Christophe Chambon

Eric Neyraud

Thierry Sayd

Pauline Bros

Romane Di Biagio

Frank Hyvrier

Catherine Féart

Perrine André

Fernando Rodriguez-Artalejo

Esther Lopez-Garcia

Garcia Garcia-Esquinas

David Gomez

Cabrero Lopez

Gordon Proctor

Martine Morzel
email: martine.morzel@inrae.fr

Esther Garcia

The salivary proteome reflects some traits of dietary habits in diabetic and non-diabetic older adults

Keywords: salivary biomarkers, proteomics, usual diet, ageing, diabetes, Gene Set Enrichment Analysis

à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

There is vast evidence linking intakes of nutrients, specific foods, food groups or even dietary patterns with health and well-being outcomes. Some studies have focused on the older population, targeting health issues more prevalent in this age group. For example, a link has been established between usual intake of protein and frailty [START_REF] Coelho-Júnior | Low Protein Intake Is Associated with Frailty in Older Adults: A Systematic Review and Meta-Analysis of Observational Studies[END_REF] or between coffee consumption and risk of falling [START_REF] Machado-Fragua | Habitual coffee consumption and risk of falls in 2 European cohorts of older adults[END_REF].

Higher adherence to the so-called Mediterranean diet (MeDi) has also been associated with decreased cognitive decline [START_REF] Singh | Association of Mediterranean Diet with Mild Cognitive Impairment and Alzheimer's Disease: A Systematic Review and Meta-Analysis[END_REF] or decreased risk of frailty [START_REF] Kojima | Adherence to Mediterranean Diet Reduces Incident Frailty Risk: Systematic Review and Meta-Analysis[END_REF][START_REF] Struijk | Diet quality and risk of frailty among older women in the Nurses' Health Study[END_REF]. Concerning another pathology with higher prevalence among the elderly population, higher adherence to MeDi diet has been associated with lower risk of type 2 diabetes mellitus (T2DM) [START_REF]Mediterranean Diet and Type 2 Diabetes Risk in the European Prospective Investigation Into Cancer and Nutrition (EPIC) Study: The InterAct project[END_REF][START_REF] Salas-Salvadó | Protective Effects of the Mediterranean Diet on Type 2 Diabetes and Metabolic Syndrome[END_REF] and not only through its impact on body weight [START_REF] André | in press) The role of overweight in the association between the Mediterranean diet and the risk of type 2 diabetes mellitus: a mediation analysis among 21 585 UK biobank participants[END_REF]. Recording one's diet can therefore be a useful tool for the clinician as a starting point to implement dietary guidelines and/or to follow adherence to dietary advice.

One challenge in nutritional epidemiology research is to capture real dietary intakes. Assessment usually relies on questionnaires (such as 24-hour recalls or Food Frequency Questionnaire) which may be prone to memory or social desirability bias. Therefore, objective markers of dietary intake are required as alternative or validating tools to increase the reliability and accuracy of diet information [START_REF] Hu | Current and Future Landscape of Nutritional Epidemiologic Research[END_REF]. With this objective in mind, markers of dietary intake have been sought for mainly in serum and in urine. For example, metabolome markers of usual consumption of citrus fruit or fish were identified in serum of adult participants [START_REF] Guertin | Metabolomics in nutritional epidemiology: identifying metabolites associated with diet and quantifying their potential to uncover diet-disease relations in populations[END_REF]. Urinary metabolome markers of usual nut intake were also identified and correlated to cognitive decline in older adults [START_REF] Rabassa | Habitual Nut Exposure, Assessed by Dietary and Multiple Urinary Metabolomic Markers, and Cognitive Decline in Older Adults: The InCHIANTI Study[END_REF]. Recently, plasma metabolome markers of adherence to the Mediterranean diet have been associated with cardiovascular disease risk [START_REF] Li | The Mediterranean diet, plasma metabolome, and cardiovascular disease risk[END_REF]. Saliva is a biological fluid which presents some advantages over blood or urine, particularly regarding its sampling which minimizes pain, privacy or safety issues. Saliva sampling also presents some limitations, for example in case of minimal saliva flow. Young children and the oldest or frail elderly subjects are thus two groups for which it may be difficult to obtain saliva samples [START_REF] Granger | Integration of salivary biomarkers into developmental and behaviorally-oriented research: Problems and solutions for collecting specimens[END_REF]. However, saliva was sucessfully sampled and its protein or peptide composition analyzed on 3-and 6-month-old infants [START_REF] Morzel | Human infant saliva peptidome is modified with age and diet transition[END_REF], on premature babies [START_REF] Castagnola | The Surprising Composition of the Salivary Proteome of Preterm Human Newborn[END_REF] or on old persons with a mean age of 82 years [START_REF] Wang | iTRAQ-based quantitative analysis of age-specific variations in salivary proteome of caries-susceptible individuals[END_REF]. Saliva composition was successfully associated with usual intake of carbohydrates in adults [START_REF] Méjean | Salivary Composition Is Associated with Liking and Usual Nutrient Intake[END_REF], with diet transition in infants [START_REF] Morzel | Human infant saliva peptidome is modified with age and diet transition[END_REF][START_REF] Morzel | Saliva electrophoretic protein profiles in infants: Changes with age and impact of teeth eruption and diet transition[END_REF] or with dietary patterns in children with or without eating difficulties [START_REF] Morzel | Associations between food consumption patterns and saliva composition: Specificities of eating difficulties children[END_REF]. In addition, saliva (together with blood) proved more resilient than urine to recent dietary intake when focusing on metabolome composition [START_REF] Walsh | Effect of acute dietary standardization on the urinary, plasma, and salivary metabolomic profiles of healthy humans[END_REF]. For all these reasons, the primary objective of this work was to evaluate whether saliva is a suitable source of objective protein markers of usual dietary intake in older adults. We evaluated this with participants from two different cohorts, in France and Spain, which provided information on the cross-cultural and/or geographical sensitivity of the results. Finally, participants were part of a wider project on salivary biomarkers of Mediterranean diet and type 2 diabetes mellitus [START_REF] Proctor | The SALAMANDER project: SALivAry bioMarkers of mediterraneAN Diet associated with long-tERm protection against type 2 diabetes[END_REF]. The design of participants' selection therefore also enabled to address a secondary objective, namely to assess the impact of this pathology on the association between saliva composition and dietary habits.

Methods

Population-based cohorts

Participants originated from two population-based cohorts on ageing, the Bordeaux sample of the Three-City Study (3C) in France [START_REF]The 3C Study Group (2003) Vascular Factors and Risk of Dementia: Design of the Three-City Study and Baseline Characteristics of the Study Population[END_REF] and the Seniors-ENRICA-2 cohort in Spain [START_REF] Cabanas-Sánchez | Twenty four-hour activity cycle in older adults using wrist-worn accelerometers: The seniors-ENRICA-2 study[END_REF]. Study protocols of the 3C and Seniors-ENRICA-2 cohorts were approved respectively by the Commitee for Protection of Persons (CPP) participating in Biomedical Research of the Kremlin-Bicêtre University Hospital (Paris) and the Ethics Research Commitee of the « La Paz » University Hospital (Madrid).

Participants

The 214 Individuals included in the study were selected using a case-control design nested in each cohort. Cases were individuals affected by T2DM based on self-reported physician's diagnosis and/or being on antidiabetic treatment (oral medication or insulin) at the time of data collection. Controls were selected concurrently and were free of diabetes at the time of data collection. For the purpose of the present study, we used the following information from each participant: cohort, sex, age (years), body mass index (BMI; kg/m 2 ), type 2 diabetic status, smoker status (never, former, current), saliva flow (g/min) and food consumption.

Dietary surveys and assessment of adherence to the Mediterranean diet

Food consumption data were collected using a FFQ in the 3C cohort [START_REF] Rahi | High adherence to a Mediterranean diet and lower risk of frailty among French older adults community-dwellers: Results from the Three-City-Bordeaux Study[END_REF] and a validated electronic diet history in the Seniors-ENRICA-2 cohort [START_REF] Guallar-Castillón | Validity and Reproducibility of a Spanish Dietary History[END_REF]. Adherence to the Mediterranean dietary pattern was assessed by calculating a MEDAS score [START_REF] Schröder | A Short Screener Is Valid for Assessing Mediterranean Diet Adherence among Older Spanish Men and Women[END_REF] modified by omitting the question on sofrito, since this cooking technique is specific of the Spanish population. The MEDAS score could therefore range from 0 to 13, with higher values indicating higher adherence to the Mediterranean diet. Differences between cohorts or diabetic status was tested by a Wilcoxon test. In addition, to study the link between saliva proteome and diet, we restricted the analysis to the 11 MEDAS items describing the consumption frequency of food groups, namely olive oil, vegetables, fruits, red meat, butter/margarine/cream, sweet drinks, wine, legumes, fish/shellfish, sweet snacks (confectionary, biscuits and commercial pastries) and nuts. For each food group, the participants were classified as high or low consumers based on the cut-off points defined for MEDAS score calculation (Online Resource 1).

Saliva sampling

Sampling of unstimulated saliva was conducted at the participants' home. Sampling was proposed early in the morning after overnight fasting. Drinking water was permitted up to 5 minutes before saliva collection. Participants were instructed to sit comfortably and to tilt their head slightly downwards. At their own rythmn, they spat the saliva pooling on the floor of the mouth into 40mL polypropylene tubes. Sampling was performed for 10 minutes. In case a participant wished to stop before the end of the 10 minutes, the time was recorded in order to be able to calculate the saliva flow (expressed in g/min). Saliva samples were immediately placed on ice, transported to the laboratory and placed at -80°C as soon as possible (never after 4 hours on ice). At the end of the collection wave, samples were shipped to the analytical facilities in dry-ice.

Saliva proteome analyses

Sample preparation

Saliva was thawed at 4°C and vortexed. One mL of saliva (or the total volume of saliva when it was lower than 1mL) was centrifuged at 14000 g for 20 minutes. The supernatant was used for proteome analyses. Protein concentration was measured by an infrared spectroscopy-based method using a Direct Detect® spectrometer (Merck). Samples were diluted in water in order to adjust all samples to the same protein concentration, then mixed with 1 volume of Laemmli denaturing buffer and heated at 90°C for 5 minutes. Sample volumes corresponding to 3.5 µg of protein were loaded onto SDS-PAGE gels containing 12% and 5% acrylamide in the resolving and stacking gels, respectively.

Electrophoresis was performed using a Mini-Protean II unit (BioRad, Marnes-La-Coquette, France) at 100 V until the dye front entered the resolving gel. Gels were stained for one hour in R-250 Coomassie. Bands were manually excised, reduced in 10 mM dithiotreitol in 50 mM ammonium bicarbonate, and alkylated in 55 mM iodoacetamide in 50 mM ammonium bicarbonate. Destaining of the excised bands was obtained by sucessive rinses in 25 mM ammonium bicarbonate / acetonitrile (1 :1 v/v). Gel pieces were then dried by incubation in 100% acetonitrile for 10 min followed by vacuum-drying in a SpeedVac. Finally, gel pieces were incubated overnight at 37°C with 30 µL of a trypsin solution (V5111, Promega) at 10 ng/µL in 25 mM ammonium bicarbonate. Peptide extraction was performed by addition of 40µL of acetonitrile 100%, 0.5% formic acid and sonication for 15 min.

The trypsin digests were vacuum-dried in a SpeedVac and stored at 20 °C in a solution of 0.05% trifluoroacetic acid before Liquid Chromatography-Tandem Mass Spectrometry (LC-MS/MS) analysis

Mass Spectrometry analyses

Five µL of the protein digests were injected into a nanoHPLC (Ultimate 3000, ThermoFisher Scientific). The peptide mixture was first concentrated and desalted on a microcolumn (Acclaim, 300 µm, 5mm) equilibrated with trifluoroacetic acid (TFA) 0.05% in water. After 6 min, the microlumn was switched on-line to an analytical C18 nanocolumn (Acclaim,75 µm, 25 cm, Pepmap) equilibrated with 94.9 % H 2 0, 5% dimethyl sulfoxide (DMSO), 0.1% formic acid (FA) and peptides were separated at 35°C according to their hydrophobicity with a 4 to 25% linear gradient of acetonitrile (94.9 % ACN, 5 % DMSO, 0.1% FA) at a flow rate of 300 nL/min for 50 min. Peptides were electro-eluted with an ESI nanosource (1.6 kV) in the mass spectrometer (Orbitrap Velos, ThermoFisher scientific). The Orbitrap was used in top 15 data dependent mode, with gas phase fractionation (GPF1 400-480 m/z; GPF2 480-560 m/z; GPF3 560-660 m/z; GPF4 660-850 m/z, GPF5 850-1401 m/z).

Samples were analyzed in 6 different series (different days). To monitor and normalize LC-MS performance over time, a Quality Control (QC) was injected every 10 samples. This QC was prepared by diluting 20µL of a commercial mixture of 15 synthetic peptides (Thermo Scientific™ Pierce™ Peptide Retention Time Calibration Mixture) into 180µL of a trypsin digest of a pool of 20 salivas. Five µL of the QC was injected and analyzed similarly to samples, except that gas phase fractionation was not performed.

Raw files were imported into ProgenesisQI Proteomics (Nonlinear dynamics) and the label-free quantification workflow was followed (see www.nonlinear.com). This includes peak alignment, establishment of a single ion map, normalization of intensities using data from 2 to 5x charged ions and XIC type quantification of all ions detected. Peptide identification were performed using Mascot interrogating the database homosapiens UniProt 201804 (71,600 sequences). Peptide mass tolerance was set to 10 ppm and fragment mass tolerance was set to 0.5 Da. Two miscleavages were authorized, and methionine oxidation, carbamidomethylation of cysteine and deamidated asparagine or acid aspartic were set as variable modifications. Protein identification was then validated when at least two unique peptides from one protein showed significant identification Mascot scores with False Discovery Rate (FDR < 1%). For protein quantification, the sum of all unique normalized peptide ion abundances for a specific protein was calculated for each sample. The final dataset consisted in 246 proteins quantified in 211 samples.

Proteome data handling

Protein abundance as obtained above was corrected for any series effect using QC data. For each synthetic peptide, the average abundance was calculated per series and for all runs combined. This enabled calculting a correcting coefficient applicable to each series for normalization. The mean correcting coefficient for the 15 synthetic peptides was calculated per series, and it was applied to the protein abundance within that series. Missing values (0.3% of overall data) were handled following two distinct imputation methods as described by Wei et al. 2018 [START_REF] Wei | Missing Value Imputation Approach for Mass Spectrometry-based Metabolomics Data[END_REF]. Eighty-two percent of the missing values corresponded to proteins which always showed low abundance values. These missing values were regarded as Missing Not At Random and thus handled using the quantile regression imputation of left-censored method. Remaining missing values were regarded as Missing At Random thus handled using the Random Forest imputation method.

Statistics

First, for each food group, we tested differences in the salivary proteome between high and low consumers Student t-tests corrected by the Benjamini-Hocberg method to control the False Discovery rate (FDR set at 5%). This was performed for the entire sample or when participants were stratified by diabetic status or by cohort.

Second, the Gene Set Enrichment Analysis (GSEA) method [START_REF] Subramanian | Gene set enrichment analysis: A knowledge-based approach for interpreting genome-wide expression profiles[END_REF] was used to highlight biological processes enriched depending on the level of consumption of a food group. Given the case-control design of the study, we performed the analyses separately for diabetic and non-diabetic subjects. For each of the 246 proteins of the dataset, ontology terms and related annotations were retrieved from quickGO and the GO database. GO terms corresponding to at least two proteins (1850 in total) were selected. For each condition (one condition = one diabetic status, one food group), proteins were ranked in descending order of their p-values after attributing a negative sign to p-values when proteins were under-expressed in "high consumers". This way, a GO term is regarded as of interest if its protein members are mostly in the top (over-expressed) or bottom (under-expressed) region of the list. GO terms were tested by unweighted GSEA estimation algorithm with at least a million permutations. With multifactorial dependencies occurring in the GO terms classification, (correlated and/or co-occurring annotations, co-occurring proteins …), controlling false positive occurrence is challenging and usual methods may be over-restrictive. Post-hoc correction was therefore conducted as follows: the community structure of the GO network (terms as nodes, relationships as edges) was determined using the Girvan-Newman algorithm [START_REF] Girvan | Community structure in social and biological networks[END_REF]. This revealed 223 separated communities with a modularity of 0.85. GO terms within a community were considered as strongly dependent from each other whereas communities were considered as independent from each other. P-values of the 223 communities were computed as the mean of p-values of its GO terms members, and the Benjamini-Hochberg correction was performed (calculation of a q-value). This generated a correcting factor for each community, which was then applied to p-values of all GO terms within this community to calculate individual q-values. GO terms were considered significant for q-values <0.01 (FDR 1%).

Finally, we fitted minimal models predicting dietary variables by sociodemographic, clinical and salivary proteome variables. For that purpose, the workflow was as follows for each food group. First we reduced the number of protein variables by three successive selection steps : 1-a Kernel Partial Least Square Regression model was computed and proteins with high Variable Importance in Projection (VIP) values were selected (cutoff=1). 2-For these proteins, the difference in abundance between high and low consumers of the food group was tested by a Student t-test corrected by the Benjamini-Hochberg method to control the False Discovery rate (FDR). Variables with a low FDR were selected (cutoff=0.05). 3-Correlation among these proteins were calculated. Candidates sharing at least one high correlation (cutoff=0.7) were ordered by Ascendant Hierarchical Clustering, with adequate number of clusters determined by bootstrapping. The final set of proteins was made of all uncorrelated variables plus one variable per cluster (the one with the highest contribution). Second, we fitted the minimal model by logistic model learning using selected proteins and sociodemographic and clinical confounding factors (diabetic status, cohort, sex, age, BMI, smoker status and saliva flow). Subjects were split into a learning set (75%) and a validation set (25%). From the learning set, a logistic model was adjusted. Two stepwise procedures (Akaike Information Criterion, Bayesian Information Criterion) were performed separately : the AUC (Area under the Curve) of the ROC (receiver operating characteristic) curves were computed from the validation set and the model with the highest AUC was selected. This process was repeated through 1000 simulations of learning/validation sets, and the final model retained the variables selected in at least half of the simulations. For the food groups where proteome variables were retained, we evaluated the performance of the models by calculating the AUC of the ROC curve. More specifically, three models were tested : Model 1 was the optimal model obtained as described above, Model 2 was Model 1 into which we forced some basic descriptive variables (cohort, age, sex, diabetic status), and Model 3 was Model 1 from which protein variables were removed. The comparison of Model 1 and Model 3 allows documenting how much value the saliva proteome variables add to the model. Data management and statistical analyses were performed using the Rgui open-source software (https://cran.r-project.org).

Results

Participants' characteristics

Among 570 participants from wave 8 (2017-2018, 18y after baseline) of the 3C-Bordeaux cohort, 65 were diabetics. Among them, 37 participants agreed to participate and a random sample of 71 participants were selected as controls. Among 3273 participants from baseline in the Seniors-ENRICA-2 cohort, 669 were diabetics. A random sample of 53 diabetics and 53 matched controls were selected. Out of those 214 participants, 3 were excluded because of unsufficient saliva production (Online Resource 2). The 211 remaining participant's characteristics are presented in Table 1. The French sample was older on average (87.3 vs 71.0 y) and comprised more women (61.3 vs 36.2%) than the Spanish one. As expected, the diabetic participants exhibited higher BMI on average than controls in both cohorts.

Saliva amounts collected and salivary flows

The amounts of saliva collected varied from 0.09 to 8.68 g. As reported in Table 1, the average at-rest saliva flow varied from 0.18 to 0.26 g/min depending on the cohort and diabetic status. The difference between the two cohorts tested by a Wilcoxon test was significant (p<0.001), with higher flow among Seniors-ENRICA-2 participants. The difference between diabetic and non-diabetic subjects was not significant either when combining the two cohorts or within each cohort.

MEDAS scores and dietary intakes

The mean MEDAS scores and the proportions of high vs low consumers of 11 food groups among all participants or stratified by diabetic status or cohort are presented in Table 2. Adherence to the Mediterranean dietary pattern was slightly (but not significantly) lower in diabetic participants compared to controls, while it was significantly (p<0.05) lower in 3C-Bordeaux participants compared to Seniors-ENRICA-2 participants. The dietary patterns were overall comparable between diabetic and non-diabetic individuals : the only two food groups which were clearly different according to the diabetic status were « nuts » and « sweets snacks » (confectionary, biscuits and commercial pastries), with a higher proportion of low consumers among diabetic subjects. In contrast, there were more differences between the two cohorts, with five food groups clearly different between Seniors-ENRICA-2 and 3C-Bordeaux. In the Spanish cohort there were more high consumers of olive oil, while in the French cohort there were more high consumers of vegetables, nuts, wine and butter.

Proteins differentially expressed between high and low consumers of 11 food groups

Table 3 provides the number of proteins significantly different (FDR 5%) between high and low consumer of the 11 food groups recorded. When considering all participants, there were differentially expressed proteins for three food groups : vegetables, butter and sweet snacks. The list of proteins significantly different, details of mass spectrometry identifications and abundance in high vs low consumers are available in Online resource 3. The intake level of vegetables, red meat and butter altered more the saliva of non-diabetic subjects (20, 58 and 5 differential proteins, respectively) than that of diabetic subjects (4, 0 and 0 differential proteins, respectively). In contrast, the intake level of sweet snacks had a major impact on saliva proteome (65 differential proteins) but only for diabetic subjects. More generally, the link between saliva proteome and diet was more pronounced among non-diabetic controls, with 85 proteins in total linked to 4 food groups (vegetables, legumes, red meat, butter), than among diabetic participants with 69 proteins linked to 2 food groups (vegetables, sweet snacks). The link between saliva proteome and diet was also more expressed among Seniors-ENRICA-2 participants with 77 proteins linked to two food groups (fruits, sweet snacks), than among 3C-Bordeaux participants with 2 proteins linked to the intake level of olive oil.

Gene Set Enrichment Analysis (GSEA)

Based on protein expression levels in the entire proteomic dataset, GSEA identified the biological processes that were significantly enriched or depleted depending on the participants' intake level of a given food group. This was performed for diabetic and control participants separately and for the food group « sweet snacks » because of its major and robust impact on the salivary proteome (see Table 3). Results for all participants are presented in Figure 1 and results of the analyses performed for each cohort separately are available in Online resource 4.

For the two cohorts combined, some biological processes were in common and similarly affected for all participants. Thus, regulation of cellular macromolecule biosynthetic process was repressed while platelet degranulation, leukocyte migration involved in inflammatory response and regulation of immune system were enhanced in high consumers of sweet snacks, regardless of their diabetic status.

In addition, the impact of sweet snacks intake level was particularly evident among diabetic participants (Fig. 1). In those participants, three GO categories related to apoptosis were repressed in high consumers of sweet snacks, as well as the category regulation of peptidase activity. In contrast, all the other GO terms were enriched in diabetic high consumers of sweet snacks. These terms covered a very large panel of biological functions such as hemostasis, protein and peptide expression, modification or secretion, immunity, cell-cell communication or metabolism. Of special interest is a group of GO terms related to carbohydrate metabolism, (black box in Fig. 1). In controls, high consumption of sweet snacks also modified specifically some biological processes but to a lesser extent.

Analyses performed for each cohort separately confirmed that the impact of sweet snacks intake level was higher for diabetic participants than for controls in both cohorts. A vast majority of the biological processes significant for the two cohorts combined were also identified and significant in at least one of the two cohorts. Results were mostly consistent between the two cohorts combined and one of the cohorts (lines highlighted in blue in Online resource 4, e.g. platelet degranulation).

Five biological processes (highlighted in yellow in Online resource 4, e.g. regulation of phosphorylation) were significant for diabetics and controls in the Seniors-ENRICA-2 cohort, while they were significant only for diabetics in the 3C-Bordeaux cohort and in the joint analysis. Finally, 14 biological processes were consistent across cohorts for diabetics subjects: regulation of apoptotic process, platelet degranulation, regulation of immune response, regulation of gene expression, regulation of transport, regulation of cellular component organization, regulation of protein/peptide secretion, regulation of cell morphogenesis involved in differentiation, interleukin-12-mediated signaling pathway, regulation of substrate adhesion-dependent cell spreading, Arp2/3 complexmediated actin nucleation, actin polymerization-dependent cell motility and microtubule-based movement. The latter four processes, related to cell spreading and motility, are likely linked to the oral epithelium repair potential.

Salivary markers of specific food groups' intake levels

Minimal models were sought for all food groups. Tables 4 and5 present an overview of the variables retained in such models for all participants combined or cohort by cohort, respectively.

Considering both cohorts combined, apart from fruit for which no minimal model was retained, the descriptive characteristics of the subjects could predict the level of consumption (defined as meeting the MeDi requirements or not) for all food groups. The descriptor « cohort » was most frequently retained (4 occurrences for vegetables, olive oil, wine and butter) followed by sex (3 occurrences for wine, red meat and sweet snacks), diabetic status (nuts and sweet snacks) and smoker status (legumes and sweet drinks). Of special interest are the three food groups for which abundance of salivary proteins are predictors of intake : vegetables (5 proteins : P22079 lactoperoxidase, O00391 sulfhydryl oxidase 1, P10909 clusterin, P37802 transgelin-2 and Q8TAX7 mucin-7), butter (4 proteins : Q96DR5 BPI fold-containing family A member 2, P22079 lactoperoxidase, P07476 involucrin and P23280 carbonic anhydrase 6) and sweet snacks (2 proteins : E7EQB2 lactotransferrin, P02749 beta-2-glycoprotein 1). For the three food groups vegetables, butter and sweet snacks, the distribution of AUCs for 10000 simulations and the corresponding means and 95% confidence intervals are presented in Fig. 2. These show that compared to the minimal models (top panels), forcing into the model additional subjects' basic descriptors (middle panels) did not improve the model performance.

Moreover, removing the protein descriptors from the minimal models (bottom panel) clearly reduced the model performance with an AUC mean shift of approximately -0.05 for vegetables and butter and -0.1 for sweet snacks. In other words, we confirmed that the salivary proteome added value to the prediction models.

Results obtained cohort by cohort (Table 5) did not directly confirm the protein markers identified when the two cohorts were combined. In agreement with the very low number of proteins significantly different between high and low consumers of the different food groups among 3C-Bordeaux participants (Table 3), no minimal models retained salivary proteins for French participants. Among Seniors-ENRICA-2 participants, salivary proteins were predictors of intake of fruits, red meat and sweet snacks.

Discussion

In this study, the salivary proteome differed depending on the intake level of some food groups (especially vegetables, fruits, sweet snacks and red meat), in a diabetic status-and cohort-specific manner. In addition, some saliva proteins were predictive of the intake level of sweet snacks after adjusting for several sociodemographic and clinical confounding factors.

The first challenge of the study was the collection of saliva. Only 3 participants out of 214 were excluded due to unsufficient saliva production, and only one of the 211 donors requested to stop before the end of the 10 min collection time. The average saliva flows were below the 0.3 g-0.4/min generally reported [START_REF] Humphrey | A review of saliva: Normal composition, flow, and function[END_REF][START_REF] Dawes | The functions of human saliva: A review sponsored by the World Workshop on Oral Medicine VI[END_REF], in accordance with the well-known reducing impact of ageing on both at-rest and stimulated saliva flow [START_REF] Affoo | Meta-Analysis of Salivary Flow Rates in Young and Older Adults[END_REF]. Age is likely the main factor explaining the statistical difference between the cohorts, with lower average flow in French participants who are on average 16 years older than Spanish participants. The sex-ratio and the cases-controls proportions also differ between the two cohorts. However, several studies reported that gender had no significant impact on saliva flows of either healthy [START_REF] Vandenberghe-Descamps | Salivary Flow Decreases in Healthy Elderly People Independently of Dental Status and Drug Intake[END_REF] or diabetic elderly subjects [START_REF] Lima | Salivary flow and xerostomia in older patients with type 2 diabetes mellitus[END_REF]. Furthermore, the diabetic status had no significant impact on saliva flow in our study, in each cohort or combining the two. To conclude on saliva collection, our study highlighted that it was feasible, well-tolerated and although the volumes were sometimes limited especially in the oldest elderlies, they remained compatible with the needs of proteome analytical methods.

The assessment of dietary intakes is also a challenge for any population. Diet history and Food Frequency Questionnaire are often used to capture usual nutrient intake or dietary habits with a high level of details. Here, we used two different tools which are standard and validated instruments for collecting food consumption data. In a previous study where these same cohorts and respective diet recording tools were used, consistent results for the association between fruit and vegetable intake and functional outcomes in older adults were obtained [START_REF] García-Esquinas | Consumption of fruit and vegetables and risk of frailty: a dose-response analysis of 3 prospective cohorts of community-dwelling older adults[END_REF]. Based on the data obtained, we used the MEDAS score to represent adherence to the MeDi diet [START_REF] Schröder | A Short Screener Is Valid for Assessing Mediterranean Diet Adherence among Older Spanish Men and Women[END_REF]. We confirmed previous observational studies reporting no difference in adherence to MeDi between persons with diagnosed diabetes and controls [START_REF] Muñoz-Pareja | The Diet of Diabetic Patients in Spain in 2008-2010: Accordance with the Main Dietary Recommendations-A Cross-Sectional Study[END_REF]. The MEDAS questionnaire also enabled to classify participants into high and low consumers for 11 food groups. There was a limited impact of the diabetic status on the intake levels, at the exception of nuts and sweet snacks. This latter finding is in accordance with previous results observed within the Seniors-ENRICA cohort, showing that the diet of diabetics differs mainly by a greater avoidance of sweet products while other food groups are little affected [START_REF] Muñoz-Pareja | The Diet of Diabetic Patients in Spain in 2008-2010: Accordance with the Main Dietary Recommendations-A Cross-Sectional Study[END_REF].

Other studies are also in general agreement with this idea. For example, a cross-cultural study investigated the diet of diabetic and non-diabetic elderly men in Finland, the Netherlands and Italy and highlighted that the only food group that was significant different in all three countries was the consumption of added sugar [START_REF] Virtanen | Comparison of diets of diabetic and non-diabetic elderly men in Finland, The Netherlands and Italy[END_REF]. In another study [START_REF] Nöthlings | Food intake of individuals with and without diabetes across different countries and ethnic groups[END_REF], the food group sweets differed largely between individuals with or without diabetes both in a pan-European cohort (the EPIC study) and a USA-based cohort (the MEC study). The two latter articles also evidenced that differences between countries exceeded those between diabetics and non-diabetics, in line with our results on the MEDAS score or the individual food groups. Some dietary differences that we observed between cohorts corresponded to expected cultural specificities (more high consumers of wine in the Bordeaux area in France, more high consumers of olive oil in Spain), while others were more surprising. In particular, the proportion of high consumers of vegetables was extremely high in the 3-C Bordeaux cohort, well above other estimations for France [START_REF] Péneau | VI.MAX 2 Research Group (2011) Fruit and vegetable intake and cognitive function in the SU.VI.MAX 2 prospective study[END_REF]. In the 3-C Bordeaux cohort, fruits and vegetables consumption has already been associated with a lower risk of death [START_REF] Letois | Nutrition and mortality in the elderly over 10 years of follow-up: the Three-City study[END_REF] which may explain that high consumers of vegetables are over-represented in our sample of very old participants. In contrast, the proportion of high consumers of vegetables in the Seniors-ENRICA-2 cohort was extremely low (3.8%) compared to the 12.3% or 17.6% in the general Spanish population [START_REF] León-Muñoz | Adherence to the Mediterranean Diet Pattern Has Declined in Spanish Adults[END_REF] or in diabetic Spanish patients [START_REF] Muñoz-Pareja | The Diet of Diabetic Patients in Spain in 2008-2010: Accordance with the Main Dietary Recommendations-A Cross-Sectional Study[END_REF], respectively. Keeping these issues in mind, and with the objective of describing broadly the impact of dietary intake on salivary proteome, we used the GSEA approach. Many salivary proteins are multifunctional [START_REF] Proctor | The function of salivary proteins and the regulation of their secretion by salivary glands[END_REF] and thus GSEA provided an overwhelming wealth of information, but a first obvious result was that the biological processes enriched according to the intake level were mostly different between diabetic subjects and controls. The salivary proteome is therefore shaped differently by diet depending on the physiopathological status of the subject.

The second finding is that intake of sweet snacks had a major effect on biological processes in diabetics, regardless of the cohort considered. This is not surprising since dietary sugars have a profound physiological effect in diabetic individuals, who by definition have difficulty in controlling glycemia. For example 8 enzymes of the glucose catabolic process to pyruvate (out of the 10 of the core glycolysis pathway) were over-represented in high consumers of sweet snacks among diabetic participants. This is consistent with the long-known increase in glycolytic enzymes activity or expression induced by glucose in various tissues or cells such as pancreatic cells [START_REF] Roche | Induction by Glucose of Genes Coding for Glycolytic Enzymes in a Pancreatic beta-Cell Line (INS-1)[END_REF] or the jejunum [START_REF] Stifel | Dietary regulation of glycolytic enzymes. III. Adaptive changes in rat jejunal pyruvate kinase, phosphofructokinase, fructosediphosphatase and glycerol-3-phosphate dehydrogenase[END_REF]. Inter-individual variability in salivary glycolytic enzymes has been hypothesized to be at least partly related to dietary habits of the healthy adult saliva donors [START_REF] Quintana | Interindividual variability of protein patterns in saliva of healthy adults[END_REF]. Finally, several glycolytic enzymes were found in saliva of diabetic subjects and these were overexpressed in subjects with the most severe forms of retinopathy [START_REF] Chee | Association of potential salivary biomarkers with diabetic retinopathy and its severity in type-2 diabetes mellitus: a proteomic analysis by mass spectrometry[END_REF]. More unexpectedly, when analyzing the two cohorts jointly, the endothelial cell apoptotic process was repressed in diabetic high consumers of sweets, while high glucose is known to trigger apoptosis in endothelial cells [START_REF] Baumgartner-Parzer | Highglucose-triggered apoptosis in cultured endothelial cells[END_REF]. However, the three proteins attached to this GO term in our dataset are the fibrinogen α, β and γ-chains. They are linked to negative regulation of the apoptotic process in GO, but their primary function is rather blood clotting: their over-expression could thus reflect the more frequent gum bleeding in diabetic individuals with inadequate intake of sweet snacks. This is then in accordance with a consensus report indicating that poor glycaemic control in diabetes is associated with poorer periodontal status and outcomes [START_REF] Sanz | Scientific evidence on the links between periodontal diseases and diabetes: Consensus report and guidelines of the joint workshop on periodontal diseases and diabetes by the International diabetes Federation and the European Federation of Periodontology[END_REF]. This example illustrates that GSEA should be regarded as indicative of biological processes to be investigated further, and findings should be examined considering representativity of the proteins attached to each GO category. In that respect, the example of platelet degranulation deserves special attention since it is associated with 30 proteins in our dataset (out of 129 in the human genome). Increased platelet degranulation is observed in T2DM patients compared to healthy subjects [START_REF] Cerbone | Diabetes, vascular complications and antiplatelet therapy: open problems[END_REF][START_REF] Randriamboavonjy | Calpain inhibition stabilizes the platelet proteome and reactivity in diabetes[END_REF] and a mechanistic study concluded that high glucose per se increased platelet reactivity in blood of both diabetics and controls [START_REF] Keating | Effects of increased concentrations of glucose on platelet reactivity in healthy subjects and in patients with and without diabetes mellitus[END_REF]. In our study, combining both cohorts, the saliva proteome composition also suggested that high intake of sweet snacks was linked with enhanced platelet reactivity both in diabetics or controls. This was confirmed in the Spanish cohort and among diabetic subjects in the French cohort.

We also looked for markers of diet and adjusted the models for confounding factors (diabetic status, cohort, age, sex etc.). Combining both cohorts, salivary proteins were retained in the model for three food groups. For « vegetables » and « butter », one should note that the proportions of high consumers are much higher in the 3C-Bordeaux cohort. Results should therefore be taken cautiously because there is a risk that results are partly confounded with a cohort effect. In addition, the analyses performed for each cohort separately highlighted the differences between the two cohorts and illustrated the difficulty of identifying universal markers. Nevertheless, whatever the subjects' characteristics in terms of cohort, age, sex, diabetic status, smoker status, BMI or saliva flow, higher abundance of lactotransferrin (E7EQB2) and beta-2-glycoprotein 1 (P02749) in saliva was associated with a higher chance of being a high consumer of sweet snacks. Interestingly, we had previously observed in healthy children that another protein of the transferrin family (serotransferrin) was positively associated with a number of food groups including biscuits & sweets [START_REF] Morzel | Associations between food consumption patterns and saliva composition: Specificities of eating difficulties children[END_REF]. There is also some biological coherence among some of the identified markers. For example, the two positive markers of vegetables intake (lactoperoxidase, sulhydryl oxidase 1) catalyze reactions involving H 2 O 2 and contribute to cellular redox homeostasis. However, the main general lesson from those results is that the abundance of some salivary proteins was linked to the consumption level of some food groups in elderly subjects after adjusting for several sociodemographic and clinical confounding factors. In addition, since including salivary proteins data improved the prediction models, this is the proof-of-concept that saliva might be a source of objective markers of usual diet.

To conclude, it should be reminded that the studied population originated from two very contrasted cohorts, especially in terms of age and dietary habits. This represented a challenge, particularly for statistical methods which can not fully account for confounding factors. Dietary intake was also here simply evaluated as compliance or not to the requirements of MeDi diet. However, the salivary proteome data suggested biological functions affected by the dietary intake level of sweet snacks, across cohorts and diabetic status (e.g. platelet degranulation) or across cohorts and specific to one diabetic status (e.g. functions linked to cell spreading and cell motility). Proteome data also added value to minimal models predicting the intake level of some food groups. It is now necessary to confirm these results on a validation population, but also to assess more finely the link between the potential markers' expression and the actual quantitative intakes.

Fig. 1 Biological processes (Gene Ontology terms) associated with saliva proteins in high consumers of sweet snacks. Gene Set Enrichment Analysis was conducted separately for diabetic participants or controls. A « positive » or « negative » effect refers to the situation where proteins attached to the GO term are over-expressed and under-expressed, respectively, in high consumers of sweet snacks. The size of the dots indicates the number of proteins attached to each GO term in the experimental dataset, and the colour of the dots translates the gene ratio, i.e. the number of proteins attached to each GO term in the experimental dataset divided by the total number of proteins linked to that GO category in the human genome. In addition, four biological processes are common to all high consumers of sweet snacks, regardless of their diabetic status : regulation of cellular macromolecule biosynthetic process (negative effect), platelet degranulation, leukocyte migration involved in inflammatory response and regulation of immune system (positive effect).

Fig. 2 Estimation of the performance of minimal models predicting the consumption level of vegetables, butter and sweet snacks : distribution of AUCs (Area under the Curve) of the ROC (receiver operating characteristic) curves for 10000 simulations. For each food group, results are presented for three models: minimal model selected as described in the Material & Methods section (upper panel), minimal model with systematic inclusion of age, sex, cohort, diabetic status (middle panel), minimal model without protein variables (lower panel).

Table 1 .

 1 Main characteristics of the 211 participants whose saliva was analyzed in the study

	Seniors-ENRICA-2	3C-Bordeaux
	diabetics	controls	diabetics	controls
	(n=52)	(n=53)	(n=37)	(n=69)

Table 4 .

 4 Variables retained in minimal models of prediction of intake of 11 food groups (two cohorts combined). Quantitative variables are separated into positive (chance of being a high consumer increases with value) or negative (chance of being a high consumer decreases with value) predictors. For categorial variables, the category associated with high intake is reported. Proteins are identified by their UniProt entry reference.

	Food groups	Quantitative variables	Categorial variables
		positive	negative
	Vegetables	P22079, O00391	P10909, P37802, Q8TAX7	French cohort
	Fruits
	Olive oil	BMI		Spanish cohort
	Legumes			Former or current smokers
	Nuts			Non-diabetics
	Wine			French cohort, Men
	Fish		Saliva flow
	Red meat			Men
	Butter	Q96DR5, P22079	P23280, P07476	French cohort
	Sweet snacks	E7EQB2, P02749		Non-diabetics, Men
	Sweet drinks		Age	Former or current smokers

Availability of data and material : Data described in the manuscript will be made available upon request addressed to the corresponding author.

Code Availibility :

The R scripts will be made available upon request addressed to the corresponding author.

Declarations

Table 2. Modified MEDAS score (0 to 13 points) and percentage of low and high consumers of 11 food groups among the 211 older adults, altogether or when individuals are stratified by diabetic status or cohort. The cut-off points to define low and high intake are provided in Online Resource 1. Cells shaded in gray highlight the food groups for which there is a large (>10%) difference between the two sub-samples.

All subjects


Thibault Cholez
email: thibault.cholez@loria.fr

Isabelle Chrisment
email: isabelle.chrisment@loria.fr

Olivier Festor
email: olivier.festor@loria.fr

A Distributed and Adaptive Revocation Mechanism for P2P networks

Keywords: P2P networks, revocation mechanism, reputation mechanism, remote accounts, KAD

With the increasing deployment of P2P networks, supervising the malicious behaviours of participants, which degrade the quality and performance of the overall delivered service, is a real challenge. In this paper, we propose a fully distributed and adaptive revocation mechanism based on the reputation of the peers. The originality of our approach is that the revocation is integrated in the core of the P2P protocol and does not need complex consensus and cryptographic mechanisms, hardly scalable. The reputation criteria evolve with the contribution of a peer to the network in order to highlight and help fight against selfish or malicious behaviours. The preliminary results show that the user perceived delays are not highly impacted and that our solution is resistant to reputation and revocation attacks.

I. INTRODUCTION

Peer-to-Peer (P2P) networks have proved their ability to gather and share a large amount of resources thanks to the collaboration of many individual peers. They are known to have many advantages compared to the client-server scheme: P2P networks scale better; the cost of the infrastructure is distributed and they are fault tolerant.

However, P2P networks encounter several difficulties induced by the growing number of malicious peers. The lack of central authority and the individual behaviour of the peers make it difficult for the P2P network to manage them. Malicious peers can be classified in three main categories; the malicious peer:

• does not follow the P2P protocol and tries to make attacks • shares malicious content (malware, pollution, illegal content)

• behaves in a selfish fashion Several studies have been made to measure the impact of these bad behaviours on the network. [START_REF] Adar | Free riding on gnutella[END_REF] and [START_REF] Hughes | Free riding on gnutella revisited: The bell tolls[END_REF] monitored Gnutella and highlighted the tragedy of the commons, consequence of selfish behaviour: 70% of users do not share anything, 50% of resources are shared by only 1% of users. The authors warn against the limitation of spontaneous cooperation in anonymous groups and the possible collapse of such networks without real control mechanisms. The pollution phenomenon has also been studied by [START_REF] Liang | Pollution in peer-to-peer file sharing systems[END_REF]; it appeared that, on average, 50% of the songs shared on Kazaa are polluted and even more of the newer files. Thus, malicious behaviours really degrade the quality of services proposed by public P2P networks.

In this context, P2P networks need a way to have the behaviour of their users supervised. We propose a fully dis-tributed and adaptive revocation mechanism. Our architecture is designed for structured P2P networks which have proved their ability to be efficient [START_REF] Castro | Debunking some myths about structured and unstructured overlays[END_REF] in their organisation and service offerings. The revocation is decided and adapted according to the reputation of each peer which is provided by remote accounts stored in a DHT (Distributed Hash Table ). For the time being, the reputation evolves with the contribution of the peers to highlight selfish behaviours.

This document is structured as follows. Section II presents the related works on reputation and revocation within P2P networks. The foundations of our architecture are described in Section III which includes the concept of remote accounts used to store the reputation, the evolution of the reputation and the revocation mechanism. The revocation is further detailed and is illustrated in Section IV for the KAD network. Section V discusses a first performance evaluation and security issues. Finally, Section VI concludes the document and presents future works.

II. RELATED WORKS

A. Reputation

Reputation management in a distributed environment is very challenging. The great majority of the reputation systems has indeed a local view, where each peer stores locally the reputation of another after having had some relationship with it [10] [6]. This approach has however several drawbacks. First, it is impossible to know if a peer is malicious before contacting it (feedbacks are not shared among the peers). Second, it is not adapted for large public P2P networks as the probability to meet a peer several times is so low that the reputation is inaccurate if it is used. That is why credit systems currently implemented in applications like eMule 1 can not fight against free riding; the local knowledge is not sufficient to determine if a peer free rides (few peers are known, few transactions are established with each one). The advantages are that the system scales well and it is suited for small communities of peers interacting frequently.

More recently, the concept of remote accounts presented in PeerMint [START_REF] Hausheer | Peermint: Decentralized and secure accounting for peer-to-peer applications[END_REF] can lead to another solution for reputation management. The idea is the following: each peer has a public account (i.e. an information set) stored in the P2P network. The storage of an account is done by mapping it on a set of peers thanks to the DHT used by structured P2P networks (Chord, Pastry, Kademlia...). This set of peers is periodically renewed to keep the information in the network despite churn; moreover, replication makes the mechanism more reliable. The remote accounts allow to build a global reputation management system where the reputation of each peer is stored in the DHT and accessible to the others.

B. Revocation

Designing a revocation mechanism adapted for P2P networks is difficult. The first way to revoke a peer is to build an access control system. The control cannot be made by a central authority because it is not adapted in a P2P environment, so it is the responsibility of the network to enforce control in a distributed way. In [START_REF] Kim | Admission control in peer groups[END_REF] and [START_REF] Saxena | Admission control in peer-to-peer: design and performance evaluation[END_REF], the authors present and experiment different approaches to achieve admission control in a peer group. Several policies are possible: the new peer must gather the agreement of a fixed number of peers, or a number proportional to the size of the group. The second proposal [START_REF] Saxena | Admission control in peer-to-peer: design and performance evaluation[END_REF] evaluates the performances of cryptographic mechanisms used to implement the admission control. It appears that they scale badly and are more suited for ad-hoc networks with high security requirements than for large public P2P networks.

In [START_REF] Clulow | Suicide for the common good: a new strategy for credential revocation in self-organizing systems[END_REF] an original way to achieve dynamic revocation in a P2P network is presented. When a peer detects that another is malicious, it sends a revocation notification that includes the malicious peer and itself, considering that its own life is less important than the goodness of the network. Therefore, it prevents the revocation mechanism to be hijacked because the cost to revoke is very high. However, this mechanism has important limitations. In fact, it can only be used whithin a private network but not in a public one where each peer has individual interests.

III. GENERAL ARCHITECTURE

A. Remote Accounts

In our system, we use remote accounts because they are efficient to introduce reputation in P2P networks. It is a way to adapt a centralised reputation system (for example eBay) to a decentralised network. With this system, each user has a grade evolving with the feedbacks of the others, so that each knowledge is shared with the community.

Stored in the DHT, each peer's account has a logical address which must remain unchanged after each session in addition to the peer's address itself. The application eMule already uses two identities for the peers of the network. The first called clientID (or KadID) is the 128 bits address of a peer in the DHT and is randomly chosen at the first connection. The second is called userID and results from a hash of the computer. This address is used for the credit system and public/private keys are associated to it to ensure the identity of the peer claiming a userID. Our solution links the peer's account to the userID as presented in figure 1. In this way, the userID is not used to localy store the credits of a peer but provides an entry in the DHT where to store its public account. An account just contains few data, that is easily storable even with replication:

• userID (128 bits) : place of the account in the DHT • publicKey (128 bits) : the account's owner has the associated private key

• trustRating (16 bits) : reputation of the account's owner • blackboard (few kiloBytes) : displays the current transactions of the account's owner

B. Evolution of Reputation

In a file sharing application, the evolution of the reputation concerns the way a peer contributes to the network, increasing when it uploads data and inversely, decreasing when it consumes resources. Thus, users are motivated to share data which are interesting for the community. In parallel, existing mechanisms ensure that rare data are sent with priority. With such a reputation rate, identifying free riders becomes easier. The major difficulty consists in finding a secure way to create and update the reputation. When a peer joins the network for the first time, it receives an initial positive reputation allowing it to start the first transactions. This initial reputation is needed to initiate transactions inside the network. No initial positive reputation would result in a global deadlock, like an automaton without a token.

Next, the evolution must be based on the fact that a transaction always involves two peers which exchange the same amount of data in opposite directions. During a transaction, both peers have to write the exchange on a part of their account, we called "blackboard". A blackboard's entry displays information for each transaction in progress: the partner in the transaction, the exchange direction, the amount of data sent or received (periodically updated). At the end of the transaction, the peers in charge of the accounts have to update the reputation according to the information displayed on the blackboards. To prevent a collusion of malicious peers which could display false transactions in order to increase their reputation, peers in charge of the accounts can not trust directly the information sent by the involved peers. They have to communicate among themselves to check if the same announcements have been received by the other part to check the consistency. This condition ensures that the transaction Fig. 2. Accounts usage during a transaction is reflected by both peers with the same ratio and avoids the hijacking of the mechanism. Each bonus of reputation resulting from a transfer has its opposite. Figure 2 presents the usage of remote accounts during a transaction and the evolution of the reputation as a consequence.

In P2P networks, the question of privacy is crucial. The reputation mechanism does not set up a new menace for the private life of users. The reputation grade is just a ratio between downloaded and uploaded data. Considering the grade, it is not possible to infer the activity of a peer, but only if the activity is balanced or not. Moreover, it is not possible to deduce from the blackboard which file is being transferred because several transactions are needed to retrieve a complete file.

C. Revocation Mechanism

The revocation mechanism uses the reputation displayed on the account of each peer to decide if, and how, a peer must be revoked. The reputation can evolve until a threshold triggering the revocation. As P2P networks are based on individual peers serving each other, a way to revoke a peer in a fully distributed manner is to check whether the requesting peer is worthy of receiving the service before providing it. If all the peers of the network check the reputation before providing a service, a peer with a bad reputation is automatically revoked, its requests being refused by the network. Moreover, this mechanism is adaptive because the refused services can change according to the different criteria of reputation used (contribution, quality of shared content...). The services provided by a P2P networks are generic: a bootstrapping process, a publication process (indexation of the shared files in the network), a search engine, and direct connections to download and upload data.

The idea of adapted sanctions has been presented by [START_REF] Karakaya | A distributed and measurement-based framework against free riding in peer-to-peer networks[END_REF]. The authors describe three levels of counter-action according to the level of free riding detected: decrementing TTL, ignoring requests and disconnecting the malicious peer. In our solution, each service can be checked independently. When a peer only has a bad sharing ratio, it is relevant to remove its rights to download data but it is not necessary to remove the other services needed to participate to the network. So, this peer will be able to download again after having shared more resources. On the opposite, when a peer is revoked for security reasons, all its rights must be removed in order to exclude it entirely from the network (see table I).

IV. DESIGN FOR THE KAD NETWORK

This section explains how and what services can be revoked, taking example of the KAD network. KAD is a part of the popular eMule and aMule file-sharing applications. It is based on the Kademlia protocol [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the xor metric[END_REF] and is one of the widest deployed structured P2P network with millions of simultaneous users.

A. Bootstrapping Process

This phase is necessary to join the network. Concretely, the bootstrapping peer asks another peer to send it other contacts from the network to initialise its routing table and inversely, to be referenced by other peers. As a first step of the revocation mechanism, the receiving peer will have to check the reputation of the bootstrapping peer before sending its contacts. This process is illustrated in figure 3. Unfortunately, a malicious peer can become a bridge for revoked members by avoiding the check step. Therefore, controlling the bootstrapping process allows to quickly carry out some total revocations. Controlling the other services allows overcoming the previously described weakness and refining the sanctions.

B. Other Services

When a peer is connected to the network, services (publication of contents, search, data download...) are achieved by sending requests to the other peers. In Kademlia [START_REF] Maymounkov | Kademlia: A peer-to-peer information system based on the xor metric[END_REF] this is done in two phases. Firstly, Kademlia REQ are sent to find nodes which are potentially able to deliver the service (according to their place in the DHT). This phase is general and only concerns the iteration mechanism used to find several peers in a part of the P2P network. In the second step, when the nodes are found, a specific request is sent to ask for a particular service. The reputation checking must be done before the specific request for three reasons. Firstly, a peer can be a bridge and search contacts for other uncontrolled peers. Secondly, the real services are provided by the specific requests. Controlling the reputation at this point allows to revoke independently the different services. Finally, checking the reputation for Kademlia REQ would increase the overhead for no advantage. The figure 4 presents the running of a publication request and includes the reputation checking. The other requests (search, data download) follow the same scheme.

However, inserting the revocation mechanism into the search function is not relevant for several reasons. Firstly, it is not a service through which a peer can damage the network. Then, searching is useless when the other services are inactive behind. Finally, it would also introduce overhead to the network and unnecessary delay for all users.

C. Implementation

We have implemented the revocation mechanism in KAD. To do that, we have introduced different modifications in the KAD client:

• our modified client can manage a new kind of information called "Account";

• the associated requests search/store Account were written, which partially behave like existing requests on keywords, files or notes;

• new functions were added in the UDPListener, where all network's requests are processed. In fact, these functions do the service-oriented revocation, searching for the reputation and checking it. • KadID and userID allocation were cheated to control the place of the peers in the DHT. We have tested that the reputation storage and retrieval and the revocation of services work fine on the modified peers. However, as our implementation defines new data types and messages to manage the accounts, we can just test our revocation mechanism on a few peers. Presently, as we test the mechanism with few resources, we have defined the KadID and UserID of modified peers to place them in the same tolerance zone. In this way, we are sure that the accounts can be stored (figure 5) when using the KAD publication mechanism. That is enough to verify the mechanism, but without the real number of replicated peers, performance measures would be wrong. That is why we are going to scale up our testbed on EmanicsLab to measure performances and compare the results with the evaluation presented in section V.

V. ANALYSIS AND DISCUSSIONS

A. Performances Evaluation

The thesis [START_REF] Brunner | A performance evaluation of the Kad-protocol[END_REF] has led a performance evaluation of the KAD network which allows us to discuss some a priori performance results. The average delay needed to store information in the network is about 200 seconds. This time is needed to find ten peers (for the replication) with a KadID close to the hash of the information to store. This delay will occur the first time that a peer connects itself to the network and periodically later to maintain the account in the network despite the churn. The delay to retrieve the information fluctuates and depends on the replication. The more replication there is, the more robust the stored information is and the quicker it is retrieved. The information is retrieved linearly, so the more a peer waits, the more results are returned. A 100 seconds delay seems to be sufficient to retrieve enough information to guess the real reputation of a peer. This delay could seem huge because it appears prior to each service of the network, except the search as explained. But in fact, 100 seconds to bootstrap are not penalising, the publication process is entirely transparent for the user and 100 seconds preceding a download are insignificant regarding the average waiting time spent in download queues. These elements show that the resulting delays would not be sensed by the users; this will be confirmed by the implementation.

B. Security Issues: Case Study

Security issues are a major constraint when designing such mechanisms. We have tried to anticipate the possible malicious behaviours of each actor to make the mechanism resistant to attacks.

1) Accounting and Reputation Attacks:

The first interest of a malicious peer is to avoid its reputation to decrease when it downloads, and to increase its reputation more than allowed when it uploads. To do this, some malicious peers will try to modify the information displayed on the blackboard at the end of the transaction. In the first case, the protocol does not allow to decrease the amount displayed on the blackboard because this action has no meaning during a transfer. In the second case, there would be a disagreement between the two blackboards and the reputation must still be updated otherwise the mechanism would be easily hijackable. In case of disagreement, the value which must be used to update both reputations is the one displayed by the downloading peer because this value can not be decreased and the downloading peer has no interest to increase it (its reputation would decrease more than needed). An agreement can occur between two peers but only one will gain reputation against the other.

It is also possible that a peer in charge of the account of another lies when the reputation is requested. This behaviour does not have a lot of consequences because of the replication. A reputation's request will always get several responses. As the majority of the peers are supposed to be honest, it is simple to retrieve the right value among the responses using majority decisions. It also prevents the mechanism from byzantine failures.

However, the initial reputation could become a problem if the hash function giving the userID (ie a new account) is hijackable. In fact, a malicious user could create and use a new account when its initial reputation is over or transfer the reputation of the new account to the main via fake transactions; but a possible solution is described further.

2) Revocation Attacks: The revocation mechanism is robust because it is fully distributed. If a malicious peer decides to bypass the protocol, answering to revoked peers or ignoring good peers's requests, will have a very limited impact. The revocation is assured because all the peers of the network refuse to serve revoked peers; one individual action (whatever it is) has no consequence for the mechanism.

But there is still a way to hijack the revocation mechanism. It consists in a coalition of peers placed in the same point of the DHT, so that they are able to take in charge the majority of the replicated account of a peer. If an account is replicated n times, placing such (n/2 +1) peers in this way can make the entire network revoke the victim peer if the malicious peers

P (X = i) = C i x * C 10-i 4000 C 10 4000+x (1)
P (X 6) = i<=10 i=6 P (X = i) (2)
The probability ( 2) is based on the indexation mechanism of KAD which uses a tolerance zone of 8 bits defining which peers are able to store an information (on average 4000 peers for 1 million of unfirewalled users). Let x be the number of malicious peers in a zone; the probability to take the control over an account is equivalent to take control on a defined number of malicious peers until having more than the half of the total number of requested peers for the replication (by default 10). The probability to choose i malicious peers among 10 is represented by the hypergeometric law with parameters (10, x, 4000+x) (1). The attack is successful when at least 6 peers are taken.

The graph 6 shows the probability that the attack be successful regarding the number of malicious peers. We can see that the tolerance zone in which an account is stored (regarding the ID) is big enough to make a total control difficult without at least thousands of peers because the storage process is not entirely deterministic (with a number of controlled peers greater than 10000 the probability is close to one). Therefore, if we make the assumption that the possibility to obtain many KadID is limited (basically one ID per IP address or computer), this attack becomes very unlikely given the resources needed.

But the current implementation in KAD is clearly insufficient and permits to announce up to 2 16 fake peers in the same zone [START_REF] Steiner | Exploiting KAD: possible uses and misuses[END_REF]. However, several propositions have been investigated to limit the Sybil attack. In [START_REF] Steiner | Exploiting KAD: possible uses and misuses[END_REF], the authors propose a central authority (CA) delivering KadIDs by cell phone. The KadID is encrypted by the CA private key from an IP address and an expiration time and can be decrypted by any peer with the CA public key to check the validity of a KadID. Castro et al. [START_REF] Castro | Secure routing for structured peer-to-peer overlay networks[END_REF] presented another design of trusted certification authorities to secure peer joining. We can also consider with interest the project Keypeer [START_REF] Wouhaybi | Keypeer: A scalable, resilient distributed public-key using chord[END_REF] which develops a certificate authority delivering keys over a DHT. Finally, KadID and userID allocation can be linked. When KadIDs are distributed by an authority (either centralized or distributed) but not chosen by the client, the hijacking of userIDs (to retrieve reputation) is also resolved. In fact, with a stronger KadID, the userID can be derivated from it by a public function instead of being calculated separately.

It is also possible to detect the peers participating in an Eclipse attack and to revoke them to stop it. The detection has been investigated by [START_REF] Singh | Defending against eclipse attacks on overlay networks[END_REF] and [START_REF] Singh | Eclipse attacks on overlay networks: Threats and defenses[END_REF]. They observe via anonymous auditing the bounding degree of a node to check if it is involved in the attack or not.

VI. CONCLUSION

Supervising the behaviours of the malicious users is the key for the good development of public P2P networks. Regarding the weakness of the currently implemented incentive mechanisms and the consequences of malicious and selfish behaviours on the networks, it is important to make the behaviours of the peers suit with the P2P philosophy. To answer to this major problem, we have proposed a revocation mechanism which is fully distributed, adaptive, and which does not require distributed consensus or complex cryptographic mechanisms. The revocation is not a layer above the network but is inserted in the core of the protocol, supervising the services provided by the P2P network. The reputation needed to take decisions is provided by remote accounts based on the DHT used by structured P2P networks. For the time being, the evolution of the reputation concerns the way the peers contribute to the network (regarding the bandwidth usage) to fight against the tragedy of the common problem. Each transaction between two peers is temporarily displayed on their blackboard to prove the evolution of the reputation. First analysis show that the resulting delays should not be sensed by the users. Moreover, the case study done to inventory the attacks tends to prove that the system itself is robust, as long as the allocation of a peer's ID is secured.

The future works consist in scaling up our testbed to evaluate the performances of the mechanisms implemented on KAD, particularly concerning the delays and the overhead. In a next step, we will develop the reputation mechanism to take into consideration new criteria such as the quality of the shared content to fight against pollution and malware diffusion, or to detect and revoke peers participating in a Sybil attack.

Fig. 1 .

 1 Fig. 1. Account storage in the DHT

Fig. 3 .

 3 Fig. 3. Reputation check during the bootstrapping process

Fig. 4 .

 4 Fig. 4. Reputation checking during the publication process

Fig. 5 .

 5 Fig. 5. Publication of accounts between modified KAD clients inside a tolerance zone

Fig. 6 .

 6 Fig. 6. Probability to take the control over an account in function of number of malicious peers

Description of eMule credit system: http://www.emule-project.net/home/ perl/help.cgi?l=1&rm=show topic&topic id=134