchanged with TRITC-free buffer. Figure 2A shows that TRITC was entrapped under the pore-spanning membranes inside the holes. A subsequent wash with 20% Sodium Dodecyl Sulfate (SDS) detergent solubilizes the lipid membrane, resulting in release of the captured fluorophore (Figure 2B). Therefore, we can conclude that our formed pore-spanning membranes are intact and are sealing the holes. To test the lamellarity of the membrane spanning over the holes, we performed experiments with a bacterial toxin, -hemolysin, which is well known for its ability to form pores in the lipid bilayers. It is a 33 kDa water-soluble monomer that binds to the lipid phosphocholine head groups and spontaneously assembles on the membrane to form a 1.4 nm diameter heptameric transmembrane pore. [START_REF] Song | Structure of staphylococcal alpha-hemolysin, a heptameric transmembrane pore[END_REF] The -hemolysin heptamer is a 10 nm long mushroom shaped complex with a transmembrane domain length of 5.2 nm, which is nearly the size of a lipid bilayer.

Existence of multilamellarity can be detected in an artificial lipid bilayer using -hemolysin as it cannot span over the next bilayer and thus the transport across multiple membranes is not possible.

The estimated size cut off for transport of macromolecules by the pore is about 2 kDa. [START_REF] Ma | Biological nanopores for single-molecule biophysics[END_REF] The final density of -hemolysin pores is a few dozen pores/µm 2 . [START_REF] Kusters | Membrane-on-a-chip: microstructured silicon/silicon-dioxide chips for high-throughput screening of membrane transport and viral membrane fusion[END_REF] After formation of the proteo-GUVs, which included 1.5 mol% Atto647N-DOPE to mark the bilayer, 100 µM of Alexa Fluor 488 soluble dye was added to the chip. No fluorescence signal was observed in the hole below the membrane (Figure 3A). After addition of 0.5 µM of -hemolysin a rapid increase of Alexa Fluor 488 fluorescence signal was observed while the membranes remained intact (Figure 3B). The crossing of the membrane by the soluble dye would not be possible with multi-layers. This demonstrates that a single lipid bilayer was formed over the holes.

Mobility of lipids and transmembrane proteins.

Using fluorescence recovery after photobleaching (FRAP), we measured the lateral lipid diffusion coefficient using fluorescent lipids, dioleoyl-phosphoethanolamine-nitro-benzoxadiazolyl (NBD-PE, 1 mol%), in pore spanning membranes (Figure 3C). The circular bleached area completely covered a single hole and was sufficiently small (10 µm) to leave the fluorescence of neighboring holes intact. We recorded that fluorescence intensity was fully restored proving that the lipid molecules of both leaflets are able to migrate over the substrate and maintain continuity across the holes (Figure 3D). The obtained diffusion coefficient of 3.8  0.4 µm 2 /s was calculated by computing best fit to the recovery curves, which is slightly slower than in corresponding proteo-GUVs (~7 µm 2 /s), [START_REF] Motta | Formation of Giant Unilamellar Proteo-Liposomes by Osmotic Shock[END_REF] probably because of lipid/substrate interactions.

Mobility of lipids is not sufficient to make an in vitro membrane a good platform to mimic physiological processes. Lateral protein movement is necessary as well. The fluidity of the transmembrane protein was assessed in pore-spanning membranes made from proteo-GUVs containing Alexa488 labeled t-SNAREs. No recovery was observed upon complete bleaching of a single hole suggesting the protein cannot be exchanged between the hole and the substrate. To confirm this result and check that proteins are mobile within the pore-spanning membrane, an elliptical region of interest (~30 % of the hole surface) at the edge of the hole of the pore spanning membrane was continuously bleached for ~10 s. As a result, the fluorescence of the entire hole is bleached showing that the proteins on the pore spanning membranes are mobile, but not on the substrate, in contrast to the lipids (Figure 3E). These results indicate that the incorporated proteins are mobile across the hole and remain trapped inside a single hole, bouncing back on the rim of the substrate. Hence, each hole contains an independent pool of proteins. Proteins that interact with the substrate are likely to be almost immobile. This correlates well with supported bilayer observations and confirms the need for working with free-standing lipid bilayer to better mimic processes taking place in fluid biological membranes. The protein diffusion coefficient of the order of 1 µm 2 /s was roughly estimated by pseudoquantitative measurements (Figure S4).

To conclude the previous sections, we have developed a simple and efficient way of generating free-standing unilamellar pore-spanning membranes with integrated mobile transmembrane proteins to study processes happening in the membrane and/or transport across the membrane.

Here, we have used t-SNAREs but this protocol should work with any protein that can be inserted in proteo-GUVs by, for example, the osmotic shock method. [START_REF] Motta | Formation of Giant Unilamellar Proteo-Liposomes by Osmotic Shock[END_REF] Using the pore-spanning membrane to monitor physiological processes -the example of SNARE-induced membrane fusion: lipid mixing and content release. (400:1 lipid to protein ratio). Protein amounts and their activity after reconstitution was tested using SDS-gel electrophoresis and a bulk fusion assay (Figure S2). Note that, at this concentration, the ATTO647N dyes are initially quenched.

Figure 4. Lipid mixing assay A) (i) Schematic illustration of the fusion process and the corresponding recorded image sequences of the VAMP2 vesicle docked on the bilayer at different timings (Scale bar = 1 µm) (ii) Tracking of fluorescent liposomes on the pore spanning membrane. Fluorescence intensity of the vesicle was traced with an ROI (green) and the outer ROI minus the inner ROI to show subsequent lipid diffusion in the pore spanning membrane (red). B) Normalized fluorescence intensity of VAMP2-4X docked vesicles over time on the membrane undergoing photobleaching (100s) instead of fusion (1-2s). C) Survival curve of docked liposomes with v-SNAREs (VAMP2) and mutant v-SNAREs (VAMP2-4X) (Total number of vesicle analyzed, n=500).

In some experiments, to monitor content release, calcium ions were encapsulated in the v-SUVs;

Mag-Fluo-4 that was already present in the hole, beneath the bilayer, becomes fluorescent upon release of the calcium ions (see material and methods for details). v-SUVs (600 nM lipids) were added above the pore spanning membrane at 37 °C. We used an inverted laser scanning confocal microscope with a resonant scanner (16 kHz) and a 40x long working distance water objective.

With this setup, docking and fusion of single vesicles can be monitored with an acquisition rate of 30 images per second. We have analyzed a total of ~500 v-SUVs that fused or remained docked for at least 600 ms, 20% of them were obtained from experiments in which both lipid mixing and content release were monitored. Initially, all these v-SUVs displayed similar behaviors. They docked and freely diffused on the pore-spanning membrane. As expected from the mobility of the t-SNAREs, this potentially able to bind with a t-SNARE) (SI Movie 1, lipid). Then, the v-SUVs had two distinct fates: ~60% of them exhibited full fusion (Fig. 4A) and ~40% stayed docked on the membrane without fusion until their fluorescence was completely bleached (at which point they could no longer be monitored) (Figure 4B and Figure S3).

In lipid mixing experiments, fusion was attested by the sudden fluorescence increase of the ATTO647N dyes as a concentric spot followed with a burst. Then, as the lipids diffuse away, fluorescence decreased near the fusion spot. An elegant way to represent this migration of the lipids was proposed recently by Kuhlmann et al. [START_REF] Kuhlmann | SNARE-Mediated Single-Vesicle Fusion Events with Supported and Freestanding Lipid Membranes[END_REF] Fluorescence is simultaneously monitored in a circular region of interest (ROI) encompassing the fusion spot (inner ROI) and in an annular ROI surrounding the circular one (outer ROI). When the fluorescent lipids left the circular ROI, they had to enter the annular one. Hence, a decrease of fluorescence intensity in the circular ROI must be followed by an increase of fluorescence in the annular one. This is exactly what we observed in our system (Figure 4A), demonstrating that these were actual fusion events.

It has been suggested that lipid mixing alone during membrane fusion experiments can sometimes lead to incorrect interpretation of the results because inner leaflet lipid dequenching is not always connected with the opening of the fusion pore and thus content release. [START_REF] Chan | Effects of linker sequences on vesicle fusion mediated by lipid-anchored DNA oligonucleotides[END_REF] Hence, simultaneously tracking lipid mixing and content release is critical to assert complete fusion actually occurred.

In our experiments, content release was monitored at the same vesicle position coordinates as the lipid mixing (Figure 5A). The kinetics of both processes can be compared (Figure 5C). Upon release of the encapsulated calcium in the v-SUVs a rapid increase of Mag-Fluo-4 fluorescence, which was captured beneath the pore spanning membrane, appeared concomitantly with the dequenching of the fluorophore of the lipids (see also SI Movie 1-content). This confirms that the cargo of the v-SUVs has crossed the pore-spanning membrane through a fusion pore. The timing of the Mag-Fluo-4 peak depends on the amount of calcium trapped in the liposomes, concentration of calcium sensitive fluorophore trapped below the membrane, and the temperature. Since calcium and Mag-Fluo-4 are trapped in the hole after fusion, the total Mag-Fluo-4 signal represents the cumulative fluorescence of all successive vesicles that released calcium into the hole. Figure 5D shows an example of the kinetics of this increase. The tight encapsulation of calcium inside the SUV was verified in bulk by measuring the fluorescence of Mag Fluor-4 before and after the addition of detergent (Figure 5B).

To check that the fusion process is driven only by the SNARE complex, we performed similar experiments with SUVs containing a v-SNARE mutant, VAMP2-4X, that only partially assembles with t-SNARE. [START_REF] Krishnakumar | A conformational switch in complexin is required for synaptotagmin to trigger synaptic fusion[END_REF] Thus, these SUVs are expected to dock, but not fuse with the pore-spanning membrane. This is exactly what we observed. We recorded the docking of 200 SUVs containing VAMP2-4X. None of them underwent fusion. Instead, they all bleached after 100 secs (Figure 4 B and C). Figure 4C shows the survival curve of docked liposomes on the pore-spanning membrane, only the liposomes containing wildtype v-SNAREs are fusing to the membrane whereas the 4x-mutant v-SNARE SUVs stayed docked and intact at the membrane. Moreover, it can be seen that about 50% of liposomes containing wildtype v-SNAREs fused within less than 2 seconds after docking which is expected for non-regulated fusion. Hence the fusion events we observed here are specifically driven by the SNARE complex with physiologically relevant kinetics. It should be noted that ~ 36 % of v-SUVs containing VAMP-4X were preferentially located near the rim (see SI movie 2).

The Fusion Analyzer Software (FAS): Module for fast data

Advanced software tools in combination with experimental method development often provide the researcher with fast and reliable data analysis in order to navigate through large volumes of data without missing any important information. In our experiments, manually analyzing hundreds of fusion events is time-consuming to a point that makes it almost impossible. Besides, to extract as much information as possible on the kinetics, the acquisition rate must be as fast as possible.

The price to pay for this is a lower signal to noise ratio which makes the analysis even more complicated as it will require a clear assessment of the data quality. Hence, in addition to the development of the advanced proteo pore-spanning membrane system, we wrote a user friendly graphical interface software ("fusion analyzer", FAS) for automated detection of fusion events in both lipid mixing and content release experiments. This open source software is written using Matlab/C++ and gives access to multiple analysis modes. The data processing is performed in three steps, as shown in in figure 6A. The first component is a hole extraction module that applies a pattern recognition algorithm to detect the location and size of each hole and generates a pattern image in which the holes can be numbered to be processed and decrease computational cost by focusing on selected holes of interest. The second component is an image enhancement algorithm that is designed to improve the image quality, sharpening the edges of the fluorescence and reduce the noise. Silicon background reflection was removed by convoluting the original image with binary mask.

Figure 6. Fusion Analyzer Software (FAS). A) Diagram shows the steps involved in analysis. Movies from both fluorescence and transmission channel are imported to FAS (1) and convoluted with a Gaussian function to preserve object edges (2). Pattern recognition was employed to extract hole location and dimensions (3) and assigned a number to each hole for simplification and direct addressing (4). Background was removed by convoluting the mask obtained from pattern recognition (5). When the user chooses the desired hole to process, the program will extract the information of the particular hole (6), tracks the vesicles dynamically (7) and detect fusion events by measuring ROIs in each frame (8). B) FAS graphical user interface.

The final component is a dynamic tracking algorithm that extracts the information of vesicles in a space-time trajectory (x,y,t) and analyzes fusion in a two dimensional (2-D) dataset. Centroid and Gaussian fit was employed to track the location of the vesicles with high accuracy. Dynamic With regards to the data source, any imaging software can be used as our software works with avi-type movies as its primary source. In our case, we used avi-movies of 1000 frames (image size: 512 x 512 pixels) that have a size reasonable enough to perform the analysis on any laptop.

DISCUSSION

To date, there have been several setups used to study membrane proteins in model membrane systems. Supported membranes such as solid supported, tethered or polymer cushioned have been employed for a range of in vitro SNARE-mediated membrane fusion studies that allow for the detection of single vesicle fusion events, [START_REF] Domanska | Single vesicle millisecond fusion kinetics reveals number of SNARE complexes optimal for fast SNAREmediated membrane fusion[END_REF][START_REF] Fix | Imaging single membrane fusion events mediated by SNARE proteins[END_REF][START_REF] Karatekin | A fast, single-vesicle fusion assay mimics physiological SNARE requirements[END_REF] but have proven limited when it comes to the mobility of the incorporated proteins due to the interaction with the substrate. Pore-spanning membranes offer greater advantages over other established techniques as the reconstituted proteins can freely diffuse on the membrane and a second accessible aqueous compartment allowing this method likely to exhibit a more physiological environment.

Recently, pore-spanning membranes containing a t-SNARE ΔN49-complex were also used to study the fusion of LUVs containing v-SNAREs by lipid mixing. [START_REF] Kuhlmann | SNARE-Mediated Single-Vesicle Fusion Events with Supported and Freestanding Lipid Membranes[END_REF] Our setup provides significant technical improvements. First, while lipid mixing is a common indicator of membrane fusion, we included a content release assay which is required to address the study of the full fusion process including the opening of the fusion pore. Second, we are using SUVs instead of LUV to better mimic the geometry of the synaptic vesicle. [START_REF] Bentz | Fusogenic capacities of divalent cations and effect of liposome size[END_REF] Finally, our preparation of the Si/SiO2 chip is done by plasma cleaning followed by rinsing with ethanol, water and buffer making the system easy to establish. In the previous setup, the surface modification of the chip involves several non-trivial steps including coating with titanium, gold and n-propanolic 6-mercapto-1 hexanol to provide a monolayer surface, making it more challenging to apply. Both systems exhibit mobile proteins in the free-standing part of the bilayer. In our system, the protein density in the freestanding part of our membranes was stable for several hours.

Regarding the results of the fusion assay, our setup provided kinetics that are more physiologically relevant than any other setup. The time scale from the point the vesicle appeared in the frame and the disappearance of fluorescence signal after lipid mixing are broadly distributed between ∼600 ms and 4 s. Most of the recorded docking and fusion events occur within the first 3 seconds with ~50% of vesicles docking and fusing within 2 seconds. In comparison to the docking times and fusion rates of the other pore-spanning membrane fusion assay, [START_REF] Kuhlmann | SNARE-Mediated Single-Vesicle Fusion Events with Supported and Freestanding Lipid Membranes[END_REF] only a few percent of vesicles were docked on the free-standing part of membrane and also exhibited long docking times ranging from 4 to 60 s. These results are comparable to most established supported membrane studies exhibiting docking times in the range of tens of seconds. [START_REF] Fix | Imaging single membrane fusion events mediated by SNARE proteins[END_REF][START_REF] Kuhlmann | SNARE-Mediated Single-Vesicle Fusion Events with Supported and Freestanding Lipid Membranes[END_REF][START_REF] Bowen | Single molecule observation of liposome-bilayer fusion thermally induced by soluble N-ethyl maleimide sensitive-factor attachment protein receptors (SNAREs)[END_REF][START_REF] Xu | A Programmable DNA Origami Platform to Organize SNAREs for Membrane Fusion[END_REF][START_REF] Schwenen | Resolving single membrane fusion events on planar pore-spanning membranes[END_REF] Another striking improvement of our setup is the high fraction of docked vesicles that actually fuse. We observed that 64 % of the firmly docked vesicles ending up fusing. Conversely, previous studies presented lower percentage of fusion events (between 0.35 and 47%). [START_REF] Fix | Imaging single membrane fusion events mediated by SNARE proteins[END_REF][START_REF] Kuhlmann | SNARE-Mediated Single-Vesicle Fusion Events with Supported and Freestanding Lipid Membranes[END_REF][START_REF] Bowen | Single molecule observation of liposome-bilayer fusion thermally induced by soluble N-ethyl maleimide sensitive-factor attachment protein receptors (SNAREs)[END_REF][START_REF] Xu | A Programmable DNA Origami Platform to Organize SNAREs for Membrane Fusion[END_REF][START_REF] Schwenen | Resolving single membrane fusion events on planar pore-spanning membranes[END_REF] Only one paper reported kinetics frequency of fusion close to ours. It used a supported membrane system that exhibited high percentage of fusion (50%) and shorter times scale (less than 1 sec). [START_REF] Karatekin | A fast, single-vesicle fusion assay mimics physiological SNARE requirements[END_REF] This observation of faster docking times and a higher fusion rate compared to previous studies with freestanding membranes may be explained by the use of SUVs instead of LUVs. As the LUVs exhibit longer docking times they are more likely to get immobilized at the rim of the hole in the pore-spanning bilayers. This behavior of collecting near the rim has also been recorded in about 36 % of the cases when using VAMP4X vesicles in our assay however this rarely occurred when using SUVs including wildtype v-SNAREs. The timescale of our recorded docking and fusion events is considered to be physiological relevant in most SNARE mediated fusion events. [START_REF] Kasai | Distinct Initial Snare Configurations Underlying the Diversity of Exocytosis[END_REF] An interesting future extension of this work will be a faster acquisition speed and the incorporation of regulatory proteins such as synaptotagmin, Munc-13, Munc-18, and complexin.

Overall, the study shows that dual detection (lipid and content release) method is a comprehensive measure to detect full fusion events. In addition, we have presented a new software, Fusion Analyzer (FAS), for measuring dynamic vesicle fusion to pore spanning membranes.

MATERIALS AND METHODS

Materials

Proteins expression and purification:

The full-length t-SNARE complex and Cys-t-SNARE complex (FLT-SNAP25B, Q20C) were derived from plasmid pTW34, and were expressed and purified as previously described. [START_REF] Li | A half-zippered SNARE complex represents a functional intermediate in membrane fusion[END_REF][START_REF] Li | Kinetic barriers to SNAREpin assembly in the regulation of membrane docking/priming and fusion[END_REF] Cys free mouse VAMP2 (pet-SUMO-VAMP2, C103S) and Cys-VAMP2 (pet-SUMO-VAMP2, S28C, C103S) was derived from wild type VAMP2 (pet-SUMO-VAMP2) and were expressed and purified as previously described. [START_REF] Shen | Selective activation of cognate SNAREpins by Sec1/Munc18 proteins[END_REF] Protein activity was verified after each protein preparation using t-SNARE, v-SNARE liposomes in a bulk fusion assay (Figure S1). [START_REF] Weber | SNAREpins: minimal machinery for membrane fusion[END_REF] In this bulk assay, the v-SNARE vesicles contained a quenched mixture of NBD and Rhodamine (1.5 mol% each). Upon fusion with t-SNARE vesicles the fluorescent lipids dilute and a consequent increase in NBD fluorescence can be recorded. The mutant 4x VAMP2 (VAMP2-4X) was produced by cloning the full length, mouse VAMP2 into a pET SUMO vector that includes N-terminal 6x His tag, followed by site-directed mutation of L70D, A74R, A81D, and L84D and were expressed and purified as previously described. [START_REF] Li | Kinetic barriers to SNAREpin assembly in the regulation of membrane docking/priming and fusion[END_REF] The cytosolic domain of the v-SNARE (CVD) has been expressed and purified previously described. [START_REF] Motta | Formation of Giant Unilamellar Proteo-Liposomes by Osmotic Shock[END_REF] We used VAMP2-4X vesicles as a control containing half zippering 4x mutant v-SNAREs (Figure S2-B) As another control, FLT-liposomes were preincubated with CDV (the cytosolic domain of VAMP2, residues 1-94) preventing the docking of FLV-liposomes. In the bulk assay, we found that, as expected, only v-SNARE vesicles progress to fusion, whereas experiments with VAMP2-4X and CDV vesicles did not display any significant fusion (Figure S2-C).

Proteins labeling:

The transmembrane t-SNARE Q20C was labeled with Alexa Fluor® similarly to previous reports. [START_REF] Motta | Formation of Giant Unilamellar Proteo-Liposomes by Osmotic Shock[END_REF] The protein was first reduced by incubating with 4 mM TCEP for 30 minutes at 4 o C with gentle rotation and centrifuged at 14,000 rpm for 20 minutes at 4 o C to remove any precipitation. Fluorescence dye was added into the protein solution at a molar ratio of 3:1 and the mixture were incubated for 1 to 2 hours at room temperature with gentle rotation. Unreacted dye was removed by passing through a PD MidiTrap G-25 column (GE Healthcare) three times.

Proteoliposomes Reconstitution: SNARE proteins were reconstituted into liposomes using rapid detergent dilution and dialysis as previously described [START_REF] Scott | Liposome fusion assay to monitor intracellular membrane fusion machines[END_REF] with slight modifications. Previous studies have shown that rapid dilution produces a narrow distribution of liposomes similar to the size of synaptic vesicles (30-50 nm). [START_REF] Ji | Protein Determinants of SNARE-Mediated Lipid Mixing[END_REF] The small vesicle diameter is crucial for measuring in vitro fusion, as these vesicles possess a high curvature stress making it more fusogenic than larger vesicles. interface. The same procedure was employed for the reconstitution of VAMP2-4X liposomes.

Ca 2+ loaded SUVs: Calcium (50 mM) encapsulated liposomes containing v-SNAREs (protein: lipid ratio: 1:400) were prepared as previously described [START_REF] Shi | Preparation and characterization of SNARE-containing nanodiscs and direct study of cargo release through fusion pores[END_REF] with small changes. Atto-647N-DOPE was used as a lipid marker and v-SNAREs proteins were incorporated into liposomes. Freshly prepared liposomes were checked for calcium encapsulation by recording the fluorescence of the liposome sample on the plate reader in the presence of 2 µM Mag-Fluo-4 for 30 min. If the signal remained stable, 10 µL of 2.5% dodecyl maltoside was added to the sample and a fluorescence increase of Mag Fluor4 was recorded due to the release of calcium ions. In this study, we only used liposomes in the single vesicle assay which showed no calcium leaking in the plate reader for at least 30 minutes. Calcium loaded liposomes were always made fresh before fusion experiment.

t-SNARE-GUV formation by osmotic shock:

GUVs containing t-SNAREs were prepared as previously described. [START_REF] Motta | Formation of Giant Unilamellar Proteo-Liposomes by Osmotic Shock[END_REF] Briefly, the coverslip glass was cleaned with isopropanol and a dust free tissue and dried with pressurized Argon. A 2 µl drop of small liposomes solution was placed on the coverslip and dried at room temperature under atmospheric pressure. Then, it was rehydrated with 6 µl deionized water, and dried again under the same conditions. In the next step the lipid film is rehydrated once more with a larger deionized water volume of 10 µl for 45 mins. GUVs grew instantly from the rehydrated lipid films mainly in the areas with high concentration of lipids resulting in a buffer concentration of 25 mM HEPES, 100 mM KCl, 1mM DTT, pH 7.4.

Generation of free standing lipid bilayer: Si/SiO2 chips containing an array of 5 um holes (Micromotive, Muenster, Germany) were glued with optically clear adhesive (Norland Optical Adhesives, NOA 81) to an eight-well sample holders (Ibidi sticky slide cat. no. 80828). The chips were cleaned using plasma for 4 mins. To prevent air bubbles in the holes the chips were incubated for 5 min in 300 µL ethanol on a shaker, followed by 5 times 300 µL rinse with water. It is important that the chips do not run dry because air bubbles could possibly form in the holes. The water is exchanged through a 5 times rinse with 300 µL of 5 mM magnesium chloride (MgCl2) containing buffer (25 mM HEPES, 100 mM KCl, 1mM DTT, pH 7.4). The bilayers prepared for content-release experiments had 1 mM MgCl2 to reduce Mg 2+ ions interactions with fluorophores trapped below bilayer. 2x10 µL of preformed proteo-GUVs was pipetted onto the chip with a halfcut pipette tip. The GUVs were allowed to settle for about 20 minutes and centrifuged in a microplate holder for 5 min at 100 x g. Non-spread GUVs and the magnesium chloride are then removed by a final 5 times rinse with 300 µl magnesium free reconstitution buffer. Same osmolarity was maintained on both sides of the membrane. Lamelarity of the membrane was tested using 0.5 µM α-hemolysin. Sealing of the pore-spanning membranes was studied by first capturing 20 mM TRITC beneath membrane followed by with 20 % SDS.

Fusion assay: In order to record membrane fusion v-SUVs (600 nM lipid) were added to the pore spanning membrane containing Alexa488-labeled t-SNAREs in 25 mM HEPES, 100 mM KCl, 1mM DTT, pH 7.4 at 37  C. Fusion was followed by lipid mixing (tracking 3 mol% Atto647N-DOPE in V-SUVs) and content release. In the latter setup, calcium was captured in the v-SUVs whereas buffer containing a calcium-activated fluorophore, 20 µM Mag-Fluo-4 (Kd for calcium:

22 μM), was trapped below the pore-spanning membrane. Here, x is the distance from the origin in the horizontal axis, y is the distance from the origin in the vertical axis, and σ is the standard deviation of the Gaussian distribution.

Further, the smoothened dataset is filtered with median filter to sharpen the image by having a median value in a 3-by-3 size around the corresponding pixel in the input image. A binary mask for every frame in the dataset is created with the value above the threshold. The values below the threshold are assumed to be zero, whereas those above threshold are unaltered. An 8-connectedcomponent labeling method is employed to identify the objects that have minimum eight point connected regions in the frame, which is ideal to get rid of a few pixels noise. We consider the objects as vesicles if it has an area above thresholding, which is 40 pixels in our case for a 40X

water immersion objective with NA = 1.1. As the area of the vesicles depends on the objective magnification, these numbers can be adjusted to get accurate tracking. Properties of the vesicles such as area and location were measured. The location of the vesicles can be traced by repeating the above procedure for every frame in the dataset. Generally, algorithms that track single particles either depend on finding the centroid and fitting Gaussian curves to the intensity or crosscorrelation. We chose a simple and efficient method to estimate the absolute positions in each image independently by calculating the centroid of two sequential images of a vesicle for calculating the distance vesicle moved. We assume I is the intensity of an image with object and background. Eq. 2 gives the centroid calculation for a single axis: where 𝑖 is the coordinate on the axis, 𝑖 is the coordinate on the axis and Iij is the intensity of the pixel. Centroids are calculated for one image and subtracted for a successive image to determine the distance of the object moved. These numbers are useful to extract the diffusion coefficient of the particle and track the movement of the vesicle itself.

Analyzing Membrane Fusion:

Our newly developed open source software "Fusion Analyzer" is an advanced platform to simplify the analysis of measuring fusion to free-standing lipid membranes. To track membrane fusion events, in each frame two region of interest (ROI) were drawn on the image of the freestanding membrane, one that tracks the vesicle movement and the other one drawn outside the vesicle ROI. When no vesicle could be found, both ROI were drawn at the center of image (x/2, y/2). In the event of fusion, the fluorescent lipids from the vesicle spread from the vesicle ROI to the outer ROI, which increases the fluorescence intensity in the outer annular ROI channel. Based on the intensity remaining in the vesicle ROI and outer annular ROI, the software can predict the stages of fusion such as docking, hemi and full fusion. A user manual of the program and sample data is available at the website for download.

ASSOCIATED CONTENT Supporting Information

The Supporting Information is available free of charge on the ACS Publications website.

Fusion Analyzer Software (FAS) MATLAB Source-code: All the functions required to run both lipid and content mixing analysis can be found in the file. (PDF) The files can also be downloaded from Matlab Central "https://www.mathworks.com/matlabcentral/fileexchange/66521-fusionanalyzer--fas" Movie 1: Movies showing docking and fusion event of v-SUVs by lipid mixing (ATTO647N-DOPE, movie 1 -lipid) and content release (Mag-Fluo-4, movie 1 -content) to a freestanding bilayer containing t-SNAREs cropped from a typical larger movie acquired using Leica confocal scanning microscope (LSCM) at a speed of 27 frames/s. This movie is in avi format that can be opened with ImageJ. (Size of hole: 5 µm) (AVI ) Movie 2: Movie showing VAMP2-4X vesicle (Atto647N-DOPE) dock on the freestanding membrane containing t-SNAREs without proceeding to fusion. The movies were acquired in LSCM at a speed of 2.6 frames/s. This movie is in avi format that can be opened with ImageJ. (Size of hole: 5 µm) (AVI)

Figure 1 .

 1 Figure 1. Pore spanning Proteo-Membrane formation on a Si/SiO2 chip A) (i) Implementation of the chip into a microscope suitable setup (ii) Schematic representation of the chip; the path of the laser beam (excitation) and emitted fluorescence (emission) are indicated in one hole at the edge of the chip B) Picture of proteo-GUVs with Alexa488 labeled transmembrane proteins (t-SNAREs) during their formation with the osmotic shock protocol C) (i) Confocal image of pore spanning membranes formed by spreading proteo-GUVs containing Alexa488 labeled t-SNARE on aSi/SiO2 chip. Fluorescence can only be seen over the hole as the substrate is opaque. Each fluorescence green dot depicts the presence of transmembrane protein above holes and attests that there is a pore-spanning membrane. (ii) Time lapse of the fluorescence signal from the pore-spanning membrane shows that the protein concentration remains constant over several hours.

Figure 2 .

 2 Figure 2. The pore-spanning membrane physically isolates the lower compartment from the upper one. A) Imaging of 20 mM entrapped soluble Tetramethylrhodamine (TRITC) dye below the pore spanning membrane. The fluorescent lipids, NBD-DOPE, of the bilayer are shown in green (left) whereas the trapped soluble fluorophore is shown in yellow (right). B) After solubilizing the lipid bilayer with 20% SDS, no fluorescence signal was observed in the lipid (left) and the trapped soluble dye (right) channel indicating that the trapped soluble dyes have diffused out of the hole.

Figure 3 .

 3 Figure 3. Unilamellarity and fluidity of the pore-spanning membrane. A) Images showing the influx of soluble Alexa Fluor 488 dye to the hole through -hemolysin pore formed on the pore-spanning membrane (Left two panels). The focus of the microscope is in the hole, several micrometers below the membrane. No fluorescence was observed at the start (t=0s) and a rapid increase in fluorescence (until t= 500s) after pore was formed demonstrates that the membranes are unilamellar. Lipid bilayer fluorescence on the right panel was imaged with ATTO647N-DOPE B) Time dependent fluorescence intensity increase of soluble Alexa488 inside the hole upon the addition of -hemolysin. C) Representative confocal laser scanning images showing recovery of fluorescence lipids (NBD-DOPE) after photobleaching. Complete loss of fluorescence in the holes (white circle) after photobleaching and the fluorescence recovery shows that pore-spanning membranes are continuous with appropriate fluidity. D) FRAP recovery curve of incorporated fluorescent lipid NBD-DOPE after completely bleaching a 10 µm circular area encompassing one hole and part of the surrounding substrate. The recovery curve corresponds to a diffusion coefficient of 3.8 ± 0.4 µm 2 /s. E) Alexa488 labelled reconstituted proteins in pore spanning membranes shown in green. Representative snapshots of pre-and post-bleached state of a hole. The white ellipse on the left panel represents the elliptical ROI that covers onethird and within which the protein fluorescence was bleached. Complete loss of fluorescence over the entire hole area indicates that all the proteins within the hole have passed through the bleaching area and is evidence of protein mobility in the pore-spanning membrane.

  the core molecular machinery that drive membrane fusion, which represents the final step in many trafficking pathways. The assembly of t-and v-SNAREs bridges the membranes and is capable of bringing them into very close contact and eventually fusion. Upon opening of the fusion pore, the membranes are mixed and the vesicle content is released towards the other side of the membrane (Figure4A (i)). In this part, we will show that our pore-spanning proteo-membranes provide a suitable platform to simultaneously monitor both membrane mixing and content re-lease during the fusion of a single SUV decorated with v-SNAREs (v-SUV) and a t-SNARE containing pore-spanning membrane.The pore-spanning membrane had the same lipid composition as in the characterization experiments presented above, a DOPC:DOPS mixture (70:30), and contained Alexa488-t-SNAREs (1000:1 lipid to protein ratio). v-SNARE containing SUVs (v-SUVs) were composed of DOPC/DOPS/ATTO-647N-DOPE (82:15:3) with reconstituted full-length v-SNARE, VAMP2

Figure 5 .

 5 Figure 5. Calcium content Assay A) (i) Schematic of content release setup (ii) Liposomes were tracked using incorporated 1.5 mol% of ATTO647N-DOPE. Image sequences of vesicle docked, diffuse on the membrane and fuse (colormap: Cyan Hot). Corresponding content release image sequences are shown below (green). An increase of the Mag-Fluo-4 fluorescence appears when the pore opens B) Efficiency of calcium trapping in the v-SUVs in bulk. Upon addition of 2.5% dodecyl maltoside an increase of Mag-Fluo-4 fluorescence intensity due to the release of calcium ions from encapsulated liposomes can be observed. C) Fluorescence intensity of labelled lipids inside (grey) and outside (red) of the ROI and the calcium sensitive fluorophore (green) during fusion process. The content release happens during dequenching of the lipids in the v-SUV. D) Fluorescence intensity of calcium sensitive fluorophore Mag Fluor-4 over time during cumulative fusion events.

  above the hole of which 99% of the vesicles that came near the edge of the substrate bounced back to the center of the hole while the remaining 1% ended up being located near the substrate. After diffusing for approximately 5-8 frames (340-540 ms), the v-SUVs movement slowed down to the point that it looks almost immobile which may indicate an increased number of engaged SNARE complexes (each v-SUV contained ~10 VAMP2 facing outside and

20 ROI

 20 coordinates of the fluorescent lipid of the vesicle channel were used to track the fluorescence of the content-mixing channel at a given time. All of the image data analysis described in this paper has been done using this software (Figure6B). The full source code of both lipid mixing and content release modes are provided with this work. Each component of the software can be easily customized according to research needs with minimal programing knowledge in MATLAB and C++. For example, the pattern recognition feature in the software can be used to extract information of any grid geometry.

:

  The following materials were purchased and used without further purification: dioleoyl-phosphatidylcholine (DOPC), dioleoyl-phosphatidylserine (DOPS), dioleoylphosphoethanolamine-nitro-benzoxadiazolyl (NBD-PE), dioleoyl-glycero-phosphoethanolaminelissamine rhodamine B sulfonyl (LR-PE) (Avanti Polar Lipids, Alabaster, AL); dioleoylphosphoethanolamine-ATTO647N (DOPE-ATTO647N) (ATTO-Tec); -Hemolysin from Staphylococcus aureus, TCEP, HEPES, Trizma hydrochloride (TrisHCl), Sulforhodamine B sodium salt, calcium chloride, magnesium chloride, sodium chloride, ethanol, OptiPrep™ Density Gradient Medium Octyl--D-glucopyranoside (Sigma-Aldrich); Alexa Fluor™ 488 C5 Maleimide, Texas Red™ C2 Maleimide, Slide-A-Lyzer™ Dialysis Cassettes (Fisher Scientific, Fair Lawn, NJ); Bio-Beads™ SM-2 Resin (Bio-Rad); 1,4-Dithiothreitol (DTT) (ROCHE); glass bottom petri dishes (Mattek); PreScission protease, a HiLoad Superdex 75 column and PD MidiTrap G-25 columns (GE Healthcare). Si/SiO2 chips was purchased from Micromotive, Germany.

Fluorescence microscopy:

  An inverted Laser-scanning confocal microscope (Leica-SP5) equipped with multi-wavelength Argon Laser including 488, and diode lasers (532 and 641 nm), and a long-working distance 43X water immersion objective (NA 1.1) was used to image the Si/SiO2 chip and to follow membrane fusion. The emission light was spectrally separated and collected by photo multiplier tubes. A resonant scanner was used to acquire movies at a speed of 36 ms per frame.Image dataset and Hole Extraction:The software "Fusion Analyzer" was developed in MATLAB/ C++ IDE and tested on image datasets acquired with a Leica Scanning Confocal microscope. Images of fluorescent lipid, vesicle and the transmission light channel were acquired at a speed of 96 ms / frame for a total of 1000 frames per movie for convenient export as an avi movie format file from the LAS AF software. The Fusion Analyzer independently imports each channel file in avi format. The transmission light channel movie is used for pattern recognition of the holes for easier processing. The extracted pattern is used to create a binary mask. The mask is overlaid with the original dataset to remove the reflection from silicon surface. Numbers were assigned to each hole for identification and simplified data analysis. The desired hole from the image dataset is extracted for vesicle fusion analysis.Vesicle Detection and Tracking: For accurate vesicle detection, the desired hole image dataset is convoluted with a Gaussian beam point spread function (Eq.1). This convolution process sets a new value to each pixel based on the weighted average of that pixel's neighborhood. The original pixel's value receives the heaviest weight and neighboring pixels receive smaller weights, which creates a blur that preserves edges of the vesicles. In this case, each image in the dataset is smoothened with 2-D Gaussian smoothing kernel with standard deviation of 2 (σ = 2).

Table of Content Graphic

	Freely-Diffusing
	SNAREs
	Lipid Mixing	Ca 2+ release
	Activated Fluorescent
	Ca 2+ Indicator

ACKNOWLEDGMENTS

We thank Dr Ilja Kuester (Havard Medical School, USA) for inspiring discussions regarding the formation of freestanding membranes and Joel Lemiere (Yale University) for very useful discussions regarding the alpha-hemolysin experiments. We also thank Kirill Grushin (Yale University, USA) for providing the SNARE protein pictures.

Funding Sources

This work was supported by Agence Nationale de la Recherche (ANR) ANR-14-1CHN-0022-01 grant to J.E.R.

AUTHOR INFORMATION

Corresponding Author

*Correspondence to Frederic Pincet (pincet@lps.ens.fr) or James E. Rothman (james.rothman@yale.edu) Present Addresses † Drug Discovery Unit, Cancer Research UK Beatson Institute, Garscube Estate, Switchback Road, Glasgow G61 1BD, UK.

Author Contributions

The manuscript was written through contributions of all authors. / All authors have given approval to the final version of the manuscript. ‡ S.R and A.G contributed equally.


Y Andaloussi

M. D El Ouadghiri

Y Maurel

J M Bonnin

H Chaoui

The 8th International Symposium on Frontiers in Ambient and Mobile Systems (FAMS-2018) Access control in IoT environments: Feasible scenarios

Keywords: IoT, access control, cryptography, security, smart objects, DCapBAC IoT, access control, cryptography, security, smart objects, DCapBAC

The Internet of Things (IoT) is the extension of the internet to the physical world where all objects collect information and interact with their environments with no or little human intervention. They collect and transfer sensitive and private data from various users. This puts security and privacy issues at the forefront: the ability to manage the digital identity of millions of people and billions of devices is fundamental for success. As most of the information contained in IoT environment may be personal or sensitive data, there is a requirement to support anonymity and restrain access to information. This article will focus on access control and authentication mechanisms as well as supporting the cryptography algorithms in constrained devices.

Introduction

In recent years, advances in the fields internet technologies have given rise to new possibilities and visions, which envisage the world as a vast network of autonomous, self-organized and self-configuring devices. This vision has

Introduction

In recent years, advances in the fields internet technologies have given rise to new possibilities and visions, which envisage the world as a vast network of autonomous, self-organized and self-configuring devices. This vision has produced a paradigm called the Internet of Things (IoT). Thus, access control has become a real challenge in the IoT.

Access control is a system that allows an authority to control access to zones and resources of a given installation. It ensures confidentiality in such a way as to ensure that information is only accessible to those authorized, it assumes also integrity in such a way that the data are indeed those believed to be. Most of recent proposals have addressed the problem of access control using centralized approaches where a central entity is responsible for managing the authorization mechanisms, allowing or denying requests from external entities [START_REF] Hernandez-Ramos | Distributed Capability-based Access Control for the Internet of Things[END_REF] . Although in these approaches, end-to-end security between devices and any Internet host cannot be achieved. However, traditional access control models do not meet the requirements imposed by IoT scenarios, introducing lack of flexibility, scalability and usability in environments with billions of devices. These problems could be solved by a distributed approach in which "things" are able to make authorization decisions without delegating this process to a different entity.

In this paper, we will be interested on the capability-based access control model. This model grants some interesting aspects such as the principle of least privilege, and greater adaptation to the requirements of IoT scenarios. The rest of this paper is structured as follows: Section 2 describes related works regarding access control in IoT, Section 3 gives a description of the different architectures of access control mechanisms. Section 4 itemizes the capability-based access control. Section 5 shows a detailed overview of our proposal. And section 6 end up with some conclusions and future works in this area.

Backgrounds

Nowadays, there is a myriad of access control models that are applied to different Internet of Things scenarios in which security is required. In the following, we give a brief description of the most popular models, which are deployed in such scenarios.

In the Mandatory Access Control (MAC) model 1 the administrator of the system give permissions for subject to access object. The model assigns security labels to subjects and objects, and it is independent of the user operations, only the administrator can modify object security labels. MAC models are difficult and expensive to implement and maintain, its usage is usually limited to military applications, and this is why MAC models are not used as access control system.

In the Discretionary Access Control (DAC) models 2 , the access to resources is maintained by users, which can grant permissions to their resources by being included in Access Control Lists (ACL). Each entry in the access control list gives users (or group of subjects) permissions to access resources. The permissions are usually stored by objects. Unlike in MAC, where permissions are given in predefined policies by the administrator, in DAC, permissions are given by users which decide the access rights to the resources they belong. DAC is adopted by current operation systems based on UNIX, FreeBSD, and Windows.

Moreover, in the Role-Based Access Control (RBAC) model [START_REF] Sandhu | Role-based access control models[END_REF] , users are assigned to roles, and the security policies grant rights to roles rather than to users. Since the users are associated to roles. RBAC allows creating hierarchies of permissions and inheritance. Nonetheless, RBAC has some problems since the administrative issues of large systems where memberships make administration potentially cumbersome.

Traditional access control models like MAC, DAC and RBAC do not take into account additional parameters such as resource information and dynamic information (such as time, location …). In order to provide a more flexible mechanism, the Attribute-Based Access Control (ABAC) model [START_REF] Vincent | Guide to Attribute Based Access Control (ABAC) Definition and Considerations[END_REF] was proposed, in which authorization decisions are based on attributes that the user has to prove (e.g.: age, location, roles, etc.). One of the main advantages of ABAC is requesters do not have to be known a priori by targets, providing a higher level of flexibility for open environments, compared to RBAC models. Nevertheless, in ABAC everyone must agree on a set of attributes and their meaning when using ABAC, which is not easy to accomplish. The Authorization-Based Access Control (ZBAC) 5 model uses authorization credentials, which are presented along a request to make an access control decision. Unlike ABAC and RBAC systems, in which the user submits an authentication along with the service request, in ZBAC systems, the user submits an authorization along with the request.

IoT scenarios imposes significant restrictions on privacy and access control, tradition access control approaches solutions were not designed with these aspects.

IoT Access Control Architectures

In this section we present the approaches related to access control, their main advantages and drawbacks.

Centralized approach

In a centralized approach 6,7 , all access control logic is externalized into a central entity responsible for lte i access requests based on their authorization policies. The end devices (sensors …) play a limited role as information providers. This centralized approach does not take into consideration constraints of resources, because the access control logic is located in an entity without constraints of resources. This approach is expressed by a scenario where a server receives a request from the mobile user who wants to access the end-device, so it generates a token containing the authorization or the refusal and sends it to the mobile user. However, this approach has major problems. Firstly, the end-device is not taken into consideration in access control decisions. Secondly, the access control logic is located in one entity, so any vulnerability might compromise all the system because it becomes a single point of failure.

Hybrid approach

The end-devices are not passive entities [START_REF] Hernandez-Ramos | Distributed Capability-based Access Control for the Internet of Things[END_REF][START_REF] Shelby | Constrained Application Protocol(CoAP)[END_REF] , they participate in the access control decisions such as presented in the Figure 2. In this approach, a server receives a request from the mobile user who wants to access the end-device, it evaluates the contextual information provided by the end device and then decides to allow or reject the access, so it generates a token containing the authorization or the refusal and sends it to the mobile user. This approach has also problem in the ability of the end-devices to take contextual information into account (location, time …) in the exact time for making decisions. So the information loses the importance in the process of authorization decision.

Distributed approach

In the distributed architectures [START_REF] Hernandez-Ramos | Distributed Capability-based Access Control for the Internet of Things[END_REF] , the end-device is a smart thing that is enable to obtain process and send information to other services and devices. The devices are able to take authorizations decisions without the need of central entities. This approach presents interesting features and it is more suitable for the scenarios and architectures of IoT.

Design of capability-based access control

Capability-based access control

DCapBAC has been postulated as a feasible approach to be deployed on IoT scenarios even in the presence on devices with resource constraints. The key concept of this approach is the concept of capability, which was originally introduced by [START_REF] Dennis | Programming Semantics for Multiprogrammed Computations[END_REF] as "token, ticket, or key that gives the possessor permission to access an entity or object in a computer system". This token is usually composed by a set of privileges which are granted to the entity holding the token. In CapBAC [START_REF] Ellison | RFC2693: SPKICerti te e y , e te be[END_REF][START_REF] Gusmeroli | A capability-based security approach to manage access control in the internet of things[END_REF] , an entity, which wants to access certain information from another entity, requires to send a token together the request. Thus, the entity that receives the capability already knows the permissions that the requester has been granted when need to process the request. This simpli es the authorization mechanism and it is a relevant feature in scenarios with resources-constrained devices and complex access control policies are not necessary.

Capability token

We are building an implementation of capability-based access control; the capability token is represented by JSON [START_REF] Ferraiolo | Role-based access control (RBAC):Features and motivations[END_REF] for its suitability in constrained devices. A brief description of each el i rovided in [START_REF] Ferraiolo | Role-based access control (RBAC):Features and motivations[END_REF] .

Our approach

Our architecture

A test bed was implemented to demonstrate the feasibility of the approach. The elements of our architecture are: Raspberry PI, the issuer, responsible for generating the capability token.ESP 8266, the end-device that will be read the request, verify the signature and decide to accept or not the request. The resource-constrained device of our scenario was implemented in an ESP 8266, with a 64 KiB of instruction RAM, 96 KiB of data RAM. Moreover, the Raspberry PI has been implemented in Java and the ESP 8266 has been implemented in C, C++. The capability token that we used is not like the capability token in the literature because it grants integrity and legitimacy of each device, each device is able to decrypt and verify the signature only of the part intended for him. So it can have access only to the part of the capability token proper to him. We used Elliptic Curve Cryptography (ECC) and Elliptic Curve Digital Signature Algorithm (ECDSA) to encrypt and sign the token because of its suitability in constrained devices.

Process of decision

Fig. 1 .

 1 Fig. 1. Centralized approach 6 .

Fig. 2 .

 2 Fig.2. Hybrid approach[START_REF] Hernandez-Ramos | Distributed Capability-based Access Control for the Internet of Things[END_REF] .

Fig. 3 .

 3 Fig. 3. Distributed approach 6 .

Fig. 4 .

 4 Fig. 4. Authorization scenario.

Table 1 .

 1 Comparaison entre ECC et RSA (paramètres de NIST).

	RSA Key (Bits)	ECC Key (Bits)
	1024	160
	2048	224
	3072	256
	7680	384

Check the validity of the token:

The device verify the validity of the fields NB, NA and II, if the token is not valid, the request is refused.

Check if the action is permitted:

The device verify each one of the access rights AC. Check that the actions are fulfilled: The device verifies the permissions of each resource. Check the validity of the signature: The device verifies the signature of the token, so the device will recalculate the signature and compare it with the signature of the token. Check the legitimacy of the user: if all the actions are granted, the access is permitted.

Conclusion

This article covered the CapBAC model that was proposed as a feasible approach for IoT scenarios [START_REF] Rom´an | On the Features and Challenges of Security and Privacy in Distributed Internet of Things[END_REF] and is supported by constrained devices. This approach is based on the concept of capability which is defined in [START_REF] Hernandez-Ramos | Distributed Capability-based Access Control for the Internet of Things[END_REF][START_REF] Shelby | Constrained Application Protocol(CoAP)[END_REF] . This token contains the privileges that will be granted to the entity that holds the token. This token must be tamper-proof and identified unequivocally to be considered in a real environment. Moreover, it is necessary to have a cryptographic mechanism which is supported even by the constrained devices. The security is a challenge in IoT environments and new technologies. This implementation is taken into account the constraints of smart objects in term of storage, energy consumption and execution time.